Last updated May 7, 2021

Reformulary Group Inc. (“Reformulary Group”, “we”, “us” or “our”) is committed to your privacy, and we take your privacy seriously. In this Privacy Policy we have documented what you should know about our commitment to protecting the confidentiality of your personal information.

This Privacy Policy applies to the information which you may provide, or that we may obtain from you, through your use of the Cannabis Standardservice (“Cannabis Standard” or the “Service”), available through our Cannabis Standard website (“Website”).

By using our Service or otherwise providing use with personal information, you are confirming that you are authorized to agree (including under applicable age of majority laws) and that you agree to the terms of this Privacy Policy and consent to our policies and practices for the collection, use, storage, disclosure and retention of personal information for the purposes identified in and in accordance with this Privacy Policy, and for the purposes identified to you prior or at the time you provided the personal information. If you are not authorized to agree or you do not agree with this Privacy Policy, you should not use our Service or provide us with personal information.

What is privacy and why does it matter?

Privacy is about more than just protecting the personal information you may share through the use of our Service, or when using our Website. Privacy is also about our obligation to use and disclose this information only for the purposes that are stated in our Privacy Policy.

Our commitment to protecting your privacy

Reformulary Group’s mandate is to support our clients in receiving the maximum value from their drug plan. As we aim to provide you and our clients with the best services, we may collect, use and/or disclose your personal information (which may include your personal health information). Our Privacy Policy sets high standards for collecting, using, disclosing and storing personal information in these specific cases. We also take great care to keep your personal information accurate, confidential and secure.

This Privacy Policy, our Privacy Code, and our privacy practices represent the parameters within which we manage privacy matters and protect personal information. You should read this Privacy Policy carefully. This Privacy Policy is incorporated into and forms part of our Cannabis Standard Terms of Use.

If you have any questions about our Privacy Policy, please contact our Chief Privacy Officer at (416) 519-9729 or privacyofficer@reformulary.com.

Privacy Policy

How we collect, use and disclose personal information?

We only ask you for the information we need

We will collect only the information we need for the purposes identified to you at the time of collection. We do not sell, rent, lease or otherwise disclose to third parties any personal information collected from you, except as provided for in this Privacy Policy or as identified to you prior to or at the time information is collected.

Why we need the information

We may collect and use personal information to:

• provide the Service to you;
• register you for a personal account on the Website and to authenticate users for security purposes;
• understand your needs, and to communicate with you about your account and needs;
• respond to any inquiries or correspondence you may send to us;
• provide customer service and support to you;
• understand our clients’ specific needs in connection with the provision of our services;
• analyze and interpret your data to provide maximum value from drug plans;
• understand, research and improve the services and products we offer, including compiling aggregated and anonymized data for research, marketing and analytics purposes;
• notify you in connection with changes to our Service or this Privacy Policy;
• communicate with you about Reformulary Group, our services and products, if you opted in to allow us to do so;
• respond to your requests to access and amend your personal information;
• cross reference with the personal information you previously provided to us to ensure its accuracy;
• protect you, our clients, our service providers and us against fraud;
• detect, prevent or mitigate security or technical issues relating to the Website and our Service;
• enforce our Terms of Use; and
• meet legislative, regulatory or contractual requirements as well as implement risk management programs and procedures relating to the Service and products provided to you.

In the event we wish to use your personal information for any other purpose, other than as set out in this Privacy Policy, we will obtain your consent before using the information for such other purpose. We will make sure you understand why we need the information by using clear, understandable language.

We will obtain your permission

We collect, use and disclose your personal information with your permission.

Your permission may be expressed in writing or be implied when you provide us with information verbally, electronically, or through your authorized representative.

You may withdraw your permission to collect, use and disclose your personal information at any time, subject to legal and contractual restrictions and reasonable notice, by contacting our Chief Privacy Officer at (416) 519-9729 or privacyofficer@reformulary.com. When you withdraw your permission, some of your access to and use of the Service may be impacted, and we may not be able to offer you access to the Service any longer.

