Our commitment
Atomes limits collection to information needed to operate the professional portal, perform regulatory verification, and administer approved transactions. We do not sell or rent personal information collected through AtomesBio Pro.
- Limited collection and explained purposes
- Human regulatory approval
- Restricted, logged, and protected access
- Access, correction, and portability requests
1. Scope and responsible organization
This policy applies to the AtomesBio Pro professional portal, professional account applications, eligibility reviews, purchase requests, related communications, and approved transactions administered by Atomes F.D. Inc.
It does not replace the AtomesBio public store privacy policy. When you use a Shopify-hosted account, checkout, or order page, the privacy practices and choices applicable to Shopify and the public store also apply.
2. Information we collect
Depending on how you interact with the portal, we may collect the following categories:
- professional identity and contact details, including name, title, business email, and telephone number;
- organization information, including legal and trade names, Québec enterprise number when supplied, establishments, and approved addresses;
- regulatory eligibility information, including permit or certificate categories and numbers, issue and expiry dates, authorized activities, supporting records, and verification results;
- request and transaction information, including product, quantity, declared use, purchase-order number, delivery notes, approved addresses, acknowledgements, decisions, and payment or fulfilment status;
- communications, including support requests, notices, decisions, corrections, complaints, and privacy requests;
- technical and security information, including IP address, browser or device type, session identifiers, authentication events, audit records, and timestamps;
- information from official sources or Shopify where needed to confirm an authorization, account identity, or order status.
3. How we collect information
We collect information directly from you through portal forms, uploads, requests, and communications. We also create review and audit records when our personnel process a file.
Some information comes from Shopify during authentication or transaction processing and from official registries consulted to verify declared authorizations. We limit collection to what is necessary for the stated purposes.
4. How we use information
We use personal information to:
- create and secure a professional account;
- evaluate the organization, its permits or certificates, and the declared use;
- perform a new human review for every purchase request;
- prepare a Shopify draft order, send an invoice, and track payment or fulfilment after approval;
- communicate with applicants, provide support, and process privacy requests;
- prevent fraud, protect the portal, scan uploaded documents, and investigate incidents;
- maintain regulatory, transactional, tax, and audit records required or reasonably necessary;
- establish, exercise, or defend legal rights and comply with applicable obligations.
5. Consent and choices
We request meaningful, free, and informed consent where required and explain purposes in clear language. Required fields are identified in the forms; without them, we may be unable to evaluate an application or provide the requested service.
You may withdraw consent prospectively, subject to legal or contractual restrictions. Withdrawal does not invalidate prior authorized use and does not require us to destroy a record that must be retained.
6. Human review and automated tools
The portal performs validations, identifies blocks, and helps route files. These functions do not automatically grant regulatory eligibility or authorize a transaction.
An authorized Atomes reviewer decides organization approval and every purchase request. Malware scanning is a security control, not an eligibility decision.
7. Disclosure and service providers
We disclose only the information needed by providers that help operate the portal, including hosting, private storage, authentication, email delivery, cybersecurity, malware scanning, and ecommerce services.
Shopify processes account identity, draft orders, invoicing, payment, and fulfilment. The portal does not request or store your full payment-card number.
We may also disclose information to professional advisers, insurers, regulators, public authorities, or others where permitted or required by law or to protect the rights, security, and integrity of the portal. AtomesBio Pro does not sell or rent personal information associated with professional files.
8. Processing outside Québec
Some providers may process or retain information outside Québec or Canada. In those locations, information may be subject to the laws of that jurisdiction and accessible to its authorities under those laws.
Before entrusting personal information to a provider outside Québec, Atomes assesses privacy factors and puts in place contractual and security measures required by applicable law.
9. Retention and destruction
We retain information only as long as needed for the stated purposes and under our retention schedule. Regulatory, transactional, and audit records are currently retained for at least five years after the latest relevant event, or longer where required by law, an investigation, litigation, or a legal hold.
At the end of the applicable period, information is securely destroyed or anonymized in accordance with law. Closing an account therefore does not necessarily result in the immediate deletion of every record.
10. Safeguards and incidents
We use administrative, technical, and physical safeguards proportionate to the sensitivity of the information. These include access restrictions, strengthened staff authentication, encryption, logging, document quarantine, and security controls.
No method eliminates every risk. We assess confidentiality incidents and notify affected individuals and the Commission d’accès à l’information when required by law.
12. Your rights
Subject to legal conditions and exceptions, you may request access to or correction of your information, withdraw consent, close your account, request cessation of dissemination where applicable, and obtain computerized information collected from you in a structured, commonly used technological format.
We may verify your identity before responding. If you are dissatisfied with how a request or complaint is handled, you may contact the Commission d’accès à l’information du Québec.
13. Minors
The portal is intended for representatives of professional organizations, not minors. We do not knowingly collect personal information from a minor through AtomesBio Pro.
14. Changes to this policy
We may change this policy to reflect developments in the portal, our practices, or legal requirements. The update date and version number appear at the beginning of the policy.
When a change is material, we will provide appropriate notice. Previous versions are available on request from the person in charge of the protection of personal information.