OperHand Privacy Policy
Version 2026-09-02 · Effective on publication
Who this covers
This policy explains how OperHand handles personal information about pharmacies, their staff, and visitors to our website the information OperHand collects for its own business. It is governed by the federal Personal Information Protection and Electronic Documents Act (PIPEDA).
Patient information is different. When a pharmacy uses OperHand, its patients' personal health information is in the custody and control of the pharmacy as health information custodian under Ontario's Personal Health Information Protection Act, 2004. OperHand handles it only as the pharmacy's agent, on the pharmacy's instructions, and never for its own purposes. Patients should read the Patient Notice shown on the signing page and direct any request about their records to their pharmacy.
What we collect and why
| Information | When | Why |
|---|---|---|
| Name, business email, phone, pharmacy name and address, role | You request a trial, sign up, or contact us | To set up and run your account, communicate with you, and bill you |
| Login credentials (hashed), multi-factor settings, session data | You use the application | Security and account access |
| Payment card details | You subscribe | Handled by our payment provider; we do not store full card numbers |
| IP address, browser and device type, pages visited, timestamps | You visit our website or use the application, including the trial request form | Security, fraud prevention, diagnosing problems, understanding use |
| Service usage events (features used, errors, performance) | You use the application | Operating, securing and improving the Service, never including patient information |
| Support messages | You contact support | Resolving your request. Please do not include patient details |
Our website and Service are intended for pharmacy businesses and are not directed at children.
Marketing emails
If you ask to receive product updates, or we contact you about OperHand as a pharmacy business, you can unsubscribe at any time using the link in any such email, and we honour opt-outs promptly. Messages to account holders about their account, billing, security or the Service are not marketing messages.
Cookies and analytics
The application uses strictly necessary cookies for login and security. The website may use privacy-respecting analytics that do not build individual profiles; we will tell you which analytics provider we use on request. We do not use third-party advertising cookies.
Where information is stored
OperHand stores and processes information, including personal health information handled on the Pharmacy's behalf, on servers located in the United States operated by our service providers. While information is in the United States, it is subject to the laws of that country, including lawful access by United States courts, law-enforcement and government authorities. OperHand protects this information through application-level encryption of patient fields before storage, strict access controls, audit logging, and written data-protection agreements with each provider. The Pharmacy remains the health information custodian of its patients' records at all times.
Who we share it with
Only our service providers, each bound by a written data-protection agreement, whose current list we will provide on request; our professional advisors (lawyers, accountants, insurers) under confidentiality; a purchaser of our business, on notice to you; and authorities where the law requires, in which case we disclose only what is required and, unless prohibited, tell you.
How long we keep it
Account and billing information: for the life of the account and as long afterwards as tax and legal obligations require. Website and trial-request data: no longer than needed to respond and secure the site.
Security
We protect information with encryption, role-based access, multi-factor authentication on OperHand's own administrative accounts and available to pharmacy accounts, and an append-only audit log. Our Security page sets out the controls in detail.
Changes to this page
We post changes here with a new version date. Changes affecting pharmacies' obligations or the companies that handle patient information are notified to pharmacies in advance under the Customer Agreement.
Your rights
You may ask to see, correct, or delete the personal information we hold about you, or withdraw consent to uses that are not necessary to provide the Service, by contacting us at the address below. We respond within 30 days. You may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca).
Contact
Privacy Officer (accountable person under PIPEDA): the director of Heaven Surge Inc.
Privacy contact and legal notices:
privacy@operhand.ca
General enquiries and support:
info@operhand.ca
Heaven Surge Inc., Ontario, Canada. A mailing address is available on request.
OperHand is a business name of Heaven Surge Inc., Ontario, Canada.