About this policy
Kiwi Pharmacy & Wellness operates the Kiwi Prescriber Portal at kiwiportal.ca. This policy covers people who request access, sign in or use the portal, and professional contacts managed through its administrative tools. It is separate from privacy notices for pharmacy care, medical services, shopping and other Kiwi services.
The portal is not a patient chart or a prescription-transmission service. Its preparation workflow is designed to keep patient-identifying fields on the user's device.
Information and purposes
Access applications and professional profiles include names, professional email addresses, credentials, licence numbers, province, specialty where supplied, clinic details and review decisions. Kiwi uses them to verify eligibility, administer accounts and manage professional relationships. Professional details may be checked against licensing registers or other appropriate sources.
Account identifiers, roles, approval status, authentication and session information, IP addresses or derived security identifiers, browser information and security timestamps support sign-in, account recovery, access control and abuse prevention.
Preparation records include the prescriber and clinic, preparation reference, catalogue product and strength, province, time and recorded rule-check results. They support preparation history and operational review; they do not establish prescription receipt or dispensing.
Administrative information includes support correspondence, professional relationship notes, tasks, campaign preferences and delivery records, and staff activity. We also record the account reference, terms version, a content fingerprint and server timestamp when you accept the terms. Information comes from you, authorized clinic or Kiwi staff, appropriate professional sources and the providers involved in the service.
Google and Microsoft sign-in
Social sign-in is optional and may depend on availability and your account settings. Google or Microsoft supplies basic identity information such as an account identifier, email and verification information, name and profile details where available. Supabase processes this information to authenticate you and connect the sign-in to an authorized portal account.
These sign-in flows request identity permissions, not access to your mailbox messages, calendar, contacts or Drive files. Kiwi does not receive your Google or Microsoft password. Provider identity tokens may be used briefly to verify the sign-in; the portal session uses Supabase authentication tokens.
We use sign-in information for authentication, account administration, security and support, not targeted advertising, sale or training general-purpose AI models. You can disable an enabled social-sign-in option in Account security. Removing access in your provider account does not itself delete portal records or necessarily terminate an existing portal session. Contact Kiwi for account closure.
Optional newsletters and updates
A separate, optional checkbox lets you request Kiwi Pharmacy & Wellness newsletters, practical tips, and product and portal updates at your account email address. Leaving it unchecked does not grant marketing consent. Accepting portal terms, obtaining access or being in the professional directory does not subscribe you.
We retain the email address, account reference, choice, date, source and wording of the consent or withdrawal to manage your preference and demonstrate what you requested. Consent does not automatically transfer to a new email address. You can withdraw at any time in Email preferences or by emailing info@kiwihealth.ca. Withdrawal does not prevent essential account and security messages. Marketing messages must identify Kiwi and provide an unsubscribe method.
Patient fields, signatures and local files
In the normal preparation workflow, the PDF is generated in your browser. Patient name, date of birth, health number and signature fields are not submitted to the portal application server. Your clinic must review, securely store and transmit the resulting form through its approved workflow.
Do not enter patient information into access requests, CRM notes, tasks, support messages, campaign files or other administrative fields. If you suspect information went to the wrong place, contact Kiwi without repeating it.
If you choose to save a signature, it is stored in that browser profile until removed or site storage is cleared. The portal's sign-out control attempts to clear saved signatures, but downloaded files and copies in device backups are outside that control. Use the signature removal control and check shared devices yourself.
Cookies and service providers
Cookies and browser storage support authentication, security and interface preferences. Blocking essential cookies can prevent sign-in. An optional saved signature is separate from the server-side account record.
Providers include Supabase for authentication and database services, Vercel for hosting, Resend for account email and Cloudflare for domain and DNS services. Google and Microsoft handle their own sign-in services. Where professional outreach is enabled, SRFax may process patient-free clinic fax communications. Providers receive the information necessary for their service.
Do not assume all processing takes place in Canada. Canadian application or database regions do not mean every authentication, email, support or infrastructure operation stays in Canada. Providers or their subprocessors may process information outside Canada, including in the United States, where it may be subject to foreign law.
Access is limited by role and operational need. Kiwi may disclose information with your direction or where permitted or required by law. We do not sell portal personal information or use it for targeted advertising. Agreeing to the terms does not sign you up for marketing.
Protection and retention
The portal uses authentication, role-based access, encrypted connections and activity records to help protect information. These measures do not guarantee that an internet service or user device is completely secure.
Retention depends on the information's purpose, account status, security and accountability needs, and applicable legal obligations. Account closure or a deletion request requires review; records are not all erased immediately or on one fixed automatic schedule.
Information used to make a decision directly affecting an individual must be retained for at least one year after its use under BC PIPA. Information must be destroyed or de-identified when its purpose and legal or business need have ended. An unresolved access request, complaint, investigation, dispute or other legal obligation can require relevant records to be preserved longer.
Terms-acceptance evidence is kept to establish which agreement was accepted and when, separately from ordinary activity history. Provider logs and recovery copies have separate retention arrangements, and deleted active records may remain in backups until those copies expire. Downloaded forms and local device backups remain the responsibility of the clinic or device owner. Contact the privacy contact for the retention circumstances of a particular record.
Access, correction, closure and complaints
You may request access to or correction of your personal information, ask about deletion or account closure, withdraw consent where applicable, or raise a privacy concern. Legal exceptions and retention duties can limit deletion. We may verify identity and explain the effect of a request on portal access.
Email info@kiwihealth.ca addressed to Privacy contact, Kiwi Pharmacy & Wellness. Describe the type of request and the portal account involved without sending patient information, identification documents, passwords or security codes. We will arrange an appropriate verification or secure communication method if needed.
The privacy contact reviews the request, coordinates a response under applicable legal time limits and explains applicable exceptions or next steps. If a concern is not resolved, you may contact the Office of the Information and Privacy Commissioner for British Columbia at oipc.bc.ca.
Updates
The revision date identifies this policy. If practices change, we will update the notice and provide additional notice or seek consent where required. A policy update is not retroactive consent to a new or unrelated use.