Privacy Policy

Last updated: 20 July 2026

LYFE Science operates the online store at https://lyfescience.ca. We sell lyophilized research peptides for in-vitro laboratory use only, and we ship within Canada only. This policy explains what personal information we collect, why we collect it, who we share it with, and what you can do about it. It is written to meet the requirements of Quebec’s Act respecting the protection of personal information in the private sector, as amended by Law 25 (formerly Bill 64), and of the federal Personal Information Protection and Electronic Documents Act (PIPEDA).

This policy applies to the website, to orders placed through it, to customer accounts, and to email we exchange with you.

1. Who is responsible for your personal information

LYFE Science, based in Quebec, Canada, is the enterprise responsible for the personal information described in this policy.

We have designated a Privacy Officer, who is accountable for our compliance with this policy and with Law 25. The Privacy Officer is reachable at support@lyfescience.ca. Please put “Privacy Officer” in the subject line so your message is routed correctly. The name and title of the individual currently holding this role will be provided to you on request, at the same address.

All requests described in this policy (access, rectification, withdrawal of consent, portability, complaints) go to that address.

2. What personal information we collect

2.1 Information you type in yourself

• Your first and last name.
• Your email address.
• Your shipping address, and your billing address if it differs.
• Your phone number, only if you choose to provide one. It is optional and used for delivery.
• Your order history: what you ordered, when, quantities, amounts, and order status.
• Account credentials, if you create an account: your username and a hashed version of your password. We never see or store your password in readable form.
• The content of any message you send us through our contact form or by email, including anything you choose to write in it.
• Your email address alone, if you subscribe to our newsletter without buying anything.

You can check out as a guest. If you do, we still collect the order and delivery information above, but no account is created and no password is stored.

2.2 Information collected automatically

• Your IP address.
• Browser type and version, operating system, device type, and screen characteristics reported by your browser.
• The pages you view on our site, the date and time, and the page that referred you.
• Cookies and session data, including your cart contents and, if you have an account, your logged-in session.

We do not run Google Analytics, we do not run a Facebook or Meta pixel, and we have no advertising or cross-site tracking scripts installed on this site. The automatic collection above comes from our hosting platform, from the store software itself, and from our spam filtering.

2.3 Payment information

We accept two payment methods: Interac e-Transfer, and cryptocurrency (Bitcoin, Ethereum, Solana, USDC, USDT) sent directly to wallets we hold ourselves.

Because of this, there is no credit card processor and no third-party payment gateway involved in our store. Concretely:

• We never collect, see, process, or store credit card numbers, debit card numbers, CVV codes, or bank account numbers. There is no field on our site that asks for them, and no such data ever reaches us.
• For Interac e-Transfer: when your transfer arrives, our store’s email inbox receives a notification from your financial institution. That notification contains the sender name shown on the transfer, the amount, and a reference. We read those notification emails automatically in order to match the incoming payment to the correct order. We do not receive your account number, your card number, or your banking credentials, and we do not have access to your bank account.
• For cryptocurrency: we record the receiving wallet address we gave you, the sending wallet address as it appears on the public blockchain, the amount, and the transaction identifier (hash). Blockchain transactions are public by nature and are recorded on a network we do not control and cannot alter or erase.

3. Why we collect each category, and on what basis

• Name, shipping address, phone: to pack your order, to create the Canada Post shipping label, and to let the carrier deliver it or contact you about a delivery problem.
• Email address: to send order confirmation, payment instructions for your chosen method, payment confirmation, tracking information, and to answer your questions.
• Order history: to process and ship your order, to handle a claim about a package that arrived damaged or did not arrive, and to keep the accounting and tax records Canadian and Quebec law requires us to keep.
• Account credentials: only to let you log in and see your own orders and addresses.
• e-Transfer sender name and amount: solely to reconcile an incoming payment with an open order, so we know which order to release for shipping.
• Crypto wallet address and transaction hash: solely to confirm that a specific payment arrived for a specific order, and to resolve underpayment or overpayment.
• IP address, browser and device data: to keep the site working, to detect and block fraudulent orders and abuse, and for our host to maintain security logs.
• Cookies and session data: to keep your cart from emptying between pages and to keep you logged in.
• Contact form content: to answer you, and to filter spam submissions.
• Newsletter subscription: only to send you the emails you asked for.
• Age confirmation: our products are restricted to persons who are 19 years of age or the age of majority in their province, whichever is greater. We record the fact that you confirmed this.

We do not use your personal information for automated profiling or for advertising targeting.

4. Consent

We ask for your consent separately for separate things, in clear terms, at the moment we need it.

