Privacy Policy

This policy covers two categories of individuals:

• Healthcare provider accounts (“Account Holders”) who register and use TripDossier
• Travelers whose information is used to generate a vaccine recommendation brochure, Proof of Vaccination record, or prescription (“Travelers”) — whether that information is entered by an Account Holder or submitted directly by the traveler through a pharmacy’s self-service QR intake form

From Account Holders:

• Name, email address (via Google sign-in)
• Business name, address, phone number, logo
• Licence/registration number and province of licensure
• A photo or scan of your professional licence document, submitted for verification purposes
• Billing information (processed by Stripe; we do not store full payment card details)

From Travelers — entered by the Account Holder on the New Report form, or submitted directly by the traveler through a pharmacy’s self-service QR intake form:

• Full name
• Date of birth
• Sex
• Personal Health Number (PHN) — optional
• Email address — optional, kept for record purposes only; we never use it to contact the traveler
• Destination country or countries, origin country, and any transit countries
• Travel date and duration of stay
• Region or area of travel, and trip activity type — optional
• Pregnancy status
• Breastfeeding status
• Immunocompromised status
• Chronic conditions
• Known allergies

Pregnancy status, breastfeeding status, immunocompromised status, chronic conditions, and known allergies are health information and are treated with particular care — see “Data Retention” and “Third-Party AI Processing” below for exactly how long we keep this information and who we share it with.

Additional information collected only on the Proof of Vaccination form:

When completing a traveler’s Proof of Vaccination / Personal Immunization Record, a pharmacist may enter the traveler’s street address, city/province, and phone number, along with details of the vaccines administered (product, dose, lot number, date given, and next dose due date). This information is entered and used entirely inside the pharmacist’s own browser to produce that one document — it is never transmitted to or stored on TripDossier’s servers, and is not part of our database at all.

Traveler information is used to generate the documents a pharmacy produces for that traveler’s visit: the personalized vaccine recommendation brochure and, where the pharmacist completes a Proof of Vaccination form, the Proof of Vaccination / Personal Immunization Record and an accompanying prescription. We do not use Traveler information for marketing, profiling, or any purpose beyond producing these documents.

To generate personalized recommendations, part of this information is sent to a third-party AI processor in the United States — see “Third-Party AI Processing and International Data Transfer” below for exactly what is sent and why.

Account Holder information is used to manage your account, process billing, and provide customer support.

Account Holders: we process your information under the agreement formed when you create a TripDossier account and accept our Terms of Service — this is necessary to provide the service you have signed up for.

Travelers — entered by a pharmacist (New Report form): when a pharmacist enters your information directly, TripDossier is acting on behalf of the pharmacy, which is providing you with a professional pharmacy service. On this path, you do not provide your consent directly within TripDossier — the pharmacist is required to obtain your consent from you in person, as part of your consultation, and to confirm this to us by checking a required attestation before your report can be generated. What we record is the pharmacist’s attestation — the date and time, and a version identifier for the exact wording they attested to — not an action you personally took within our product. Our own basis for processing your information here is the pharmacy’s legitimate professional purpose in serving you as their patient, together with the consent the pharmacist attests to having obtained from you.

Travelers — submitted through the self-service QR intake form: if you fill out your own information through a pharmacy’s QR code link, you provide your consent directly to us before submitting — a required checkbox describing how your information will be used, with a link to this policy, must be checked before the form can be submitted. In this case we record your own consent: the date and time you gave it, and a version identifier for the exact wording you agreed to.

In every case, the information is used only to prepare the documents described above, and is deleted from our systems on the schedule described in “Data Retention” below.

To generate personalized vaccine recommendations, TripDossier sends part of the traveler’s clinical profile to Anthropic’s Claude API, a third-party AI service operated by Anthropic, PBC, based in the United States. Specifically, we send: age (calculated from date of birth — the date of birth itself is not sent), sex, pregnancy status, breastfeeding status, immunocompromised status, chronic conditions, known allergies, destination country, origin country, transit countries, exact travel date, duration of stay, and any region or trip-activity details entered.

We do not send the traveler’s name, date of birth, Personal Health Number, email address, or any other contact information to this service.

This is a transfer of personal information to a service provider located outside Canada, in the United States, for processing — a transfer we make under the Personal Information Protection and Electronic Documents Act (PIPEDA), which permits transferring personal information to a processor for processing on our behalf, provided we take reasonable steps to ensure it receives a comparable level of protection. Under our commercial agreement with Anthropic, this information is not used to train Anthropic’s AI models, and is retained by Anthropic only briefly, for abuse and safety monitoring, before being deleted.

