Please read our privacy policy carefully before using our platform, website or services.
Empego Technologies Inc. (“Empego“) has developed a platform (the “Platform“) that enables users to initiate a consultation with a pharmacist, either on-site or remotely, and allows users to answer, before the consultation, questions needed to prepare for the consultation. Empego processes patient information on behalf of pharmacies, which remain responsible for it.
At Empego, we are committed to protecting the privacy, confidentiality and security of our users, customers, employees, and partners. This privacy policy (the “Policy”) sets out how we collect, use, disclose, store, manage and protect the Personal Information (as defined below) we collect. By providing us with your Personal Information via our website, Platform, email or telephone, you consent to the collection and processing of your Personal Information in accordance with this Policy. You also authorize Empego, its third parties, partners and service providers to process your Personal Information for the purposes set out below. If you do not agree with this Policy, please do not use our services or provide us with your Personal Information.
All employees and third parties working with Empego are required to comply with the commitments described in this Policy. We are committed to respecting your fundamental right to privacy and all applicable data protection laws and regulations.
Data and Personal Information that may be collected
When you use the Platform, certain personally identifiable information (“Personal Information”) may be collected, which includes:
Demographic data (“Demographic Data”) may also be collected, including:
Furthermore, certain information concerning the consultation (“Consultation Information”) may be collected, such as:
Lastly, usage data (“Software Usage Data”) may be collected from the website and Platform, which includes:
Use and sharing of Personal Information
Personal Information, Demographic Data and Consultation Information are transmitted to the pharmacist through the Platform and used in connection with the consultation. If the pharmacist deems it relevant to their duties, they may consult this information. To learn more about how your pharmacy handles your Personal Information, please refer to its privacy policy. Your Personal Information will never be disclosed to a third party, except where a pharmacist, governed by professional confidentiality as per their Code of Ethics, may need to consult it, or when its communication is necessary for the provision of a pharmaceutical service.
As a general rule, Empego employees do not have access to information that could identify you. Personal information is encrypted, and the data accessible to employees as part of their regular duties is de-identified to prevent your direct identification.
An authorized employee may access personal information in limited circumstances, including in response to a court order, a major technical issue affecting the Platform, or to respond to a request to exercise your rights (access, correction, withdrawal of consent). The employee would first need to submit a formal request and obtain formal authorization to access any such data. This request must contain reasonable grounds justifying the need for such access. Reasonable grounds may include the need to diagnose, repair or maintain computer systems, to resolve technical problems, or other legitimate reasons related to data management.
Once the request has been submitted, it will be reviewed by the appropriate parties, usually Empego’s Data Protection Officer. This person is responsible for deciding whether the grounds presented justify giving access to the data. The decision must consider the need to safeguard the security, confidentiality, and integrity of the data.
If the request is approved, the authorized employee will receive limited, temporary access to the data, specifically for the purpose in question. The access granted must strictly comply with the conditions set out in the approved request. Any unauthorized access or misuse of data may have legal consequences.
In short, an authorized employee may access protected data after submitting a reasoned request and obtaining formal authorization. However, such access must be limited to a specific purpose and be in accordance with the rules established to protect data security and confidentiality.
Consultation Information and Demographic Data may be used to produce aggregated and anonymized statistics that do not allow any individual to be identified. Only these statistics may be shared with researchers or partners, in compliance with applicable laws and regulations. To guarantee the protection of our users’ privacy, Consultation Information and Demographic Data are processed so that they do not allow the identification of the person concerned.
This data may be used, without limitation, for studies, research, or statistical analysis, as well as for demographic, behavioural, and population trend analyses in the context of pilot projects. It may also be used for other legitimate purposes, including improving our products and services, strategic decision-making, research, technological development, and pharmaceutical practice.
Software Usage Data is collected for statistical purposes. This data is primarily used to examine traffic, observe and analyze how users interact with the Platform, monitor and analyze statistics, and obtain an accurate representation for the technical administration of the Platform. The aim is to increase functionality and user-friendliness, and to better adapt our Platform to users’ needs. This type of data will not allow you to be identified.
Empego uses anonymized Software Usage Data and Consultation Information for research purposes, to analyze population trends, as part of commercial partnerships, and to improve the Platform. Rest assured that this data cannot be used to identify you. Only aggregated and anonymized statistics—which do not allow for the identification of any individual—may be shared with researchers or business partners.
