← Back

Legal

Privacy Policy

Effective date: July 22, 2026

At AE Health, protecting your personal and health information is part of providing good care. This Privacy Policy explains what we collect, how we use and share it, how we protect it, and the choices and rights you have. It applies to 1598934 B.C. Ltd., doing business as "AE Health" ("AE Health," "we," "us," "our") and to our websites and any web or mobile property on which this Privacy Policy is posted (the "Platform").

Capitalized terms used but not defined here have the meaning given to them in our Terms of Use, which form part of your agreement with us.

Your privacy and your care

AE Health operates a telehealth Platform that connects you with our affiliated medical practice, Active Energy Laser & Med Spa Limited (the "Medical Practice"), whose care is delivered by licensed nurse practitioners, supported by consulting physicians and other regulated healthcare professionals ("Healthcare Professionals"), for online evaluations, prescriptions and treatment, monitoring, lab testing, and pharmacy services (the "Healthcare Services"). The Healthcare Services are provided by the Medical Practice and its Healthcare Professionals, labs, and pharmacies — not by AE Health. We may also sell you non-clinical products, supplies, technology, and content directly (the "Products"). Together, the Platform, the Healthcare Services, and the Products are the "Services."

Continuity of care means your care is connected and consistent over time. Your Healthcare Professional needs accurate, up-to-date information to evaluate, treat, and safely monitor you — this is especially important for ongoing treatments such as testosterone replacement therapy, which involves a controlled substance and requires identity confirmation and regular lab work and follow-up. Collecting the information described in this policy is a necessary part of providing the Services you ask for.

By using the Platform or the Services, you acknowledge this Privacy Policy. To use the Services you must also accept our Terms of Use. If you don't agree with either, please don't use the Platform or the Services.

We do not sell or rent the personal or health information we collect from you.

Definitions

Affiliate. Any entity that, directly or indirectly, controls, is controlled by, or is under common control with AE Health, where "control" means the power to direct the management and policies of an entity, whether through ownership of voting interests, by contract, or otherwise.

Personal Information. Information that identifies you, or that could identify you when combined with other information, or as otherwise defined under applicable privacy law.

Personal Health Information (PHI). Information about you that relates to your physical or mental health or the health care provided to you, or as otherwise defined under applicable health-privacy law.

Medical Record. PHI used to provide healthcare evaluations and Healthcare Services.

De-identified Information. Information processed to remove direct and indirect identifiers so that it cannot reasonably be used to identify you. We do not try to re-identify it, and we do not treat it as Personal Information or PHI.

Pseudonymized Information. Information from which direct identifiers have been removed but which still contains indirect identifiers (such as codes). We treat it as Personal Information or PHI and protect it accordingly.

1. Accountability

The Medical Practice and the Healthcare Professionals who provide your care through it are responsible for the Personal Health Information in your Medical Record under the health-privacy law of your province or territory. Which of them formally holds that role — called a "custodian" in some provinces, a "trustee" in Saskatchewan and Manitoba, and a "health information custodian" in Ontario — depends on the province where your care is provided; in some provinces it is the Medical Practice, and in others it is the individual Healthcare Professional. Either way, AE Health handles that Personal Health Information only as a service provider acting on their behalf and on their instructions, not as the entity in control of it. AE Health is responsible, as the organization in control, for the Personal Information it collects from you in its own right to operate the Platform and provide the Products — for example, your account, contact, payment, and usage information. We take responsibility for the information in our custody or control, maintain policies, practices, and procedures to protect it, train our staff on handling it, and require the Medical Practice, the Healthcare Professionals, and the service providers we work with to use and disclose information only as needed to provide the Services and to protect it.

We comply with — and require the Medical Practice, the Healthcare Professionals, and the service providers we work with to comply with — applicable privacy and data-protection laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA), the private-sector privacy laws of the provinces that have them (including British Columbia's and Alberta's Personal Information Protection Acts), the health-privacy legislation of each province or territory where your care is provided (such as Ontario's Personal Health Information Protection Act, Alberta's Health Information Act, Saskatchewan's Health Information Protection Act, and Manitoba's Personal Health Information Act), anti-spam and telemarketing laws (including CASL), and the rules of the regulatory colleges that govern the Healthcare Professionals.

