Privacy Policy

Who We Are

RiseONRx is operated by RISEONRX INC (Ontario Corporation No. 1001708518). We operate a virtual-care platform that connects patients in Canada with physicians registered with the College of Physicians and Surgeons of Ontario. Registered office: Suite 163, 1720 Howard Ave, Windsor, Ontario N8X 2R8, Canada. Telephone: 1-226-773-5055.

The treating physician is the health information custodian for your health record, and RISEONRX INC acts as their agent in providing the platform. Which health privacy law applies to that record depends on where your physician practises — in Ontario it is the Personal Health Information Protection Act (PHIPA), and other provinces and territories have their own health privacy legislation. Personal information that is not health information is handled under the federal Personal Information Protection and Electronic Documents Act (PIPEDA). We apply the standards described in this policy to every patient regardless of where you live.

Information We Collect

This website. Browsing riseonrx.ca does not require an account and we do not collect health information here. If you email or telephone us, we receive whatever you choose to send.

The patient platform. When you create an account and complete an assessment we collect:

• Identifying information — name, email address, telephone number, date of birth, and your address
• Your location at the time of the encounter, to confirm you are in a province where our physicians are licensed to practise
• Health information — medical history, current medications, allergies, measurements, and your assessment responses
• Government-issued identification, which we collect to verify that you are who you say you are
• Consent records — which consents you gave, the version of the document, and the date, time, IP address, and browser used
• Payment information — processed by our payment provider; we receive a token and the card brand and last four digits, never your full card number
• Records of your care — orders, prescriptions issued by your physician, messages with your care team, and an audit trail of access to your record

Why We Collect It

• To provide virtual healthcare services and support your physician's clinical decision-making
• To verify your identity and confirm you are located in a province we serve
• To process payments for services and medications
• To communicate with you about your care, your account, and your orders
• To transmit a prescription to a licensed pharmacy where your physician issues one
• To keep the records, consent records, and audit trails that professional and privacy law require us to keep

We do not use your personal or health information for advertising, and we do not sell it.

Who We Share With

• The physician responsible for your care, and clinical staff supporting that care
• The licensed pharmacy that dispenses your prescription, where your physician issues one and you have consented to that disclosure
• Our payment provider, which processes card payments and holds your tokenized card credential
• Service providers that host our infrastructure and deliver email and text-message notifications on our behalf, under contract and only as needed to provide the service
• Any person or body to whom we are required or permitted by law to disclose information

Where Your Information Is Stored

The platform’s primary systems — the application database, document and identification storage, encryption keys, and the authentication service — are hosted in Amazon Web Services’ Canadian region (ca-central-1, Montreal).

Some service providers used for notification delivery and address lookup may process a limited set of personal information — such as your name, email address, telephone number, or address — on servers located outside Canada. Where that happens, the information is subject to the laws of the country in which it is processed, including lawful access by authorities in that country. Health information from your assessment and clinical record is not included in those transfers. You may contact our Privacy & Security Officer for current details about our service providers and where they process information.

How We Protect Your Information

• Information is encrypted in transit using TLS 1.2 or higher
• Health and identifying fields are individually encrypted before they are stored, using keys managed in AWS Key Management Service
• Access is restricted by role, and physicians can only access records of patients in a province where their licence has been verified
• Multi-factor authentication is required for physician, pharmacy, and administrative accounts, and is available to patients
• Every access to health information and every change of state is written to an audit log that cannot be altered or deleted
• Identification documents are stored in a separate encrypted location and are shown to reviewers with a watermark

No system can be guaranteed to be completely secure. If a privacy breach occurs that creates a real risk of significant harm, we will notify you and the appropriate regulator as the law requires.

Data Retention

Medical records are retained for at least 10 years from the date of the last entry, in line with CPSO medical records requirements. Consent records, audit logs, and financial records are retained as required by law and are not deleted. Other personal information is retained only as long as needed for the purpose it was collected for, or as required by law. You can ask our Privacy & Security Officer what we hold about you and how long we expect to keep it.

Your Rights

Under Canadian health privacy and personal information law, you have the right to:

• Access your personal and health information
• Request correction of information that is inaccurate or incomplete
• Withdraw your consent, subject to legal and clinical limits, which we will explain to you
• Ask questions about how your information is handled and receive a response
• File a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca), or with the privacy regulator in your province or territory — in Ontario, the Information and Privacy Commissioner of Ontario (ipc.on.ca)

To exercise any of these rights, contact our Privacy & Security Officer at privacy@riseonrx.ca. We will respond within the timeframes set by applicable law.

Cookies

This website uses only the cookies necessary for it to function. We do not run advertising, analytics, or tracking cookies on riseonrx.ca, and we do not build advertising profiles of visitors. The patient platform uses strictly necessary cookies to keep you signed in securely.

Changes to This Policy

If we change this policy we will update the “last updated” date above. Where a change materially affects how your information is handled, we will tell you directly and, where required, ask for your consent again.

Contact