Privacy Policy
Effective: 2 September 2026
Patricia Saunders, operating as Ontario Bio Sciences ("Ontario Bio Sciences", "we", "us", "our") operates the website at https://www.ontariobiosciences.com (the "Site"). We are the organization responsible for the personal information collected through the Site. Our address is Ontario, Canada (full postal address available on request by email). Our privacy contact is the Owner, reachable at [email protected] or available on request by email.
This policy explains what we collect, why, who sees it, where it is kept, how long, and what you can ask of us. It is written to meet the Personal Information Protection and Electronic Documents Act (Canada), the provincial private-sector privacy laws of Quebec, Alberta and British Columbia, and the consumer privacy laws of the United States and its states, to the extent each applies to us.
1. What this policy covers
This policy covers the Site, the order requests you send through it, and our email correspondence with you about those requests. It does not cover other websites we link to, including the laboratories that issue our certificates of analysis. Their own policies apply there.
2. Information we collect
2.1 Information you give us. When you submit an order request through the Site we collect:
- your full name and email address (required);
- your phone number and a shipping or institution address (optional, if you enter them);
- any note you add to the request;
- the products and quantities you requested, the reference figure shown on screen, and the order reference number the Site generates.
When you write to us by email, we keep the correspondence. If an order request becomes a sale, we keep the records of that sale (the confirmed order, invoice, shipping record and lot number) in our business records. Payment is arranged between you and us outside the Site, on terms we confirm by email; the Site itself never asks for card numbers, bank credentials or any other financial account information.
2.2 Information collected automatically. Our hosting and network providers keep standard server logs: your IP address, browser and device type, the pages requested, the time of each request, and the referring page. The Site stores your currency preference and, while you build a request, the items in it, in your browser's local storage. That data stays on your device and reaches us only when you submit the request. The Site sets no advertising cookies, runs no analytics or behavioural tracking, and does not fingerprint devices. If that ever changes, we will update this policy and, where the law requires it, ask for your consent first.
2.3 What we do not collect. Payment card or banking details, health information, government identifiers, precise location, or information from anyone under 18.
3. Why we use your information
We use the information above only to:
- receive your order request and reply to it;
- confirm availability, pricing, taxes, shipping and delivery with you;
- fulfil, ship and track an order you have confirmed and paid for;
- keep the business, tax, accounting and product-traceability (lot and certificate of analysis) records the law requires;
- answer your questions and handle returns, damage claims and complaints;
- protect the Site and our inbox from spam, bots and abuse;
- meet legal obligations, including lawful requests from authorities and any product safety or recall notice; and
- with your separate, express consent only, send you marketing.
We do not use your information for advertising, for profiling, or for any automated decision that has a legal or similarly significant effect on you.
4. Consent and legal basis
If you are in Canada. By submitting an order request you consent to our collecting, using and disclosing the information in section 2 for the purposes in section 3. For the purposes needed to answer and fulfil your request, that consent is implied by the request itself. For marketing, we ask for express consent separately and never assume it. You may withdraw consent at any time by contacting us; we will explain what that means for any open order, and the withdrawal will not affect what we have already lawfully done.
If you are in the United States. This section, together with section 2, is our notice at collection. We collect the categories listed in section 2 for the purposes in section 3, and we keep them for the periods in section 7.
5. Who we share your information with
We share personal information only with service providers who work for us under contract, only so far as needed to run the Site and fulfil orders, and only for the purposes in section 3. They may not use it for their own purposes.
| Provider | What they do for us | Where they process data |
|---|---|---|
| Vercel Inc. | Hosts the Site and keeps its server logs | United States |
| Cloudflare, Inc. | Domain name service, content delivery and security filtering in front of the Site; sees the traffic to the Site, including IP addresses | United States, on a global network |
| Viva Systems order relay (Viva Vendind AI LLC), using Resend, Inc. for email delivery | Delivers your order request to us by email and sends you a confirmation copy | United States |
| Viva Systems (Viva Vendind AI LLC, Texas) | Built the Site and maintains it under a care plan; has administrative access to the Site and its order relay; bound by contract to confidentiality and to use information only to provide that service | United States |
| Google LLC (Gmail) | Provides the inbox that receives your order request and our correspondence with you | United States |
| Shipping carriers | Receive your name, address and phone number to deliver an order | Where the order travels |
| Google LLC (Google Fonts) | Serves the typefaces the Site uses; receives your IP address when a page loads them | United States |
We may also disclose personal information when the law requires it, to protect our rights or someone's safety, to a buyer of our business as part of that sale, or with your consent.
We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done either in the twelve months before the effective date of this policy.
6. Where your information is kept
The providers in section 5 store and process information in the United States, and Cloudflare on its global network. If you are in Canada, your information will leave Canada, and while it is in the United States it is subject to United States law, including lawful access by authorities there. Your order request is handled only by the providers named in section 5. We choose providers with recognized security programs and bind them by contract, but we cannot make foreign law not apply.
If you are in Quebec: before using these providers we assessed the privacy factors of sending information outside Quebec, as the Act respecting the protection of personal information in the private sector requires, and concluded the information receives adequate protection.
7. How long we keep it
| Record | Kept for |
|---|---|
| Order requests that do not become an order | 12 months from the request, then deleted |
| Confirmed orders, invoices, shipping records and lot traceability | 7 years from the end of the year of the sale, as tax and product-traceability rules require |
| Correspondence | As long as the matter it concerns is open, then with the order record it belongs to |
| Server logs | The default retention of the hosting and network provider, measured in days |
| Copies held by the order relay | The relay keeps no copy of its own. Your request stays in our email inbox, and a delivery record stays with our email provider, for as long as each is kept there |
| Marketing consent records | For as long as you are subscribed, and three years after you unsubscribe, as proof of consent |
When a record is no longer needed we delete it or strip anything that identifies you.
