Privacy policy

1. Introduction and scope

Bento Studio Inc. operates Pharmia, a consultation, research, and documentation service. This policy covers patient and pharmacist information, including trials without an account.

2. Our role

Your pharmacy is responsible for your care and patient record. Pharmia processes information for these services according to the pharmacy’s instructions.

Pharmia directly controls account management, service assessment and improvement, feedback, and interface recordings.

Authorized personnel can access information to operate the service, provide support, diagnose problems, and assess quality. Section 6 describes access to traces.

3. Privacy officer and contact details

Pharmia’s privacy officer is Mohammed Larbi Turki, Chief Executive Officer, Bento Studio Inc.

For a request or complaint about your information, email privacy@pharmia.ca.

4. Information collected

Pharmia collects information you or your pharmacy provide through forms, messages, documents, and voice conversations. It also collects some information automatically.

• Health and consultation: symptoms, history, medicines, answers, documents, and information relevant to the consultation. This information is sensitive.
• Account and identity: name, contact details, and information used to manage access and associate exchanges with your account or pharmacy.
• Audio and transcripts: recordings of voice conversations and their transcripts.
• Device and usage: browser and device information, network information, session cookies, interactions, and error logs.
• Outputs and feedback: preliminary assessments, notes, other service outputs, and survey answers.

Diagnostic and quality-assurance traces can include conversations and a link to the patient or consultation. Section 13.1 governs interface recordings.

5. Purposes and consent

Pharmia processes information to support consultations, prepare documents for pharmacists, manage accounts, operate and secure the service, diagnose problems, and assess quality.

The pharmacy obtains consent needed for clinical processing. A separate use of sensitive information requires express consent, unless a legal exception applies. Consent requests must specify their purpose. Written requests must appear separately from other information.

You can withdraw consent to the use or disclosure of your information by contacting your pharmacy or Pharmia’s privacy officer. Legal retention obligations still apply. Section 11 describes request procedures.

6. Artificial intelligence, diagnostics, and quality assurance

AI produces a preliminary assessment or document for the pharmacist from symptoms, history, medicines, and other information in your exchanges. The pharmacist remains responsible for clinical assessment.

You can request the information used, reasons, factors, and parameters behind the output, correction, or human review. Contact your pharmacy or Pharmia’s privacy officer. If a decision rests exclusively on automated processing, applicable rights include information about that decision and an opportunity to submit observations to someone able to review it.

Pharmia uses conversation traces to diagnose errors and assess service quality. These traces can contain identifiable information and remain linked to the patient or consultation. Authorized quality-assurance and engineering personnel can review them for these purposes.

This separate use of sensitive information requires express consent, unless an applicable legal exception exists. This policy does not obtain that consent. Contact Pharmia’s privacy officer for requests. Section 9 states retention rules.

Pharmia does not use identifiable patient health information to train or fine-tune its own AI models.

Pharmia does not sell your personal information. Patient clinical information serves neither marketing nor advertising.

7. Recipients and processing locations

Pharmia discloses necessary information to your pharmacy and providers that support the service. These providers supply hosting, AI processing, transcription, speech synthesis, message delivery, and service diagnostics.

Primary storage of patient information is in Quebec. Some information, including health information, can be processed outside Quebec and Canada. Section 13.1 states where interface excerpts are stored.

Pharmia enables zero data retention for AI inference services that support it. Pharmia excludes the use of your data to train provider models. Temporary processing and limited security or legal exceptions can still apply.

8. Protection and anonymization

Pharmia limits access to authorized personnel who need the information for their duties. Pharmia applies technical and organizational safeguards appropriate to the information’s sensitivity. Pharmia encrypts stored sensitive information and communications between your device and the service. Personnel handling information and relevant providers are subject to applicable confidentiality obligations.

Removing direct identifiers does not anonymize information; protection rules still apply. Anonymization requires an irreversible transformation that reasonably prevents direct or indirect identification under the legal standard, recognized best practices, and regulatory criteria. Information anonymized to that standard can serve serious and legitimate purposes.

