Privacy Policy

Sharing Personal Information within Aleafia Health and Third Parties

We share personal information within the Aleafia Health family of companies in order to provide you with the services that you request. For example, you may authorize one of our medical clinic physicians to share your medical document authorizing the use of cannabis with Emblem in order to facilitate your purchase of Emblem products.

If you purchase cannabis products from Emblem, we will share the types and quantities of products you purchased with the physician who provided us with your medical document if your physician requests that information. Please speak with your physician for information on their personal information handling practices.

Website Visitors

We collect personal information on our websites in order to provide you with the information and services you request, to fulfill regulatory obligations, to secure our websites, and to understand and improve our websites and our business.

For example:

• You do not need to provide us with your name to browse our websites. However, we will request your name if you fill out an online form to ask a question or submit information to us or log into some restricted areas of our websites.
• Some of our websites require visitors to tell us their date of birth and province of residence. We ask for this information to comply with laws that restrict who may receive information about our cannabis products and services.
• We use “cookies” on our website. A cookie is a small text file that use in combination with your browser. Cookies help us recognize you when you return to visit our site using the same browser. We use cookies for a variety of purposes including to let us know that you have previously told us your date of birth and province of residence.
• We collect IP addresses, browser type information and other device technical information for the purposes of providing the website content to you in a format that works on your device and for troubleshooting issues with how our website functions with different browsers.
• We use third party analytics providers such as Google Analytics and LinkedIn Analytics. These analytics providers help us understand how visitors navigate through our website and whether they came to us from an advertisement that we placed on another website. These analytics providers do not provide us with your name. However, we may learn information through these analytics providers such as your approximate location from your IP address. For example, you can learn more about how Google uses information from websites that use Google Analytics here.
• We use third-party service providers who display our advertising when you conduct a search, such as using Google, or when you are on other websites or use social media, such as Facebook or LinkedIn. When you interact with these advertisements, our third-party service providers may record that you saw the advertisement and visited our website. These third-party providers do not provide us with your name.

We also aggregate information about you with information from other users to that we can understand trends relating to what information visitors find useful, when visitors use our websites, where visitors are located, how visitors found us, and more. This aggregate information does not identify individual visitors. Aggregated information about the use of our websites may be disclosed to our service providers, regulatory bodies, and others.

Newsletter Subscriptions

You may subscribe to our newsletters or consent to receive other communications from us. We use the email address you provide to us to deliver the newsletter and other communications about special offers, product information, or other messages related to our cannabis products brands, to medical cannabis more generally, or other topics. Our newsletter subscriptions contain small image files that allow us to understand when you have opened or interacted with our newsletter. We collect this information so that we can better understand what is relevant to our subscribers and how frequently the find our newsletters useful in order to provide better content. You may terminate your subscription at any time by using the links provided to you in our communications or by emailing us at Privacy@AleafiaHealth.com.

Patients

We collect personal health information (PHI) from patients. If you are a patient of one of our clinics, this information may include:

• your name, address, email address, phone number, date of birth, veteran status, health card information, health history, family health history; and
• information related to assessment, diagnosis, medication, counseling, treatment and education programs you participate in.

Our primary uses for the PHI we collect are:

• to provide assessment, treatment and other health care services; and
• to obtain payment for healthcare services, including through provincial insurance plans.

We also use PHI to conduct research, for quality assurance evaluations, to comply with legal and regulatory requirements and to plan, administer and manage our operations.

We usually only collect PHI directly from you or your referring physician with your express or implied consent. For example, in order to register you as a patient, we will ask you to provide us with a physician referral form (unless we allow you to make a self-referral). The physician referral form will ask your physician to provide us with PHI such as:

• name, address, email address, phone number, date of birth, and health card information;
• the nature of the referral; and
• information related to your current physical and mental health.

With limited exceptions, we only disclose PHI directly to you and other healthcare providers in your circle of care unless you provide us with your consent or implied consent.

However, there are situations when we might collect personal information from third parties or disclose that information to third parties without your consent. We cannot list all of the situations this might occur in this Privacy Notice. The following list is an example of some of the situations that collection or disclosure may occur without your consent:

• if you have a substitute decision-maker;
• to reduce a significant risk of serious bodily harm;
• to comply with a court order or statutory legal requirement;
• in a legal proceeding that you are involved in with us; or
• for research permitted under applicable health privacy laws.

E-Commerce Purchasers

Aleafia Health’s affiliate, Emblem Cannabis Corporation, is licensed to sell cannabis for medical purposes through our ecommerce websites. If you wish to purchase cannabis from our website, a physician must provide a medical document authorizing the use of cannabis for medical purposes.

In order to make a purchase on our website, we will collect your name, residential address, shipping address, email address, phone number, date of birth, gender, veteran status, quantity of dried cannabis prescribed by your physician or nurse practitioner, dosage frequency. When you make a purchase, we will collect transaction information, including the type and quantity of products you purchase. Our third-party service provider will collect your payment card information to process the purchase. You can store your payment card for future use; however, we will only have a tokenized version of your payment card and not the actual payment card number.

We use your personal information to provide you with the products and services you request, to fulfill regulatory obligations, and to understand our customers’ preference and to improve our products and business. For example, we use your personal information to:

• enable registration and access to your account;
• enable you to view our products and services;
• fulfill your orders and ship them to your address;
• comply with our regulatory requirements to determine that you are entitled to purchase cannabis and to track dates, quantities and other details of purchases;
• protect us against error and fraud;
• understand how many customers we have, and their purchasing preferences;
• respond to questions or reviews by Health Canada; and
• respond to requests made by your insurance providers to review your insurance claims.

