While Canada's privacy laws protect medical histories, diagnoses, and prescriptions from being sold or misused, a growing loophole involves health-adjacent data collected from smartwatches, fitness trackers, and loyalty card purchases. This data is not considered protected health information and can be bought and sold by data brokers and advertising platforms.
How Your Loyalty Card Exposes Health Information
When you purchase an over-the-counter supplement like saw palmetto (used for benign prostatic hyperplasia symptoms) and swipe your loyalty card, that transaction becomes commercial data. Unlike prescription medications such as Tamsulosin or Finasteride, which are protected health information, supplement purchases can be shared with data brokers or platforms like Meta, Google, or Amazon.
According to Tom Keenan, the author of the article, "Confirmation that they actually do this can be found in the published privacy policies of many companies, including Loblaws/Shoppers Drug Mart." These policies often mention that loyalty IDs and email addresses are "hashed" using SHA-256, giving an illusion of privacy. However, advertising platforms can match the hashed data with their own records to identify individuals and target ads.
The Illusion of Hashing and Data Broker Categories
Hashing does not guarantee anonymity because the same algorithm is used universally. Once matched, the platform knows exactly who you are. Data brokers sell groups of potential customers in categories like "aging men," "sport nutrition buyers," "sleep aid purchasers," and "ED concerns." This explains why users often see uncannily relevant ads.
Keenan highlights that "You have almost certainly been swept up in one or more of these groups." The accuracy of such data can be questionable—for example, a young man buying saw palmetto for his grandfather using his own loyalty card may be incorrectly categorized as having BPH.
Cross-Border Data Processing and U.S. Privacy Differences
Because U.S. and Canadian privacy laws differ significantly, it's important to note which companies process loyalty data in the U.S. The privacy policies of Loblaws/Shoppers Drug Mart, Sobeys/Safeway/Scene+, and Canadian Tire/Triangle Rewards all contain language such as "Your information may be processed in other countries." This means data can be transferred to the U.S., where it may be sold to insurance companies and employers—a practice that is legal there but could lead to increased premiums or denial of coverage or employment.
What Consumers Can Do
To protect health-adjacent data, consumers should be cautious about using loyalty cards for supplement purchases and consider paying with cash. Reviewing privacy policies and opting out of data sharing where possible can also help. However, the onus is largely on regulators to close the loophole between protected health information and commercial data.
