A loyalty card should not know what is in the medicine cabinet

My position is simple to state and expensive to keep. A retailer that runs pharmacies should decide, in advance and in writing, a list of conclusions about its customers that its data will not be used to draw. That list should bind marketing, personalised offers, supplier advertising and analytics alike, and consent should not be able to override it. At Mirebrook the list currently covers 38 categories of front-store product, and our board's audit and risk committee approves it every year.

I hold this view because of what our data could do, not because of a scandal. Mirebrook Circle has 10.6 million members who have shopped with us in the past year, and about four-fifths of front-store sales are made with a member card. Our dispensary records sit in a separate system, governed by provincial health-information law and by the obligations of the pharmacists who hold them, and they never enter the loyalty platform. That separation is necessary. It is not sufficient, because the front of the store tells its own story.

What a front-store basket says without being asked

A pregnancy test followed three weeks later by prenatal vitamins and unscented lotion is not a medical record. Neither is a monthly purchase of nicotine gum, a switch to adult incontinence products, a run of lice treatment, or a year of ovulation kits that suddenly stops. Each is an ordinary retail transaction. Taken together, over time and across ten million people, they become a register of conditions that customers may have mentioned to their pharmacist and certainly did not mention to our marketing department.

Our data scientists can detect most of these patterns with little effort. In 2022 a member of my team built, as an internal exercise, a model that flagged probable early pregnancy from front-store baskets alone. It was more accurate than I expected and less accurate than anyone using it would have assumed, which is the most dangerous combination. A false positive in that category is not a wasted coupon. It is a congratulatory offer sent to someone who has just miscarried, or a nappy promotion arriving in a shared household before the customer has told anyone at all.

I first met this problem in 1998, as a junior statistician on a household purchase panel, when a panellist withdrew because she had received coupons that she believed revealed what she bought. We had not sold her diary. A mailing house had matched area-level profiles bought elsewhere. She did not care about the mechanism, and she was right not to. The harm lay in the inference, not in the transfer, and almost every safeguard our industry has built since then concerns transfers.

Consent cannot carry this weight

The usual answer is consent: ask the customer, record the answer and respect it. I support consent and spent much of 2023 rebuilding ours, so that members now choose separately whether to receive personalised offers and whether their purchases may be used in supplier advertising. Sixty-one per cent agreed to the first and forty-four per cent to the second. Those figures mean something, because saying no costs a member nothing in points or prices.

Consent to personalised offers, however, is consent to a general practice. No member who agrees is thereby agreeing that we may conclude she is probably trying to conceive, that he is likely to be stopping smoking or that their teenager's acne needs a prescription. The federal privacy commissioner has long treated health information as sensitive and expected express consent for its use, and Québec's private-sector law, as amended in recent years, asks for express consent where information is sensitive. An inferred condition is arguably health information, whatever its source. I would rather not rely on winning that argument. A consent notice listing every inference we might draw would be unreadable, and a notice that does not list them is not meaningful for this purpose.

There is also a practical difficulty. Consent is given once and inference runs continuously. A member who agreed to offers in 2023 did not agree to whatever a model might learn to detect in 2027, with data we will have collected by then and techniques we do not yet use.

A refusal list the board approves

So we keep a list. It names product categories whose purchase, alone or in combination, could reveal a health condition, a pregnancy, a dependency, sexual activity or a disability: 38 categories today, from pregnancy and fertility tests to smoking cessation, incontinence care, lice treatment and sharps disposal. Purchases in those categories are excluded from the features available to personalisation models, from audiences offered to suppliers and from the segment reports our merchants receive. They remain in forecasting and replenishment, where they are needed to keep products on the shelf, and in store-level reporting.

The list costs money. Two consumer health manufacturers withdrew campaigns worth about C$9 million in 2024 when we would not build audiences from buyers of their own categories. Our partner network earned C$118 million that year against a plan of C$141 million, and the list explains part of the gap. It also costs accuracy, since a model denied these features predicts less well what a member will buy next.

The list has edges I cannot draw cleanly. Is a premium anti-ageing serum a health purchase? Is a fragrance-free sunscreen bought every fortnight for a child with eczema? We review contested categories with our chief privacy officer and two practising pharmacists, and we lean towards exclusion when the inference would embarrass a customer if spoken aloud at the counter. The test is not scientific. It is the one our customers would apply.

Why should the board own the list rather than management? Because the pressure to shorten it will come from business lines that would earn money without it, including teams I work with every day, and it will arrive in small, reasonable increments: one category this year, an exception for a brand's own buyers the next. A committee that approves the list annually, sees every proposed removal and asks who gains from it is a better guard than any single executive's resolve, mine included.

I am not asking other retailers to adopt our 38 categories. A sporting goods chain or a hardware retailer will hold different sensitive inferences, and fewer of them. I am arguing that every retailer holding purchase histories at scale should write its own list, apply it to marketing and advertising before the first supplier asks, and put it where the board can watch it being tested. The alternative is to discover the list one complaint at a time, and the first complaint usually arrives from the customer who least wanted to be noticed.