2. What information we collect and how

Information you give us directly. Depending on how you use the Services, we, the Medical Practice and the Healthcare Professionals who work with us, or our service providers may collect:

  • Identification and contact information — your name, date of birth, sex/gender, email address, mailing and shipping address, and phone number, to create and manage your account, identify you, contact you, deliver the Services and any Products, and process payment for your subscription.
  • Personal Health Information — depending on what you use, this may include your provincial health card number, the treatment you're seeking and why, medical history, symptoms, allergies, current medications, lab and test results, and other information you choose to share. If you don't have a provincial health number, you can tell us so; this may mean you pay the lab directly for testing. We, the Medical Practice, and the Healthcare Professionals use this to provide the Healthcare Services and support continuity of care.
  • Identity verification information — your name, date of birth, contact details, and government-issued photo ID, collected to confirm who you are. If we use a third-party identity-verification provider, it may collect biometric information for the sole purpose of verifying your identity; it is not used for any other purpose and is retained only as long as needed for verification and audit requirements. Identity confirmation is especially important for prescribing controlled substances such as those used in TRT.
  • Payment information — collected directly by our third-party payment processor and governed by its privacy policy. We do not collect or store your full card details; the processor stores your payment method on file to support the recurring billing described in our Terms of Use.
  • Order and shipping information — the Products you order and the address and delivery details needed to ship them.
  • Referral information — if you tell us who referred you (for example, a trainer or a friend), we collect that person's name and, if you provide it, their contact details, to attribute the referral and administer any reward. If someone introduces you to us with your permission, we collect your name and contact details from them so we can contact you once about the Services.
  • Mailing list information — your name and email if you subscribe, used to send you updates and promotional material; you can unsubscribe anytime.
  • Inquiry information — the details you provide when you contact us, used to respond to you.

You don't have to give us all of this information, but without it we may be unable to provide some or all of the Services.

Information collected while providing Healthcare Services. We may collect PHI when you complete a questionnaire, request an evaluation, or use secure messaging. The Medical Practice and the Healthcare Professionals may collect and generate PHI when they evaluate you — for example, prescriptions and evaluation notes — and labs and pharmacies may collect information in connection with diagnostics and dispensing. PHI is held in your Medical Record and in your communications with Healthcare Professionals. We do not record the audio or video of your telehealth visits with Healthcare Professionals.

Information from other sources. We may receive information about you from others — for example, an accept/decline result from our payment processor, a result from our identity-verification provider, or lab and pharmacy information related to your care.

Information we collect automatically. When you use the Platform we may automatically collect technical information such as your IP address and approximate location, device and browser type, pages viewed and links clicked, dates and times, language preferences, and cookie data. We use this to keep the Platform secure, fix problems, and improve it. We treat IP addresses as Personal Information, and we treat any technical information used to identify you as Personal Information. To do this we use cookies, log files, and web beacons/pixels, and analytics and security tools such as Google Analytics and Google reCAPTCHA. You can limit some of this collection as described in Section 12.

3. How we use your information

We use Personal Information, PHI, and technical information to:

  • Communicate with you — to provide continuity of care (including follow-up, monitoring of your response to treatment, and adherence), respond to your requests, send operational and account messages, notify you of changes to the Services or this policy, alert you to security or fraud issues, send legally required notices, contact you by email, text, in-app messaging, or phone where permitted, and honour your communication preferences and do-not-call requests.
  • Provide and operate the Services — to register and authenticate your account, deliver the Healthcare Services and fulfill Product orders, enable the Medical Practice and the Healthcare Professionals to evaluate, treat, and monitor you (including phone outreach to confirm or clarify treatment), and protect the security and integrity of the Platform.
  • Verify your identity and support safe prescribing — to confirm who you are and to meet the additional requirements that apply to prescribing and dispensing controlled substances.
  • Administer the referral program — to attribute referrals, administer rewards, and, with your consent, confirm to a referrer that a reward was earned.
  • Improve and develop the Services — to understand how the Platform is used and to develop and improve features and offerings.
  • Personalize and market to you — where permitted and, where required, with your consent, to tailor content and send you offers, reminders, and news across the channels you've enabled.
  • Detect and prevent fraud and misuse — including misuse or diversion of controlled substances and breaches of our Terms.
  • Create and use De-identified Information — for analytics, research, and service improvement (including, where applicable, training and evaluating AI tools). We do not try to re-identify it.
  • Comply with the law — including maintaining unsubscribe and do-not-call lists.

