Rexall Direct
  • Home
  • Privacy Policy

Rexall Direct® Online Privacy Notice
(the “Privacy Notice”)

Last update: September 20, 2022

Rexall Direct® (hereinafter referred to as the “Rexall Direct® Services”) is a home delivery service that is available to residents of Canada, excluding Quebec, which is administered by Rexall through certain pharmacies owned or operated by Rexall under the trademarks Rexall® (collectively referred to as the “Rexall Pharmacy(ies)”) by accredited pharmacists (the “Rexall Pharmacist(s)”).

For the purposes of this Privacy Notice, unless stated otherwise, all references to “Rexall” or “we” or “us” include Rexall Pharmacy Group ULC, as well as its affiliates Rexall Pharmacies ULC, Rexall Pharmacies (SASK) ULC and Rexall Pharmacies (BC) ULC, and each of their respective agents, representatives and third-party service providers, and each of their respective affiliates.

At Rexall we value the trust that our customers and patients place in us to appropriately use and protect Personal Information. This Privacy Notice informs visitors and regular users of the RexallDirect.ca website (the “Rexall Direct® Site”), about the purposes for which Rexall may collect, use, and share Personal Information, and how it is protected. We want you to be clear how we use Personal Information and the ways in which we protect this information. By using the Rexall Direct® Site, you accept the privacy practices presented in this Privacy Notice. We encourage you to read this Privacy Notice in full to understand our privacy practices before using the Rexall Direct® Site or submitting any Personal Information.

The collection, use and disclosure of your Personal Information by Rexall and your applicable Rexall Pharmacist(s), are governed by the terms of this Privacy Notice and the Rexall External Privacy Policy available at https://www.rexall.ca/external-privacy-policy, the terms of which are incorporated by reference into this Privacy Notice.

Scope

This Privacy Notice applies only to the Rexall Direct® Site. Rexall and its affiliates and subsidiaries may have separate websites, sub-domains, and services through other web, mobile, or cloud platforms that are not subject to this Privacy Notice. Additionally, Rexall business partners, ad networks, and other third parties have their own websites and services with separate privacy practices. We encourage you to read the privacy notices of all websites, portals, and applications that you visit to understand their privacy practices.

Throughout this Privacy Notice, we use the term “Personal Information”, which is any information accessed, collected, or used by Rexall that identifies an individual, or can reasonably be used to identify an individual, directly or indirectly, including without limitation the personal health information, insurance information and financial information included in your Rexall Pharmacy record. “Personal information” is equivalent to similar terms used in different regulations, such as “personally identifiable information (PII)” and “personal data.”

Consent

The Rexall Direct® Site does not collect, use, or disclose Personal Information from you for any purposes other than those specified in this Privacy Notice without obtaining your consent, unless permitted or required by law. Consent may be express or implied. Consent can be “express” through words or by specific acts (such as oral or written consent) or implied by your conduct, where it would be reasonable for us to infer that you have agreed to the collection, use or disclosure of your Personal Information. For example, if you enter information in order to create your personal profile and register a personal account on the Rexall Direct® Site or update your Rexall Pharmacy record through the Rexall Direct® Site, it is assumed that you have given consent to the collection of the transaction information required to fulfill the purposes specified in this Privacy Notice.

You may refuse, limit or withdraw your consent to any or all of the uses identified in this Privacy Notice at any time by following the procedures outlined below under “Your Rights”. However, in certain circumstances there may be legal or regulatory reasons that you cannot withdraw your consent to our collection, use or disclosure of your Personal Information. Please note that if you refuse or withdraw consent to certain uses of your Personal Information, we may no longer be able to offer you certain products or services for which those uses are required.

We will inform you periodically, by means of brochures, correspondence or through the Rexall Direct® Site, or otherwise, of any new collection, use or disclosure of Personal Information or material change to this Privacy Notice. We may use one or a combination of these methods.