Although we do not send a traveler’s name or contact details, we want to be clear that we do not consider this information anonymous. A combination of details — such as an exact travel date, a specific destination, and an uncommon health condition — could in principle be enough to identify a specific individual, even without a name attached. We treat this information with the same care as any other personal health information.

Traveler information collected on the New Report form or the self-service intake form is stored only while a report is active. Each report is accessible for 60 minutes from the moment it is generated. After that window, the report — including the traveler’s name, date of birth, sex, PHN, email (if provided), destinations, travel dates, and health information — is permanently deleted from our database.

For pharmacy owner oversight of staff activity, we keep a permanent log of report generation. This log contains only the pharmacy, the name of the pharmacist who generated the report, the report’s reference number (the same short code printed on the report itself, e.g. “Ref: A1B2C3D4”), and the date and time. It does not contain the traveler’s name or any other traveler-identifying information, and cannot be used to determine which traveler a given report was for.

Information submitted through the self-service QR intake form is deleted automatically 24 hours after submission if it has not been reviewed by pharmacy staff. If a pharmacist reviews it and generates a report for every traveler in the submission, it is deleted at that point instead — we do not keep it afterward as a record.

Information entered only on the Proof of Vaccination form — street address, city/province, phone number, and vaccine administration details such as dose and lot number — is never transmitted to or stored on TripDossier’s servers at all (see “Information We Collect” above), so no retention period applies to it on our end.

We recommend Account Holders print two copies of each document: one for the traveler and one to retain according to their own professional recordkeeping obligations. Any copy retained after printing is the responsibility of the Account Holder, not TripDossier — once a report expires, we have no further copy to provide.

Account Holder information (business profile, billing history) is retained for the duration of your active subscription and as required for accounting and legal compliance after account closure.

Your licence document is stored securely (private, access-controlled storage) and is used solely to verify your professional registration. It is permanently deleted from our systems immediately upon approval or rejection of your registration — it is not retained afterward. Your licence number and province of licensure are retained as part of your account record for as long as your account remains active.

Taken together: no traveler personal data persists in our systems beyond the windows described above.

We use the following third-party services to operate TripDossier:

• Google Firebase — authentication
• Stripe — payment processing
• Neon (PostgreSQL) — database hosting
• Vercel — application hosting
• Anthropic’s Claude API — generates personalized vaccine recommendations from CDC travel-health guidance. Unlike the services above, this one does receive part of the traveler’s clinical information — see “Third-Party AI Processing and International Data Transfer” above for exactly what is sent and how it is handled.

We do not use analytics or advertising trackers of any kind.

We apply reasonable technical and organizational safeguards to protect personal information, including encrypted data transmission and access-controlled infrastructure. No system is completely secure, and we cannot guarantee absolute security.

Sensitive documents, such as your licence upload, are stored using private, access-controlled storage with time-limited access links generated only when needed for review — never a permanent public URL.

Account Holders: you can access, update, or delete most of your account information at any time from Settings. To access other information we hold, request a correction, withdraw consent, or close your account, contact us at hello@tripdossier.ca.

Travelers: you do not have a TripDossier account or login — a pharmacist enters, or you submit, your information directly for a specific visit. Because of this:

• While your report is still active (within 60 minutes of it being generated), you can ask us to access or correct the information on it by emailing hello@tripdossier.ca and referencing the pharmacy’s name, the approximate date and time, and, if you have it, the reference number printed on your document (e.g. “Ref: A1B2C3D4”).
• Once that 60-minute window has passed, your information has already been permanently deleted from our systems — we no longer hold anything for us to access, correct, or delete on your behalf through TripDossier. Any copy of your documents that still exists is held by the pharmacy itself, under their own professional recordkeeping obligations, not by TripDossier — you would need to contact the pharmacy directly for that copy.
• If you submitted information through a pharmacy’s self-service QR intake form and it has not yet been reviewed by pharmacy staff, you can ask us to remove it before the pharmacy acts on it by contacting us with the same details above, within 24 hours of submitting it.

Both Account Holders and Travelers have the right to file a complaint with the Office of the Information and Privacy Commissioner for British Columbia (OIPC BC) if you believe we have not handled your information properly.

Questions or complaints about how we handle personal information can be directed to hello@tripdossier.ca — our designated point of contact for privacy matters.

If we expand operations to other provinces or jurisdictions, this policy will be updated to reflect any additional applicable privacy laws, including Quebec’s Law 25 if we begin operating there.

We may update this policy from time to time. Material changes will be communicated to Account Holders via email or in-app notice.

Questions about this policy can be directed to hello@tripdossier.ca.