9. Retention and destruction

Information must be kept as long as needed for its purpose or legal obligations, then destroyed or anonymized according to those obligations.

• Consultation exchanges and documents: retention depends on the pharmacy’s needs and inclusion in the clinical record.
• Clinical records and associated outputs: pharmacy instructions and professional record duties determine retention. Account closure or consent withdrawal does not remove those duties.
• Account and identity: retention relates to account management, consultation association, and applicable obligations.
• Audio: retention relates to producing and checking transcripts and documents, or an applicable clinical-record obligation.
• Identifiable conversation traces used for diagnostics and quality assurance: Pharmia’s rule sets a twelve-month maximum. A shorter period applies when the information is no longer needed.
• Device, usage, and surveys: retention is limited to the disclosed operation, security, and improvement needs.
• Interface excerpts: at most seven days without an account link; at most thirty days with that link. Earlier deletion applies when the purpose ends.

Deletion requests remain subject to retention obligations. If your pharmacy closes or becomes unreachable, contact Pharmia’s privacy officer.

10. Confidentiality incidents

Pharmia must assess incidents, reduce the risk of injury, and keep a register. If an incident presents a risk of serious injury, Pharmia must promptly notify affected individuals and the Commission d’accès à l’information, subject to legal exceptions. Other applicable notification duties remain in effect.

11. Your rights and requests

Under the conditions established by law, you can:

• access your information and obtain a copy;
• correct inaccurate, incomplete, or ambiguous information, or request deletion of information processed unlawfully;
• withdraw consent to a use or disclosure;
• obtain computerized information collected from you in a structured, commonly used format, subject to serious practical difficulties;
• request cessation of dissemination or de-indexing of a link when the applicable conditions are met;
• complain to the Commission d’accès à l’information and, where the federal regime applies, the Office of the Privacy Commissioner of Canada.

Portability excludes information the service creates or infers. This exclusion does not remove your access right to that information.

Email privacy@pharmia.ca or contact your pharmacy. Specify your request; identity verification may be necessary. Pharmia handles requests for information it controls and helps the pharmacy with others.

The privacy officer must answer an access or correction request in writing promptly, within thirty days of receipt. You can request help to clarify a request or understand a refusal.

12. Minors and people unable to consent

Age, capacity, and care rules determine who can consent or exercise rights. When a representative is required, they must have legal authority. A parental account alone does not grant access to a minor’s health information.

13. Cookies and automatic collection

Pharmia uses session cookies, device information, and interaction logs to operate and secure the service, diagnose problems, and improve use. Some usage information is associated with an account or workspace.

13.1 Pharmacist interface recording

Pharmia plans automatic recording of pharmacist interfaces and interactions, including trials without an account. When used, this recording helps correct problems and improve service use. Private and clinical content remains masked or excluded. Pharmia stores excerpts in Quebec.

By default, excerpts are not linked to your account. Optional data sharing in your privacy preferences allows association with your account and workspace. It also permits collection of public interface text. You can withdraw this choice without limiting service access. Recording without an account link continues.

To request that recording stop, email support@pharmia.ca. Without an account, the request concerns the browser used. Sections 9 and 11 state retention rules and your rights.

13.2 Optional surveys

Pharmia can offer surveys about satisfaction and the service. Answers can be linked to your account and help improve the service. Participation is optional; refusal does not limit access. Do not include health information in your answers. Section 11 explains consent withdrawal and your rights.

14. Disclosures required by law

Pharmia may have to disclose information to a legally authorized authority. Disclosure must remain limited to required information. Pharmia must respect legal conditions governing any other disclosure.

15. Policy changes

Pharmia publishes each change and distributes the corresponding notice to affected individuals. Pharmia or the pharmacy must obtain any new consent required before the relevant processing.

16. Languages

This policy is available in French and English. You can request either version from Pharmia’s privacy officer. This policy does not limit rights granted by applicable laws.