Privacy policy

ShapesRx is operated by Mansoor Brothers Enterprises Inc., a company based in Canada. Our registered address is Suite 104, 100 Dynamic Drive, Toronto, ON M1V 5C4. In this policy, "we" and "us" mean Mansoor Brothers Enterprises Inc..

ShapesRx is software a pharmacy uses to run its own deliveries. The pharmacy decides what information goes into it. We operate the software and store that information on the pharmacy's behalf.

Customer names, delivery addresses, phone numbers, email addresses, customer notes, delivery instructions, amounts to collect, driver names, phone numbers and notes, delivery status history, and proof of delivery in the form of a signature image or a photo.

ShapesRx does not ask for or store prescription contents, medication names, diagnoses or any clinical information. Staff can enter an optional prescription reference number, such as the Rx number used in the pharmacy dispensing system. There are free-text fields for notes and delivery instructions, and pharmacies should not put clinical details into them.

ShapesRx also keeps a record of important actions, such as who created or changed a driver, who created a driver sign-in code, and when a driver signed in.

Each pharmacy's records are separated at the database level, so one pharmacy cannot read another's. Within a pharmacy, admins and staff have different permissions, and drivers can only see the deliveries assigned to them.

We can access pharmacy data when providing support or investigating a problem. During the pilot, that access is more frequent than it would be otherwise, because we are working directly with you. Some of our team works outside Canada, so this access can happen from outside Canada.

Drivers sign in with their mobile number and a one-time code that pharmacy staff create in ShapesRx and give to the driver directly. A code works once and expires after 10 minutes. ShapesRx stores only a one-way hash of each code, not the code itself.

A tracking link shows a shortened recipient name, the street without a house number, the city, the delivery status, and the pharmacy's name and phone number. It does not show the customer's phone number, a full address, or anything about what is being delivered.

The link itself is stored only as a one-way hash, so the link cannot be recovered from our database. Links stop working 48 hours after a delivery is complete.

ShapesRx uses Supabase for its database, sign-in and file storage. This data is stored in Supabase's Canada (Central) region.

The ShapesRx application runs on Vercel in Washington, D.C., in the United States. When you use ShapesRx, the information shown and entered passes through and is processed on servers in the United States.

When you send us a pilot request from this site, the details you enter are also emailed to us through Resend, an email service, so we can reply.

When a driver taps Navigate on a delivery, the delivery address is sent to Google Maps to show directions. Google's own privacy terms apply to that step.

Delivery records are kept for as long as the pharmacy's account is active, because the operational history is the point of the product. If a pharmacy leaves, we will export their data to them and delete it on request. Export and deletion are currently done manually by our team.

Automatic backups are not yet in place. We will update this page when they are.

ShapesRx is built with privacy and security in mind for pharmacy operations. We do not claim any formal certification. Your own obligations depend on your operations, your other systems and your province, and we are happy to go through how ShapesRx works so you can assess it.

Ask on the pilot form and we will answer directly. You can also write to us at rx@shapesoft.ca, or by post at Mansoor Brothers Enterprises Inc.,Suite 104, 100 Dynamic Drive, Toronto, ON M1V 5C4.