If you have any questions or concerns about our use of anonymized or de-identified data, please do not hesitate to contact us at security@empego.ca.
We reserve the right to disclose Personal Information and any other data if we are required to do so under any applicable law or if we believe in good faith that such disclosure is necessary to comply with such applicable laws.
Communication to Third Parties for the Provision of Pharmaceutical Services
Personal Information, Demographic Data and Consultation Information may be communicated to a third party when such communication is necessary for the provision of a pharmaceutical service. Only the information necessary for this purpose is communicated. Third parties who receive this information are required to keep it confidential and to use it only for the purposes for which it was communicated to them, in accordance with applicable laws.
Period of Retention
We keep your Personal Information for the duration of the activity for which it was collected, and for an additional period of 10 years thereafter to comply with our legal and regulatory obligations. Once this retention period has expired and the Personal Information is no longer required, we securely destroy it or anonymize it. Empego will store anonymized information indefinitely on encrypted and secure servers located in Quebec. If our relationship with your pharmacy ends, your information will be deleted from the Platform within 60 days of the contract’s termination; encrypted backup copies will be automatically deleted within one year at the latest.
Rights of Platform users (patients)
As users of the Platform, you have certain rights regarding your Personal Information, including the right of access, rectification and withdrawal of consent to processing. Empego employees are authorized to access your Personal Information for these purposes. The withdrawal of consent involves the destruction or complete anonymization of your data. It may therefore affect our ability, as well as your pharmacy’s ability, to provide you with certain services. We will inform you transparently of the potential consequences at the time of withdrawal of consent.
We may request additional information to verify the identity of any person who requests access to, or attempts to make changes to, a user’s Personal Information on the Platform. This information may include specific data related to the account on the Platform, as well as official identification. This measure is intended to prevent unauthorized access to a user’s Personal Information.
Should our relationship with your pharmacy come to an end, your Personal Information and Consultation Information will be anonymized.
You may speak to your pharmacy’s staff to exercise your rights or to obtain a copy of the Consultation Information on the Platform. The pharmacy staff must then verify the identity of the individual making any such request.
Rights of Pharmacy Staff
We collect certain Personal Information from pharmacy staff to provide the Platform services. Pharmacy staff have certain rights regarding their Personal Information, including the right of access, rectification, and withdrawal of consent.
Any request for access, rectification, or removal from Empego’s client list must be made in writing by a person able to prove their identity to the e-mail address security@empego.ca.
We may request additional information to verify the identity of any person who requests access to, or attempts to make changes to, Personal Information. This information may include specific account or transaction data, as well as official identification. This is to prevent unauthorized access to an individual’s personal data.
Data Location and Security
We take all necessary measures to protect any Personal Information from unauthorized disclosure or access, alteration, accidental loss, destruction, or any other unlawful form of processing of Personal Information in our possession.
Personal Information in our possession is encrypted and stored on secure, encrypted servers located in Quebec. We use all appropriate technical, physical and organizational security measures to guarantee the confidentiality and integrity of the data collected.
For certain AI features, Empego uses models hosted by third-party cloud service providers. The data is stored and processed in Montreal; however, if capacity is not available there, it may also be processed elsewhere in the European zone, where the legal framework (GDPR) provides a recognized level of protection; in such cases, only de-identified information may be transferred outside of Quebec and Canada. Prior to such a transfer, Empego conducts a privacy impact assessment and governs the transfer through a written agreement that guarantees adequate protection of the information.
Access to Demographic Data, Consultation Information and Software Usage Data is restricted to Empego’s employees, representatives and service providers who are authorized to access such information. These individuals may access only the information necessary to perform their duties. Subject to the exceptions described in this Policy, Personal Information is not accessible to Empego’s employees, representatives and service providers. Empego ensures that employees, representatives, and service providers authorized to consult Personal Information are subject to confidentiality obligations and guidelines, with penalties for breaches.
While we take every measure to protect your information, it should be noted that Internet transmission methods and electronic storage methods are not foolproof. Although risks are minimized, we cannot ensure or warrant the security of any information you send or provide to us, and you do so at your own risk and peril. Nor can we guarantee that such information will not be accessed, obtained, disclosed, modified or destroyed as a result of a breach of our physical, technical or administrative safeguards.
