Security & trust

Security & your data

Last updated: July 14, 2026

1Rx is cloud software for pharmacy delivery management. The data you entrust to us concerns patients, and we treat it accordingly. This page describes the concrete measures we take to protect that information. No platform is entirely free of risk, but we are committed to applying recognized safeguards and improving them continuously.

1. Hosting in Canada

Our infrastructure is hosted in Canada, in Canadian data centres operated by our hosting provider OVH. Health data and patient information are kept in the country. This helps us stay aligned with Canadian privacy requirements.

2. Encryption in transit

Traffic between your browser (or the driver's mobile app) and our servers is encrypted using HTTPS/TLS. Encryption is applied everywhere, managed by our Caddy front-end server, so data in transit is never carried in the clear over the network.

3. Per-pharmacy isolation

1Rx is a multi-tenant platform: each pharmacy has its own isolated data space. One pharmacy's data is not mixed with another's, and a pharmacy's staff can only access their own organization's information. This separation is enforced at the architecture level, not just in the interface.

4. Backups and disaster recovery

Data is continuously replicated to separate storage, which limits the risk of loss in the event of an incident. We maintain a disaster-recovery plan and we have tested data restoration to confirm that data can be brought back into service when needed.

5. Role-based access

Access to data is governed by roles (administrator, pharmacy staff, driver, accountant). Each person sees only what they need for their work.

• Password authentication, with self-service reset (by email and by SMS).
• An optional quick PIN to speed up sign-in on shared counter devices.
• Administrator access is restricted and protected separately.

6. SMS notifications: consent and logging

SMS delivery notifications are sent only with the patient's consent. We comply with Canada's Anti-Spam Legislation (CASL):

• Every SMS sent is logged.
• Unsubscribes (replying STOP) are honoured and recorded in an unsubscribe registry.
• That registry operates fail-closed: when in doubt, the message is not sent.
• No health information (medication name, diagnosis) is ever sent by SMS.

7. What we do with your data

In concrete terms: your data is hosted on servers located in Canada, it is never sold or shared for commercial purposes, and it is only used to provide the service to your pharmacy. Our approach is aligned with PIPEDA and the applicable provincial laws. Alignment level, standard by standard:

• Law 25 (Quebec) — designated and published privacy officer; data hosted in Quebec; incident management.
• Law 5 (Quebec, health information) — access logs and audit trails available to the pharmacy.
• PHIPA (Ontario) — 1Rx acts as the pharmacy's service provider: no use of the data for any purpose other than the service.
• HIA (Alberta) — pre-filled privacy impact assessment (PIA) package provided to pharmacies that find it useful.

8. Your data belongs to you

Your pharmacy's data remains yours. You can request an export of it, and you can request its deletion. When service ends, we delete or anonymize your data on request, subject to legal retention obligations. To exercise these rights, write to support@1rx.ca.

9. Reporting a security issue

If you believe you have found a vulnerability or a security issue, please email us at support@1rx.ca. We take these reports seriously and act on them promptly.