Privacy Policy

Overview

HormoneFit ("HormoneFit," "we," "us," or "our") recognizes the importance of protecting your privacy and personal information. Protecting your Personal Identifiable Information (PII) and your Protected Health Information (PHI) is our priority.

As such, we have prepared this Privacy Policy to provide you with important information about our practices applicable to hormonefit.ca (the "Site"), which is a Telehealth platform that provides access to consultation services and lab testing, collectively referred to as "Services" related to menopause and hormone health through secure telehealth technology. The Site consists of various web pages operated by HormoneFit.

HormoneFit operates in accordance with the Personal Health Information Protection Act, 2004 (PHIPA) and the Freedom of Information and Protection of Privacy Act (FIPPA) of Ontario, as well as all other applicable Canadian federal and provincial privacy legislation.

Individuals who choose to access and use the Website (hereinafter "you" or "User" and collectively the "Users") consent to the data practices described in this Policy as well as our Terms and Conditions ("Terms"). Definitions used in our Terms have been adopted in this Privacy Policy.

Collecting your health data helps us to provide you with a personalized online health experience. You may browse the Site and/or many of our applications without providing any Personally Identifiable Information (PII) or Protected Health Information (PHI). However, we ask that you provide information at various times and locations through the Site.

When you sign up or create an account with HormoneFit, we ask you to confirm that you have read, acknowledged, understood and agreed to our Privacy Policy. This means that by submitting your Personally Identifiable Information (PII) or Protected Health Information (PHI) and other information to our Site, you consent to the collection, use, and disclosure of such information as set forth in this Privacy Policy.

Collection of Personal Identifiable Information

We collect your name and email address when signing up or creating an account for our Site. Additional personal identifiable information such as, but not limited to: your age, address, phone number, payment information, etc. is collected when ordering lab testing or scheduling a menopause consultation.

Our Relationship With OHIP and Public Health Insurance

HormoneFit operates exclusively as a private, direct-to-consumer virtual care service. All services we provide are uninsured services, meaning they are not covered by the Ontario Health Insurance Plan ("OHIP") or any other provincial health insurance program.

We do not bill OHIP, we do not submit claims to provincial health plans, and we do not provide OHIP-insured medical services. All Services offered through HormoneFit are paid privately by the User.

Because our Services are non-insured and outside the public insurance system, we may offer access through a single paid subscription or membership program. This subscription is required to access our private Services and is not connected in any way to the delivery of OHIP-insured healthcare.

If a service we offer later becomes designated as insured by a provincial health plan, we will remove that service from our private program and will not charge for it.

Information Related to Membership and Subscription Services

Access to HormoneFit's Services is provided through a private paid subscription ("Membership"). Because all Services we offer are uninsured and outside the provincial insurance system, the Membership is required to access our Services.

If you enroll in the Membership, we collect and use personal information — including your name, contact information, service usage history, and payment information — to:

• administer your subscription and determine your eligibility for included Services
• process payments and issue receipts (for potential private insurance or personal records)
• verify that the Services provided fall within our private, non-insured model
• comply with applicable privacy, regulatory, and professional standards under PHIPA and other Ontario legislation

Payment information is processed through secure third-party payment providers; we do not store full credit card numbers.

Collection of Medical Health Information

Any medical or health information (PHI) that you provide is subject to specific protections under the Personal Health Information Protection Act, 2004 (PHIPA) of Ontario and will be used and disclosed only in accordance with that legislation and other applicable Canadian federal and provincial privacy laws.

Children

Our online doctors office and lab testing services are designed for use by women 40 years of age and older. If you are younger than age 40, please do not provide any information to us through the Site. We do not knowingly collect personally identifiable information from individuals under 18. If we learn we have collected any PII and or PHI from an individual under the age of 18, we will delete the information in accordance with PHIPA.

How we use and Disclose your Personally Identifiable Information (PII) Or Protected Health Information (PHI)

Because HormoneFit provides only uninsured wellness, hormone-health, and lifestyle support services, the information you provide is used solely for the delivery of these private, non-insured Services. We do not use your information to process or submit claims to OHIP or any public health insurance plan.

We use and disclose your Personally Identifiable Information (PII) to make payments, to run our healthcare operations and send you emails. We use and disclose your Protected Health Information (PHI) to provide you with medical care, to run our healthcare operations and to comply with regulations under PHIPA and applicable Ontario law. We implement a range of technical, administrative and physical safeguards to protect both your PII and your PHI.

We use your email address to send you different types of emails, including but not limited to: emails that update the status of your care, appointment confirmations and reminders, emails asking for feedback on your experience of using the service, and marketing emails to notify you of services we provide. We will share your email and name with third party email platforms to enable us to send aforementioned emails.