Personal Information Sharing with Service Providers
Empego conducts business with third-party suppliers and partners who provide, among other things, development, hosting and maintenance services for the Platform. These third parties may access or process de-identified Personal Information in the course of providing services to us. We limit access to Personal Information to that which is reasonably necessary to enable them to perform their services and carry out their mandate. Our contracts with these service providers require them to maintain the confidentiality of Personal Information.
Use of the Platform by a Third Party or a Minor
When the Platform is used by a third party on behalf of an individual, pharmacy personnel must ensure that they obtain the individual’s consent to the collection of Personal Information and to the third party’s communication of their Personal Information. When the Platform is used for the benefit of a minor under the age of fourteen (14), consent to the collection and communication of the minor’s personal information must be provided by the person who has parental authority or by the minor’s guardian, in accordance with applicable laws.
We undertake to protect the Personal Information of minors and to collect and use it solely for the purposes of using the Platform and for their own benefit, in compliance with all applicable data protection laws and regulations.
Use of Artificial Intelligence and Large Language Models (LLMs)
Empego may use artificial intelligence (“AI”) technologies, including large language models (“LLMs”), to support certain functionalities of the Platform, such as consultation preparation and improving our services.
Nature of Processing
LLMs are used as assistive tools to help process, organize, summarize, or prioritize the information provided, in order to support healthcare professionals. They do not make any clinical decisions on their own, and no decision regarding you is based solely on automated processing. These tools are not designed or intended to be used as software as a medical device (SaMD): they are clinical decision-support tools, and the healthcare professional can review the information on which each result is based in order to independently reach their own decision.
Data Minimization and de-identification
Personal Information is removed, masked, or de-identified prior to processing. Only the minimum data necessary for the intended purpose is used. Personal information and health information processed as part of our services are not used to train artificial intelligence models.
Third-Party LLM Providers
When third-party providers (e.g., Anthropic) are used, they are bound to:
Data Retention
Personal Information processed through AI systems is not retained longer than necessary. Data submitted to AI models is subject to a “zero data retention” policy: it is neither retained by providers nor used to train their models, and the configuration of our production accounts prohibits its retention.
Data Location and Transfers
In certain limited cases, de-identified data may be processed outside of Quebec and Canada, particularly in the European zone, where the legal framework (GDPR) provides a recognized level of protection, subject to appropriate safeguards.
Security Measures
Appropriate technical and organizational measures are implemented, including encryption in transit and at rest, access controls, monitoring, and vendor risk assessments.
Human Oversight
All AI-generated outputs are subject to review by qualified professionals. AI does not replace professional judgment.
Privacy Impact Assessments
Empego conducts privacy impact assessments, including assessments specific to artificial intelligence systems, to identify and mitigate risks and ensure compliance with applicable laws.
Transparency and User Rights
The use of AI does not affect users’ rights regarding their Personal Information. For any questions, users may contact: security@empego.ca or visit our Trust Center at https://trust.empego.ca/.
Cookie Policy
When you use our website or the Platform, we may use cookies, which are small files stored on your device that allow our server to recognize your browser from one visit to the next.
We use Software Usage Data, such as Cookies, to tailor our website and Platform to your preferences. It also allows us to compile statistics about the consultation and use of the Platform, so that we can improve your experience.
Application of the Policy
We reserve the right to update this Policy periodically to reflect changes in our privacy practices and to comply with the governing laws. All changes will be posted on our website, and we encourage you to review them regularly.
We will notify you of any significant changes to the Policy. If a change involves new purposes for using your personal information, we will ask for your consent again before using your information for those new purposes.
By using or accessing the Platform, you agree to the terms of this Policy and authorize the use of your Personal Information, Demographic Data, Consultation Information and Software Usage Data in accordance with the provisions described above. This Policy should be read in conjunction with the Terms of Use. You should not use the Platform unless you fully understand and accept the Terms of Use and the Policy.
If you have any questions or concerns about this Policy or our privacy practices, please contact Empego’s Data Privacy Officer, Eric Poitras, at security@empego.ca.
This Policy has been updated on October 13, 2026.
