This Privacy Policy describes how Kinro Health Inc. (“Kinro,” “we,” “us,” and “our”) collects, uses, discloses, retains, and protects your information when you visit our website, use our patient application, or otherwise interact with our services (together, the “Services”). It is incorporated into our Terms of Service. Capitalized terms not defined here have the meaning given to them in the Terms of Service.
Kinro and its service providers comply with applicable Canadian privacy legislation, including the Personal Information Protection and Electronic Documents Act (Canada) ("PIPEDA"), the Personal Health Information Protection Act, 2004 (Ontario) ("PHIPA"), Québec's Act respecting the protection of personal information in the private sector, and other provincial or federal privacy and health-information legislation that applies to the Services.
PLEASE READ THIS PRIVACY POLICY CAREFULLY TO UNDERSTAND HOW WE HANDLE YOUR INFORMATION. IF YOU DO NOT AGREE WITH IT, PLEASE DO NOT USE THE SERVICES.
Our Privacy Officer
Kinro has designated a Privacy Officer who is accountable for our compliance with this Privacy Policy and applicable privacy legislation. You may contact our Privacy Officer at any time with questions, requests, complaints, or concerns about how your information is handled:
Morgan Holdway, Privacy Officer, Kinro Health Inc.
privacy@kinrohealth.com
Who Holds Your Health Record
Healthcare Services are provided by independent, licensed health care practitioners (“Authorized Medical Providers”) who use the Kinro platform to deliver care, and pharmacy services are provided by a licensed pharmacy partner.
Personal health information created in connection with Healthcare Services may be held by the Authorized Medical Provider, the professional entity through which the provider delivers care, the dispensing pharmacy, or another organization that is responsible for the information under applicable law (each, a "Responsible Health Organization"). Depending on the arrangement and the information involved, Kinro may act as an agent, service provider, or electronic service provider to a Responsible Health Organization. Kinro does not assume the professional or statutory responsibilities of an Authorized Medical Provider or pharmacy merely because information is stored or transmitted through the Kinro platform.
If you wish to access or correct a health record, withdraw consent, or exercise another right relating to personal health information, contact our Privacy Officer using the details above. Kinro will respond directly where it is legally responsible for the information or will help direct and coordinate your request with the appropriate Responsible Health Organization.
Québec Privacy Requirements
Where Québec law applies, Kinro and the relevant Responsible Health Organizations will handle personal information in accordance with Québec privacy legislation. This may include completing privacy impact assessments when required for new or materially changed information systems or for processing outside Québec, using privacy-protective default settings, maintaining a confidentiality-incident register, and providing access, correction, portability, and complaint rights required by Québec law.
Table of Contents
1.
Information We Collect
2.
Consent
3.
How We Use Your Information
4.
How We Disclose Your Information
5.
Where Your Information Is Stored
6.
How We Protect Your Information
7.
Privacy Breaches
8.
Retention of Your Information
9.
Your Rights
10.
Children
11.
Third-Party Websites
12.
Changes to This Privacy Policy
13.
Contact Us
Information We Collect
Québec Privacy Requirements.
We collect information you give us directly, including when you create an account, complete a medical assessment, communicate with an Authorized Medical Provider, verify your identity, request insurance or manufacturer-program support, place an order, or contact support. Depending on how you use the Services, this may include:
•
Identification and contact information, including your name, mailing address, date of birth, telephone number, email address, and, where required, government-issued identification, provincial health-card information, or emergency-contact information;
•
Personal health information, including your medical history, current medications, allergies, symptoms, physical measurements, laboratory information, prescriptions, treatment decisions, and other information you provide to or receive from an Authorized Medical Provider;
•
Insurance, benefits, public-plan, manufacturer-assistance, prior authorization, and reimbursement information, including plan identifiiers, coverage results, and supporting documents;
•
Account credentials, communication preferences, consent records, and information used to verify your identity, age, location, account security, or payment authorization;
•
Billing and delivery information, including your shipping address and payment details. Full payment-card information is collected and processed by our payment processor and is not stored by Kinro;
•
Information about your orders, transactions, refunds, prescriptions, pharmacy selections, fax transmissions, deliveries, and shipment tracking;
•
Records of your interactions with our customer support team and automated support assistant;
•
Information you submit through forms, surveys, feedback, employment applications, or other communications.