We also use your Personally Identifiable Information (PII) for payment for services you request offered by HormoneFit. We share your PII and credit card details with our online payment processor and they store them on our behalf. We share your Protected Health Information (PHI) with selected organizations that provide us with services to provide your treatment and to run our healthcare operations. As examples, we share your PHI with organizations that help us run and maintain the technology and security infrastructure that supports our Website and the care we provide. We also may share your health information with medical staff to ensure that we are providing a service that meets the appropriate standard of care.

If we order laboratory tests for you or if you "self order" laboratory testing, we share your PHI with the lab company that runs the tests. If a laboratory test we order for you finds a reportable condition, we may be required by law to share your PHI with the applicable Ontario public health authority in accordance with the Health Protection and Promotion Act.

We store information you provide us with whether you complete a visit or whether you do not complete a visit. We take the same precautions over your data regardless of whether you complete a visit.

We do not record video visits between our patients and our medical team.

We may use your Personally Identifiable Information (PII) or Protected Health Information (PHI) to tell you about health-related products and services.

We may share your Personally Identifiable Information (PII) or Protected Health Information (PHI) with a third party if we merge, are acquired or undergo an asset sale, subject to applicable requirements under PHIPA.

Our Site may contain links to other third-party sites. When you click on one of these links you are visiting a website operated by someone other than HormoneFit, and the operator of that website may have different privacy policies. HormoneFit is not responsible for the individual privacy practices of those websites.

Document Storage and File Uploads

HormoneFit allows patients and referring healthcare providers to upload documents including but not limited to: lab results, imaging reports, referral forms, and supporting medical documentation. These files constitute Protected Health Information (PHI) under PHIPA.

All uploaded files are stored using Amazon Web Services Simple Storage Service (Amazon S3), operated in the Canada (Central) region (ca-central-1), located in Montreal, Canada. Files are encrypted at rest using AWS Key Management Service (AWS KMS) and are encrypted in transit via HTTPS.

Access to uploaded files is strictly controlled. Files are never publicly accessible. Access is granted only through time-limited, authenticated links generated by our backend systems. Every access, download, and upload event is logged in our audit system in accordance with PHIPA requirements.

We have entered into a Data Processing Addendum with Amazon Web Services to govern their handling of PHI stored on their infrastructure.

Referral Document Submissions

Healthcare providers referring patients to HormoneFit may submit referral documentation through our secure upload portal. Information submitted through this portal, including patient health information and supporting clinical documents, is treated as PHI under PHIPA.

Referral submissions are stored securely on Amazon S3 in Canada and are accessible only to authorized HormoneFit clinical staff. All file submissions are subject to security scanning and validation. Audit logs are maintained for all access to referral documents.

By submitting a referral through our portal, referring physicians confirm they have obtained appropriate consent from the patient for the sharing of their health information with HormoneFit for the purpose of facilitating care.

Other Information we Collect

Separate to the personal identifiable and health information we collect, we collect technical information about how you use our Site. We use this information to help us improve the overall quality of our Site, improve the service we provide, and improve our advertising and marketing campaigns. Technical information we collect may be shared with Google, including information about your mobile device or computer, including but not limited to unique device identifiers and the operating system and browser you use, and information about when and how you use the HormoneFit Website. Google is bound by the Google Analytics Terms of Use and Privacy Policies available on their website.

We do not respond to 'do not track' signals in your browser.

Sharing Information with Third Parties

HormoneFit does not sell, rent or lease its customer lists to third parties.

HormoneFit may share data with trusted partners to help perform statistical analysis, send you email or postal mail, provide customer support, or arrange for deliveries. All such third parties are prohibited from using your personal information except to provide these services to HormoneFit, and they are required to maintain the confidentiality of your information in accordance with PHIPA.

Our key third-party data processors include:

• Amazon Web Services (AWS) — cloud infrastructure and file storage, operated in Canada (ca-central-1)
• Stripe — payment processing

HormoneFit may disclose your personal information, without notice, if required to do so by law or in the good faith belief that such action is necessary to: (a) conform to the orders of the law or comply with legal process served on HormoneFit or the site; (b) protect and defend the rights or property of HormoneFit; and/or (c) act under immediate circumstances to protect the personal safety of users of HormoneFit, or the public.

Breach Notification

In the event of a privacy breach involving your Personal Health Information, HormoneFit will comply with the notification requirements under PHIPA. If a breach is determined to pose a real risk of significant harm to you, we will notify you as soon as reasonably possible and will report the breach to the Information and Privacy Commissioner of Ontario (IPC) as required by law.

If you believe your health information has been accessed, used, or disclosed without authorization, please contact our Privacy Officer at [email protected].

Tracking User Behaviour

HormoneFit may keep track of the websites and pages our users visit within HormoneFit, in order to determine what HormoneFit services are the most popular. This data is used to deliver customized content and advertising within HormoneFit to customers whose behaviour indicates that they are interested in a particular subject area.

