Lab analysis is performed independently by a C-NRPP-listed laboratory. Results are reported against the Health Canada guideline of 200 Bq/m³. RadonTest.ca™ provides a Managed Testing Service with online registration, reminders, bilingual Canadian support and access to laboratory results. RadonTest.ca™ does not provide medical advice or health assessments.
Privacy policy
Effective Date: May 7, 2026
Last Updated: September 30, 2026
RadonTest.ca™ ("we," "us," or "our") operates the RadonTest.ca™ website and guided radon testing service (the "Services"). RadonTest.ca™ is powered by Shopify. This Privacy Policy describes how we collect, use, and disclose your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA), Quebec's Act respecting the protection of personal information in the private sector (Law 25), and applicable Canadian privacy laws.
If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to personal information.
By placing an order or using our Services, you consent to the collection and use of your personal information for service delivery and customer support. Use of your test result for research, public health, or commercial licensing is governed by separate, granular consent captured at registration (see Section 6).
1. Information We Collect
- Contact information: name, email, phone (if provided, for support purposes only), shipping and billing address.
- Payment information: handled by Shopify Payments — we do not store credit card numbers.
- Order information: items purchased, order date, transaction details, browsing/cart activity.
- Radon test results: Bq/m³ value associated with your shipping address; test start and end dates.
- Service interaction data: emails sent and received, reminder history, return tracking, audit log of changes to your test record.
- Home characteristic data (collected at registration): home type, floors above grade, approximate home size, the decade the home was built — or the exact year, where you choose to provide it — foundation type, floor where the detector is placed, test purpose (initial test, retest, real estate, post-mitigation, new construction within the 7-year warranty period, commercial), and whether a mitigation system is currently installed.
- Communications with us: information you include in support inquiries.
- Device and usage information: IP address, browser and device, pages visited and actions taken on the site, and advertising identifiers, via cookies and similar technologies (see Section 10).
Registration fields we are introducing. We are expanding the registration form so your results come with more useful context. When these fields appear they will include: whether you own or rent; your water supply (municipal or private well); the room the detector is in and whether it is used daily; any radon equipment already in the home (a capped rough-in pipe, a passive stack, or an active system); and — for newer Ontario homes only — new-home warranty enrolment and approximate possession year. You may also choose to add a short private note to help you find your own detector at the end of the test, a second household contact who receives only the “time to end your test” and “test not received” notices, and a mobile number for those two text messages. Every one of these is optional, with “not sure” and “prefer not to say” available. We describe them here in advance so there are no surprises; until they appear at registration, we do not collect them.
Radon test results linked to your address are sensitive personal information. Express consent is required for any use of these results for research or commercial purposes (see Section 6).
2. How We Collect Your Information
- Directly from you when you place an order, register, or contact us.
- Automatically via cookies and similar technologies when you use the Services.
- From service providers acting on our behalf.
3. How We Use Your Information
- Order fulfilment and service delivery: process orders, ship kits, send placement instructions and reminders, return coordination, deliver results.
- Test context and placement guidance: tailor your results report based on home characteristics.
- De-identified research and data initiatives (granular express consent — see Section 6).
- Customer support: respond to inquiries and resolve issues.
- Understanding regional demand: we count what visitors search for on the radon map, by postal prefix or area, so we know which parts of Canada are looking for radon information and where to focus our public information and advertising. These counts are aggregate and are not linked to any individual.
- Advertising: where you consent to marketing cookies, measuring whether our ads lead to orders, improving how those ads are delivered, and showing our ads to people who have visited our site — on Google, Meta (Facebook, Instagram), Microsoft (Bing) and, when we advertise there, TikTok and Pinterest (see Sections 4 and 10).
- Marketing emails: only where you have opted in via your preferences page at portal.radontest.ca/preferences. You can change this at any time; transactional emails (order confirmation, reminders, results) are always sent regardless of marketing preference.
- Security and fraud prevention.
- Legal and compliance.
- Service improvement using aggregate, de-identified data.
