Privacy Policy

Orentia operates the Service. For privacy inquiries, contact us at support@orentia.ca.

Effective date: July 12, 2026

Depending on how you use the Service, we may collect:

• Account information: name, email address, password (stored in hashed form by our authentication provider), and role (owner, manager, or employee).
• Workforce data: schedules, shifts, availability, time-off requests, team assignments, and related operational notes entered by your organization.
• Organization settings: business name, timezone, notification preferences, and workspace configuration.
• Usage and technical data: device/browser type, IP address, pages visited, error reports, and performance metrics collected to keep the Service reliable.
• Communications: messages you send to support and system emails related to your account.

We use personal information to:

• Provide, secure, and maintain the Service (authentication, scheduling, notifications).
• Send transactional emails such as invitations, schedule updates, and account notices.
• Respond to support requests and improve product quality.
• Detect, investigate, and prevent abuse, fraud, or security incidents.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell personal information. We do not use workforce scheduling data for third-party advertising.

Production data for the Canada pilot is hosted in Canada (ca-central-1) through our infrastructure providers. We design the Service so workforce scheduling data for Canadian organizations remains in Canada for storage and primary processing, subject to limited technical operations (such as encrypted backups or support access) described in our subprocessors list below.

Orentia is a staff scheduling and workforce operations tool. It is designed for shift planning, availability, and time-off among pharmacy and retail teams—not for storing or processing patient records, prescriptions, drug profiles, clinical notes, or other personal health information (PHI) about customers or patients.

• Your organization must not enter patient names, prescription numbers, health card numbers, diagnosis details, or other PHI into Orentia.
• If you operate in Ontario, PHIPA may apply to patient records in your pharmacy systems. Orentia is outside that patient-record scope when used only for employee scheduling.
• You remain responsible for policies that keep staff scheduling separate from patient-facing systems and for training staff not to paste PHI into schedule notes or messages.

We send emails that are reasonably expected in connection with your account, including invitations, schedule changes, and security notices. These are transactional or relationship messages under Canada's Anti-Spam Legislation (CASL).

You can manage non-essential notification categories in Settings. To stop receiving account-related emails entirely, you must close or deactivate your account—some messages are required to operate the Service securely.

Marketing emails (if we send them in the future) will include a clear unsubscribe mechanism and identify Orentia as the sender.

We use cookies and browser storage for sign-in sessions, preferences, and error monitoring. See our Cookie Notice for details and choices.

We rely on trusted providers to run the Service, including:

• Supabase — authentication and database (Canada region).
• Vercel — application hosting and delivery.
• Sentry — error and performance monitoring.
• Resend (or equivalent) — transactional email delivery.

These providers process data on our instructions and under contractual safeguards. A current list is available on request at support@orentia.ca.

We retain personal information while your organization uses the Service and for a reasonable period afterward to resolve disputes, meet legal requirements, and maintain backups. Organizations may request deletion of workspace data subject to technical and legal limits.

Under PIPEDA and applicable law, you may request to:

• Access personal information we hold about you.
• Correct inaccurate information.
• Withdraw consent where processing is consent-based (some processing is required to provide the Service).
• Challenge our compliance with applicable privacy principles.

Contact support@orentia.ca. We will respond within a reasonable time. You may also contact the Office of the Privacy Commissioner of Canada if concerns remain unresolved.

We use administrative, technical, and organizational measures appropriate to the sensitivity of workforce data, including encryption in transit, access controls, and row-level security in our database. No method of transmission or storage is 100% secure.

If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and regulators as required by Canadian law.

The Service is intended for workforce use by adults (typically employees aged 16 or older). We do not knowingly collect information from children under 13.

We may update this policy as the Service evolves. Material changes will be posted on this page with an updated "Last updated" date. Continued use after changes constitutes acceptance of the revised policy where permitted by law.

Privacy questions: support@orentia.ca

Governing jurisdiction for privacy disputes: Ontario, Canada.