Privacy Policy

• Account information — the work email and password you use to sign in, your pharmacy’s name and address, and the names/roles of team members you invite.
• Reconciliation records you upload or enter — purchase, dispensing, destruction, and physical-count records for controlled substances. These typically include a drug identification number (DIN), quantity, and date, and may include an invoice or prescription (Rx) reference number where you provide it. We do not require patient names, and we ask that you not upload them.
• Usage and technical data — basic logs (e.g. sign-in events and actions taken in the app) used to operate, secure, and audit the service.

We use your information solely to provide the service: to compute reconciliations, surface variances, generate reports, send the compliance reminders you ask for, secure your account, and provide support. We do not sell your data, and we do not use your reconciliation records for advertising.

Your data is hosted in Canada in our database provider’s Canadian region (ca-central-1). It is encrypted in transit (TLS) and at rest, and access is restricted to your pharmacy’s authorized users through row-level security.

We rely on a small number of providers to run NarcCount:

• Supabase — database, authentication, and storage (Canadian region).
• Vercel — application hosting and delivery.
• Resend — delivery of transactional and compliance-reminder email.
• OpenRouter — the AI provider used for optional discrepancy triage. Only the variance figures needed for that analysis are sent; we do not send patient identifiers.

We retain your reconciliation records for as long as your account is active so your count history stays continuous (recordkeeping periods for controlled substances are typically multi-year). If you close your account, you may request export or deletion of your data, subject to any retention you are legally required to maintain.

Consistent with Canadian privacy law (including PIPEDA), you may request access to, correction of, or deletion of your personal information, and you may withdraw consent subject to the limits of providing the service. To make a request, contact us at the address below.

If we become aware of a breach of security safeguards involving your information that poses a real risk of significant harm, we will notify you and, where required, the appropriate authorities, without undue delay. Our security practices are described on our Security page.

Questions about this policy or your data? Email privacy@narccount.ca.