You are not required to provide all of this information, but if you do not, we may be unable to provide some or all of the Services to you.
Information we collect automatically.
When you use our public website or access the Services, we and our service providers may collect technical and security information, including your IP address and approximate geographic location, browser and device type, operating system, device identifiers, referring and exit pages, pages viewed, time spent on pages, login events, error logs, and fraud or security signals. On our public website, some of this information is collected using cookies, tags, tracking pixels, and similar technologies.
Advertising and analytics. We use advertising and analytics services provided by third parties, including Meta, TikTok, and Google, on our public marketing website. These services allow us to measure the effectiveness of our advertising and to understand how visitors use our site. Conversion events reported to these advertising platforms indicate only that a visitor has registered or completed a purchase with Kinro. They do not identify which treatment or therapeutic area a person has enquired about, been prescribed, or purchased.
We do not permit advertising or analytics tracking on our patient application. Third-party advertising and session-analytics technologies (including Meta, TikTok, and Microsoft Clarity) do not operate on the authenticated pages of our patient application, and therefore do not collect your personal health information.
Information we receive from others. We may receive information about you from Authorized Medical Providers, professional entities, pharmacies, payment and subscription processors, insurers and benefit administrators, public plans, manufacturer-support programs, identity-verification and fraud-prevention providers, laboratories, delivery partners, regulators, and other service providers that help us deliver or protect the Services
Consent
We collect, use, and disclose personal information and personal health information with your consent, except where the law permits or requires us to do so without consent. Consent may be express or implied depending on the sensitivity of the information, the purpose, your reasonable expectations, and applicable law. Information processing that is necessary to provide care, dispense medication, administer your account, process authorized payments, protect the Services, or comply with law is treated separately from optional processing. Where required by law, Kinro will obtain separate or express consent for optional activities, including certain marketing communications, manufacturer-support programs, non-essential cookies or tracking technologies, surveys, or disclosures that are not necessary to provide the Services. Access to Healthcare Services is not conditioned on consent to receive promotional marketing.
Withdrawing consent. You may withdraw your consent to our collection, use, or disclosure of information at any time, subject to legal, professional, and contractual restrictions and reasonable notice. To withdraw consent, contact our Privacy Officer. Withdrawing consent may mean that Kinro, an Authorized Medical Provider, or a pharmacy can no longer provide some or all of the Services. Withdrawal does not affect uses or disclosures made before it took effect, and information may continue to be retained or used where required or permitted by law.
Marketing communications. You may opt out of marketing emails or text messages at any time by using the unsubscribe method provided in the message or by contacting us. You may not opt out of transactional, clinical, safety, legal, or operational messages that are reasonably necessary for your account, care, prescriptions, payments, or orders.
Cookies and advertising technologies. Cookies, tracking pixels, and similar technologies operate on our public marketing website. Where required, we obtain consent before using non-essential technologies. You can control or block cookies through your browser settings and use the privacy and opt-out tools provided by Meta, TikTok, Google, and other advertising platforms. Blocking cookies may affect how parts of our website function. These technologies do not operate on authenticated pages of our patient application and do not collect personal health information from those pages
How We Disclose Your Information To Others
We use your information to:
•
Provide the Services, including facilitating assessments, Healthcare Services, prescriptions, pharmacy services, and medication delivery;
•
Enable Authorized Medical Providers, Responsible Health Organizations, pharmacies, laboratories, and other authorized participants to provide care or related services;
•
Verify your identity, age, location, insurance information, account security, and payment authorization, and investigate suspected fraud or misuse;
•
Administer your account and process payments, authorization holds, refunds, insurance claims, prior authorizations, and manufacturer-program requests;
•
Communicate with you about your account, care, prescriptions, coverage, orders, deliveries, privacy requests, and enquiries;
•
Provide customer support, resolve technical issues, and operate an automated support assistant subject to the limitations described below;
•
Send marketing communications where you have provided the required consent;
•
Operate, secure, audit, improve, and develop the Services, including quality assurance and service analytics;
•
Create and use de-identified or aggregate information for research, service improvement, and outcome analysis;
•
Detect, prevent, investigate, and respond to fraud, misuse, privacy breaches, and securityincidents;
•
Comply with legal, regulatory, contractual, and professional obligations, and establish, exercise, or defend legal claims.
