Pharmacies trust Box Labs with some of the most sensitive information there is. This policy explains, in plain language, what information Box Labs Inc. ("Box Labs", "we") collects, where it lives, how it is protected, and the Canadian privacy laws we follow.

Our commitments

The full policy

1. Who this policy covers

This policy is for the pharmacies that use Box Labs. It covers:

• the information your pharmacy keeps in the Box Labs platform, including your patients' health information; and
• the information we collect to run our business, such as when you contact us, book a demo or ask for support.

2. Information we collect

• Pharmacy and staff accounts: the names, work contact details and sign-in details of the people who use Box Labs at your pharmacy.
• Your pharmacy's records: the patient, prescription and billing information your pharmacy enters, imports or creates in Box Labs.
• When you contact us: your name, your pharmacy, your contact details and what you tell us.
• Technical logs: such as when requests were made and any errors, which we use to keep the platform running and secure.

We collect only the information we need to provide our services, and we work to keep it accurate and up to date.

3. Your data belongs to you

Your pharmacy keeps full ownership of its data. Box Labs uses it to provide and support the platform. Apart from the de-identified, aggregated data described in section 5, we do not use, change or disclose it without your consent unless the law requires it.

Our staff access client data only for specific purposes, such as providing technical support or resolving an issue you've reported.

4. How we use information

• To provide, support, maintain and secure the platform.
• To answer you when you contact us or ask for support.
• To send you news about Box Labs, if you've agreed to it. You can opt out of marketing messages at any time.

We get consent before collecting, using or disclosing personal information, except where the law permits or requires otherwise, and we use it only for the purposes it was collected for.

5. When information leaves the platform

Identifying information about your pharmacy or patients is never sold. It leaves the platform only:

• when your pharmacy sends it, for example when you submit a claim or use an integration you have turned on;
• to service providers that help us run the platform, which are bound by contract to protect it and may use it only to deliver our service; or
• where disclosure is required by law, for example by a court order.

De-identified, aggregated data

From the dispensing records in the platform, Box Labs may produce statistics that combine data from many patients and many pharmacies, and may share or sell them to third parties, such as healthcare data and research companies. Before that happens, the data is aggregated and identifying details are removed, so that it cannot identify your pharmacy, any other pharmacy, or any patient, as the law requires.

6. Where your data is stored

All data on the Box Labs platform, including backups, is stored on servers in Canada, and the platform's AI features run on servers in Canada too. Your data is stored redundantly and backed up automatically to guard against hardware failure and accidental loss.

7. How we protect it

We use technical, administrative and physical safeguards to protect your data against loss and unauthorized access, use or disclosure, and to keep it confidential and intact both in storage and in transit.

• Access is limited to authorized staff who need it for their role, and access rights are reviewed regularly.
• Every team member is trained on privacy protection and their responsibilities under this policy.
• Our team runs internal security audits multiple times a year.
• Box Labs has passed third-party security assessments, so our safeguards are also checked by outside experts.

8. If a security incident occurs

If a breach ever affects your data, we will notify you promptly, as required by law, and tell you what happened, what information was involved, and any steps we recommend you take.

9. Keeping and deleting information

We keep personal information only as long as we need it for the purposes it was collected for, or as the law requires. When we no longer need it, we securely destroy or anonymize it.

If you end your service, we will help you transfer your data to another system. Afterward, or whenever you ask, we delete or anonymize your data unless we are legally required to keep it.

10. Your rights

• See and correct your information: you can ask to see the personal information we hold about you, and to correct it if it's wrong.
• Marketing: you can opt out of marketing messages from Box Labs at any time.
• Questions and complaints: contact our privacy contact below.

If you are not satisfied with our response, you can contact the Office of the Privacy Commissioner of Canada.

11. Canadian privacy law

Box Labs complies with the Personal Information Protection and Electronic Documents Act (PIPEDA). Our platform is built to help pharmacies meet their own obligations under provincial health privacy legislation, such as Ontario's Personal Health Information Protection Act (PHIPA).

12. Changes to this policy

If we change this policy, we will post the new version on this page and update the date below.

Use of the Box Labs platform is also governed by our End User Licence Agreement.
Last updated: October 30, 2026