Privacy Policy

Overview

MedShort.ca ("we", "us") is operated by an independent individual based in Ontario, Canada, and respects your privacy. This policy explains what information we collect, how we use it, and the choices you have. We aim to comply with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, the EU General Data Protection Regulation (GDPR) for visitors in the EEA, UK, or Switzerland. By using MedShort.ca, you agree to the practices described here.

Information We Collect

Account information: if you sign in (by email magic link or Google), we store your email address and a unique account ID through our authentication provider, Supabase.

Favorites: if you favorite a drug, we store which drug shortage records you've favorited so we can show them to you and notify you of status changes.

Usage data: we use Google Analytics to understand how visitors use the site (pages viewed, general location, device type). This is aggregated and not tied to your name unless you're signed in.

Favoriting a medication does not confirm that you personally take it. We nonetheless treat medication-interest data as sensitive and use it only to provide the alerts you've requested — the shortage data on this site otherwise describes drug supply status in Canada generally, not anything about your own medical history.

Cookies

We use Google Analytics, which uses cookies and similar technologies to measure site usage. If you are in the EEA, UK, or Switzerland, you'll be shown a consent prompt before any non-essential cookies are set.

Learn more about Google's practices at How Google uses information from sites that use our services.

How We Use Your Information

We use your email address to send you a status-change notification when a drug you've favorited enters or resolves a shortage, and for account-related messages (like sign-in links). Notification emails are sent with a generic subject line — the drug name and status only appear once you open the message, not in the subject line or a preview snippet. We don't sell your information, and we don't share it with third parties for their own marketing purposes. Your favorites are never combined with your Google Analytics identifier or with any advertising identifier — favorites data stays in our database and is used only to decide which alerts to send you.

Third-Party Services

We use the following third-party services to run MedShort.ca: Supabase (accounts and database), Resend (transactional email), Vercel (hosting), and Google Analytics (site analytics). Each of these providers processes data on our behalf under their own privacy policies and security practices. We choose providers that maintain industry-standard safeguards for the data they process.

Where Your Data Is Processed

Your account and favorites data (Supabase) is stored in Canada. Our application is hosted on Vercel, whose servers for this site are located in the United States. Resend and Google Analytics are US-based providers and may process data outside Canada as a result. If you are outside Canada, your information may therefore be processed in Canada, the United States, or other countries where these providers operate, and may be subject to the laws of those countries, including lawful access by their authorities.

Your Rights and Choices

Depending on where you live, you may have the right to access, correct, or request deletion of your personal information. You can request deletion of your account and associated data at any time by emailing info@medshort.ca. We will respond to your request within a reasonable timeframe, consistent with applicable law.

Data Retention

We keep your account information for as long as your account is active. We currently consider an account inactive if it has not been signed into for 12 consecutive months. If you request deletion, we will remove your personal information from our active systems, except where retention is required for legal or legitimate business purposes (such as fraud prevention). We do not currently maintain automated backups of the database, so deletion from our active systems is effectively complete; if that changes, we will update this policy with the backup retention period.

Data Breach Notification

If a breach of security safeguards occurs involving your personal information that creates a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada and affected individuals as required under PIPEDA, without unreasonable delay after we become aware of the breach. We will also keep a record of any breach, as required by law, whether or not it meets that notification threshold.

Children's Privacy

MedShort.ca is not directed at children, and we do not knowingly collect information from anyone under 13. If we become aware that we have inadvertently collected personal information from a child under 13, we will delete it promptly.

Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. We'll update the "Last updated" date above when we do, and material changes will be reflected here.

Contact Us

Questions about this policy or your data? Email the MedShort.ca Privacy Officer at info@medshort.ca. The Privacy Officer is accountable for our compliance with this policy and applicable privacy law.