De-identified and aggregate information
We may de-identify and aggregate information using measures intended to prevent it from being linked back to you or your device. We may use this information to understand treatment outcomes, improve the Services, conduct research, and report on the effectiveness of care delivered through the platform. We do not attempt to re-identify properly de-identified information, and we do not sell personal information or personal health information or disclose de-identified health information to advertisers, promotional partners, or sponsors.
How We Protect Your Information
We disclose your information in the following circumstances:
•
Authorized Medical Providers and Responsible Health Organizations — to assess and provide care, maintain health records, coordinate follow-up, and meet professional or legal obligations.
•
Pharmacies, laboratories, and external healthcare providers — to transmit prescriptions or requisitions, dispense medication, process pharmacy services, coordinate care, and fulfil a request you have made.
•
Insurers, benefit administrators, public plans, and manufacturer-support programs — to verify or administer requested coverage, reimbursement, prior authorization, discount, or patient-support benefits.
•
Delivery and logistics providers — to arrange, track, confirm, and support delivery of medication or other items.
•
Identity-verification, payment, fraud-prevention, and security providers — to verify information, process authorized transactions, and protect patients, Kinro, and the Services.
•
Service providers — we use third parties for subscription billing, customer support, communications, hosting, security, analytics, records management, and related functions. They may access information only as reasonably necessary to provide contracted services and must protect it under applicable law and their agreements with us.
•
Legal and safety — where required or permitted by law, including to respond to a subpoena, court order, regulatory request, or lawful investigation; enforce our Terms of Service; investigate suspected fraud or misuse; or protect the rights, property, health, or safety of Kinro, patients, practitioners, or the public.
•
Business transactions — if Kinro is involved in a proposed or completed merger, financing, reorganization, acquisition, or sale of assets, information may be disclosed or transferred as permitted by law and subject to appropriate safeguards. Personal health information will remain subject to the requirements applicable to the Responsible Health Organization.
We do not sell your personal information or personal health information.
Insurance, Third-Party Payers, and Manufacturer Programs
If you ask Kinro or a pharmacy to verify or process insurance, benefit-plan, public-plan, manufacturer-assistance, or other third-party coverage, information may be collected from and disclosed to the applicable payer, pharmacy, plan administrator, manufacturer-program administrator, or service provider. This may include identity and contact information, insurance identifiers, prescription and product information, claim information, supporting documents, and the coverage result, but only as reasonably necessary to administer the requested benefit. These organizations may separately handle information under their own privacy practices.
External Pharmacies and Delivery Providers
If you select an external pharmacy, Kinro or an Authorized Medical Provider may send the pharmacy your prescription, contact information, relevant medical information, and other information reasonably necessary to fulfil your request. When an item is shipped, Kinro or the dispensing pharmacy may provide the courier with information necessary to complete and manage delivery, such as your name, delivery address, telephone number, email address, delivery instructions, and shipment-tracking information.
Key service providers
Our principal service providers include:
•
Payment processing and subscription billing (Adyen; Chargebee);
•
Email and marketing communications (Klaviyo);
•
Customer support and messaging (Intercom);
•
Cloud hosting and infrastructure (Amazon Web Services);
•
Identity-verification, fraud-prevention, insurance, and manufacturer-program administrators, where applicable;
•
Delivery and logistics partners;
•
Advertising and analytics providers, on our public marketing website only (Meta, TikTok, Google, Microsoft Clarity).