Personal Information We Collect

When you use the Rexall Direct® Site, we may collect Personal Information about you. The Personal Information we may collect with your prior consent, where required by law, includes but is not limited to:

  • Registration: In order to use the Rexall Direct® Services, you must register for an account and provide certain Personal Information to us such as your name and email address.
  • Purchases: When you make a purchase through the Rexall Direct® Site, we may collect the following information: e-mail address, billing address, mailing address, pseudonyms, phone number, IP address, Rexall Direct® password, personal preferences, group affiliations, public and/or private insurance provider information, payment assistance program information, payment and billing information. During checkout, you have the option to have us remember your credit card number for future purchases. We do this using a technology called "payment tokenization". That's just a fancy way of saying we don't actually store your credit card number. Instead, when you complete a purchase we use your credit card number to obtain a secret token - a special random string of letters and numbers - from the credit card payment provider. Then, when you want to make your next purchase, instead of sending your credit card number to the credit card payment provider, we send the secret token. Just like all of our other financial transactions, this communication is set up to take place over a secure, encrypted communication line. We may use third party freight providers to deliver your purchases, and accordingly we share your name, phone number, email address and shipping address with such providers for the purposes of completing your delivery.
  • Pharmacy Services: When you use the Rexall Direct® Services your Rexall Pharmacy may use some health-related information, such as your medical records and other information about your health and your prescriptions, that has been collected or generated by your pharmacist for the purpose of managing your prescriptions and prescription refills.
  • Information about you that you share or make visible on the Internet. We may combine such information with information we already have about you.

We may collect non-Personal Information and it may be aggregated with other information. If we combine your non-Personal Information with Personal Information, the combined information will be treated as Personal Information.

You do not have to provide us with this information if you do not want to; however, that may limit your ability to use certain functions or to request certain services or information.

Tracking Technologies We Use

We use various technologies to collect Personal Information about visitors to our Rexall Direct® Site. These technologies include the following:

  • Web server logs
    • As is true of most websites, we gather certain information automatically and store it in log files. This information may include IP addresses, browser type, internet service provider, referring/exit pages, operating system, date/time stamp and/or clickstream data.
  • Cookies and pixel tracking
    • We and our subsidiaries, business partners, marketing partners, affiliates, or other service providers may utilize cookies. Cookies uniquely identify your device or user account associated with the Rexall Direct® Site. You can control the use of cookies by adjusting your browser preferences at any time. If you reject cookies, you may still use the Rexall Direct® Site but your ability to use some features or areas of the Rexall Direct® Site may be limited. We may also use tracking pixel. A tracking pixel is a piece of code embedded on a web page that collects information about users’ engagement on that web page. The tracking pixel can be provided either by Rexall or its advertising partners. The tracking pixel may include a command to create cookies.
  • Geo-location
    • When you enable a location-based service, we may collect information about your location for the purpose of providing you with weekly flyers, finding a Rexall drugstore or locating a medical clinic closest to you. We use various features to determine location, such as IP address, GPS signals, and sensor data from your device that may provide information on nearby Wi-Fi access points and cell towers. You may opt out of geo-location collection by changing the setting of your browser or device.
  • Other Tracking Technologies
    • The Rexall Direct® Site uses Google Analytics, a Google Inc. (“Google”) provided web analysis service. To learn more about how Google Analytics collects and processes data, please visit Google’s website "How Google uses data when you use our partners' sites or apps" located at www.google.com/policies/privacy/partners/
    • We also use HTML5 (or any similar technologies) to collect and store content information and preferences. Our third-party partners, who provide certain features on this Rexall Direct® Site or who display advertising, use HTML5 to collect and store information. Various browsers may offer their own management tools for removing HTML5 (or any similar technologies).

These methodologies are used for the following purposes:

  • To personalize your user service or provide you with customized site-content based on your preferences
  • Quick and easy online prescription refills
  • Online prescription transfers to Rexall
  • To provide you with customer and troubleshooting support

We may receive reports based on the use of tracking technologies on an individual and aggregated basis.

How We Respond to “Do Not Track” Signals

Some web browsers have a “Do Not Track” feature. This feature allows you to tell websites you visit that you do not want to have your online activity tracked over time and across websites. These features are not yet uniform across browsers. The Rexall Direct® Site is not currently set up to respond to those signals.

