Reformulary Group Privacy Policy

Last updated: March, 2021

Reformulary Group Inc. (“Reformulary Group”, “we”, “us” or “our”) is committed to protecting the privacy and confidentiality of any personal information which you may provide, or that we may obtain from you, through your use of Reformulary Group website (https://reformulary.com) and the myReformulary™ portal available on Reformulary Group website (collectively, the “Website”), when you contact us with inquiries or otherwise communicate with us.

The purpose of this privacy policy (this “Privacy Policy”) is to provide information concerning Reformulary Group’s privacy practices and policies, including:

• what personal information we collect and why we collect it;
• how we use your personal information;
• who we share your personal information with; and
• to provide contact information should you have questions or concerns about our practices.

This Privacy Policy is designed to comply with applicable privacy legislation in Canada, including the Personal Information Protection and Electronic Documents Act (“PIPEDA”). You should read this Privacy Policy carefully. This Privacy Policy is incorporated into and forms part of our Terms of Use.

BY USING OUR WEBSITE OR OTHERWISE PROVIDING US WITH YOUR PERSONAL INFORMATION, YOU CONSENT TO THE COLLECTION, STORAGE, USE, DISCLOSURE AND RETENTION OF YOUR PERSONAL INFORMATION FOR THE PURPOSES IDENTIFIED IN AND IN ACCORDANCE WITH THIS PRIVACY POLICY, AND FOR THE PURPOSES IDENTIFIED TO YOU PRIOR OR AT THE TIME YOU PROVIDED THE PERSONAL INFORMATION. IF YOU DO NOT AGREE WITH THIS PRIVACY POLICY, YOU SHOULD NOT USE OUR WEBSITE OR PROVIDE US WITH YOUR PERSONAL INFORMATION.

This Privacy Policy does not apply to information which we may receive from you through your use of our services made available through related sites, including DrugFinder™ services, Cannabis Standard services and myRequest™ services. Please visit our related sites to learn about our privacy practices which apply to users of these services.

OVERVIEW OF OUR PRIVACY PRACTICES

Our privacy practices are summarized here. Under this Privacy Policy, Reformulary Group:

1. collects personal information when you visit our Website, contact us with inquiries, communicate with us or otherwise provide your personal information to us;
2. collects, stores, uses, discloses and retains this information for the purposes set out in this Privacy Policy or otherwise made available to you prior to or at the time of collection;
3. may disclose this information to our authorized employees, agents, affiliates, partners, service providers and legal representatives that may be located outside Canada, in which case information may be subject to the laws in those jurisdictions. Such parties may only use your personal information for the purposes for which such information may be used by us under this Privacy Policy;
4. except as set out in items 2 and 3 above, does not disclose your personal information to third parties without your consent unless authorized by you or required by law, as part of the sale of a business or as disclosed to you prior to or at the time the information is collected;
5. retains your personal information in compliance with our legal obligations and only as long as necessary for the purposes for which it was collected;
6. allows you to withdraw your consent to the collection, storage, use, disclosure and retention of your personal information at any time, subject to legal and contractual restrictions and reasonable notice;
7. mitigates the risk and impact of potential harms involved in the disclosure of personal information through the adoption of reasonable physical, technical and organizational procedures appropriate to the sensitivity of the data in an effort to safeguard the personal information you provide to us;
8. may collect, use, transfer and disclose non-identifiable information such as summary or aggregated de-identified personal information for research, marketing and analytics purpose; and
9. notifies you of any updates to this Privacy Policy and our privacy practices by posting on our Website or notifying you directly.

Even with the physical, technical and organizational measures adopted by Reformulary Group to safeguard your personal information, there is a residual risk of the loss of, unauthorized access to, or unauthorized disclosure of your information which could result in financial or other harm to you.

Further information with respect to our privacy practices is set out below.

1. WHAT INFORMATION DO WE COLLECT?

We collect information you share when you visit our Website, contact us with inquiries, communicate with us or otherwise provide us with information. Only information that is reasonably necessary is collected. The information we collect comes directly from you. You should exercise discretion when sharing your personal information, and should not disclose sensitive or confidential information that you wish to remain private.

The types of information we collect include:

a. Personally identifiable information

Personally identifiable information (or personal information) is any information recorded in any form that identifies or can identify an individual.

