Privacy Policy: Airix Over (Beta)

Last updated: June 11, 2026

1. Who we are

Airix Over (the "Platform") is a business-to-business (B2B) marketplace operated by Airix2020 Inc. ("Airix", "we", "us"), enabling certified Canadian pharmacies to buy and sell surplus medications and used equipment among themselves.

This policy describes how we collect, use, disclose, retain and protect personal information, in accordance with Quebec's Act respecting the protection of personal information in the private sector (as amended by Law 25) and Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

Privacy Officer (Person in charge of the protection of personal information):

Sami Soltan, Pharmacist, President and CEO

Email: support@airix.ca

Address: Airix2020 Inc., Mirabel, Quebec, Canada

2. Scope

The Platform is intended exclusively for certified pharmacies and licensed healthcare professionals in Canada. It is not intended for the general public or for minors.

Important: the Platform does not collect, process or host any patient health information. Drug data displayed on the Platform (DIN, product names, formats) comes from Health Canada's Drug Product Database, a public source of regulatory data.

3. Personal information we collect

We collect only the information necessary to operate the Platform:

At account creation:

• Email address and password (passwords are hashed using the bcrypt algorithm; we never have access to your password in clear text)
• Pharmacy name and provincial licence number
• Contact person's name, phone number and full pharmacy address

Through your use of the Platform:

• Listings, orders, negotiated offers and transaction history
• Shipping and delivery addresses, tracking numbers
• Messages exchanged through the buyer-seller chat
• Product photos and shipping labels (PDF files) uploaded or generated

Technical data:

• A session cookie containing a signed token (JWT), strictly necessary for authentication
• A language preference cookie

We do not use any advertising, tracking or profiling cookies. No technology that identifies, locates or profiles users beyond what is strictly necessary for the operation of the service is enabled.

4. Purposes of collection

Your information is used exclusively to:

1. Create and manage your account and verify your eligibility (status as a certified pharmacy or licensed professional)
2. Enable the publication of listings, the negotiation of offers and the completion of transactions between pharmacies
3. Facilitate shipping (rate comparison and label purchase)
4. Process payments through our payment providers
5. Enable communication between buyers and sellers (chat)
6. Ensure lot traceability (DIN, lot number, expiry date) and enable notification of buyers in the event of a drug recall
7. Secure the Platform, prevent fraud and comply with our legal obligations
8. Send you essential service communications (confirmations, delivery notices, recall and security notices)

We do not use your information for marketing purposes without your consent, and we never sell your personal information.

5. Consent

By creating an account, you consent to the collection and use of your information for the purposes described above. Any new purpose will be subject to separate consent. You may withdraw your consent at any time by closing your account (subject to information we are legally required to retain).

6. Disclosure to third parties

We disclose your information only to the following third parties, and only to the extent strictly necessary:

Shipping providers: ClickShip (Freightcom) and ShipStation (ShipEngine). When preparing a shipment, the names, addresses and phone numbers of the shipping and receiving pharmacies are transmitted to these services to compare rates and issue labels.

Payment providers: Paysafe (credit card payments) and Plooto (electronic funds transfers). Credit card details are entered directly with the provider and never pass through or are stored on our servers. During the beta phase, these integrations operate in simulation mode: no real payments are processed until production keys are activated.

AI assistant (optional): if you use the chatbot assistant, the questions you type into the widget are sent to Anthropic's Claude API in order to generate a response. No other account data is transmitted. Use of the assistant is entirely optional.

Authorities: we may disclose information where required by law (court order, legitimate request from a professional regulatory body or Health Canada).

Each provider is bound by contractual obligations or terms of service limiting the use of information to the purpose of the service rendered.

7. Transfers outside Quebec and Canada

Some providers (notably ShipStation/ShipEngine, Paysafe and Anthropic) may process information outside Quebec, including in the United States. In accordance with section 17 of Quebec's private sector privacy act, we conduct a privacy impact assessment before any communication of personal information outside Quebec, to ensure it receives adequate protection. By using the shipping, payment or AI assistant features, you are informed that the information strictly necessary for those features may be processed outside Quebec.

8. Hosting and beta phase

During the beta phase, the Platform is self-hosted and runs locally on the operator's infrastructure (SQLite database and files stored on local disk, with no cloud deployment). Before going to production, the Platform will be migrated to a hosting provider located in Canada (Canadian data residency) with encrypted communications (HTTPS/TLS).

9. Retention and destruction

We retain your information only for as long as necessary for the purposes described, and thereafter for the period required by applicable laws. As an indication:

• Account and profile: lifetime of the account, then deletion within 90 days of closure
• Transaction records (orders, invoices, shipping records): 7 years, in accordance with tax obligations and drug traceability requirements
• Lot traceability records (DIN, lot number, expiry date, identities of the selling and buying pharmacies): at least one year after the expiry date of the lot concerned, in order to enable the execution of recalls
• Chat messages: 24 months after the last activity on the related transaction
• Technical security logs: 12 months

Upon expiry, information is securely destroyed or irreversibly anonymized.

10. Security measures

We apply reasonable security measures proportionate to the sensitivity of the information, including: bcrypt password hashing, signed session tokens (JWT), least-privilege access controls, access logging, and encrypted communications (HTTPS/TLS in production). No system is infallible; we recommend using a strong, unique password.

11. Your rights

Under Law 25 and PIPEDA, you have the following rights:

• Access: obtain confirmation of the existence of information about you and receive a copy of it
• Rectification: have inaccurate, incomplete or ambiguous information corrected
• Withdrawal of consent: withdraw your consent to the use or disclosure of your information
• Portability: receive the computerized personal information you provided to us in a structured, commonly used technological format
• Cessation of dissemination and de-indexing, where the conditions set out by law are met

To exercise a right, write to the Privacy Officer (contact details in section 1). We respond within a maximum of 30 days. If a request is refused, we will provide the reasons, the applicable legal provisions and the available recourses.

12. Confidentiality incidents

We maintain a register of confidentiality incidents. Any incident presenting a risk of serious injury will be reported promptly to the Commission d'accès à l'information du Québec (CAI), to the Office of the Privacy Commissioner of Canada (OPC) where required, and to the individuals concerned.

13. Changes to this policy

We may update this policy. The update date appears at the top of this document. Any material change will be communicated through a notice on the Platform or by email. Continued use after changes take effect constitutes acceptance.

14. Complaints and recourse

For any question or complaint, please first contact our Privacy Officer. You may also contact:

• Commission d'accès à l'information du Québec (CAI): cai.gouv.qc.ca, 1-888-528-7741
• Office of the Privacy Commissioner of Canada (OPC): priv.gc.ca, 1-800-282-1376