How We Use the Personal Information Collected

We may use the Personal Information we collect for purposes such as:

  • provide healthcare and pharmacy related services including the management of your online prescriptions and refills (the “Rexall Direct® Online Prescription Services”) or the transfer of your prescriptions (the “Rexall Direct® Online Prescription Transfer Requests Services”)
  • communicate with individuals involved in your care, such as your prescribing physician or your health insurance provider.
  • provide health-related education communications
  • communicate products and services
  • provide loyalty programs, promotions and other non-pharmacy related activities
  • managing the Rexall business

Additional Information Regarding the Rexall Direct® Online Prescription Services and Rexall Direct® Online Prescription Transfer Requests Services

The Rexall Direct® Online Prescription Services allow you to make a request, through the Rexall Direct® Site, to a Rexall Pharmacy to have a new prescription filled or an existing prescription refilled, where refills remain (or where, in some provinces, the Rexall Pharmacist is permitted to authorise refills). The Rexall Direct® Online Prescription Transfer Requests Services allows you to request a transfer of your prescriptions from another pharmacy to a Rexall Pharmacy. Please consult the Rexall Direct® Terms of Use available at https://www.rexalldirect.ca/terms-of-use for further information.

Your request for a prescription transfer, fill or refill will be transmitted to the Rexall Pharmacy authorised to operate in your province of residence. Once the Rexall Pharmacy has received the request, it will be handled in the same manner as all Rexall prescription fill and refill requests, at all times being subject to the dispensing Rexall Pharmacist’s professional judgment and ethical responsibilities. You will also be contacted by a Rexall representative by phone at the phone number you provided regarding the details of your prescription fill or refill.

Additional Use of the Personal Information Collected

We may also use the Personal Information collected for the following purposes:

  • Surveys or Contests
    • If you participate in surveys or register to contests, we will request certain Personal Information from you. Participation in these surveys or contests is completely voluntary and you have a choice whether to disclose this information. We may use a third-party service provider to conduct these surveys or contests. We will not share the Personal Information you provide through a contest or survey with other third parties unless we give you prior notice and choice.
  • Advertising
    • We may partner with third parties to manage our advertising. Our third-party partner may use cookies and other technologies to gather information about your activities to provide you advertising based upon your browsing activities and interests.

How We Share Personal Information Collected

  • We may share Personal Information with other Rexall business units when permitted by law. Additionally, we may share your Personal Information with third parties only in the ways described in this Privacy Notice.
  • We may provide your Personal Information to third parties that provide services to help us with our business activities such as Bambora or other third party payment processor, Apple Wallet or Google Pay for processing payments or digital wallet services. These companies are authorized to use Personal Information about you only as necessary to provide these services to us.
  • We do not give, rent, or sell Personal Information to any organization or individual. We may provide your Personal Information to Rexall affiliates or subsidiaries, suppliers, and companies contracted to process and manage transactions, research, analysis and communications. However, Personal Information may be disclosed to such organizations or individuals whose services are retained by Rexall or its affiliates or subsidiaries, including advertising agencies, direct marketing agents, data processing and storage firms as well as mailing houses, and providers of administrative support service. These agents, representatives or organizations must sign a confidentiality agreement and may only use the information disclosed to them for the purposes mentioned in the agreement, after which they must return this information to us or destroy the information, without keeping a copy. They are prohibited from disclosing the information to third parties without obtaining appropriate consent in advance.
  • Some of our pages may utilize framing techniques, which allows us to display content to/from our partners while preserving the look and feel of our Rexall Direct® Site. If you choose to interact or share Personal Information via these frames, please be aware you are providing Personal Information to these third parties and not directly to Rexall, and your Personal Information is subject to the privacy practices of these third parties.
  • Our site may offer a public area for users to share posts, comments, blogs, or testimonials. You should be aware any Personal Information you provide in these areas may be read, collected, and used by others who access them. To request removal of Personal Information from our blog or community forum, contact us at Toll-free: 1-877-378-4100 or send an email to privacyofficer@rexall.ca.
  • We may share Personal Information with your caregiver (if you have designated one). Some of your Personal Information (e.g., prescription name, last fill date, quantity/supply, pharmacy location, and prescribing physician) may be available to the caregiver that you have designated in order to allow such caregiver to assist you with your prescriptions and refills and related functions, such as:
    • adding or removing Pharmacy accounts on your behalf in the Rexall Direct® Site;
    • viewing your medication record with every linked Pharmacy account in the Rexall Direct® Site;
    • requesting prescription refill through the Rexall Direct® Site on your behalf;
    • receiving notifications (e.g. Reminder) on your behalf;
    • enrolling/unenrolling to Rexall’s AutoRefill program;
    • receiving notification if your medication adherence falls below a threshold.

