Privacy Policy

1. What we collect today

Browsing WomensHealthPrices.ca to compare treatment prices does not require an account or any personal information. If you choose to sign up for price-change email updates using the signup box on our homepage, we collect: your email address; your province and the treatment categories you say you’re interested in, if you provide them; the page you signed up from; and the IP address your device used at the moment you signed up.

We keep the IP address and signup timestamp specifically because Canada’s Anti-Spam Legislation (CASL) requires us to be able to show that you consented to receive commercial email from us — we do not use it to track your location or for any other purpose. Signing up triggers a one-time welcome email and, going forward, notifications about price changes; every email we send includes an unsubscribe link. Clicking it stops us from emailing you, but we keep the record rather than deleting it, so we don’t accidentally sign you up again later and so we retain a history of your consent and its withdrawal, as CASL expects.

If you email us directly (for example, at hello@womenshealthprices.ca), we receive and read that message the same as any other email, and use it only to respond to you.

2. Cookies

This site uses next-auth to power our own administrative sign-in, and its session-checking code runs on every page you visit, not only on the admin dashboard. As a result, two small cookies — next-auth.csrf-token and next-auth.callback-url — are set in your browser on every page load, for every visitor, not only when the site owner signs in. Both are marked HttpOnly and SameSite=Lax. They exist solely to support the login system’s built-in security checks (CSRF protection and post-login redirect handling) — they do not identify you, are not used for advertising, and are not used to build a profile of your browsing. A further, separate session cookie is set only if the site owner actually completes admin sign-in; that one is genuinely restricted to managing prices and content. We do not use advertising cookies, and we do not run Google AdSense on this site.

This site also sets one first-party cookie of its own, whp_sid — a random, anonymous identifier created when a partner placement is shown to you or you click one of our disclosed partner links. It lasts up to 180 days and lets us count, on our own systems, that the same browser saw and later clicked a partner placement. No name, email, IP address, or browser fingerprint is stored with it.

3. Analytics

This site’s codebase supports two privacy-conscious analytics options — Google Analytics 4 and Umami. As of the last-updated date below, neither is enabled: no analytics script loads on any page you visit. If we turn one on, we will update this section first. Analytics, when enabled, would record aggregate usage such as which pages are viewed and which outbound provider links are clicked — not your name, email address, or any information that identifies you individually.

4. Error tracking

We use Sentry, an error-monitoring service, in our production environment only. If something on the site breaks, Sentry may capture technical diagnostic information — such as the error message, the page URL, and general browser/device information — to help us find and fix the problem. Session replay (recording what a visitor did on the page) is switched off. This data is used only for debugging, never for marketing, advertising, or profiling.

5. Affiliate and outbound links

Some links on this site lead to third-party telehealth providers or products, and some of those are affiliate links (see our affiliate disclosure). Clicking one takes you to that provider’s own website, which has its own privacy practices — we encourage you to review them. When you click a disclosed partner (affiliate) link, the click passes through our own redirect and we log it on our own systems — which placement was clicked, the page it was clicked from, and the anonymous whp_sid identifier described in Section 2. We also record anonymously when a partner placement is shown on a page you view, along with the page it appeared on and your browser window’s width (used to tell mobile from desktop layouts). We use these records to count clicks independently of partner reporting and to understand which placements are seen and used; we do not receive any personal information you subsequently provide to that third-party site.

6. Hosting and data storage

This site is built on PostgreSQL (hosted by Neon) and served by Vercel. It also uses Redis, a caching service, to temporarily store the results of price and coverage lookups so repeat visits load faster — this cache holds aggregate treatment and price data only, never personal information about a visitor. These providers may store or process data outside of Canada. Under PIPEDA, we are responsible for ensuring our service providers protect information to a comparable standard, and each maintains industry-standard security practices, including encryption in transit. All traffic to this site uses HTTPS.

7. Third-party sharing

We do not sell, rent, or trade personal information. If you sign up for price-change email updates, your email address (and your province and interests, if you provided them) is shared with SendGrid, the email delivery service we use to send those emails on our behalf. SendGrid is a United States-based provider, so this information may be processed outside Canada — see Section 6 for how we handle cross-border service providers generally. We do not otherwise share your signup information with any third party, and we do not use it for advertising or to build a profile of you.

8. Your rights under PIPEDA

Under Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to access, correct, or request deletion of any personal information we hold about you, and to withdraw consent for its use at any time. To exercise any of these rights, email us at hello@womenshealthprices.ca. We will respond within 30 days, as required by PIPEDA. If you are not satisfied with our response, you have the right to file a complaint with the Office of the Privacy Commissioner of Canada.

9. Changes to this policy

We may update this privacy policy as our practices change — most notably before enabling analytics or any personal-information collection feature. We will update the “Last updated” date at the bottom of this page whenever we do, and material changes affecting an active data-collection feature will be reflected here before that feature goes live.

10. Contact

Questions about this policy or how we handle information? Email us at hello@womenshealthprices.ca.