Automatically Collected Information

Information about your computer hardware and software may be automatically collected by HormoneFit. This information can include: your IP address, browser type, domain names, access times and referring website addresses. This information is used for the operation of the service, to maintain quality of the service, and to provide general statistics regarding use of the HormoneFit Site.

Use of Cookies

The HormoneFit website may use "cookies" to help you personalize your online experience. A cookie is a text file that is placed on your hard disk by a web page server. Cookies cannot be used to run programs or deliver viruses to your computer. Cookies are uniquely assigned to you, and can only be read by a web server in the domain that issued the cookie to you.

One of the primary purposes of cookies is to provide a convenience feature to save you time. When you return to the same HormoneFit website, the information you previously provided can be retrieved, so you can easily use the HormoneFit features that you customized. You have the ability to accept or decline cookies. Most Web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. If you choose to decline cookies, you may not be able to fully experience the interactive features of the HormoneFit services or websites you visit.

Uninsured Fees

HormoneFit provides both insured and uninsured services. The fee paid by a HormoneFit membership client is for uninsured services only and is unrelated to any insured services that a membership client may require or obtain through HormoneFit. Many services requested by our clients are not covered by OHIP. If the Member has opted to pay the membership fee, the fees outlined in the fee schedule will not apply.

Uninsured fees follow the recommendations of the College of Physicians and Surgeons of Ontario (CPSO) and the Ontario Medical Association. For more information about our uninsured fees and fee schedules, please visit our Uninsured Fees page.

Links

This website contains links to other sites. Please be aware that we are not responsible for the content or privacy practices of such other sites. We encourage our users to be aware when they leave our site and to read the privacy statements of any other site that collects personally identifiable information.

Risk of Sending Unencrypted Emails

Some emails we send you may not be encrypted end-to-end. Other people may be able to read and forward the emails we send you and the emails you send us. In accordance with our commitment to minimizing risk, we limit the personal health information included in email communications and direct you to your secure patient dashboard for sensitive information. When you create an account on our Website we ask you to give us your email address. If you provide an incorrect email address we will unknowingly send communication to the wrong person.

Risk of Storing PII/PHI on your Device

When you use our Site there is a risk that your Personally Identifiable Information (PII) or Protected Health Information (PHI) will be stored on your device. We take a variety of technical safeguards to minimize unintentional storage of your PII/PHI on your device but we cannot guarantee that these safeguards work in all circumstances.

Risk of our Systems Getting Hacked and/or Compromised

We take a number of administrative, technical and physical safeguards to look after the Personally Identifiable Information (PII) or Protected Health Information (PHI) that we hold electronically on our servers. These include but are not limited to encryption at rest and in transit, access controls, audit logging, and regular security reviews. Despite these safeguards, we cannot guarantee that our systems and your PII and PHI will not be compromised by unauthorized third parties.

We strive to take appropriate security measures to protect against unauthorized access to or alteration of your personal information. No data transmission over the Internet or any wireless network can be guaranteed to be 100% secure. As a result, while we strive to protect your personal information, you acknowledge that: (a) there are security and privacy limitations inherent to the Internet which are beyond our control; and (b) security, integrity, and privacy of any and all information and data exchanged between you and us through this Site cannot be guaranteed.

External Data Storage Sites

We store your data on servers provided by third party hosting vendors with whom we have contracted. Our primary cloud infrastructure provider is Amazon Web Services (AWS), which stores data in the Canada (Central) region (ca-central-1). We have executed a Data Processing Addendum with AWS governing the handling of personal and health information stored on their infrastructure.

E-mail Communications

From time to time, HormoneFit may contact you via email for the purpose of providing announcements, promotional offers, alerts, confirmations, surveys, and/or other general communication. In order to improve our Services, we may receive a notification when you open an email from HormoneFit or click on a link therein.

If you would like to stop receiving marketing or promotional communications via email from HormoneFit, you may opt out of such communications by clicking on the UNSUBSCRIBE button.

Your Rights Under PHIPA

As a patient or user of HormoneFit, you have the following rights with respect to your Personal Health Information under the Personal Health Information Protection Act, 2004 (PHIPA) of Ontario:

How to Contact HormoneFit

For any privacy-related questions, requests, or concerns, please contact our Privacy Officer:

Revisions to this Privacy Policy

We reserve the right to change this Privacy Policy at any time whereby relevant changes take effect for the future. Any new Privacy Policy will apply to all Personally Identifiable Information (PII) or Protected Health Information (PHI) that we maintain, including PII/PHI that was created prior to the change. We will update the "Last updated" date at the top of this page when changes are made.

Your continued use of the Site and/or Services available through this Site after such modifications will constitute your: (a) acknowledgment of the modified Privacy Policy; and (b) agreement to abide and be bound by that Policy.