Privacy Policy
Last updated: March 2026
Who we are
Rowan is a virtual primary care service for adults 40–60 in Ontario, Canada. Rowan is operated by PurposeMed Inc. (“we”, “us”, “our”). We are committed to protecting your personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Ontario's Personal Health Information Protection Act (PHIPA).
What we collect
When you join our waitlist or subscribe to updates, we may collect:
- Email address
- First name
- Age range
- Gender
- Current healthcare situation
- Postal code prefix (first 3 characters)
- How you heard about us
- Marketing attribution data (UTM parameters, Google Click ID)
All fields beyond email are optional. We only collect what is necessary to plan our service launch and prepare for your care.
Why we collect it
- To reserve your spot on the waitlist
- To notify you when Rowan is ready for you
- To help your future Nurse Practitioner prepare for your first visit
- To understand demand across Ontario and plan our service expansion
- To improve our marketing effectiveness
Where your data is stored
Your personal information is stored in Canada, in a secure database hosted in Montreal, Quebec (AWS ca-central-1 region). Data is encrypted at rest (AES-256) and in transit (TLS). Access is restricted to authorized personnel only.
How long we keep it
We retain your waitlist information for as long as you remain on the waitlist or until you request deletion. If you become a Rowan member, your waitlist data will be incorporated into your patient record and governed by our clinical privacy practices. If you do not become a member, we will delete your data within 24 months of your last interaction with us.
Your rights
Under PIPEDA and PHIPA, you have the right to:
- Access — Request a copy of the personal information we hold about you
- Correction — Ask us to correct inaccurate or incomplete information
- Deletion — Ask us to delete your information from our systems
- Withdrawal of consent — Withdraw your consent at any time by contacting us
Third parties
We do not sell your personal information. We use the following third-party services to operate our website:
- Vercel — Website hosting (data processed in the US; no personal data stored)
- Supabase — Database hosting (data stored in Montreal, Canada)
- Google Analytics / Google Ads — Website analytics and advertising measurement
Contact us
If you have questions about this policy or wish to exercise your privacy rights, please contact us at: