Privacy Policy

Phai Labs Inc. operates Compounded, software that supports compounding pharmacy operations and marketing workflows. This policy applies to visitors, customer representatives, authorized users, and people who connect a Facebook Page or Instagram professional account to Compounded.

A pharmacy may also have its own privacy obligations for information it collects from its customers. Those pharmacy practices are governed by that pharmacy's policies, not this policy.

Depending on how you use Compounded, we may collect:

• Account and organization information: name, work email, role, pharmacy or company details, and authentication information.
• Connected social account information: Facebook Page or Instagram account identifiers, page or username, granted permissions, access-token and expiry information, and connection status. OAuth credentials are stored in encrypted form and are not shown back to users.
• Marketing content and instructions: captions, images, links, publishing selections, schedules, and delivery results. When a feature requests it, we may also retrieve profile details, recent public media, or account metrics to help tailor content to the connected brand.
• Product and technical information: feature activity, security and audit logs, device or browser information, IP address, error reports, and support communications.
• Website inquiries: contact details and information submitted through demo, contact, or other public forms.

We do not ask for your Facebook or Instagram password. Authentication occurs through the applicable Meta or Instagram authorization screen.

We use the information described above to:

• create and secure accounts and verify authorized access;
• connect the social account you select and display its connection status;
• draft, schedule, publish, and track content that an authorized user directs us to publish;
• operate, maintain, troubleshoot, and improve Compounded;
• provide onboarding, support, and service communications;
• prevent misuse, investigate security incidents, and meet legal obligations.

We do not sell personal information. We do not use connected social account data to build or sell third-party advertising profiles.

We may disclose information only as needed:

• to Meta, Facebook, or Instagram when an authorized user connects an account or directs Compounded to retrieve or publish content;
• to service providers that host, secure, monitor, support, or help operate Compounded, subject to appropriate contractual controls;
• within the customer organization to its authorized administrators and users;
• when required by law, or when reasonably necessary to protect rights, safety, security, and the integrity of the service;
• as part of a corporate transaction, subject to applicable law and safeguards.

Meta and other third-party services handle information under their own terms and privacy policies when you use their services.

We seek consent or rely on another lawful basis where required. You can choose not to connect a social account, limit the permissions you grant where the provider allows, or disconnect an existing channel from Marketing Settings. You may also revoke the app's access from your Facebook or Instagram settings.

Withdrawing a required permission may prevent social publishing or another requested feature from working.

We use administrative, technical, and organizational safeguards appropriate to the nature of the information. These include access controls, transport encryption, monitoring, and encryption of connected-channel credentials at rest. No method of transmission or storage is completely secure.

We retain information only while it is reasonably needed to provide the service, maintain security and audit records, comply with customer agreements, meet legal requirements, or resolve disputes. Retention periods vary by record type and context. Information may be processed by service providers in Canada, the United States, or other jurisdictions and may therefore be subject to the laws of those jurisdictions.

You may request access to or correction of your personal information. To stop social access, disconnect Facebook or Instagram in Compounded Marketing Settings; this deletes the stored channel connection and credential from Compounded. You can also revoke access through your Facebook or Instagram settings.

For deletion of other information associated with the Compounded Social App, follow our data deletion instructions or email support@compounded.ca. We may need to verify your identity and authority before fulfilling a request. We may retain limited information where required by law, security, fraud prevention, or a binding customer agreement.

Compounded is a business service and is not directed to children. We do not knowingly collect personal information from children through the Compounded Social App.

We may update this policy as our services or legal obligations change. We will post the revised policy here and update the effective date. We will provide additional notice when required by law.

Contact the Privacy Officer at Phai Labs Inc. by emailing support@compounded.ca. Please use the subject line “Privacy Request” and do not send passwords, access tokens, or patient information.