4. When we disclose your information

Service providers and affiliates. We share information with Affiliates and service providers who help run our business — for example, hosting and IT, payment processing, identity verification, communications, analytics, and shipping and logistics — under contracts that limit their use of it to providing services for us.

The Medical Practice and Healthcare Professionals. We share the Personal Information and PHI that the Medical Practice and the Healthcare Professionals need to provide your care — for example, your name, contact details, date of birth, sex/gender, province, medical history, symptoms, and prescriptions.

Labs and pharmacies. When diagnostics, lab testing, or dispensing are needed for your care, you consent to us sharing the information required on a requisition with the lab or pharmacy — typically your name, date of birth, address, phone number, health number, and the PHI relevant to that requisition.

Provincial health systems. Depending on your province, some information is recorded in provincial systems as a required part of care, and other health professionals involved in your care may be able to view it. For example, in British Columbia, pharmacies must record dispensed prescriptions in PharmaNet at the time of dispensing; and lab results are commonly reported to provincial laboratory information systems (such as Ontario's OLIS or BC's Health Gateway), where practitioners you see in the future may access them. These systems are operated by provincial authorities under their own rules, and we can't control access to them. If you receive provincial coverage for labs or medications, the applicable provincial plan's information-sharing practices also apply.

Referrers. If you consented to us confirming your referral, we will tell the person who referred you only that a reward was earned. We never disclose to a Referrer any information about your health, your Medical Record, whether you were offered or accepted any treatment, or anything else about your use of the Healthcare Services — and a Referrer's reward is never affected by any of those things.

Marketing service providers. If you've consented to marketing, we may share limited contact and preference information with providers who help us deliver those communications.

Legal and business reasons. We may disclose information, sometimes without notice where the law allows, to collect a debt, prevent or investigate fraud or illegal activity, comply with a court order, subpoena, warrant, or other legal requirement, protect the safety of any person, enforce our Terms, establish or defend our legal rights, or in connection with a sale, merger, or other business transfer, in accordance with applicable law.

5. Personalized marketing, communications, and AI tools

Where permitted, we may use automated tools (including AI-based tools) to analyze your interactions and preferences and to tailor offers, reminders, and health-related information across channels such as email, text, and phone. We — or providers acting for us — may phone you to confirm your communication preferences and to check in on your treatment, but not for promotional calls without your express consent. You can withdraw consent at any time, as described in Section 12.

6. AI and automated decision-making

We may use internal and third-party AI and machine-learning tools to support the Services — operationally (for example, helping with communications, triage of inquiries, categorization, and general information) and, where applicable, clinically (for example, intake, symptom triage, and decision support for Healthcare Professionals). Where AI is used for clinical purposes, any significant medical or legal decision is reviewed by a Healthcare Professional. We do not use AI to independently make clinical diagnoses or treatment decisions.

7. How we protect your information

We use administrative, technical, and physical safeguards to protect your Personal Information and PHI against loss, theft, and unauthorized access, use, or disclosure, including:

  • access monitoring through activity logs and regular audits;
  • secure storage with reputable cloud providers;
  • network security controls, including separating internal systems from public-facing ones; and
  • staff and contractor training, with confidentiality obligations in place.

We also require our Affiliates and service providers to protect information we share with them. The security of your account also depends on you keeping your password confidential. No method of transmission or storage is completely secure; if a breach affecting your information in our custody or control occurs, we will follow the notification and reporting requirements of applicable law.

