CompoundCheck (“we”, “us”, “our”) provides compounding risk assessment software for Canadian pharmacies at compoundcheck.com (the “Service”). This policy explains what information we collect, how we use it, where it is stored, and the choices you have. We designed the Service — and this policy — around the Personal Information Protection and Electronic Documents Act (PIPEDA).
1. The short version
- Application data is hosted in Canada (AWS Canada Central region, Montréal).
- The assessment workflow is designed to work without patient information, and a built-in scanner flags suspected patient identifiers in uploaded documents so they can be removed.
- We do not sell personal information, and we do not use advertising trackers on the Service.
- We collect what is needed to run a professional tool: account details, the formula documents you upload, an audit trail of assessment actions, and technical logs.
2. Information we collect
Account information
When an account is created we collect your name, email address, and pharmacy details (such as pharmacy name and province). Authentication is handled by our infrastructure provider, Supabase.
Waitlist signups
If you join the waitlist we collect your email address and any notes you choose to provide (for example pharmacy name, province, and compounding volume). We use this information only to contact you about CompoundCheck access and to prioritize pilot expansion.
Documents and assessment data
We store the compounding formula documents you upload and the data derived from them: extracted ingredients, hazard data retrieved from published sources, risk classifications, overrides and rationales, sign-offs, and generated documents. These are professional records about compounds — not patient records. Do not upload documents containing patient identifiers; the Service scans uploads and flags suspected identifiers so you can remove them.
Audit trail
Because assessments are professional documents that may be shown to inspectors, the Service keeps an audit trail of assessment actions. Audit entries record the acting user, their pharmacy, the action taken, a timestamp, and the IP address of the request.
Technical information
Like most web applications we receive standard technical data (IP address, browser type, pages requested). If the application encounters an error, our error-monitoring provider (Sentry) receives a technical report that may include your IP address, browser information, and the state of the screen where the error occurred. We use this solely to find and fix defects. We do not run third-party advertising or cross-site tracking, and we use browser storage only to keep you signed in and remember interface preferences.
3. How we use information
- To provide, secure, and support the Service.
- To maintain the assessment audit trail that makes your documentation defensible.
- To communicate with you about access, changes to the Service, and (if you joined the waitlist) pilot availability.
- To diagnose errors and improve reliability and accuracy.
- To meet legal obligations.
We do not sell personal information and we do not use your data to train generative AI models.
4. Where data lives and who processes it
Application data — accounts, uploaded documents, assessments, and the audit trail — is stored with Supabase in the AWS Canada Central region (Montréal, Canada). The website itself is delivered through Netlify’s content delivery network, which serves static pages from locations around the world.
We use a small number of service providers to operate the Service:
- Supabase — database, authentication, file storage, and server functions (data stored in AWS ca-central-1, Canada).
- Netlify — web hosting and content delivery.
- Google (Gemini API) — when you upload a formula document, its text is sent to Google’s Gemini API to extract ingredients and formulation details. This processing may occur on Google infrastructure outside Canada. Formula documents are commercial formulation records; this is another reason patient identifiers must not appear in uploads.
- Sentry — error monitoring, as described above.
- Published chemistry data sources — to enrich an assessment, the Service queries PubChem (U.S. National Library of Medicine), the EPA CompTox Chemicals Dashboard, and Health Canada’s Drug Product Database. These queries contain ingredient names and chemical identifiers only — never your account or pharmacy information.
Where a provider processes data outside Canada, that data may be subject to the laws of the jurisdiction where it is processed. We limit what each provider receives to what its role requires.
5. Retention
We retain account information and assessment records for as long as your account is active. Because finalized assessments and their audit trails are professional compliance records, we retain them while your pharmacy uses the Service and for a reasonable period afterwards, unless you ask us to delete them sooner and no legal obligation requires retention. Waitlist information is kept until you are onboarded or ask to be removed. Error-monitoring data is retained on a rolling short-term basis.
6. Security
Data is encrypted in transit and at rest. Access to pharmacy data is segregated by tenant and enforced at the database level (row-level security), so one pharmacy cannot read another’s records. Access to production systems is restricted and credentialed. No system is perfectly secure; if we become aware of a breach that creates a real risk of significant harm, we will notify affected users and the Office of the Privacy Commissioner of Canada as required by PIPEDA.
7. Your rights
Subject to limited exceptions under PIPEDA, you may:
- request access to the personal information we hold about you;
- request correction of inaccurate information;
- withdraw consent to our handling of your information (which may require closing your account);
- request deletion of your account and waitlist information.
To exercise any of these rights, contact our Privacy Officer at contact@compoundcheck.com with “Privacy” in the subject line. We will respond within the timelines required by PIPEDA. If you are not satisfied with our response, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
8. Children
The Service is a professional tool for pharmacy practice and is not directed to individuals under the age of majority.
9. Changes to this policy
We may update this policy as the Service evolves. If a change is material, we will notify account holders by email or in-app notice before it takes effect. The “Last updated” date above reflects the current version.
10. Contact
Privacy Officer, CompoundCheck — contact@compoundcheck.com