Déclaration de confidentialité (CA)

1. Person in Charge of Processing

This privacy policy applies to the website and online store operated by Osmo Pharma (referred to in this policy as "we," "us," or "our").

We are subject to Quebec Law 25 — formally known as An Act to modernize legislative provisions as regards the protection of personal information (S.Q. 2021, c. 25) — which governs how we collect, use, disclose, and protect the personal information of anyone who visits or transacts through our website.

This policy explains, in plain language, what personal information we collect, why we collect it, who we share it with, and what rights you have over it. If you have any questions, the contact details of our Person responsible for the protection of personal information are set out in Section 8.

2. Personal Information Collected

We collect personal information only to the extent necessary for the purposes described in Section 3. The categories below reflect what is actually collected through our website and its integrated services.

2.1 Identification and Contact Information

• Name, billing address, shipping address
• Email address and phone number

2.2 Transaction and Order Information

• Order history, items purchased, order value
• Payment details (processed securely through our payment provider; we do not store full card numbers)

2.3 Technical and Navigation Information

• IP address (approximate geolocation derived from IP)
• Device identifiers and browser type
• Pages visited, session duration, and navigation behavior

2.4 Consent Preferences

• Your cookie consent choices, recorded and stored by our consent management platform

We do not knowingly collect personal information from individuals under the age of 14 without verifiable parental consent, as required by Quebec Law 25.

3. Purposes of Processing

For each category of personal information, we process it for a specific purpose and on a specific legal basis under Quebec Law 25.

3.1 Processing Your Orders

Data used: identification, contact, and transaction information.
Purpose: To receive, process, fulfill, and follow up on your online orders, including issuing invoices and handling returns. This processing is carried out using WooCommerce, our e-commerce platform.
Legal basis: Performance of a contract (your purchase agreement with us).

3.2 Audience Measurement and Site Improvement

Data used: technical and navigation information.
Purpose: To understand how visitors use our website so we can improve its content and performance. We use Google Analytics 4 (operated by Google LLC, United States) and WooCommerce Analytics (operated by Automattic Inc., United States) for this purpose.
Legal basis: Your consent, collected through our cookie consent banner before any analytics cookies are activated.

3.3 Displaying Website Content Correctly

Data used: IP address and device identifiers.
Purpose: To load custom typefaces so that our website displays as intended. We use Adobe Fonts (Typekit) (operated by Adobe Inc., United States) to serve web fonts.
Legal basis: Your consent, collected through our cookie consent banner.

3.4 Managing Your Consent Choices

Data used: consent preferences and IP address.
Purpose: To record and honor the cookie preferences you set when you visit our site. This is handled by Moelleux (by Horizon-Cumulus), our consent management platform, hosted in Quebec (OVH, Beauharnois). A cookie named moelleux_{site_key} is stored in your browser for up to 13 months to remember your choices.
Legal basis: Legal obligation (Quebec Law 25 requires us to obtain and document your consent before placing non-essential cookies).

4. Third Parties and Processors

We work with the following third-party service providers. Each one processes personal information on our behalf or alongside us, strictly for the purposes described in this policy.

We do not sell your personal information to any third party. We do not share your personal information with third parties for their own marketing purposes.

5. Transfers Outside Quebec

Some of the services we use transfer personal information outside Quebec, specifically to the United States. Under Quebec Law 25 (section 17), before communicating personal information outside Quebec, we are required to conduct a Privacy Impact Assessment (PIA) to ensure that the information will receive adequate protection in the destination jurisdiction.

The following services involve transfers to the United States:

• Google Analytics 4 (Google LLC, United States) — technical and navigation data, including IP address and device identifiers, are processed on Google's servers in the United States. Google participates in the EU-U.S. Data Privacy Framework and applies standard contractual clauses for international transfers.
• WooCommerce Analytics (Automattic Inc., United States) — transaction data and navigation behavior may be processed on Automattic's infrastructure in the United States. Automattic applies standard contractual protections for cross-border data transfers.
• Adobe Fonts (Typekit) (Adobe Inc., United States) — IP address and device identifiers are transmitted to Adobe's servers in the United States when fonts are loaded. Adobe maintains contractual safeguards for international data transfers.

We have conducted or are in the process of conducting a Privacy Impact Assessment (PIA / EFVP) for each of these transfers, as required by Quebec Law 25. If you would like more information about the safeguards in place for any specific transfer, please contact our Person responsible for the protection of personal information (see Section 8).

Our website hosting and consent management infrastructure are operated entirely within Quebec by Horizon-Cumulus (Joliette, Quebec), verified through our hosting provider (OVH, Beauharnois, Quebec). No data processed by these components leaves Quebec.

6. Retention Period

We keep your personal information only for as long as necessary to fulfill the purpose for which it was collected, or as required by law.

When the applicable retention period expires, personal information is securely deleted or anonymized so that it can no longer be linked to an identifiable individual.

7. Your Rights

Under Quebec Law 25, you have the following rights with respect to your personal information. To exercise any of these rights, please contact our Person responsible for the protection of personal information using the details in Section 8. We will respond within 30 days of receiving your request.

7.1 Right of Access

You have the right to ask us whether we hold personal information about you, and to receive a copy of that information in a clear and understandable format.

7.2 Right of Rectification

If any personal information we hold about you is inaccurate, incomplete, or ambiguous, you have the right to ask us to correct it.

7.3 Right of Erasure

You may ask us to delete personal information that was collected without a valid legal basis, or that is no longer necessary for the purpose for which it was collected, subject to any legal retention obligations we must fulfill.

7.4 Right to Data Portability

You have the right to receive personal information that you provided to us in a structured, commonly used, and machine-readable format, and to have it transmitted to another organization where technically feasible.

7.5 Right to Withdraw Consent

Where we process your personal information based on your consent (for example, analytics and functional cookies), you may withdraw that consent at any time by updating your preferences through our cookie consent banner. Withdrawing consent does not affect the lawfulness of any processing carried out before the withdrawal.

7.6 Right to File a Complaint

If you believe we have not handled your personal information in accordance with Quebec Law 25, you have the right to file a complaint with the Quebec Information Access Commission (CAI) at: https://www.cai.gouv.qc.ca

8. Person Responsible for the Protection of Personal Information

In accordance with section 3.1 of Quebec Law 25, we have designated a Person responsible for the protection of personal information who oversees our compliance with this policy and with the Act. You may contact this person for any question, request, or concern related to your personal information.

• Name: Alexandre Perras
• Title / Role: --
• Email: vita-sante@hotmail.com
• Phone: 450 755-5352

We will acknowledge your request promptly and provide a substantive response within 30 days, as required by Quebec Law 25. If your request is complex or involves a large volume of information, we may extend this period by an additional 30 days and will notify you accordingly.

9. Effective Date and Versioning

This privacy policy takes effect on 10 juin 2026 and supersedes any previous version.

Version: 2

We may update this policy from time to time to reflect changes in our practices, the services we use, or our legal obligations under Quebec Law 25. When we make a material change, we will update the effective date above and, where appropriate, notify you through our website or by email. We encourage you to review this policy periodically.