Privacy Policy

This Privacy Policy (hereinafter the «Policy») sets out how Prélib inc. (hereinafter the «Company» or «Prelib») collects, uses, communicates, retains, and destroys your Personal Information, particularly in order to govern the management of such Personal Information within the Company. To facilitate reading this Policy, we will use the expressions «we» from time to time to refer to the Company. 

We may provide you with additional information regarding the processing of your Personal Information, in some cases, at the time of collection.  

We may also obtain your specific consent in certain cases for the collection, use, disclosure and retention of your Personal Information. 

The Policy applies to Personal Information collected by us in any manner, whether in person, by telephone, by videoconference or via our website. 

By accepting this Policy or by providing us with Personal Information after you have had an opportunity to review this Policy or any supplemental notice, you agree that your Personal Information will be treated in accordance with this Policy and any supplemental notice.  

1. About us 

Here is our identification information: 

2121 Crescent Street, Suite 305
Montréal (Québec) H3G 2C1
(514) 535-1475

You may contact our Privacy Officer, Mr. Maxim Régimbal-Ethier, co-founder of the Company, with any questions or comments you may have regarding the Policy, the manner in which we handle Personal Information, or to exercise your rights regarding your Personal Information. 

You can reach our privacy team in two (2) ways: 

  1. By email to the following email address: [email protected]; 
  2. By mail at the address mentioned above. 

The Society is a self-testing center that offers quick and easy prevention and screening services for sexually transmitted and blood-borne infections. Several health professionals, including physicians, nurses and pharmacists, collaborate to assess, guide and treat patients. These professionals also perform medical follow-ups to ensure ongoing services.  

We train and raise awareness among staff members and the healthcare professionals involved, in particular by offering ad hoc activities and training, and by applying practices and policies in this respect. We ensure that staff and other stakeholders are aware of these policies and practices. We also ensure that they rigorously apply them to their duties and functions. 

All our employees who use Personal Information are bound by confidentiality obligations. Furthermore, they may only have access to Personal Information that is necessary for the performance of their respective duties. Our governance policies and practices provide for sanctions in the event of non-compliance. 

2. Definitions 

 For the purposes of the Policy and any other document arising therefrom or related thereto, the following words and expressions shall have the meanings set forth below, unless otherwise indicated: 

  1. "Privacy incidentPersonal Information" means (i) access to Personal Information that is not authorized by law; (ii) use of Personal Information that is not authorized by law; (iii) disclosure of Personal Information that is not authorized by law; or (iv) loss of Personal Information or any other breach of the security of Personal Information; 
  2. "Personal informationPersonal information" means information that identifies a natural person, such as first name, last name and address, as well as any information that may be contained on the Company's servers as a result of the functionalities offered by the Company. 

3. Treatment and use of Personal Information 

The Company uses a unified technological platform to operate and manage its medical clinic (hereinafter the "Platform"), in particular to collect, host and process Personal Information from patients and offer all its services online.   

We use Personal Information only for the purposes of our activities, namely : 

3.1 Patient File 

We use Personal Information to share patient files between the various parties involved via the Platform. A patient file contains, among other things, the Personal Information required to identify a patient, relevant data from screening tests and an overall picture of sexual habits. This use of Personal Information enables the Company to offer effective medical follow-up. We make Personal Information about each patient available directly on his or her profile via the Platform. Healthcare professionals can also add medical notes to a patient file. Various laboratories also collect Personal Information required to analyze tests and share related results with other stakeholders and patients. 

3.2 Email and text message notification system 

We use the Personal Information we collect to provide you with automated behavioural and screening reminders. We use the Personal Information we collect to automatically schedule appointments (phone calls, videoconferences, in-person appointments, etc.) with healthcare professionals selected by the patient, and to create availability schedules. 

3.3 PrEP Solution (services related to taking the PrEP medication) 

We use the Personal Information required to send reminders, schedule deliveries, program recurrences and follow up on medication.  

3.4 Technical Support 

In the event that you request assistance from the support team, the Personal Information required from you will be used to contact you. 

3.5 Ensure patient identification 

We also use the Personal Information required to identify a user and to ensure the authenticity of this identification.

3.6 Ensuring the quality of our services 

We also reserve the right to use the Personal Information we collect to monitor the quality of our services and improve your experience.  

3.7 Registration via the Platform 

We collect Personal Information when you register on the Platform and enter information, such as by completing online questionnaires regarding your sexual health or eligibility for PrEP services (PrEP Solution). 