Where medical or health information about you is collected or disclosed, we will obtain your consent prior to doing so. We will not share it, unless your consent has been obtained or we are required to so by law.

Before we make personal information available to third parties, other than an authorized employee, agent or service provider who needs it, or except as required by law or where Reformulary Group reasonably believes it is necessary to do so to comply with the law, we will tell you at the time we obtain your consent or before we make the information available, who those persons or organizations are, the kind of information we want to share with them and why.

We will limit how long we keep information

We will keep your personal information only as long as it is necessary for the purposes for which it was collected, or as required by law.

When we destroy personal information, we will use safeguards to prevent unauthorized parties from gaining access to the information during the process.

We will protect your personal information

We are responsible for your personal information

We are responsible for all personal information in our possession so that we can provide you with the Service. We store and process all your personal information within Canada.

We may, in the future, use service providers outside Canada to store and process your personal information on our behalf. These service providers are only permitted, and all other service providers are only and will only be permitted, to store and process your personal information, and are not otherwise authorized to collect, use or disclose your personal information, except in accordance with the purposes set out in this Privacy Policy or as required by applicable laws of those foreign jurisdictions. In such circumstances, there is a risk that your personal information may be accessible to law enforcement and national security authorities in jurisdictions outside Canada in which our service providers are located.

In some instances, such when you make payments through a third-party service provider, that third-party may collect personal information directly from you and the third-party service provider may be located in jurisdictions outside Canada. If that is the case, then your personal information may be subject to the laws of those foreign jurisdictions. Each of the third-party service providers will have their own privacy policies and procedures, which may or may not contain the same protections as Cannabis Standard’s Privacy Policy.

This Website contains links to websites operated by other parties (“Linked Sites”). The Linked Sites are not under the control of Reformulary Group, and Reformulary Group is not responsible for the content available or privacy practices on any such Linked Sites. View our Terms of Use for more information. Please review the terms of use and privacy policies of any website you access.

How we protect information

Access to your personal information is restricted to our employees, authorized service providers and partners who need it to do their jobs.

We have developed and are continuing to enhance security procedures to safeguard and protect personal information against loss, theft, unauthorized disclosure, copying, and unauthorized use or modification. We will maintain appropriate safeguards and security procedures that reflect the types of documents, including electronic or paper records, organizational measures such as security clearances and limiting access on a "need-to-know" basis, and technological measures such as the use of passwords and encryption. While we endeavor to protect all information, the most sensitive information, such as health information, receives the highest level of protection.

Notwithstanding these measures, no collection, storage or transmission of information over the Internet on websites or otherwise can be guaranteed to be 100% secure, and therefore we cannot ensure, warrant or guarantee that there will be no unauthorized access, hacking, data loss or breaches of our security safeguards. Accordingly, you should not transmit personal information to us over the Internet if you consider that information to be sensitive.

If you suspect that the personal information you provided to us has been improperly accessed or used, please contact our Chief Privacy Officer at (416) 519-9729 or privacyofficer@reformulary.com.

Your right to access your personal information

You have the right to ask whether we hold any personal information about you and to see that information, as provided by law.

You also have the right to know:

• how we collected your personal information,
• how we are using it, and
• to whom it may have been disclosed.

To access your personal information, please contact our Chief Privacy Officer as set out below and we will assist you. You may be required to put your request in writing to confirm your request and identity.

Under certain circumstances, it is possible that we may not be able to provide you with all of the information you may have requested. For instance, we may not be able to provide you information that contains references to other individuals, information that cannot be disclosed for legal, security or commercial proprietary reasons, or information that is subject to solicitor-client or litigation privilege. Fees may also be applied to any copy of the requested personal information. We may decide to provide you access to your personal health information through a health practitioner.

If you believe we have not dealt with your request to your satisfaction, you can submit a complaint to us to resolve your privacy-related issue.

How to request an update or correction

If you believe any of the information we have collected about you is incorrect or incomplete, you have the right to ask us to change it.

If you show that your personal information is inaccurate or incomplete, we will take all reasonable measures to make the necessary changes.