Kinro maintains a current list of principal service providers and subprocessors, including the general service they provide and the locations in which information may be processed. You may request the current list from our Privacy Officer. We may also publish or update this list through our website.
Information about your treatment program held by our communications platform. Our email and communications platform may hold the minimum information needed to send accurate transactional, care, order, and, where separately consented, marketing communications. We seek to use limited program codes or categories rather than diagnoses, symptom details, clinical notes, or free-text medical information. Access is restricted, the information is not disclosed to advertising platforms, and it is subject to the retention and cross-border safeguards described in this Policy.
Automated support assistant. We use an automated support assistant provided through our customer-support platform to answer common questions about accounts, orders, deliveries, billing, and treatment programs. To answer these questions, it may access limited account information, including order history, billing information, and current prescription and dose information. Support conversations may be recorded, logged, retained, and reviewed for security, quality assurance, and support improvement. The assistant does not provide medical advice, make clinical decisions, prescribe or alter medication, independently change an order or account, approve a refund, or make another decision that produces a significant effect without appropriate human involvement.
Information accessed by the automated support assistant is processed by our customer-support platform outside Canada (see “Where Your Information Is Stored” below). We require that the information be used only to provide services on our behalf and not to train the provider’s general-purpose artificial-intelligence models or any underlying model. Clinical, safety, privacy, and disputed billing matters are directed to an appropriate person. You may request human support at any time.
Where Your Information Is Stored
Health records stored in Canada. Health records created and stored within the Kinro patient application are hosted on Amazon Web Services infrastructure located in Canada. Authorized Medical Providers, Responsible Health Organizations, pharmacies, laboratories, or other authorized participants may also retain records in their own systems in accordance with applicable law and professional requirements.
Some information is processed outside Canada. Certain service providers, including payment, subscription billing, email and communications, customer support, identity-verification, and related providers, may store or process information outside Canada, primarily in the United States. Information processed in another country is subject to that country’s laws and may be accessible to its law-enforcement, regulatory, or national-security authorities. We use contractual, organizational, and technical safeguards appropriate to the information and assess cross-border processing and related privacy risks where required by law, including Québec law.
You may contact our Privacy Officer for more information about our practices regarding service providers outside Canada.
How We Protect Your Information
We use technical, organizational, and physical safeguards appropriate to the sensitivity, amount, format, and location of the information. Depending on the system and risk, safeguards include role-based and need-to-know access controls, encryption in transit and at rest, multi-factor authentication for administrative access, audit logging and monitoring, employee and contractor privacy training, confidentiality obligations, vendor security reviews and contractual protections, backup and recovery measures, periodic access reviews, vulnerability management, and secure retention and destruction practices.
We apply privacy-by-design principles and conduct privacy or security assessments for new or materially changed systems, uses, disclosures, automated tools, and cross-border processing where required or appropriate. Access to personal health information is limited to people and service providers who reasonably require it for care, pharmacy services, legal obligations, or support of the Services.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account password confidential and for notifying us promptly if you believe your account has been compromised.
Privacy Breaches
If your personal information or personal health information is lost, stolen, or accessed, used, disclosed, copied, or modified without authorization, we will take steps to contain the breach and to investigate it.
Where required by law, we will notify affected individuals at the first reasonable opportunity and notify the applicable privacy regulator. This may include the Information and Privacy Commissioner of Ontario, the Office of the Privacy Commissioner of Canada, and the Commission d’accès à l’information du Québec. Where Québec law applies, Kinro or the responsible organization will assess whether a confidentiality incident presents a risk of serious injury and will make required notifications.
We maintain a breach-response protocol and records of privacy breaches and confidentiality incidents as required by law, including a Québec confidentiality-incident register where applicable.