When you visit our Website you are anonymous, unless you voluntarily choose to identify yourself. You are not required to provide personal information to use our Website and browse its content. However, our Website contains features that have active information collection points which require you to provide certain personally identifiable information, such as your full name, e-mail address, phone number and other personal information as may be reasonably requested by us. For example, access to the myReformulary™ portal requires you to login with your e-mail address and password.

You have the option to contact us with questions, comments and feedback about our services, products or other inquiries. When you choose to contact us, you will be asked to provide certain personally identifiable information. You may contact us by submitting an online “Contact Us” form or using our e-mail reply mechanisms through our Website. You may also contact us directly by e-mail, phone, mail or otherwise. As Internet communication is not a secure medium, if you have concerns about providing personal information by e-mail or through our Website, you should mail or deliver to us such information at the address set out at the bottom of this Privacy Policy.

If you contact us, we may keep a record of the correspondence but we do not make any use of your e-mail address or other contact information, other than to respond to the communication. In the event we wish to use your personal information for any purpose, other than as set out in this Privacy Policy, we will obtain your consent before using the information.

We also offer our current and prospective clients to subscribe to our e-mail newsletter to keep in touch and provide industry information. To provide you with this service, we will need to collect your e-mail address and other personally identifiable information, such as your full name, title, business address and business phone number. If at any time you decide to opt-out of receiving our e-mail newsletter, simply click the link at the bottom of the e-mail newsletter to unsubscribe. We will remove your e-mail address from our e-mail newsletter list, and will do the same with your name, title, business address and business phone number upon request.

Our Website and the services we provide are not directed at children and we do not knowingly collect information from individuals under the age of majority in their province or territory of residence.

b. Non-personally identifiable information

Non-personally identifiable information is information that cannot be used on its own to identify or trace an individual.

We use various technologies to passively collect information from you while you are visiting our Website. Such technologies allow our Website to collect a range of non-personally identifiable information, including your Internet Protocol (IP) address (a unique identifier automatically assigned to your computer when logging onto the Internet), the type of web browser and operating system you use, the date and time you visit our Website, the specific pages you visit on our Website, your searched pages, and the address of the website from which you linked directly to our Website.

One example of a technology used by websites are “cookies”. Cookies are small text files that store information about your interactions with a particular website, either temporarily (known as a “temporary” or “session” cookie, and deleted once you close your browser window) or more permanently on the hard drive of your computer (known as a “permanent” or “persistent” cookie). Cookies can make it easier to use a website by allowing servers to access certain information quickly. “Session” cookies can be used to help a user’s browser navigate a website more smoothly and may show up if the user comes from a website with which the subsequent website has some relationship (e.g. a website of an affiliated company) and can give helpful information. “Persistent” cookies can be used to customize a website for a user, such as by storing passwords, preferences, registration and account information so that users do not have to re-enter them each time they visit a website.

Our Website uses both session/temporary cookies and persistent/permanent cookies to store information that allows us to offer you better service and navigate our Website with ease. To make our Website easier to use, we may combine information collected via cookies with personally identifiable information. You may choose to decline cookies if your web browser permits, but doing so may affect your use of our Website and your ability to access certain features of our Website.

Reformulary Group may also collect, use, transfer and disclose non-personally identifiable information, such as summary or aggregated de-identified personal information for research, marketing and analytics purposes. For instance, we may analyze de-identified personal information in order to better understand our customers and market trends and may share our analysis and reports on an aggregated basis with our affiliates, partners, and other third parties, such as pharmaceutical companies and insurance companies. This non-identifiable information is anonymized such that it cannot be used alone, or in combination with other information, to identify a specific individual and therefore is considered and treated as non-personal information for the purposes of this Privacy Policy.