If you feel we have not dealt with your request to your satisfaction, you can follow our complaint resolution procedures.

Personal Information and Online Security

When you visit the Website you are anonymous unless you voluntarily choose to identify yourself. You are not required to provide personal information to use our Website unless a feature requires it. If a feature does require providing personal information, in these specific cases, we have physical, electronic and procedural safeguards in place to help protect your online personal information from unauthorized use or improper access.

Although we have physical, electronic and procedural safeguards that are commercially and reasonably adequate to protect personal information, any such systems may be subject to human and operational error or inadvertent access. In particular, because the Internet is an open system, we cannot and do not guarantee that personal information entered by you online will not be misappropriated, intercepted, modified, deleted or used by others.

Online Data Collection Tools: Improving And Evaluating Website Functionality and Effectiveness

Like many organizations, Reformulary Group may from time to time gather data regarding how visitors explore our Website - information about the number of new and repeat visitors, where on the Website a visitor explores, how long they visit, and similar details. All such information is collected in an aggregate form and is used to improve our Website performance and functionality, create a better experience for our visitors, analyze trends, track movements around the Website, generate aggregate reports and measure the response to web marketing campaigns.

Passive Information Collection

The Website uses various technologies to passively collect information from you while you are visiting (that is, you do not actively provide this information). Such technologies allow the Website to collect a range of non-personal information, including your Internet Protocol (IP) address (a unique identifier automatically assigned to your computer when logging onto the Internet), the type of web browser and operating system you use, the date and time you visit the Website, the specific pages you visit on the Website, and the address of the website you visited before coming to the Website.

Reformulary Group can use such passively collected information for a variety of purposes, such as to administer the Website, customize the Website to your preferences, and compile aggregated statistics for marketing and research purposes. Reformulary Group reserves the unrestricted right to use this passively collected, non-personal information, including to: analyze trends; track movements around the Website; generate aggregate reports; and permit access to, or otherwise transfer it to Reformulary Group’s affiliates, or business partners.

The “passive information collection” technologies that we use may include “cookies” and “pixels”. Cookies are small text files that store information about your interactions with a particular website, either temporarily (known as a "temporary" or "session" cookie, and deleted once you close your browser window) or more permanently on the hard drive of your computer (known as a "permanent" or "persistent cookie"). Cookies can make it easier to use a website by allowing servers to access certain information quickly. "Session" cookies can be used to help a user's browser navigate a website more smoothly and may show up if the user comes from a website with which the subsequent website has some relationship (e.g., a website of an affiliated company) and can give helpful information. "Persistent" cookies can be used to customize a website for a user, such as by storing passwords, preferences, and registration and account information so that users do not have to reenter them each time they visit a website.

This Website uses both session/temporary cookies and persistent/permanent cookies to store information that allows us to offer you better service and to navigate through the Website with ease. To make this Website easier to use, we may combine information collected via cookies with personal information. Note that if you configure your browser to reject cookies, you might not be able to access important functions or areas of the Website or enjoy certain conveniences at the Website.

Active Information Collection

At various points on the Website, you might choose to actively provide certain kinds of information, including personal information, such as your full name, e-mail address, date of birth and other personal information (including personal health information), such as information regarding your health symptoms, conditions, prescription drugs and pharmacy information, including drugs dispensed, dosage and other prescription information. For instance, you have the option to create a personal account by completing the registration process on the Website to access additional features of our Service, such as tools to track the impact of medical cannabis on your health and your day-to-day life. You may also complete surveys conducted by third parties on our behalf.

All information that you provide on the Website and in using the Service is provided at your option in connection with your use of the Website when you use interactive tools that may be available on the Website. You should exercise discretion when sharing your personal information, and should not disclose sensitive or confidential information that you wish to remain private.

With respect to all content and information you submit to the Website you represent and warrant to Reformulary Group that you have the lawful right to do so without limitation or restriction. In any case, by submitting information via an "active information collection point" on the Website, you are expressly consenting to the collection, use, and disclosure of such information in accordance with this Privacy Policy.

