youRx

Privacy Policy

Last updated: June 10, 2026

This document is provided in English and Chinese. The English version is authoritative; in the event of any conflict between the two versions, the English version governs.

youRx is operated by Yourx Holdings Ltd. ("youRx", "we", "us"). This policy describes how we collect, use, store, share, and protect personal and health information when you use the youRx telehealth platform at yourx.ca. It is written to comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial health-information legislation.

1. Information we collect

  • Account information: name, email address, mobile phone number. Account credentials are managed by our authentication provider, Clerk; we do not store your password on our servers.
  • Health intake information: date of birth, sex assigned at birth, height, weight, medical history, current medications, allergies, lifestyle answers, and other clinical data you provide during a consultation.
  • Identity verification: a photo of a government-issued ID, used only to confirm your identity before issuing a prescription. Each ID photo is individually encrypted before storage (see Section 6), and accessed only by you (from your account), your treating clinicians, and authorized youRx operations staff, through short-lived (15-minute) signed URLs.
  • Shipping information: name, address, phone number for medication delivery.
  • Payment information: processed by our third-party payment provider. We do not store full card numbers on our servers.
  • Communications: messages you send us, and metadata about emails and SMS we send to you (delivery status, opens, clicks).
  • Technical information: IP address, browser and device information, session activity. Used for security and to operate the service.

2. How we use your information

  • To provide telehealth consultations and dispense prescriptions through our pharmacy partners.
  • To send transactional notifications by email and SMS (consultation status, prescription approval, ID re-upload requests, payment retries, shipping updates).
  • To verify your identity and prevent fraud.
  • To respond to your support requests and improve the service.
  • To comply with legal and regulatory obligations, including health-record retention requirements.

3. SMS / Text Messaging Terms

At the intake consent step, an optional checkbox reads: "I agree to receive transactional SMS from youRx about my consultation, prescription, ID verification, and shipping. Reply STOP to unsubscribe." By checking this box, you opt in to receive transactional text messages from youRx about your consultation, prescription, ID verification, and shipping. If you do not check the box, no SMS notifications will be sent to you.

  • Message types: appointment and consultation status updates, prescription approvals, ID re-upload reminders, payment retry notifications, and shipping updates.
  • Message frequency: Message frequency may vary based on your consultation activity; typically 0–3 messages per month.
  • Costs: Message and data rates may apply.
  • Opt-out: Reply STOP to any youRx text message to opt out at any time. Reply HELP for assistance, or email info@yourx.ca.
  • No third-party sharing: We do not share, sell, rent, or transfer your mobile phone number, SMS consent, or SMS opt-in information to any third parties or affiliates for marketing or promotional purposes. Your mobile number is shared only with our SMS delivery provider (Twilio) for the sole purpose of transmitting the messages you have requested.
  • Service availability: SMS service is available on most major US and Canadian wireless carriers. youRx is not liable for delayed or undelivered messages caused by your carrier.

4. Who we share information with

  • Your treating clinician(s) on the youRx platform, who review your intake and issue prescriptions.
  • Pharmacy partners in your delivery area, who dispense and ship your medication. They receive only the information needed to fulfill the prescription (name, address, phone, prescription contents).
  • Service providers who help us operate the platform, under written agreements that restrict their use of your information to providing services to us: cloud hosting (Vercel; Supabase, Canadian region), file storage (Supabase Storage, Canadian region), email delivery (Resend), SMS delivery (Twilio), authentication (Clerk), and payment processing.
  • Authorities when required by law (court order, regulatory request, or to protect against fraud or harm).

We do not sell your personal information or health information to any party.

5. International data transfers

Your primary health records are stored on infrastructure located in Canada (Supabase Canadian region). Some service providers we use (including Twilio, Clerk, Resend, and Vercel) operate global networks and may process limited data (such as routing metadata, your SMS message body during transmission, or delivery logs) outside Canada. Where this is the case, we use providers with appropriate contractual safeguards.

6. Security

  • Encryption in transit (HTTPS / TLS) for all traffic.
  • Encryption at rest for all stored records, including identity documents.
  • Identity documents get an additional layer of per-document (envelope) encryption: each government-ID photo is encrypted with its own AES-256 key, and that key is itself encrypted by a hardware-security-module key held in a Canadian-region key-management service. Documents are decrypted only in the browser of an authorized viewer, and every key-wrapping and key-unwrapping operation is logged.
  • Identity documents are accessed only through short-lived (15-minute) signed URLs, never via a permanent public link.
  • Row-level security in the database so each user can only access their own records.
  • Access to your records by our clinicians and operations staff — including viewing a patient record or opening an identity document, and actions such as approving or declining a consultation, requesting additional information, or exporting records — is recorded in an internal audit log.

7. Retention

Health records are retained as required by provincial regulations, which generally require at least 7 years of retention (longer for minors). Other personal information is kept only as long as needed to provide the service or to comply with our legal obligations. You may request deletion of non-required information at any time (see Section 9).

8. Cookies and analytics

We use a small number of essential cookies for authentication and session management. We do not use third-party advertising trackers. Any analytics we deploy is privacy-preserving (no cookies, no personal identifiers) and used only to understand aggregate site usage.

9. Your rights

Under PIPEDA and applicable provincial law, you have the right to:

  • Access the personal information we hold about you.
  • Request correction of inaccurate information.
  • Withdraw consent for non-required processing (this may affect our ability to provide the service).
  • Request deletion of information not required to be retained.
  • File a complaint with the Office of the Privacy Commissioner of Canada.

To exercise any of these rights, contact us at info@yourx.ca. We respond to requests within 30 days.

10. Children

youRx services are not offered to anyone under the age of 18. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this policy from time to time. When we make material changes, we will post a notice on the homepage and send a notification to registered users. The "Last updated" date at the top of this page reflects the most recent change.

12. Contact

Questions about this policy or how we handle your information? Email info@yourx.ca or write to:

Yourx Holdings Ltd.
British Columbia, Canada