4. How We Share Your Information
We use a small number of third-party service providers to operate RadonTest.ca — for storefront and checkout, hosting, database, email, shipping, laboratory analysis, product reviews, and website analytics and advertising. Each receives only the data it needs to perform its function. We require all service providers to protect your information at a level comparable to PIPEDA. Advertising platforms also use the information they receive under their own terms and privacy policies, including to improve their advertising services. We do not sell, rent, or trade your personal information for marketing purposes.
| Recipient | Data Shared |
|---|---|
| Shopify Inc. | Name, email, address, payment, order details |
| Vercel Inc. | All operational personal information |
| Supabase (Canadian region) | All personal information |
| Resend | Email, name, message content |
| Canada Post | Name, shipping address |
| ShipStation | Name, shipping address |
| Lex Scientific Inc. (Guelph, ON — C-NRPP-listed laboratory) | Name, address, detector barcode, floor tested, test dates |
| Vercel Analytics | IP, page views |
| Google LLC / Google Ireland Ltd. (Google Analytics 4, Google Ads) | Website analytics and advertising: pages viewed; actions such as searches, button clicks, product views, add-to-cart, checkout steps and purchases, with order value and items; IP address and approximate location; device and browser type; and advertising identifiers such as cookies and ad-click identifiers. Where you consent to marketing cookies, conversions such as purchases are also sent — from your browser or directly from our store’s servers — with your email address, phone number, name and street address in hashed (coded) form, and your postal code, city, province and country in readable form, so Google can match them to its users (“enhanced conversions”). Loaded only where permitted — see Section 10. Map searches are recorded as the three-character postal prefix only (for example “K7A”). We never send your radon result to Google. |
| Meta Platforms Ireland Ltd. (Facebook, Instagram) | Advertising on Facebook and Instagram: pages viewed; actions such as product views, add-to-cart, checkout steps and purchases, with order value and items; IP address; device and browser information; and Meta cookie identifiers. Where you consent to marketing cookies, these events are also sent with your email address, phone number, name, city, province, postal code and country in hashed (coded) form so Meta can match them to its users — from your browser and directly from our store’s servers (Meta’s Conversions API). Loaded only where permitted — see Section 10. We never send your radon result to Meta. |
| Microsoft Corporation (Microsoft Advertising — Bing) | Advertising on Bing and Microsoft’s advertising network: pages viewed; actions such as product views and purchases, with order value; IP address; device and browser information; and Microsoft advertising identifiers. Where you consent to marketing cookies, conversions may also be sent with your email address and phone number in hashed (coded) form. Loaded only where permitted — see Section 10. We never send your radon result to Microsoft. |
| TikTok (TikTok for Business) — when we advertise on TikTok | Advertising on TikTok: pages viewed; actions such as product views, add-to-cart, checkout steps and purchases, with order value and items; IP address; device and browser information; and TikTok cookie identifiers. Where you consent to marketing cookies, these events may also be sent with your email address and phone number in hashed (coded) form — from your browser and directly from our store’s servers. Loaded only where permitted — see Section 10. We never send your radon result to TikTok. |
| Pinterest, Inc. — when we advertise on Pinterest | Advertising on Pinterest: pages viewed; actions such as product views, add-to-cart, checkout steps and purchases, with order value and items; IP address; device and browser information; and Pinterest cookie identifiers. Where you consent to marketing cookies, these events may also be sent with your email address, phone number, name and address details in hashed (coded) form — from your browser and directly from our store’s servers. Loaded only where permitted — see Section 10. We never send your radon result to Pinterest. |
| Radonova Laboratories AB (Uppsala, Sweden — accredited radon laboratory) — for tests analysed in Sweden; see Section 8 | Detector barcode, your name and email address, the test address the certificate is issued to, the type of building, the floor and room tested, and test start and end dates. No payment information. |
| Judge.me (product reviews) | After your results are delivered, we ask Judge.me to email you a request to review your purchase: your name, email address and details of the product you bought. Judge.me’s app also syncs our store’s orders — including buyers’ names, email addresses and the products ordered — so it can mark reviews from real buyers as verified. If you leave a review, it is published under the name you provide. Its storefront analytics load only where permitted — see Section 10. |
| Shopify analytics and web pixels | Storefront and checkout usage data used to operate and secure the store. |
We may also disclose personal information when you direct us to, in connection with a business transaction (with notice), or to comply with legal obligations.
5. Relationship with Shopify
Services hosted by Shopify, which collects and processes information to provide the Services. Information may be transmitted to Shopify and third parties in countries other than where you reside. See Shopify's Consumer Privacy Policy and Shopify Privacy Portal.
6. De-Identified and Aggregated Data — Granular Consent
Because address-linked radon results are sensitive personal information, your consent for any research, public health, or commercial use of this data is captured separately at registration via explicit, granular opt-in. You may decline any or all of these uses without affecting your test service.
