youRx

Privacy Policy

Last updated: July 30, 2026

This document is provided in English and Chinese. The English version is authoritative; in the event of any conflict between the two versions, the English version governs.

youRx is operated by Yourx Holdings Ltd. ("youRx", "we", "us"). This policy describes how we collect, use, store, share, and protect personal and health information when you use the youRx telehealth platform at yourx.ca. It is written to comply with the privacy laws that apply to you based on where you live: British Columbia's Personal Information Protection Act (PIPA) for our BC patients, Ontario's Personal Health Information Protection Act (PHIPA) for the health information of our Ontario patients, and the federal Personal Information Protection and Electronic Documents Act (PIPEDA) where it applies, including to data that moves between provinces or outside Canada. In Ontario, your treating physician is the health information custodian of your medical record; youRx supports your care as their electronic service provider.

1. Information we collect

  • Account information: name, email address, mobile phone number. Account credentials are managed by our authentication provider, Clerk; we do not store your password on our servers.
  • Health intake information: date of birth, sex assigned at birth, height, weight, medical history, current medications, allergies, lifestyle answers, and other clinical data you provide during a consultation.
  • Identity verification: a photo of a government-issued ID, used only to confirm your identity before issuing a prescription. Each ID photo is individually encrypted before storage (see Section 6), and accessed only by you (from your account), your treating clinicians, and authorized youRx operations staff, through short-lived (15-minute) signed URLs.
  • Shipping information: name, address, phone number for medication delivery.
  • Payment information: processed by our third-party payment provider. We do not store full card numbers on our servers.
  • Communications: messages you send us, and metadata about emails and SMS we send to you (delivery status, opens, clicks).
  • Technical information: IP address, browser and device information, session activity. Used for security and to operate the service.

2. How we use your information

  • To provide telehealth consultations and route approved prescriptions to our pharmacy partners for dispensing.
  • To send transactional notifications by email and SMS (consultation status, prescription approval, ID re-upload requests, payment retries, shipping updates).
  • To verify your identity and prevent fraud.
  • To respond to your support requests and improve the service.
  • To comply with legal and regulatory obligations, including health-record retention requirements.

3. SMS / Text Messaging Terms

At the intake consent step, an optional checkbox reads: "I agree to receive transactional SMS from youRx about my consultation, prescription, ID verification, and shipping. Reply STOP to unsubscribe." By checking this box, you opt in to receive transactional text messages from youRx about your consultation, prescription, ID verification, and shipping. If you do not check the box, no SMS notifications will be sent to you.

  • Message types: appointment and consultation status updates, prescription approvals, ID re-upload reminders, payment retry notifications, and shipping updates.
  • Message frequency: Message frequency may vary based on your consultation activity; typically 0–3 messages per month.
  • Costs: Message and data rates may apply.
  • Opt-out: Reply STOP to any youRx text message to opt out at any time. Reply HELP for assistance, or email info@yourx.ca.
  • No third-party sharing: We do not share, sell, rent, or transfer your mobile phone number, SMS consent, or SMS opt-in information to any third parties or affiliates for marketing or promotional purposes. Your mobile number is shared only with our SMS delivery provider (Twilio) for the sole purpose of transmitting the messages you have requested.
  • Service availability: SMS service is available on most major US and Canadian wireless carriers. youRx is not liable for delayed or undelivered messages caused by your carrier.

4. Who we share information with

  • Your treating clinician(s) on the youRx platform, who review your intake and issue prescriptions.
  • Pharmacy partners in your delivery area, who dispense and ship your medication. They receive only the information needed to fulfill the prescription (name, address, phone, prescription contents).
  • Service providers who help us operate the platform, under written agreements that restrict their use of your information to providing services to us: cloud hosting (Vercel; Supabase, Canadian region), file storage (Supabase Storage, Canadian region), email delivery (Resend), SMS delivery (Twilio), authentication (Clerk), and payment processing.
  • Authorities when required by law (court order, regulatory request, or to protect against fraud or harm).

We do not sell your personal information or health information to any party.