2. WHAT DO WE USE THE COLLECTED INFORMATION FOR?

Reformulary Group collects and uses information, including personal information, that you provide or that we collect in the course of your use of our Website, when you contact us with inquiries or communicate with us, for the following purposes:

• To contact and provide you with services that you have requested from us, including using the information you submit through our Website or other means to review your request and respond to you;
• To administer and monitor our Website, including managing e-mails and other communications that we send or receive;
• To register you on myReformulary™ portal and to authenticate its users for security purposes;
• To understand your needs and our clients’ specific business needs in connection with the provision of our services;
• To provide customer service and support to you;
• To understand, research and improve our Website and the services we offer, including compiling aggregated non-personally identifiable information for research, marketing and analytics purposes;
• To track your activity on our Website;
• To evaluate and improve our Website’s performance and functionality;
• To detect, prevent or mitigate security or technical issues relating to our Website and services;
• To enforce our Website’s Terms of Use and other service agreements relating to our services;
• To protect you, our clients, our service providers and us against fraud;
• To notify you in connection with changes to this Privacy Policy;
• To respond to your requests to access and amend your personal information;
• To cross reference with the personal information you previously provided to us to ensure its accuracy;
• If you opted in to allow us to do so, to communicate with you about Reformulary Group, our services and products;
• As permitted by, and to comply with, applicable laws and regulations; and
• Other purposes permitted by law.

In the event we wish to use your personal information for any other purpose, other than as set out in this Privacy Policy, we will obtain your consent before using the information for such other purpose.

3. WHERE IS YOUR PERSONAL INFORMATION STORED?

Reformulary Group currently stores and processes personal information provided to it or that it collects on servers located in Canada. We may, in the future, use service providers outside Canada to store and process your personal information on our behalf. These service providers are only permitted, and all other service providers are only and will only be permitted, to store and process your personal information, and are not otherwise authorized to collect, use or disclose your personal information, except in accordance with the purposes set out in this Privacy Policy or as required by applicable laws of those foreign jurisdictions. In such circumstances, there is a risk that your personal information may be accessible to law enforcement and national security authorities in jurisdictions outside Canada in which our service providers are located.

4. DO WE DISCLOSE YOUR PERSONAL INFORMATION TO THIRD PARTIES?

We keep personal information that you provide to us private, and disclose such personal information only in accordance with this Privacy Policy, or as identified to you prior to or at the time information is collected. Prior to us making your personal information available to any third party (other than as referred to in this Privacy Policy), we will obtain your consent and let you know the identity of such third party, the type of information that would be shared with them and why.

Reformulary Group does not sell, rent, or lease to third parties any personal information it collects from you.

Reformulary Group may disclose or share personal information with its authorized employees, agents, affiliates, partners, service providers and legal representatives (collectively, “Authorized Parties”) for the purposes described in this Privacy Policy. For instance, your personal information may be transferred to Authorized Parties we engage to assist us in providing and developing our services and products. Our Authorized Parties may be located outside Canada, including in the United States, and your personal information may be subject to the laws in jurisdictions outside Canada, for example lawful requirements to disclose personal information to government authorities in those jurisdictions.

If Reformulary Group is involved in the sale or transfer of some or all of its business, then Reformulary Group may disclose your personal information in connection with the sale or transfer but will require the acquiring organization to agree to protect the confidentiality of your personal information in a manner that is consistent with this Privacy Policy.

Reformulary Group may disclose your personal information to a government institution or agency that has asserted its lawful authority to obtain the information or where Reformulary Group has reasonable grounds to believe the information could be useful in the investigation of an unlawful activity, or to comply with a subpoena or warrant or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with court rules regarding the production of records and information, or to protect Reformulary Group’s rights and property. Where it is justified or permitted to disclose your personal information to third parties, the use and disclosure of such information will be limited so that only that information which is required is used or disclosed.

5. HOW LONG DO WE RETAIN YOUR PERSONAL INFORMATION FOR?

We will keep and retain your personal information in compliance with our legal obligations, and only as long as necessary for the purposes for which it was collected. Personal information that is no longer required will be destroyed, erased or made anonymous according to our guidelines and procedures.

Where you have provided your consent to use your personal information to communicate with you about our services, products or other marketing communications, we will keep this information until you notify us or otherwise withdraw your consent.

6. HOW DO WE PROTECT YOUR PERSONAL INFORMATION?

We keep the personal information we collect about you confidential in accordance with this Privacy Policy. Access to your personal information is restricted to our Authorized Parties as described and for the purposes set out in this Privacy Policy.

We have adopted reasonable physical, technical and organizational procedures appropriate to the sensitivity of the data to protect the personal information you provide to us from loss, theft, unauthorized disclosure, copying, unauthorized use or modification, and while the personal information is handled by our Authorized Parties. This includes, among other things, limiting access of our employees to, and the use of, your personal information on a “need-to-know” basis through the use of passwords and graduated levels of clearance. Notwithstanding these measures, no collection, storage or transmission of information over the Internet on websites or otherwise can be guaranteed to be 100% secure, and therefore we cannot ensure, warrant or guarantee the security of any such information.