We collect your Personal Information only for the purposes of the activities described above. We refer you to the information above regarding the purposes for which we collect your Personal Information. 

3.8 Retention Period of Personal Information 

We will destroy your Personal Information once the purpose for which it was collected or used has been fulfilled, subject to any retention periods provided by law. To this end, we retain the Personal Information required to comply with applicable laws concerning the keeping of medical records, including the Regulation respecting the records, places of practice and cessation of practice of a physician and the Regulation respecting the effects, consulting rooms and other offices of members of the Ordre des infirmières et infirmiers du Québec. 

3.9 List of Personal Information That May Be Collected 

  • Your first and last name 
  • Your e-mail address 
  • Your telephone number 
  • Your home address  
  • Your health insurance number (RAMQ) 
  • Your bank details 
  • Cookies (see article 9 of these terms and conditions for more information) 
  • Medical information required for the provision of services offered by Prelib 

3.10 Access to Personal Information and Sharing of Such Information with Third Parties 

Access to your personal information may be granted to the following individuals and entities only to the extent necessary

The healthcare professionals involved in your case
  • the company's employees to the extent they need to know this information
  • our suppliers and our subcontractors as described in Article 4 of the Policy

Prelib does not share end-user personal information with third parties for marketing or promotional purposes.. When personal information has been expressly consented to by the user, this information may be shared with our subcontractors or external service providers only to the extent necessary to provide the services you are receiving and for the purposes specified in this Policy. 

3.11 Conservation and Storage of Personal Information 

The Personal Information required to offer our services via the Platform is hosted on the servers of Amazon Web Services, Inc. ("AWS"). You may consult the following hyperlinks to learn more about the security measures implemented by AWS: 

  • Amazon RDS Security 
  • Amazon S3 Security 
  • Amazon EKS Security 

3.12 Sharing Information with Third Parties Outside of Quebec 

To provide you with the requested services, we may use suppliers located outside of Quebec.. Within this framework, it may be necessary for us to share your personal information or entrust its management to others, whether for its collection, use, transmission, or retention. 

If we need to share your information with these providers for purposes other than those originally intended, we will seek your consent before taking any action. 

Before sharing your information with suppliers outside of Quebec, we ensure they comply with data protection standards that align with Quebec laws. A fully executed service agreement will always be established with these suppliers.. We will only proceed with this exchange if we have assessed and confirmed that their practices ensure an adequate level of protection. 

4. Suppliers and technological products used 

In the course of its business, the Company retains the IT services of a provider who offers the Platform services to the Company. The Company transfers Personal Information to the Platform in accordance with this Policy. 

Various subcontractors are used to operate the Platform (collectively the "Platform Subcontractors"). 

4.1. Platform service provider 

The Platform is the technological tool used by the Company to make all healthcare services available online. 

4.2. Web development 

The Company retains the services of a web development supplier to develop and support its technological tools. This supplier may have access to Personal Information from time to time in order to provide its services, but may not copy or retain such information. In addition, we use access logging through their services.  

4.3. Amazon Web Services, Inc ("AWS") - data hosting 

The Personal Information required to offer our services via the Platform is hosted on AWS servers, as described above. 

4.4. Block, Inc. ("Square") - payment platform and financial services 

Square's services are used during a transaction at a Prelib clinic (physical terminals), specifically when the patient pays for sample transport fees. These services are secured by, among other things, two-factor authentication. The personal information collected is the last four (4) digits of a credit card, an email address, and a phone number. The personnel involved who can access this information are Prelib nurses, management team members, and external accountants. 

4.5. Stripe, Inc. online payment processing platform 

Stripe's services are retained during online transactions on the Platform for consultation fees or missed appointments. These services are secured by two-factor authentication. Only our employees directly involved in monitoring these transactions have access to them. The Personal Information shared with Stripe is a patient's surname, first name and invoice number. 

4.6. Medical billing agency 

 The Company retains the services of a medical billing agency authorized by the Régie d'assurance-maladie du Québec ("RAMQ") for medical billing purposes. The Personal Information collected is the first and last name, the health insurance number, the first and last name of the attending physician and the billing code managed by RAMQ. Only Platform administrators and the development team have access to this information. In addition, only administrator accounts have access to this section of the Platform. 

