Privacy Impact Assessment — [Pharmacy Name]

Implementation of the 1Rx delivery management platform

Prepared following the Alberta Health "Completing a Privacy Impact
Assessment" annotated template (v1.1, 2023) for community-based custodians
under the Health Information Act (HIA), s. 64.

Cover Letter

To be printed on pharmacy letterhead and SIGNED BY THE CUSTODIAN

(this signature cannot be delegated). Verify the current Commissioner's

name at oipc.ab.ca before sending.

[DATE]

Information and Privacy Commissioner
Suite 410, 9925-109 Street NW
Edmonton, AB T5K 2J8

Dear Commissioner:

Re: Privacy Impact Assessment for the implementation of the 1Rx delivery
management platform — [CUSTODIAN NAME]

Please find attached my PIA regarding the implementation of 1Rx, a
Canadian pharmacy delivery management platform (route planning, delivery
driver mobile application, and patient notifications by SMS and telephone).
1Rx acts as an information manager on our behalf; it does not hold our
dispensing records. [Mention here any existing OIPC file number for a
previously reviewed PIA, e.g., your pharmacy management system PIA.]

The attached PIA is submitted for review and comment. Should there be
questions about any aspect of the submission, please contact
[primary contact name and role] for clarification.

Yours truly,

[Custodian name, signature]

Cover Page

Section A: Project Summary

(Pre-filled by 1Rx — adjust the bracketed parts to your practice.)

[Pharmacy Name] provides prescription delivery to patients at home. We are
implementing 1Rx, a Canadian software platform that manages our
delivery operations: it plans delivery routes, guides our delivery
driver(s) through a mobile application, records proof of delivery, and
notifies patients of their delivery by text message (SMS) and, where
enabled, a voicemail line.

The purposes are to deliver medications reliably, tell patients when their
delivery will arrive, reduce missed deliveries and phone calls, and keep an
auditable record of deliveries.

The system needs a limited set of individually identifying health
information to achieve this: who receives a delivery, where, how to reach
them, and the record that the delivery occurred. It does not hold our
dispensing records: no prescription details, drug names, Personal Health
Numbers, diagnoses, or clinical notes are entered into 1Rx (free-text
delivery instructions are limited to logistics).

Where the information is accessed and stored:

• Pharmacy staff access 1Rx through a web application at the pharmacy.
• Delivery drivers use a mobile application (iOS/Android) showing only the

deliveries on their own route for the day.

• The information is stored in Canada (province of Québec) on servers

operated by 1Rx (vendor: 1Rx.ca / [legal entity name], a Canadian
company). Each pharmacy's data is held in its own isolated database.
1Rx acts as an information manager under s. 66 of the HIA; its
technical staff can access the system for support and maintenance only,
over a private administration network.

[PHARMACY — add: number of staff and drivers who will use it, whether
drivers are employees or contractors, and any local specifics.]

Section B: Organizational Privacy Management

This section describes the PHARMACY's own privacy management. If a

previous PIA already described it and nothing changed, reference that

OIPC file number instead of rewriting it.

B.1 Management Structure

[PHARMACY — TO COMPLETE: who is accountable for health information privacy
(custodian), which affiliate is your designated privacy contact (HIA s. 62),
and how privacy issues and patient complaints are resolved.]

B.2 Policy Management

[PHARMACY — TO COMPLETE: how your privacy policies are developed,
reviewed, and communicated to staff (HIA s. 63). List and attach them in
Section E.]

B.3 Training and Awareness

[PHARMACY — TO COMPLETE: privacy training for staff and drivers —
onboarding and refreshers, how completion is documented, oaths of
confidentiality. Remember drivers are your affiliates under HIA s. 62(2):
their collection, use, or disclosure is yours.]

Vendor support (pre-filled): 1Rx provides role-based training materials
(help centre, printable quick-reference sheets per role, tutorial videos)
that can be incorporated into your training.

B.4 Incident Response

[PHARMACY — TO COMPLETE: your privacy incident procedure, including
mandatory breach reporting under HIA s. 60.1 and HIR s. 8.1 (notify the
Minister of Health, the Commissioner, and affected individuals where there
is a risk of harm).]

Vendor role (pre-filled): 1Rx monitors its systems with automated health
checks and alerting, maintains an incident register, and notifies the
custodian of any incident affecting its data so the custodian can meet its
duty to notify. Audit logs are available to support investigations.

B.5 Access and Correction Requests

[PHARMACY — TO COMPLETE: how you respond to patients' access and
correction requests (HIA ss. 7-13, response within 30 days).]

Vendor support (pre-filled): pharmacy staff can consult, correct, and
export a patient's delivery information directly in 1Rx at any time, and
can obtain from 1Rx a copy of the access logs concerning a patient's
records on request.

Section C: Project Privacy Analysis

C.1 Health Information Listing

(Pre-filled by 1Rx — remove rows you will not use.)

* Unique identifiers. Not collected in 1Rx: Personal Health Number,
prescription/drug details, diagnoses, clinical information.