8. How long we keep your information

We keep Personal Information in our custody or control (and Personal Health Information that we hold as a service provider on behalf of the Medical Practice and the Healthcare Professionals) for as long as we have a legal or legitimate business need — for example, to provide the Services you subscribe to or to meet retention requirements in law. After our relationship ends, we generally keep archived copies for legitimate purposes such as defending claims, audits, and legal compliance, and we destroy information when we no longer need it and are not required to keep it. We may keep and use De-identified Information indefinitely for analytics, research, and service improvement.

We also retain Personal Health Information for as long as needed so that the Medical Practice and the Healthcare Professionals can meet the record-retention requirements set by applicable law and by the regulatory colleges that govern them in the province or territory where your care is provided. These periods vary by province and by profession and can extend for many years after your last care (longer where care was provided to a minor). You can ask us which retention period applies to your record using the contact details in Section 14.

9. Where your information is stored and transferred

We aim to process and store your PHI in Canada. Some Personal Information may be processed, stored, or transferred by our service providers outside Canada, including in the United States, in which case it is subject to the laws of that country and may be accessible to its courts, law enforcement, and authorities without notice to you. You can ask us for more information about our use of non-Canadian providers using the contact details below.

10. Third-party services and links

The Platform may link to third-party websites and apps for your convenience. Once you leave the Platform, this Privacy Policy no longer applies and you are subject to the third party's own terms and privacy policy. We don't control those sites, and you use them at your own risk; some may operate outside Canada.

11. Consent and your privacy rights

Only people who are at least 19 years of age may use the Services, and we do not knowingly collect information from anyone under 19. If we learn we have, we will delete it. When you provide information to open an account, to be evaluated by a Healthcare Professional, or to complete a purchase, you consent to our collecting and using the information needed for those activities.

Depending on where you live, you may have the following rights. To exercise them, contact us using the details in Section 14. We aim to respond to written requests within 30 days and will tell you in writing if we need more time. We may verify your identity before responding, and an authorized agent may act for you if they confirm their identity and authority.

  • Withdraw consent — for future uses within the scope of your consent. You can't withdraw consent for uses that already happened or where the law requires or permits us to use the information.
  • Access and correct — request access to your Personal Information and PHI and ask us to correct anything inaccurate or incomplete.
  • Access your Medical Record — request access to your Medical Record. We will not disclose it to an external Healthcare Professional without your consent.
  • Deletion — ask us to delete Personal Information and PHI in our possession, where permitted by law (note the retention requirements in Section 8).

Your rights may be limited where granting a request would affect others' rights, our ability to provide a Service you asked for, or our legal obligations. If you believe we haven't followed this policy, please contact our Privacy Officer (Section 14). If we can't resolve your concern, you may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) or to the information and privacy commissioner (or equivalent oversight office) for your province or territory; our Privacy Officer can direct you to the right office for where you live.

12. Your privacy preferences

  • Marketing — where you have opted in to marketing, you can opt out anytime by using the unsubscribe link in our emails, replying STOP to texts, or asking to be added to our internal do-not-call list. Even then, we may still contact you about your care, account, or transactions.
  • Cookies — you can block or disable cookies in your browser, though some Platform features may not work as a result.
  • Analytics and advertising
  • You can opt out of Google Analytics with Google's browser add-on (tools.google.com/dlpage/gaoptout).
  • You can manage interest-based advertising through the Digital Advertising Alliance of Canada (youradchoices.ca).

13. Changes to this Privacy Policy

We may update this Privacy Policy as our business, the law, or our technology changes. When we do, we'll revise the effective date above and post a notice on the Platform; for account holders and subscribers we may prompt you to review and accept the changes, and for substantive changes we may also email you. Changes take effect on the date stated.

14. Contact us

We have appointed a Privacy Officer responsible for our information-handling practices. To exercise your privacy rights, ask a question, or make a complaint, contact our Privacy Officer at privacy@aehealth.ca.