4.7. Cloud telephone services 

The Company retains the services of a cloud-based communications service provider. The only data shared with this provider is Personal Information exchanged during calls (voice or videoconference) made online via the Platform. These services are secured by two-factor authentication. Only a few Company employees have access. 

4.8. Communication software 

 The Company retains the services of a communication software provider. The provider's services are used to communicate with Prelib patients via email, directly from the Platform, as well as to communicate information following patient requests. The Personal Information collected includes a patient's last name, first name, residential address, and email address.  

4.9. APlatform Usage Data Analysis 

The Company uses a third-party tool to analyze the use of the Platform. This allows us to improve our services by collecting and analyzing user behavior data. Personal Information shared with this tool include anonymized information about user interactions with the Platform. This data is used solely for analysis and improvement of the user experience. Only members of the technical and management team have access to this information. 

4.10. Marketing Automation and Customer Data Platform (CDP) 

The Company uses a third-party platform to manage and automate marketing communications, as well as to centralize customer data (CDP). This tool allows us to send notifications, reminders, and important communications related to the Platform's services. Additionally, the platform enables data synchronization and access control with other third-party platforms, thereby ensuring secure and centralized data management. 

Personal information shared with this platform includes the patient's name, email address, and information related to their interaction with the Platform. This data is treated confidentially, and only authorized teams have access to it. 

4.11. Microsoft Canada Inc. («Microsoft Office») 

The Company and the parties involved in a case use the Microsoft Office suite, including the TEAMS and Outlook applications, to carry out the Company's general activities. For example, required Personal Information is shared on certain Microsoft Office technological tools during exchanges between various professionals, employees and patients. 

4.12. Transport of Samples to Laboratories 

Many specimens are transported between the Company's clinics and provincial laboratories by carriers or Company employees authorized by the said provincial laboratories. The information used to identify samples is the surname, first name, date of birth, Quebec health insurance number and the list of tests performed by a patient. 

4.13. Facsimile  

The Company may send and receive faxes, in order to obtain laboratory results concerning tests performed on a Prelib patient, among other things. The Company's employees may receive information transferred by fax, namely the first name, last name, Quebec health insurance number, and analysis results. 

4.14. Platform Usage Data Analysis 

As part of its activities, the Company collects certain statistical data using the Plausible.io tool. It should be noted that the information collected through Plausible.io is entirely anonymized and does not identify you. This data is collected automatically by this analytics tool and is useful to the Company for improving its services and the user experience on the Platform. Plausible.io does not use cookies and respects user privacy. 

You can access Plausible.io's privacy policy via the following link: https://plausible.io/privacy

5. Governance, security measures and inherent risks 

We have implemented various measures to take into account the sensitivity of Personal Information and its use. We follow industry security standards to protect the Personal Information we collect and receive.  

In particular, we have put in place appropriate physical, technical, IT and administrative safeguards to protect your personal information against a Privacy Incident. 

5.1. Technical and organizational measures implemented by the Platform provider 

 Amazon's services were chosen to optimize the physical and software security of the infrastructures. 

In addition, the Company and its main supplier, through the Platform, use various tools and measures to protect Personal Information: 

  • Principle of least privilege access; 
  • Use of IP addresses to restrict access to data servers; 
  • Biannual safety audits; 
  • Two-factor authentication for our employees; 
  • Application error logging, monitoring and management; 
  • Web application firewall; 
  • Encrypted database: AES-256 encryption of stored data. 

5.2. Security when data is exchanged between different parties and suppliers 

Personal information is transmitted using the protocol commonly known as HTTPS (HyperText Transfer Protocol Secure), which allows you to verify the identity of the website you are accessing by means of a reliable third-party authentication certificate. 

Despite these measures, given the risks inherent in the use of computer systems, we cannot ensure or guarantee the security and confidentiality of any Personal Information you transmit or provide to us. You do so at your own risk. If you have reason to believe that Personal Information has been compromised, please contact us as indicated in Section 1 of the Policy. 

6. Your consent 

 Your consent to the collection, use or disclosure of your Personal Information must be manifest, free and informed. It must be given for the specific purposes and objectives identified in this Policy.  

By using the Prelib website, and thus the Platform, you consent to your Personal Information being collected, used, disclosed, and retained in accordance with this policy.   

If you do not consent, please stop using the website. Except where otherwise provided by law, you may withdraw your consent at any time upon reasonable notice.  