8. How we protect it
The Site is served over HTTPS only. Access to order information is limited to the owner of the business and, under contract, to the maintenance provider named in section 5. Inboxes and administrative accounts use strong passwords and two-factor authentication. Our providers run their own security programs. No method of storage or transmission is perfect, and we cannot promise absolute security.
If a breach of our security safeguards involves your personal information and creates a real risk of significant harm to you, or where state law requires it, we will notify you and the responsible regulator without undue delay, within any deadline the law sets (in Florida, no later than 30 days after we determine a breach occurred). We keep a record of every breach of our safeguards, whether or not it met that threshold, for at least two years, and give it to the regulator on request.
9. Your rights and choices
Wherever you live, you can ask us to tell you what personal information we hold about you, to correct it, to delete it (subject to records we must keep by law), to stop using it for a purpose you no longer agree to, and to explain how we handle it. You can also complain to us, and we will answer.
If you are in Canada. You have the rights of access and correction under the Personal Information Protection and Electronic Documents Act or the substantially similar law of your province. We respond within 30 days. If you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada or to the Office of the Privacy Commissioner of Canada. If you are in Quebec, you may also ask us to give you the personal information you provided in a structured, commonly used technological format, and to stop disseminating it.
If you are in the United States. If a state consumer privacy law applies to us, you have the rights it gives: to know and access, to delete, to correct, to obtain a portable copy, to opt out of the sale or sharing of personal information and of targeted advertising, to limit the use of sensitive personal information, and not to be discriminated against for exercising a right. We do not sell or share personal information, do no targeted advertising, and collect no sensitive personal information, so there is nothing to opt out of. We honour these rights whether or not a threshold in a given state makes them mandatory for a business of our size. We respond within 45 days, and if we need longer we tell you why. If we decline a request, you may ask us to reconsider by replying to our decision, and you may contact your state attorney general. You may use an authorized agent if the agent can show us your written permission. We treat a Global Privacy Control signal from your browser as a request to opt out of sale and sharing.
How to ask. Email [email protected] and, if you have one, quote your order reference. We verify a request by replying to the email address we hold for you, and we may ask for more only if that is not enough to be sure it is you. We do not charge for a request unless it is manifestly unfounded or repetitive, and we tell you first.
10. Marketing messages
We send marketing email only to people who have given us express consent, and we keep a record of that consent. Every marketing message names Patricia Saunders, operating as Ontario Bio Sciences, gives our postal address and a way to contact us, and carries an unsubscribe link that works for at least 60 days and takes effect within 10 business days. Messages about an order request or an order (confirmation, questions, shipping notices) are not marketing; we send them because you asked us to act on your request. Every email we send, those included, identifies Patricia Saunders, operating as Ontario Bio Sciences, gives our mailing address and a way to contact us, and tells you how to stop receiving anything beyond the messages your order needs.
11. Children
The Site is not directed to anyone under the age of majority where they live, and never to anyone under 18. We do not knowingly collect personal information from a minor. If you believe a minor has given us information, contact us and we will delete it.
12. Links to other sites
Certificates of analysis, published literature and carrier tracking pages are hosted by others. Their privacy practices are their own.
13. Changes to this policy
When we change this policy we update the effective date at the top. If a change is material, we post a notice on the Site before it takes effect and, where we hold a recent email address for you, we tell you by email. Continuing to use the Site after the effective date means you accept the change, except that a material change to how we use information already collected needs your consent where the law requires it.
14. Contact us
the Owner
Patricia Saunders, operating as Ontario Bio Sciences
Ontario, Canada (full postal address available on request by email)
[email protected] · available on request by email
Rider A: additional notice for residents of Canada
Include this rider on every store that serves Canadian customers.
Accountability. the Owner is accountable for our compliance with Canadian privacy law and is the person to contact with any question or complaint.
Purposes are identified before or at collection. The order form tells you why we ask for each field. We collect nothing beyond what section 2 lists, and we do not require you to consent to anything beyond what is needed to answer your request as a condition of answering it.
Openness. This policy, our retention periods and the list of our service providers are published here and available on request in another form if you need one.
Quebec. the Owner is our person in charge of the protection of personal information under the Act respecting the protection of personal information in the private sector. The Site uses no technology that identifies, locates or profiles you, so no consent prompt is needed for such technology. A French-language version of this policy will be provided where the law of your province requires it. We keep a register of confidentiality incidents, notify the Commission d'accès à l'information and the people affected when an incident presents a risk of serious injury, and before sending personal information outside Quebec we assess the privacy factors of the transfer and put it under a written agreement. If you are dissatisfied with our handling of a request, you may complain to the Commission d'accès à l'information du Québec.
Rider B: additional notice for residents of the United States
Include this rider on every store that serves United States customers.
Categories of personal information. In the twelve months before the effective date we collected these categories, from you directly and from your device automatically, for the business purposes in section 3, and disclosed them only to the service providers in section 5:
| Category | Examples | Source |
|---|---|---|
| Identifiers | Name, email, phone, postal address, IP address, order reference | You; your device |
| Commercial information | Products requested or purchased, reference figures, order history | You |
| Internet or network activity | Pages requested, browser type, timestamps | Your device |
We collected no sensitive personal information, no biometric, geolocation, health, financial-account or inference data, and no information about anyone under 16. We sold no personal information and shared none for cross-context behavioural advertising. We do not use or disclose personal information for purposes incompatible with those disclosed.
State-specific notes. If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah or Virginia, the rights in section 9 are how we apply your state's law. Where your state gives a right of appeal, our reconsideration in section 9 is that appeal, and the decision we send you will explain how to contact your state attorney general.