If you suspect that the personal information you provided to us has been improperly accessed or used, please contact our Privacy Officer by e-mail at PrivacyOfficer@reformulary.com.

7. THIRD PARTY LINKS

Our Website, e-mails or other messages or information we may send or make available to you may contain hypertext links to the websites of third parties. We are not responsible for the privacy practices or the content of such third party websites. Linked websites are maintained by third parties. Such links are provided for your convenience and reference only. Reformulary Group does not operate or control, in any respect, any information, software, products or services available on such third party websites. The inclusion of a link to a website does not imply any endorsement of the services or the site, its contents, or its sponsoring organization.

Please review the privacy policies and terms of use of any websites you access.

8. WITHDRAWING CONSENT TO THE USE OF YOUR PERSONAL INFORMATION

You may withdraw your consent to the collection, use, storage and disclosure of your personal information at any time, subject to legal and contractual restrictions and reasonable notice. To do this, please contact our Privacy Officer by e-mail at PrivacyOfficer@reformulary.com. Please note that withdrawal of your consent to the collection, use, disclosure and storage of personal information may result in you being unable to continue using our Website or certain features of it.

You also have the option to withdraw your consent to be contacted about our services, products or industry information in messages that we send to you. Please follow the unsubscribe link available in every message we send to you to be removed from our contact list.

9. HOW TO ACCESS AND AMEND YOUR PERSONAL INFORMATION?

Subject to certain exceptions prescribed by law, you will be given reasonable access to your personal information held by us and you may request that your personal information be corrected or updated. Under certain circumstances, it is possible that we may not be able to provide you with all of the information you have requested. Exceptions may include information that is prohibitively costly to provide, information that contains references to other individuals, information that cannot be disclosed for legal, security or commercial proprietary reasons, or information that is subject to solicitor-client or litigation privilege. Fees may be applied to any copy of the requested personal information. We will provide the reasons for denying access upon request.

To access or amend your personal information, please e-mail or otherwise contact our Privacy Officer as set out below and we will assist you. You may be required to put your request in writing to confirm your request and identity. If you believe we have not dealt with your request to your satisfaction, you can submit a complaint to us to resolve your privacy-related issue.

We will make every reasonable effort to keep your personal information accurate and up-to-date. It is your responsibility to notify us of any changes to your personal information, including contact information, so we can contact you and inform you about updates to this Privacy Policy and any other relevant information with respect to your use of our services and Website.

10. COMPLAINT RESOLUTION PROCEDURE

We maintain procedures for addressing and responding to all inquiries or complaints from individuals about Reformulary Group’s handling of personal information or compliance with this Privacy Policy. You may submit a privacy-related inquiry or complaint by contacting our Privacy Officer. We will explain Reformulary Group’s complaint resolution procedure to you and investigate your complaint. If your complaint is justified, we will take all appropriate steps to resolve the issue, including changing our policies and practices if necessary. We will also let you know what other complaint procedures may be available to you.

11. PRIVACY POLICY CHANGES AND UPDATES

From time to time, we may need to update this Privacy Policy or our privacy practices. We will let you know by posting changes on our Website. Changes will be effective at the time of posting. We may also notify you directly of any updates to this Privacy Policy or our privacy practices. If we make an important change to this Privacy Policy, we will make this known to you.

It is your responsibility to review to check this Privacy Policy periodically for any updates or changes. Your continued access to or use of our Website constitutes your consent to the contents of any updated policy.

12. QUESTIONS?

If you would like more information about this Privacy Policy, the personal information collection, storage, use and disclosure policies and practices of Reformulary Group or Reformulary Group’s policies and practices with respect to service providers, please contact our Privacy Officer by e-mail or at the address set out below.

You may also mail or deliver to us any documentation containing your personal information at 55 York Street, Suite 1400, Toronto, ON M5J 1R7.

Please let us know your questions or concerns and we will do our best to help you.

13. CONTACT US

You may contact our Privacy Officer by email at PrivacyOfficer@reformulary.com or by mail at 55 York Street, Suite 1400, Toronto, ON M5J 1R7.