5. International data transfers

Your primary health records are stored on infrastructure located in Canada (Supabase Canadian region). Some service providers we use (including Twilio, Clerk, Resend, and Vercel) operate global networks and may process limited data (such as routing metadata, your SMS message body during transmission, or delivery logs) outside Canada. Where this is the case, we use providers with appropriate contractual safeguards. Information processed or stored outside Canada is subject to the laws of that jurisdiction and may be accessible to its courts, law enforcement, and national-security authorities as those laws allow.

6. Security

  • Encryption in transit (HTTPS / TLS) for all traffic.
  • Encryption at rest for all stored records, including identity documents.
  • Identity documents get an additional layer of per-document (envelope) encryption: each government-ID photo is encrypted with its own AES-256 key, and that key is itself encrypted by a hardware-security-module key held in a Canadian-region key-management service. Documents are decrypted only in the browser of an authorized viewer, and every key-wrapping and key-unwrapping operation is logged.
  • Identity documents are accessed only through short-lived (15-minute) signed URLs, never via a permanent public link.
  • Row-level security in the database so each user can only access their own records.
  • Access to your records by our clinicians and operations staff — including viewing a patient record or opening an identity document, and actions such as approving or declining a consultation, requesting additional information, or exporting records — is recorded in an internal audit log.
  • If a privacy breach occurs that affects your information, we will notify you and the relevant regulators as required by applicable law, and tell you what happened and what we are doing about it.

7. Retention

Health records are retained as required by the rules of the medical regulators in your province — currently at least 16 years from the last entry in British Columbia, and at least 10 years in Ontario, with longer periods for the records of minors. Other personal information is kept only as long as needed to provide the service or to comply with our legal obligations. You may request deletion of non-required information at any time (see Section 9).

8. Cookies and analytics

We use a small number of essential cookies for authentication and session management. If you arrive through one of our campaign links, we also set a single first-party marketing-attribution cookie (yourx_src, expires after 30 days). It stores only a short campaign label — for example, which social platform a link was posted on — and never contains health information or personal identifiers. If you arrive through a referral link shared by an existing member, we likewise set a single first-party referral cookie (yourx_ref, expires after 30 days) that stores only the referral code from that link, used solely to credit the referral — it too contains no health information or personal identifiers. Neither cookie is shared with any third party. We do not use third-party advertising trackers. Any analytics we deploy is privacy-preserving (no cookies, no personal identifiers) and used only to understand aggregate site usage.

9. Your rights

Under the privacy laws that apply to you (BC PIPA, Ontario PHIPA, and PIPEDA), you have the right to:

  • Access the personal information we hold about you.
  • Request correction of inaccurate information.
  • Withdraw consent for non-required processing (this may affect our ability to provide the service).
  • Request deletion of information not required to be retained.
  • File a complaint with the privacy regulator for your situation: in British Columbia, the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC); in Ontario, for your health information, the Information and Privacy Commissioner of Ontario (IPC); and the Office of the Privacy Commissioner of Canada for matters under PIPEDA. We encourage you to contact us first at info@yourx.ca — most concerns can be resolved directly.

To exercise any of these rights, contact us at info@yourx.ca. We respond to requests within 30 days.

10. Children

youRx services are not offered to anyone under the age of 18. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this policy from time to time. When we make material changes, we will post a notice on the homepage and send a notification to registered users. The "Last updated" date at the top of this page reflects the most recent change.

12. Privacy Officer and contact

youRx has designated a Privacy Officer who is accountable for our compliance with this policy and with the privacy laws described above — BC's PIPA, Ontario's PHIPA, and PIPEDA:

  • Dr. Ian Miao, Co-Founder — Privacy Officer. Accountable for how youRx handles your personal and health information, and the health-information custodian for your clinical records. Complaints about our privacy practices reach him.
  • Yancong Li, Co-Founder — platform and security. Designated by the Privacy Officer for technical safeguards, security incidents, and the system-side handling of the access, correction, and deletion requests described in Section 9.

To reach the Privacy Officer, or with any question about this policy or how we handle your information, email info@yourx.ca or write to:

Yourx Holdings Ltd.
British Columbia, Canada