Rexall may also need to share information with companies, organizations, or individuals outside of Rexall if we have a good faith belief that access, use, preservation, or disclosure of that information is reasonably necessary to:

  • Meet applicable laws, regulations, legal processes, or enforceable governmental requests
  • Enforce applicable Terms of Service, including investigation of potential violations
  • Detect, prevent, or otherwise address fraud, security, or technical issues
  • Protect against harm to the rights, property or safety of our users, Rexall, or the public as required or permitted by law
  • Engage in a merger, acquisition, reorganization, or sale of all or a portion of Rexall assets.

Your Choice

Where appropriate or legally required, we will describe how your information we collect through this Rexall Direct® Site will be used, and will provide choices about whether to allow us to engage in that use. To exercise your choice, you may contact us to correct, update, amend, or request deletion of your Personal Information through the address listed in the Contact Information section below.

Where permitted in our legitimate interest, or with your prior consent where required by law, we will use your name and email address to send our newsletter to you. You may choose to stop receiving our newsletter or marketing emails by following the unsubscribe instructions included in these emails or contacting us using the contact information listed below in this Privacy Notice.

Your Rights

You can contact us directly any time at the address listed in the Contact Information section below to update your Personal Information or make another type of request regarding the information you know or believe Rexall holds about you. Here are some rights that you may have according to where you are located:

  • Access
    • Subject to applicable law, you have the right to receive information about, and review in person, or obtain copies of, the Personal Information we maintain about you. We may charge you a reasonable fee as allowed by law to obtain this information.
  • Amendment or Deletion
    • Subject to applicable law, you have the right to request that we amend or delete your Personal Information.
  • Disclosure Accounting
    • Subject to applicable law, you have the right to request and receive a list of certain disclosures made of your Personal Information. If you request this list more than once in a 12-month period, we may charge you a reasonable fee as allowed by law to respond to any additional request.
  • Use/Disclosure Restriction or Objection
    • Subject to applicable law, you have the right to request we restrict our use or disclosure of your Personal Information for certain purposes. You also have the right to object to the processing of your Personal Information. We may not be required to agree to a requested restriction or objection. We will agree to restrict use, or disclosure of, your Personal Information provided the law allows it and we determine the restriction does not impact our ability to operate our business, provide diagnostic services, and comply with the law. Subject to applicable law, even when we agree to a restriction request, we may still disclose your Personal Information in a medical emergency and use or disclose your Personal Information for public health, safety and other similar public benefit purposes permitted or required by law.
  • Withdraw Consent
    • Subject to applicable law, you may withdraw your consent to our processing of your Personal Information. Note: withdrawal does not invalidate the consent-based processing that occurred prior to withdrawal.
  • Automated Decision Making
    • Subject to applicable law, if at any time the Rexall Direct® Site uses automated decision making to process Personal Information, you have the right to object to the use of your Personal Information.
  • Data Portability
    • Subject to applicable law, you have the right to receive your Personal Information in a structured, commonly used, and machine-readable format.

These rights may be limited in some circumstances by local law requirements.

Rexall shall provide you with a response to any such request(s) without undue delay and in any event within 30 days of receipt of the request. That period may be extended by 30 days where necessary, taking into account the complexity and number of request(s). Rexall shall inform you of any such extension within 30 days of receipt of the request, together with the reason(s) for the delay. If you make the request by electronic-form means, the information shall be provided by electronic means where possible, unless otherwise requested by you in written documentation.

You can also exercise the rights listed above at any time by going to the contact information at the bottom of this notice.

If your request or concern is not satisfactorily resolved by us, you may approach your local data protection or privacy regulator.