During registration, you will be asked to choose, independently, whether to permit each of the following uses of your de-identified result:
- Tier 1 — Public radon awareness map and public health research: a publicly accessible map showing aggregated radon levels by Forward Sortation Area (the first three characters of your postal code), and contributions to public health agencies (Health Canada, provincial health authorities).
- Tier 2 — Academic research: your individual de-identified record may be shared with academic researchers under a Data Use Agreement that prohibits any attempt to re-identify individuals.
- Tier 3 — Commercial data licensing: your de-identified result may be included in datasets licensed commercially to real estate data providers and building science researchers. RadonTest.ca will never disclose your name, address, or contact information.
De-identification methodology. We remove all direct identifiers (name, full address, email, phone, payment data) before any data is used in research or licensed externally. We use the first three characters of your postal code (Forward Sortation Area) rather than the full postal code, and home characteristics are recorded in ranges rather than exact values. We suppress any FSA with fewer than 20 results from external publications and licensing exports to reduce re-identification risk in low-density areas. Despite these measures, we cannot guarantee absolute anonymization — we use "de-identified" to reflect this technical reality.
Withdrawal. Change preferences anytime at portal.radontest.ca/preferences or email privacy@radontest.ca. Withdrawal stops future use of your record; we make reasonable efforts to remove your record from datasets in active circulation, subject to active Data Use Agreements.
Your service is unaffected by your choice. Whether you opt in to none, one, two, or all three tiers, you receive the full RadonTest.ca testing service.
7. Data Storage and Security
Primary customer database stored on Canadian servers. Shopify holds commerce and payment data on its own infrastructure. Some services (email, shipping label generation, analytics and advertising) may process your information outside Canada — see Section 8.
Protections include:
- Encryption in transit (HTTPS/TLS) and at rest.
- Row-level security on the database; role-based admin access.
- Multi-factor authentication on all admin accounts.
- API keys in secure environment variables, never in code.
- Audit logging of all admin access to customer data.
- Rate limiting and bot defenses on portal endpoints.
- Content Security Policy and other HTTP security headers.
Address-linked radon results are classified as sensitive PII; access restricted to authorized personnel on a need-to-know basis with full access logging.
No method of electronic storage is 100% secure. We take reasonable measures and recommend you avoid unsecure channels for confidential information.
8. International Transfers and Privacy Impact Assessment
Your primary record is stored on Canadian servers. Some service providers operate outside Canada, where information may be subject to foreign laws. This includes providers in the United States and the United Kingdom, and — as we bring a second accredited laboratory online — Radonova Laboratories AB in Sweden, which is subject to Swedish law and the European Union’s General Data Protection Regulation. Where a test is analysed in Sweden, the laboratory receives the detector barcode, your name and email address, the test address the certificate is issued to, the type of building, the floor and room tested, and the test dates. It receives no payment information. Before any personal information is transferred to Radonova, we complete a Privacy Impact Assessment for that transfer under Quebec Law 25 and put a written data-processing agreement in place; we will identify the analysing laboratory on your order and results.
Analytics and advertising platforms — Google, Meta, Microsoft and, when we advertise there, TikTok and Pinterest — may process the information described in Sections 4 and 10 in the United States and in other countries where they operate.
Pursuant to Quebec Law 25, RadonTest.ca conducts a Privacy Impact Assessment (PIA) for transfers of personal information outside Quebec. The PIA is reviewed annually and is available to Quebec residents on request at privacy@radontest.ca.
We contractually require service providers to protect your information at a level comparable to PIPEDA.
9. Data Retention
- Order and contact information: 7 years after most recent order activity.
- Radon test results: 7 years from analysis date, then de-identified for aggregate research or deleted on request.
- Home characteristic data: same schedule as test results.
- Email records: 7 years for service delivery evidence.
- Consent records: retained indefinitely as audit trail of your consent decisions (PIPEDA accountability).
- Website analytics: aggregate, non-identifying counts of what visitors search for on our radon map — the three-character postal prefix or area name only — are kept indefinitely as a record of public interest by region. The underlying individual records are deleted within 14 days. Analytics held by Google Analytics is retained according to Google’s settings, currently 14 months.
- Advertising data: kept by each advertising platform according to its own policies and our account settings.
- Payment information: per Shopify's retention policies.
De-identified aggregate data, where consented under Section 6, may be retained indefinitely after the 7-year period. You may request deletion at any time, subject to technical limitations on data already in circulating aggregate datasets.
10. Cookies and Tracking Technologies
Strictly necessary cookies. These are required for the site to function — shopping cart, checkout, login session, and basic site security. They cannot be disabled because the site cannot operate without them.