Retention of Your Information
We retain information only as long as reasonably necessary for the purposes for which it was collected, or as required or permitted by law, professional standards, contractual obligations, a legal hold, or an active complaint or investigation. Retention periods may differ depending on the Responsible Health Organization, province, type of record, and purpose. Our general retention approach is:
•
Health records — retained for the period required by the laws, professional standards, and record-retention rules applicable to the Authorized Medical Provider or Responsible Health Organization. The period may depend on the province where care was provided, the type of record, the patient’s age, and whether the record relates to continuing care, a complaint, an investigation, or a legal proceeding.
•
Prescription and dispensing records — retained by the responsible pharmacy in accordance with applicable pharmacy legislation, standards, and record-retention requirements.
•
Billing and transaction records — retained as required by applicable tax and financial record-keeping laws.
•
Identity-verification, fraud-prevention, and security records — retained for as long as reasonably necessary to verify transactions, protect accounts, investigate misuse, meet legal obligations, and resolve disputes.
•
Marketing and analytics information — retained for no more than forty-eight (48) months following your last interaction with us, unless a shorter or longer period is required or permitted by law, after which it is deleted or de-identified.
•
Customer support records — retained for no more than forty-eight (48) months, unless required for a longer period for patient safety, quality assurance, a legal claim, complaint, investigation, or regulatory matter.
Properly de-identified or aggregate information that can no longer reasonably be linked to an individual may be retained for longer periods for research, analytics, security, or service-improvement purposes.
You may request deletion of information at any time (see “Your Rights” below). We will honour a deletion request where required by law and reasonably possible, but may retain information that forms part of a health, prescription, dispensing, billing, fraud-prevention, tax, audit, complaint, investigation, or legally required record.
Your Rights
Subject to applicable law, you have the right to:
•
Access personal information and personal health information held about you, subject to limited exceptions under applicable law;
•
Update ordinary account information, such as contact or delivery information, through the available account tools or by contacting us;
•
Request correction of inaccurate or incomplete information. Clinical notes, prescriptions, or information relied upon by a healthcare professional may be corrected through an amendment or notation rather than deletion of the original record;
•
Withdraw consent to collection, use, or disclosure, subject to legal, professional, and contractual restrictions;
•
Request deletion of information, subject to the retention requirements described above;
•
Where Québec law applies, request that eligible computerized personal information be provided to you or another authorized organization in a structured, commonly used technological format, subject to legal exceptions;
•
Ask questions about our practices, request information about cross-border processing or service providers, or make a complaint.
To exercise a right, contact our Privacy Officer at privacy@kinrohealth.ca. We will verify your identity before responding. We generally respond within thirty (30) days or within another period required by applicable law, subject to any lawful extension. If a fee is permitted for a particular request, we will advise you in advance.
Complaints. If you are not satisfied with our response, you may complain to the Information and Privacy Commissioner of Ontario, the Office of the Privacy Commissioner of Canada, or the Commission d’accès à l’information du Québec, as applicable. You may also complain about an Authorized Medical Provider or pharmacy professional to the appropriate professional regulatory college.
Children
The Services are intended only for individuals eighteen (18) years of age or older. We do not knowingly permit an individual under eighteen to create or use a patient account. If we learn that an individual under eighteen has created an account, we may restrict or close it and delete information that we are not legally or professionally required to retain. Information forming part of a health, prescription, dispensing, billing, fraud-prevention, safety, complaint, or legally required record may be retained for the applicable period
Third-Party Websites
Our Services may contain links to websites and services operated by third parties. This Privacy Policy does not apply to those third parties, and we are not responsible for their privacy practices. We encourage you to review their privacy policies before providing them with your information.
Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in law, our practices, service providers, or the Services. The most recent revision date appears at the top. If we make a material change, we will provide notice as required by law. Where a new or expanded activity requires separate or additional consent, we will obtain that consent before applying the change to your information. Continued use of the Services may indicate acceptance of other updates where permitted by law.
Contact Us
If you have questions, requests, or concerns about this Privacy Policy or about how Kinro handles your information, please contact our Privacy Officer:
Morgan Holdway, Privacy Officer, Kinro Health Inc.
privacy@kinrohealth.ca