Retention

We will retain your Personal Information to meet our contractual obligations to you and for as long any account you activate on, through or in association with this Rexall Direct® Site is active, is reasonably useful for commercial purposes, or as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. We may also retain aggregate information beyond this time for research purposes and to help us develop and improve our services. You cannot be identified from aggregate information retained or used for these purposes.

Social Media Connection

You may choose to enable an interface, share with others, or log in to the Rexall Direct® Site via various social media or social networking services such as LinkedIn, Instagram, Facebook, or Twitter (“Social Networking Services”). By integrating these Social Networking Services into the Rexall Direct® Site, we can offer you a richer and more personalized experience with our products and services. When you connect your current account to a social media account, we may collect certain Personal Information you have provided to the Social Networking Service. For example, when you log in with your Facebook credentials, we may collect Personal Information from your Facebook profile, such as your email address, profile picture, and friend list.

Children’s Privacy

The Rexall Direct® Site is not intended for any person under the age of 14 and we do not knowingly collect Personal Information from children under the age of 14. We do not allow children under the age of 14 to enroll in the Rexall Direct® Site. A caregiver may enroll in the Rexall Direct® Site on behalf of a child who is under the age of majority. A user of the Rexall Direct® Site who is capable of making their own decisions and who has not yet reached the age of majority in their province of residence may choose not to give their caregiver access to some of their information such as their prescription name, last fill date, quantity/supply, pharmacy location, and prescribing physician.

How We Protect Your Information

As a key provider of services and technology to the healthcare industry, Rexall has implemented programs to address the privacy and security requirements of protecting personal health information.

Rexall has also established appropriate physical, technical, and administrative safeguards to protect the Personal Information we collect from or about our users and the information that they provide us. We restrict access to Personal Information to Rexall employees, contractors, and agents who need to know the information to process it for us, and who are subject to confidentiality obligations.

Any sensitive Personal Information (e.g., healthcare number or credit card number) will be transmitted in an encrypted form using TLS protocol or other equivalent encryption technology (TLS is cryptographic protocol that provides end-to-end communications security over networks). Notwithstanding our security safeguards, it is impossible to guarantee 100% security in all circumstances. If you have any questions about security or have reason to believe your interaction with us is no longer secure (for example, you feel the security of any account you might have with us has been compromised), you must immediately notify us of the problem by contacting Rexall at Toll-free: 1-877-378-4100 or by sending an email to privacyofficer@rexall.ca.

Cross-Border Transfer of Personal Information

When you use this Rexall Direct® Site, your Personal Information, other than your Rexall Pharmacy record which shall be maintained in Canada, may be transferred to another country where we or our service providers operate, including the United States. These countries may have different data protection standards and privacy laws from your country of residence, but we will transfer and protect your Personal Information lawfully and in accordance to this Privacy Notice. We will have proper contracts or legal mechanisms in place (such as data protection agreements or other standard contractual clauses) prior to transferring Personal Information to another country.

Changes to this Privacy Notice

We may periodically update this Privacy Notice to describe new features, products, or services we offer and how it may affect our use of Personal Information about you and your controls. Since we may change this Privacy Notice, we recommend you check the current version available from time to time. If we make changes to this notice, we will update the “Effective Date” at the beginning of this notice.

Privacy Office Contact Information

If you have questions or concerns about this Privacy Notice, our information handling practices, or any other aspect of privacy and security of your Personal Information, please contact us at: privacyofficer@rexall.ca

You may also call us Toll-free at 1-877-378-4100

Or write to us at:

Rexall Pharmacy Group ULC
ATTN: Mona Sabharwal, Privacy Officer
2300 Meadowvale Blvd
Mississauga, ON L5N 5P9

For more information on your privacy rights, you may also contact the Federal Privacy Commissioner at:

Office of the Privacy Commissioner of Canada
112 Kent Street
Place de Ville
Tower B, 3rd Floor
Ottawa, Ontario
K1A 1H3

Or your provincial office of the Information and Privacy Commissioner for more information.

If you are a Quebec resident and you have questions or comments about our efforts to protect your personal privacy, or if you require additional information about our privacy practices, please contact us at compliance@mckesson.ca. You may also write to our Privacy Officer at: McKesson Canada Corporation, Attn: Privacy Officer, 2300, Meadowvale Blvd., Mississauga, ON, L5N 5P9.