E-Mail Reply Mechanisms

The Website may provide you with one or more e-mail mechanisms through which you may submit questions or comments. Information you provide via such e-mail mechanisms is optional. Reformulary Group may use the information you provide in your e-mail to respond to your inquiry, and Reformulary Group reserves the right to retain whatever information you submit in your e-mail, including your name, e-mail address, and any comments or other information that you send via the e-mail mechanism.

Question, Comment, and Feedback Forms

The Website may post a form for you to use in submitting questions, comments, and other feedback about Reformulary Group, its Service and other topics. Reformulary Group uses such feedback information to improve the Website, as well as for marketing and research purposes. Most information you provide in such forms is optional, but you will need to provide at least some personal information, such as your name and e-mail address, so that we may respond to your inquiry.

Aggregated and Anonymized Information

In an ongoing effort to better understand and serve the users of our Service, we conduct research on our customer and user demographics and behaviour based on personal information, and other information that we have collected. This research can be used to conduct industry research, understand market trends, symptoms, and provide our users with statistics and metrics on quality of health and life that may be of interest to them. This research will be compiled and analyzed on an aggregate basis and this aggregated information does not identify any individual and therefore is considered and treated as non-personal information under the Privacy Policy. This aggregated and anonymized data may be provided to third parties, such as pharmaceutical companies and insurance companies. Reformulary Group may also develop product offerings to its clients, based on aggregated and anonymized personal information of its employees that utilize the Service, to better understand the drug utilization of their clients and employees.

Collection of Personal Information From Minors

The Website and our Service is not directed at minors. We do not knowingly collect information from minors under the age of 18 or relevant age of majority or cannabis use in your province or territory of residence.

Updates

We may update and modify this online Privacy Policy at any time. Changes will be effective at the time of posting. Please review our Privacy Policy and Terms of Use each time you access and/or use our Website. If there is an important change to the Privacy Policy, then we will make this known to you.

Your continued access to or use of the Website constitutes your consent to the contents of any updated policy.

How to register complaints

You may register a privacy-related complaint by contacting our Chief Privacy Officer. We will explain our complaint procedure to you and investigate all complaints. If a complaint is justified, we will take all appropriate steps to set the situation right, including changing our policies and practices if necessary. We will also let you know what other complaint procedures may be available to you.

For more information

If you would like more information about this Privacy Policy, the personal information collection, storage, use and disclosure policies and practices of Reformulary Group or Reformulary Group’s policies and practices with respect to service providers, please contact our Chief Privacy Officer at (416) 519-9729 or at privacyofficer@reformulary.com

Principle 1 – Accountability

Each employee of Reformulary Group is responsible for personal information under his or her control and is accountable for compliance with this Code.

Principle 2 - Identifying Purposes

The purposes for which personal information is collected shall be identified before or at the time the information is collected.

Principle 3 - Consent

The prior knowledge and permission of the individual or organization are required for the collection, use or disclosure of personal information, except for legal or security reasons.

Principle 4 - Limiting Collection

The collection of personal information shall be limited to that which is necessary for the purposes identified. Personal information shall be collected by fair and lawful means.

Principle 5 - Limiting Use, Disclosure And Retention

Personal information will not be used, disclosed or retained for purposes other than those for which the information was collected, except with the permission of the individual or organization, or as permitted or required by law.

Principle 6 - Accuracy

Personal information shall be as accurate, complete and current as is necessary for the identified purposes for which it is to be used.

Principle 7 - Safeguarding Information

Personal information will be protected by safeguards appropriate to the sensitivity of the information.

Principle 8 - Openness

Reformulary Group will make readily available to their customers specific information about our policies and procedures relating to the management of their personal information.

Principle 9 - Individual Access

Upon request, an individual or organization will be informed of the existence, use and disclosure of his or her personal information and shall be given access to it. An individual or organization will be able to challenge the accuracy and completeness of the information and have it amended as appropriate.

Principle 10 - Handling Customer Complaints And Suggestions

Individuals can address any complaint regarding compliance with the above principles with our Chief Privacy Officer at (416) 519-9729 or at privacyofficer@reformulary.com.