Physicians, Nurse Practitioners and other Healthcare Providers

If you are a referring physician or you are a physician or nurse practitioner providing a medical document on behalf of your patient to facilitate the purchase of cannabis, we collect your name, designation, contact information and billing number. We may also offer physicians, nurse practitioners and other healthcare providers with cannabis education programs to assist in assessment and authorization training and cannabis treatment options. If you enroll in one of these programs, we will collect your name, email address and contact information.

We use the information about physicians we collect to comply with our legal and regulatory requirements, including, for example, to verify the information provided to us. In certain circumstances, we may be required to disclose such information to applicable licensing authority that governs the practice of their profession.

Applicants for Employment and Independent Contractors

We collect personal information from applicants for employment or independent contractors who we hire to assist us in our business. If you are an applicant for employment or an independent contractor, this information may vary depending on the nature of the position that we have available. This information may include name, contact information, past employment and volunteer activities, education and credentials and other information that you provide to us with your application or response to a request for proposal. In some cases, this information may include a criminal records check, credit check, and/or a credentials check.

We usually collect personal information directly from candidates for employment and independent contractors. However, we may also obtain information from references you provide and from third parties during our process of conducting background checks.

Investors

If you are an investor, we collect personal information about you if you are a registered shareholder or a non-objecting beneficial owner. We also collect personal information about from you if you communicate with us as part of our investor relations activities or a shareholders’ meeting. We use the information we collect from you to provide you with newsletters and updates about our organization, to communicate with you about your investment in our organization and to send you notices and materials required by law. In limited situations, we may be required by law to allow third parties to inspect or obtain copies of lists of our investors.

Minors

Our websites are not for minors. You may use our websites only if you are of the age of majority in the location where you reside (or you are under the supervision of your parent or legal guardian). You must also satisfy any other provincial age restrictions on accessing the content on our websites.

We may require you to tell us your age before we allow you to access some of our sites or restricted areas of our site. You must provide us with accurate information about your birth date. We collect this information in order to comply with laws that restrict who can access information about cannabis and cannabis accessories.

Third Party Service Providers

Like most organizations, we use third-party service providers to assist us provide you with the website and our services. For example:

• our websites are also hosted by third-party service providers;
• we use third parties to ship our products to you;
• we use third-party analytics providers that provide us with information on how our websites are used and help us understand whether our marketing of employment opportunities, products and services is effective;
• we use third-party service providers to place and promote our advertisements and to report to us on how visitors interacted with our advertisements;
• if you make a purchase, your payment will be processed by our third-party payment processor;
• third-party service providers to host and provide software that powers our electronic medical records (EMRs); and
• we use third-party service providers to assist us in our investor relations communications and sending other communications to investors that are required by law.

Third parties must implement appropriate security measures to comply with applicable privacy laws.

International Transfers of Personal Information

If you are a patient of one of our clinics, your electronic medical record is stored in Canada and we limit the circumstances where your personal health information might be stored outside of Canada. For example, your personal health information may be transmitted, processed or stored outside of Canada when we use third party service providers or transmit information between our clinics and companies over the internet.

The personal information collected through our other services may be stored or processed outside of Canada if our service providers are located in another country.

If your personal information is transferred outside of Canada, then it may become subject to the laws of the country to which it is transferred. Those laws may be different than those in Canada. In some cases, those laws may afford you fewer rights than the laws of Canada.

Our Legal Disclosure Obligations

We may have legal obligations to disclose personal information about you, including personal health information, without your consent.

For example, the Canadian federal Cannabis Act, provincial laws relating to cannabis and provincial health information laws may require us to disclose your personal information in some circumstances to police, the Ministry of Health, healthcare provider licensing authorities or other authorities. In some cases, we may be required to disclose information as a result of a court order, subpoena, warrant or other legal requirement or if we are part of a court, administrative, or other proceeding to which we are a party. We will use reasonable care not to disclose any more personal information than required. We will also provide you with notice of the disclosure if we are legally permitted to do so.

Retention of Your Personal Information

We retain your personal information for the longest period of time that is necessary to fulfill the purposes for which we collected it, to meet our legal obligations and to protect our rights. For example, if you are a patient of one of our clinics, we will retain your personal health information for at least 10 years after the last entry in your medical record. If you are a minor, your personal health information will be retained for at least 10 years after you reach the age of majority. We may retain your personal information longer if you have raised concerns about the treatment you were provided. We will keep transaction records for purchases on our e-commerce websites for at least 7 years.

Questions and Complaints

Our staff will attempt to assist you with any question or concern that you have about how we handle your personal information.

If you are not satisfied, please contact us using the contact information below.

We will investigate and respond to your question or complaint. We endeavour to respond to all questions and complaints within 30 days.

Changes to this Privacy Notice

We may change this Privacy Notice from time to time.

Effective as of December 30, 2020, this Privacy Notice replaced previous privacy notices and policies posted our websites. In this latest version of our Privacy Notice, we:

• consolidated different the privacy notices and policies on our different websites;
• provided you with more information about the personal information we collect and how we use it; and
• provided you with more information about options on how to control your personal information and how to exercise your rights.