Legal
Last Updated: April 8, 2026
Crown Labs Inc. ("Crown Labs," "we," "us," or "our") is committed to protecting the privacy of every person who uses our Platform. This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and the choices you have.
As a Canadian company registered in British Columbia providing health services, we are subject to:
We do not sell your personal information. We do not share your health information with advertisers.
We collect information in the following categories:
| Category | Examples | Sensitive? |
|---|---|---|
| Identity | Name, email, date of birth | No |
| Health | Symptoms, medications, photos | Yes |
| Financial | Payment method (tokenised) | Yes |
| Technical | IP address, browser, device | No |
| Communications | Messages, consultation notes | Yes |
We use the information we collect for the following purposes, each with a lawful basis under PIPEDA and BC PIPA:
We do not use your health information for advertising or marketing, and we do not sell or rent your personal information to third parties.
We engage trusted third-party service providers to help operate the Platform. These processors access your personal information only to perform services on our behalf and are contractually bound to comply with applicable privacy laws.
We use Supabase as our primary backend database and authentication provider. Supabase stores your account information, health questionnaire data, and consultation records. Data may be stored on servers in Canada or the United States. Where data is stored in the US, it may be subject to US law including laws permitting government access. We have a Data Processing Agreement with Supabase requiring PIPEDA-standard protections.
Credit card and payment data is handled by a PCI-DSS compliant payment processor. We do not store full card numbers on our servers. Only the information necessary to process your transaction is shared with the processor.
Where video consultations are offered, we use a HIPAA/PIPEDA-compatible video platform. Sessions are not recorded without your explicit consent.
Transactional and marketing emails are delivered via a third-party email service provider that processes your email address and engagement data (opens, clicks).
We may use privacy-respecting analytics tools to understand aggregate usage patterns, configured to anonymize or pseudonymize data and to avoid transmitting health information.
Where your practitioner issues a prescription fulfilled by a partner pharmacy, we share the minimum necessary information (name, shipping address, prescription details). Pharmacy partners are subject to their own professional privacy obligations.
A current list of significant sub-processors is available upon written request to legal@crownlabshair.ca.
Our privacy practices are built on PIPEDA's ten fair information principles and BC PIPA's substantially similar requirements:
Some service providers process data in the United States. Data transferred outside Canada may be subject to foreign laws including laws permitting government access. We take contractual steps to require comparable privacy protections, but we encourage you to review this risk before using the Platform.
Subject to applicable law, you have the following rights regarding your personal information:
Request a copy of the personal information we hold about you. We respond within 30 days of a written request.
Request correction of inaccurate or incomplete information. Most account information can be updated directly in your settings.
Withdraw consent to non-essential processing (such as marketing emails) at any time. Withdrawing consent for essential processing (such as sharing health data with your practitioner) may mean we can no longer provide services to you.
Request deletion of your account and personal information. Deletion is subject to legal retention requirements — health records may be retained for a minimum period under provincial law, and financial records for tax purposes. Retained data will not be used for any other purpose.
Request a machine-readable export of your account and health data in a common format (e.g., JSON or CSV) within 30 days.
If you believe your privacy rights have been violated, contact:
To exercise your rights, email legal@crownlabshair.ca with your name, account email, and description of your request. We may verify your identity before processing.
We retain personal information for as long as necessary to fulfil collection purposes, provide services, and comply with legal obligations:
When data is no longer required, it is securely deleted or anonymized.
We implement industry-standard technical and organizational security measures to protect your personal information, including:
In the event of a breach posing a real risk of significant harm, we will notify affected individuals and the applicable privacy commissioner(s) as required by law.
No system is 100% secure. You are responsible for maintaining the confidentiality of your account credentials.
Questions about this Privacy Policy or our privacy practices? Contact our Privacy Officer:
Privacy Officer — Crown Labs Inc.
British Columbia, Canada
Email: legal@crownlabshair.ca
Website: crownlabshair.ca
We commit to responding to privacy inquiries within 10 business days and resolving complaints within 30 days. If we cannot resolve your complaint satisfactorily, you have the right to escalate to the Office of the Information and Privacy Commissioner for BC or the Office of the Privacy Commissioner of Canada.