Please note that if you choose to withdraw your consent to the collection, use or disclosure of your Personal Information, certain website features or services offered by the Company may no longer be available to you. 

7. Disclosure of Personal Information for Public Safety or Law Enforcement Purposes 

7.1. If there is a serious risk of death or serious injury 

We may disclose Personal Information in our possession to protect an individual or group of individuals where there is reasonable cause to believe that there is a serious risk of death or serious bodily harm to that individual or group as a result of a disappearance or an act of violence, including an attempted suicide, and the nature of the threat inspires a sense of urgency.  

The information may then be communicated to the person or persons exposed to the risk, to their representative or to any person likely to be able to help them. Only the information required for the purpose of the communication will be released.  

7.2. Law enforcement agencies 

We may also communicate information to the Director of Criminal and Penal Prosecutions or to a person or group responsible for preventing, detecting or repressing crime or legal offences when the information is necessary for the purposes of a prosecution for an offence under a law applicable in Québec.  

Finally, we may communicate information to a police force when it is necessary for the planning or execution of an intervention adapted to the characteristics of a person or situation, in either of the following cases: 1° the police force intervenes, at our request, to provide us with help or support as part of the services we provide to a person; 2° we act in concert or partnership with the police force as part of mixed psychosocial and police intervention practices. 

8. Your rights with respect to your Personal Information 

The law gives you various rights with respect to your Personal Information. In particular, you have the following rights: 

  • Access You have the right to ask whether we hold any Personal Information about you and, if so, to request access to that Personal Information. 
  • PortabilityYou have the right to request access to your Personal Information in a structured technological format and to require that it be communicated to a third party, with certain exceptions. 
  • Rectification The right to request rectification of any incomplete or inaccurate Personal Information held by us. 
  • Withdrawal of consentYou have the right to withdraw your consent to the disclosure or use of your Personal Information. 
  • Restricting or refusing accessYou have the right to request that a specific stakeholder or stakeholder category not have access to one or more pieces of information that you have identified. 
  • ComplaintYou have the right to file a complaint with our Privacy Officer as identified in Section 1 of the Policy in connection with this Policy, or to file a complaint with the Commission de l'accès à l'information du Québec if you believe that a breach of privacy legislation has occurred. To file a complaint with the Commission d'accès à l'information (Québec), please use the appropriate form available at the following address: For citizens | Commission d'accès à l'information du Québec (gouv.qc.ca)
  • PortabilityYou have the right to request that your Personal Information be communicated to you, or that it be transferred to another organization in a structured and commonly used technological format. 

To exercise any of these rights, please contact our Privacy Officer as indicated in Section 1 of the Policy. 

9. Use of browser cookies 

The cookies we use may include the following types of files: 

  • Essential witnessesCookies are necessary for the operation and navigation of our website. It is not possible to deactivate them. Cookies may be used to ensure the smooth operation of our website, to improve its security or to comply with our legal obligations. 
  • Preference indicatorsCookies are used to improve and personalize the functionalities of our website and the content offered to you based on your browsing habits and previous choices. If you disable cookies, you may not be able to navigate certain areas of the website or take advantage of certain features. In addition, our website will not be able to determine your preferences, such as language preference, from session to session.  

When you access our website, a banner may appear to inform you about our use of cookies. You will be able to disable certain types of cookies at that time, but you will not be able to disable essential cookies. You can change your cookie preferences at any time by configuring your device's settings or by re-displaying the consent banner «Cookie Settings». 

10. Third-party sites (external sites) 

This Policy does not apply to third-party websites, pages or applications that may be accessed through our services. We are not responsible for such third-party services.  

If you follow such links, these third-party sites or services will likely have their own privacy policies that you should review before submitting your Personal Information. 

11. Fully automated suggestions 

When a patient completes an online medical questionnaire via the Platform portal, sample tests are automatically suggested according to the answers obtained. Of course, the patient can accept or refuse the suggested tests. This approach offers patients fast, user-friendly services. It should be noted that a patient's attending physician always has a say in which tests are recommended. Indeed, doctors always analyze each situation and use their professional judgment to determine whether the suggested tests are appropriate. They can always decide not to follow the proposed recommendations, or to suggest new tests.  

What's more, following a sampling appointment, we automatically send the patient an invitation to book a telephone appointment using the Personal Information in his or her file.  

12. Policy update 

We may, from time to time, amend the Policy to reflect changes in our business processes or in the law.