Privacy Policy

Last updated: July 21, 2026 · Applies to Shifa Rewards, operated in Canada.

1. Who we are

Shifa Rewards is a Canadian platform that verifies professional status and provides access to curated rewards. We are the "organization" responsible for your personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA) and equivalent provincial privacy laws.

2. Principles we follow

We follow the ten fair information principles set out in PIPEDA: accountability, identifying purposes, consent, limiting collection, limiting use/disclosure/retention, accuracy, safeguards, openness, individual access, and challenging compliance.

3. What we collect

We collect only what we need for the purposes below. Categories:

  • Account: email address, password (hashed by our auth provider), and optional Google sign-in identifier.
  • Professional profile: legal first and last name, phone (optional), province, city (optional), profession, professional title / designation, regulatory or professional body, workplace (optional), specialty (optional), work setting (optional), years of experience (optional), and preferred discount categories.
  • Professional verification: profession, regulatory or professional body, jurisdiction, registration / licence number (where applicable), any supporting information you choose to provide, and the legal name you submitted for cross-checking against the applicable public registry.
  • Activity: saved deals, deals you submit, and anonymous click counters used to measure which discounts are useful.
  • Communications: messages you send us and your consent choices for email.

We do not currently collect photo ID or upload documents. We do not collect payment information — Shifa Rewards is free for verified professionals.

4. Why we collect it

  • Verifying professional status to determine eligibility for Shifa Rewards. Merchants and partners never receive your verification data. Shifa Rewards is independent and is not affiliated with or endorsed by any regulator or professional body.
  • To operate your account, show you relevant discounts, and let you save deals.
  • To improve the platform in aggregate (for example: how many verified professionals in each province and how many clicks a reward gets). Aggregate insights never identify an individual member.
  • To send you the messages you have opted into (deal alerts, marketing).
  • To respond to your support requests.

5. Consent

We ask for your consent when you create an account, submit verification, and opt into any optional communications. You can withdraw consent at any time by updating your profile or contacting us — see Section 12.

Consent is unbundled: agreeing to verify your professional status does not sign you up for marketing, deal alerts, or any future feature. Each consent is a separate opt-in.

Future opportunities consent (opt-in only, not yet active)

Your profile includes an optional field called future_opportunities_consent. This is reserved for a possible future feature — for example, an opt-in way to hear about professional surveys, research invitations, or association programs.

  • It is off by default and only becomes true if you explicitly turn it on.
  • It has no current effect. No feature reads it today. Nothing is sent to you because of it.
  • We are not building a job board, employer marketplace, hiring product, or recruiting service. We do not share your profile with employers or recruiters, and we never will without asking you again through a separate, clearly labeled consent at that time.
  • If we ever activate this feature, we will describe exactly what it does before using it, and you can leave the toggle off (or turn it off at any time) with no effect on your verification or discounts.

6. How long we keep it

  • Account and profile: for as long as your account is active. If you delete your account, we delete or anonymize your profile within 30 days, except where law requires longer.
  • License verification records (regulator, license number, legal name, verification decision, admin notes): retained while your verification is active, and for up to 24 months after your account is closed or your verification expires, for audit and anti-fraud purposes. After that, we delete or irreversibly de-identify these records.
  • Verification attempts that are rejected or abandoned: retained for up to 12 months to prevent repeated fraudulent submissions, then deleted.
  • Deal clicks and aggregate analytics: stored without your user ID (click events are recorded anonymously) and retained indefinitely in aggregate form.
  • Support emails: retained up to 24 months, then deleted unless required for a legal matter.

7. Who we share it with

We do not sell your personal information. We disclose it only to:

  • Service providers that host our database, run authentication, send email, and support us in delivering the service. They act on our instructions and under contract.
  • Professional regulators and registries — only by looking up the license information you provided, against their public registries. We do not send them additional information about you.
  • Partners offering discounts: we do not currently share any member information with partners, including whether you used a reward. Redemption happens on the partner's own site or process. We do not share your name, email, license number, or profile.
  • Partnership inquiries: if you contact us through the partner form, we use the business and contact details you send to respond to your inquiry, evaluate the partnership opportunity and communicate about potential or active partnerships. These details are only visible to authorized Shifa Rewards administrators.
  • Law enforcement or regulators where legally required, and only to the extent required.

8. Where your data lives

Shifa Rewards uses hosted infrastructure that may process data in Canada and, for some functions, in other jurisdictions including the United States. When personal information is processed outside Canada, it may be subject to the laws of that jurisdiction. We use contractual and technical safeguards to protect it in transit and at rest.

9. How we protect it

  • Encryption in transit (HTTPS) and at rest.
  • Row-level security in our database: members can only read and edit their own profile.
  • Administrative access is restricted and audited.
  • Aggregate dashboards used by our team never display individual member contact information beyond what is already visible in the verification review workflow.

10. Your rights

Under PIPEDA and provincial privacy law you may: access the personal information we hold about you, request correction of inaccurate information, withdraw a consent, and file a complaint. To exercise these rights, contact us using Section 12. We will respond within 30 days.

11. Children

Shifa Rewards is intended for registered healthcare professionals and is not directed at anyone under 18. We do not knowingly collect information from minors.

12. Contact and complaints

Questions, access requests, or complaints can be sent to our Privacy Officer at our contact form. If you are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca or your provincial privacy authority.

13. Changes

We will post a new "last updated" date at the top of this page when we change this policy. Material changes will be highlighted for signed-in members before they take effect.