C.2 Information Flow Analysis

Description. Pharmacy staff enter (or import) the patient's delivery
information into 1Rx (Flow 1) and use it to plan routes and dispatch
deliveries (Flow 2). 1Rx, as information manager, stores and processes the
information on its servers in Québec, Canada (Flow 3). The assigned driver
sees the deliveries of their route in the mobile application and records
proof of delivery (Flow 4). The platform sends the patient their delivery
notifications by SMS or automated call through a telecommunications
carrier, and patients may leave voicemails on the pharmacy's delivery line
(Flow 5). No other disclosure occurs: the information is never sold,
shared for commercial purposes, or used for any purpose other than
providing the service.

a. Information Flow Diagram

[PHARMACY — a numbered diagram may be drawn from the description above;
a clear numbered list mapping to the table below is acceptable. There is no
universally required format.]

b. Legal Authority and Purposes Table

(Pre-filled by 1Rx — have your privacy contact confirm the citations
against your own practice.)

C.3 Notice

[PHARMACY — TO COMPLETE: update your collection notice (HIA s. 22(3)) to
mention delivery management and SMS notifications: why the information is
collected, the legal authority, and who to contact with questions. A
sample notice is in the Alberta Health "Health Information Act Forms"
document.]

C.4 Consent and Expressed Wishes

(Pre-filled, adjust.) Delivery notifications are sent only to patients
whose delivery the pharmacy manages in 1Rx, for the purpose of providing
that health service (disclosure to the individual, HIA s. 33). Every SMS
supports an industry-standard opt-out (reply STOP); an opted-out patient
still receives their deliveries, without text notifications.
[PHARMACY — describe how you record and honour patients' expressed wishes
(HIA s. 58(2)), e.g., regarding proof-of-delivery photos or preferred
contact methods.]

C.5 Data Matching

Not applicable. The project does not combine data sets to create new
individually identifying health information (HIA s. 1(1)(g)). 1Rx uses the
information only to operate deliveries for the pharmacy.

C.6 Contracts and Agreements

(Pre-filled.) The pharmacy and 1Rx enter into a written Information
Manager Agreement as required by HIA s. 66 and HIR s. 7.2, including the
additional provisions required by HIR s. 8(4) because the information is
stored outside Alberta (in Québec, Canada). The agreement limits 1Rx to
processing the information solely to provide the service, prohibits sale or
secondary use, requires safeguards (Section D), requires incident
notification to the custodian, and provides for return or destruction of
the pharmacy's data at the end of the contract. 1Rx provides the relevant
privacy provisions of its service agreement for attachment to this PIA.
[PHARMACY — attach the agreement or its privacy provisions in Section E.]

C.7 Health Information Used, Stored or Disclosed Outside of Alberta

(Pre-filled.) Yes — storage outside Alberta, inside Canada:

• At rest, 100 % in Canada. Production and standby servers are located

in the province of Québec (OVH data centres, Beauharnois/Montréal
region), with one isolated database per pharmacy. Voicemail audio is
stored exclusively in Québec. The only data outside Québec is an
immutable anti-ransomware backup copy in Toronto, Ontario (bounded
45-day retention). No health information is stored in the United States.

• Technical transit for telecommunications. SMS and telephone calls

necessarily transit the telecommunications carrier (Telnyx, USA) to
reach the patient's phone. Voicemail transcription runs on 1Rx's own
Canadian servers — no US engine processes voice content — and the audio
recording is deleted at the carrier within minutes of receipt.
Transactional email and payment processing involve no patient
information.

• Safeguards for out-of-province handling are contractual (HIR

s. 8(4) provisions, C.6) and technical (Section D).

Section D: Project Privacy Risks and Mitigation Plans

D.1 Access Controls

(Pre-filled by 1Rx — pharmacy to adjust roles and staff counts.)

Access is role-based with individual accounts; driver access is limited to
the current route; accounts are deactivated by the pharmacy manager when a
person leaves ([PHARMACY — describe your departure procedure]).

D.2 Privacy Risk Assessment and Mitigation Plans

(Pre-filled by 1Rx — pharmacy to add local risks, e.g., paper run sheets
if any.)

D.3 Monitoring

(Pre-filled, adjust.) 1Rx maintains system and access logs, automated
health monitoring with alerting, and an audit trail of deliveries. The
pharmacy manager can review access logs [PHARMACY — state frequency,
e.g., quarterly and on suspicion] and 1Rx provides log extracts on
request to support audits or investigations.

D.4 PIA Compliance

[PHARMACY — TO COMPLETE: commit to reviewing this PIA periodically (e.g.,
annually) and to notifying the OIPC of significant changes (new
information flows, new service providers). Routine software updates and
security patches are not significant changes.]

Section E: Policy & Procedures Attachments

The PIA is considered incomplete without the pharmacy's own privacy

policies and procedures attached.

Before You Submit: Checklist

• Every section answered (or marked not applicable with a reason) —

blank sections cause the OIPC to close the file un-reviewed.

• Cover letter signed by the custodian (not delegable) with the

current Commissioner's name verified.

• Pharmacy policies and the Information Manager Agreement provisions

attached (Section E).

• Written plainly — understandable without technical knowledge.
• Submitted BEFORE going live with 1Rx; keep the OIPC closing letter

on file.