Your information, handled with care

Overview

Vytals helps you explore your own health, build a panel of private lab tests, and have a licensed BC prescriber review your request. To do that, we handle some personal information and, at points in the journey, health information. We aim to collect only what is needed, keep it in Canada, protect it well, and give you clear control over it.

We treat your health information as sensitive by default. We do not sell your information. We do not share it except to deliver the service you asked for (for example, sending your request to a prescriber for review) or where the law requires it.

What we collect

We aim for the minimum needed to run the service safely. In practice, that means:

• Account details: the information needed to create and secure your account, such as your name, contact details, and sign-in credentials.
• The tests you select: the panel you build, your saved progress, and notes tied to your choices.
• Information a prescriber needs to authorize: the health details a licensed BC prescriber needs to decide whether a requisition is appropriate for you. This can include date of birth, sex assigned at birth where a test depends on it, relevant history, and current medications.

We collect only what a given step requires. If a test or step does not need a piece of information, we do not ask for it.

Why we collect it

Each type of information has a clear purpose:

• Account details let you save a panel, return to it, and keep your account secure.
• The tests you select let us show your panel, prepare your request, and pass it to a prescriber for review.
• The information a prescriber needs lets an independent, licensed BC prescriber make a safe clinical decision about whether to authorize each requisition. Authorization is a clinical decision and is not guaranteed for every test.

We do not use your health information for advertising, and we do not build marketing profiles from it.

Where your data lives

Your personal and health information is stored and processed in Canada. We handle it in a manner intended to comply with British Columbia's Personal Information Protection Act (PIPA) and the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

• Information is encrypted in transit and at rest.
• Accounts use strong authentication, and access for clinician or pharmacist accounts is protected by strong authentication as well.
• Access to health information is limited to the people who need it to deliver your care, and that access is logged.

Analytics

We use privacy-respecting analytics to understand how the site is used and to improve it. This is disclosed here rather than hidden. We never send personal information or health information to analytics. In particular, we do not send your account details, the specific tests you select, or any information tied to your identity to any analytics tool.

How we handle results

You should never be left with a worrying number and no path forward. When results return, we follow a real workflow so that abnormal or urgent findings are seen by a person and acted on.

• Return: results come back securely to your account from the contracted laboratory.
• Review: a Carebridge pharmacist can review your results and help you understand what they mean in plain language.
• Flag: results that fall outside expected ranges are flagged for attention rather than left for you to interpret alone.
• Escalate: abnormal or urgent findings are escalated. A pharmacist and, where a clinical decision is needed, a prescriber are brought in, with real follow-up and a clear next step.

Pharmacists support you in understanding results. A prescriber makes clinical decisions. Where treatment follows, Carebridge can help, and you are free to use any pharmacy you choose. For a medical emergency, call 911 or go to your nearest emergency department.

Your choices

You have meaningful control over your information:

• Access: you can ask to see the personal information we hold about you.
• Correction: you can ask us to correct information that is wrong or out of date.
• Deletion: you can ask us to delete your information, subject to any records we are legally required to keep (for example, clinical or dispensing records that must be retained for a set period).
• Consent and withdrawal: you consent to how we handle your information when you create an account and use the service, and you can withdraw that consent. Withdrawing consent may mean we can no longer provide some or all of the service.

To make any of these requests, contact us using the details below.

Data breach commitment

We work to prevent unauthorized access to your information. If a breach happens that puts your personal or health information at real risk of harm, we commit to acting quickly: to contain the issue, to notify affected people in plain language about what happened and what to do, and to notify the appropriate authorities where required. We will tell you what we know, what we are doing about it, and what steps you can take.

Contact

Questions about your privacy, or a request to access, correct, or delete your information, can go to Carebridge Pharmacy, which coordinates the Vytals service.

Consent summary

This is a short, standalone summary of what a person agrees to when creating an account. The full policy above provides the detail.