Analytics and advertising technologies. We use Google Analytics 4 to understand how the site is used — which pages are visited, what visitors search for on the radon map, and which links they use. We use advertising technologies from Google (Google Ads), Meta (Facebook, Instagram), Microsoft (Bing) and, when we advertise there, TikTok and Pinterest to measure whether our ads lead to orders, to improve how our ads are delivered, and to show our ads to people who have visited our site. Shopify, our storefront platform, also collects usage data to operate and secure the store. These are not strictly necessary. They set cookies or similar identifiers and share data with these companies as described in Section 4.
Matching your visit or purchase to an ad. Where you consent to marketing cookies, we share contact details you give us at checkout — such as your email address, phone number, name and address — with these advertising platforms so they can match your visit or purchase to their own users and tell us which ads led to an order. These details are hashed (converted into a coded form) before they are sent, except that Google receives your postal code, city, province and country in readable form. Hashed details are not readable as sent, but each platform can compare them with its own records — that is how the matching works. Some of this information is sent directly from our store’s servers rather than from your browser (for example, Meta’s Conversions API); it is sent only if you have consented.
What we never send. We never send your radon result, or the information you give us when you register your test (such as details about your home), to any analytics or advertising platform. Where we record what was searched on the radon map, we record only the three-character postal prefix (for example “K7A”) or the area name — never a full postal code.
First-party performance metrics. Vercel Analytics measures page performance without third-party tracking cookies and aggregates visit data without identifying individual users.
Your choices. You can block or delete cookies in your browser settings; strictly necessary cookies will still be set, and blocking others will not affect your ability to buy or register a test. You can opt out of Google Analytics across all sites using Google’s browser add-on, and manage how each company personalizes ads in your Google, Meta, Microsoft, TikTok or Pinterest account settings. Non-essential technologies — including information sent from our store’s servers to advertising platforms — are used only after you consent.
Quebec residents. Under Quebec Law 25, technologies that are not strictly necessary require your consent before they are used. You will be asked for that consent, and you may withdraw it at any time using the Cookie preferences control in the site footer or by contacting privacy@radontest.ca.
11. Your Rights and Choices
Under PIPEDA (with additional Quebec Law 25 rights for QC residents):
- Access — request a copy of personal information we hold about you.
- Correction — request correction of inaccurate or incomplete information.
- Deletion — request deletion (subject to legal retention obligations).
- Withdraw consent — anytime, subject to legal or contractual restrictions.
- Data portability — receive a structured copy and request transfer.
- De-indexation (Quebec) — in certain circumstances.
- Communication preferences — manage marketing and reminder preferences at portal.radontest.ca/preferences, or unsubscribe via the link in any marketing email.
Self-service: manage all consents and request data export or deletion at portal.radontest.ca/preferences. Or contact privacy@radontest.ca — we respond within 30 days, no fee, no discrimination.
12. Breach Notification
If a data breach creates a real risk of significant harm, we will:
- Notify you within 72 hours of becoming aware.
- Report to the Office of the Privacy Commissioner of Canada and (where applicable) Commission d'accès à l'information du Québec.
- Describe the breach, information involved, and steps we're taking.
- Provide guidance to protect yourself.
Records of all security safeguard breaches retained for minimum 24 months and available to the Privacy Commissioner upon request.
13. Third Party Websites and Links
Third-party links are not endorsed; review their policies.
14. Children's Privacy
Services not directed to individuals under 18. We do not knowingly collect children's personal information. Parents/guardians may contact us to request deletion.
15. Changes to This Policy
Updates posted with revised "Last Updated" date. Material changes communicated by email where possible. Where a change materially affects how your data is used, renewed consent will be requested at your next interaction.
16. Complaints
Contact our Privacy Officer at privacy@radontest.ca. Acknowledged within 7 days. Unresolved complaints may go to the Office of the Privacy Commissioner of Canada (www.priv.gc.ca) or, for Quebec residents, the Commission d'accès à l'information du Québec (www.cai.gouv.qc.ca).
17. Privacy Officer and Contact
Designated Privacy Officer: Ger McNamee, founder of RadonTest.ca, reachable at privacy@radontest.ca.
RadonTest.ca maintains an internal privacy management program reviewed annually.
RadonTest.ca™ — Operated by 1514890 Ontario Inc.
11E-900 Greenbank Road, #510, Nepean, Ontario K2J 4P6
Phone: (613) 690-6328 • Email: support@radontest.ca