• Order processing. By placing an order you consent to our using your name, address, contact details and payment reference to fulfil that order. This is necessary: we cannot ship a package without a name and an address.
• Marketing. Newsletter and promotional email require a separate, explicit opt-in. It is never pre-checked and it is never bundled into checkout. Consenting to marketing is not a condition of buying anything.
• Optional fields. Anything marked optional, such as your phone number, is collected only because you chose to give it.

Withdrawing consent. You can withdraw your consent to marketing at any time, either by clicking the unsubscribe link at the bottom of any newsletter, or by writing to support@lyfescience.ca. Withdrawing marketing consent has no effect whatsoever on your orders, your existing account, or our willingness to serve you.

You may also withdraw consent to other uses of your personal information by writing to the Privacy Officer. Where the information is genuinely required to complete a transaction you have already started, or where we are legally required to retain it (for example, tax records), we will tell you what we cannot delete and why.

5. Who we disclose personal information to

We do not sell, rent, trade, or otherwise commercialize your personal information. Ever. No exceptions, and no “partner” arrangements.

We share the minimum necessary with the following categories of service providers, each of which is bound to use it only to provide their service to us:

We may also disclose personal information where the law requires it: to a court, to a law enforcement or regulatory authority acting under valid legal authority, or where necessary to establish or defend a legal claim. If we ever receive such a demand, we disclose only what is legally required.

6. Transfers and storage outside Quebec and outside Canada

You should know this clearly: some of our service providers store and process personal information on servers located outside Quebec, including outside Canada, primarily in the United States. This applies in particular to our hosting platform, our spam filtering, and our newsletter tooling.

Personal information stored in another jurisdiction is subject to the laws of that jurisdiction, and may in some circumstances be accessible to foreign courts, law enforcement, or government authorities under the laws that apply there. We cannot change that.

Under Law 25, before communicating personal information outside Quebec, we are required to conduct a privacy impact assessment of the transfer, taking into account the sensitivity of the information, the purposes of its use, the protection measures the recipient applies, and the legal framework of the destination jurisdiction. We perform that assessment for the transfers described above, and we will not use a service provider where the assessment shows the information would not receive adequate protection. You may ask the Privacy Officer for information about a specific transfer.

7. How long we keep it, and what happens then

• Order and transaction records (including the payment reference used to reconcile the order): kept for seven (7) years from the end of the fiscal year of the transaction, which is the period Canadian and Quebec tax and commercial record-keeping rules require.
• Customer account data (profile, saved addresses, credentials): kept while your account is open. If you ask us to close your account, we delete the account and its credentials and retain only the order and transaction record described above for the legally required period.
• Newsletter subscription data: kept until you unsubscribe, plus a suppression record (your email address, flagged as unsubscribed) so we do not accidentally email you again.
• Contact form and email correspondence: kept up to 24 months after the exchange closes, unless it relates to an ongoing claim or dispute.
• Server, security and spam-filter logs: kept for the period set by the provider, generally short, and used only for security and troubleshooting.

When the retention period ends and no legal obligation requires us to keep the information, we destroy it or anonymize it so that it can no longer be used to identify you. Destruction covers digital copies and any backup once that backup is rotated out.

One limitation we must be honest about: blockchain transaction records are public and permanent. If you paid in cryptocurrency, the transaction exists on a public network we do not own and cannot edit or delete. We can delete our own internal note linking that transaction to your name and order, and we will, but we cannot remove the transaction from the blockchain.

8. Your rights

Under Law 25 and PIPEDA you have the following rights over your own personal information. All of them are exercised free of charge by writing to support@lyfescience.ca, subject line “Privacy Officer”. We will respond within 30 days.

• Right of access. You may ask us to confirm whether we hold personal information about you, and to give you a copy of it, along with information about how it is used and who it has been communicated to.
• Right of rectification. If information we hold about you is inaccurate, incomplete, or ambiguous, or if it was collected in a way not permitted by law, you may require us to correct or delete it.
• Right to withdraw consent. As described in section 4, including for marketing, at any time and without penalty to your orders.
• Right to de-indexation and to cessation of dissemination. Where the law allows, you may require us to stop disseminating personal information about you, or to de-index a hyperlink that gives access to it, in particular where the dissemination causes serious injury to your reputation or privacy and the request is not disproportionate to the public interest in the information.
• Right to data portability. You may ask us to give you the computerized personal information you provided to us in a structured, commonly used technological format (we provide it as CSV or JSON). You may also ask us to transmit it directly to another person or organization authorized by law to collect it, where doing so is technically feasible.
• Right to information about automated decisions. If a decision affecting you were ever based exclusively on automated processing of your personal information, we must inform you of that at or before the time of the decision, tell you what personal information was used, explain the principal factors and parameters that led to it, and let you submit observations to a member of our staff who can review the decision. To be clear about our current practice: we do not assess you, score you, or decide anything about you as an individual by automated means. Our e-Transfer matching is a reconciliation step rather than an assessment of a person: it compares the amount stated in a payment notification against the amount owed on unpaid orders, and marks an order paid when exactly one order matches that amount. Where an amount is ambiguous, or matches more than one order, nothing is decided automatically and the payment is left for a person to review.
• Right to be informed of collection. You may ask us, at the time of collection or afterwards, why we are collecting a given item, how it will be used, and whether providing it is optional.

We may ask you to confirm your identity before acting on a request, so that we do not hand your information to someone else. We will only ask for what is needed to verify you.

9. Confidentiality incidents

A “confidentiality incident” means unauthorized access to, unauthorized use of, unauthorized communication of, or loss of personal information, or any other breach of its protection.

If one occurs, we commit to the following:

• Take reasonable measures immediately to reduce the risk of injury and to prevent new incidents of the same kind.
• Assess whether the incident presents a risk of serious injury, taking into account the sensitivity of the information, the anticipated consequences of its use, and the likelihood that it will be used for an injurious purpose.
• If there is a risk of serious injury, promptly notify the Commission d’accès à l’information du Québec and notify each affected individual, unless doing so would hinder an investigation, and in that case notify as soon as we are able.
• Maintain a register of confidentiality incidents, as Law 25 requires, and provide a copy of it to the Commission on request.

10. How we protect personal information

We describe here only measures that are actually in place. We do not claim any certification, external audit, or compliance seal, because we hold none.

• The site is served over HTTPS, so traffic between your browser and the site is encrypted in transit.
• Account passwords are stored as salted hashes by the store software, not as readable text.
• Access to the store administration and to the store email inbox is limited to the small number of people who need it to run the business, each with their own credentials.
• We reduce our own exposure by design: because we take no card payments, there is no card data on our systems to lose.
• Hosting-level security, backups and infrastructure patching are handled by our hosting platform.

No system is perfectly secure, and we do not promise that ours is.

11. Cookies

Cookies are small files placed on your device by your browser. We use them for the following:

• Cart cookies: remember what you put in your cart as you move between pages. Without these, the store cannot function.
• Session cookies: keep your session consistent while you browse.
• Login cookies: if you have an account and log in, keep you logged in and remember your display preferences. Removed when you log out.
• Security and spam cookies: set by our host and by our spam filtering to distinguish a genuine visitor from an automated one.
• Preference cookies: remember choices such as a dismissed notice, so you are not shown it repeatedly.

We do not set advertising cookies, retargeting cookies, or cross-site tracking cookies, because none of those tools are installed on this site.

Controlling cookies. Every major browser lets you see the cookies stored, delete them, block third-party cookies, or block cookies entirely, in its privacy or security settings. You may also browse in a private window, which discards cookies when you close it. Be aware that blocking cookies for our site will break the cart and login, so you will not be able to place an order.

12. Children and age requirement

Our products are restricted to persons who are at least 19 years old or the age of majority in their province of residence, whichever is higher. The site is not directed at minors and we do not knowingly collect personal information from a minor. If we learn that we have, we delete it. If you believe a minor has given us information, write to support@lyfescience.ca and we will remove it.

13. Changes to this policy

If we change how we handle personal information, we will update this page and change the “Last updated” date at the top. If the change is significant, for example a new category of information collected or a new category of recipient, we will describe it clearly at the top of the page, and where the law requires it, we will ask for your consent again.

14. Questions and complaints

Step one: contact us. Send any question, access request, correction request, or complaint about your personal information to the Privacy Officer at support@lyfescience.ca, with “Privacy Officer” in the subject line. We will acknowledge your message, examine it, and give you a written answer within 30 days. If we refuse a request in whole or in part, we will tell you the reason, the legal basis, and how to challenge the decision.

Step two: the regulator. If you are not satisfied with our answer, or if we do not answer within the time allowed, you have the right to file a complaint with the Commission d’accès à l’information du Québec, which oversees the protection of personal information in Quebec, and to apply to it for a review of our decision. Its contact details and complaint procedure are published on its website. Residents outside Quebec may also address a complaint to the Office of the Privacy Commissioner of Canada.

Using our internal process first is not required in order to go to the Commission, but it is usually the fastest way to resolve a problem.