CANNARA BIOTECH (QUEBEC) INC.

• our corporate and medical-program websites, including https://medical.cannara.ca and https://www.cannara.ca ; 
• applications and registrations for Cannara’s medical cannabis program; 
• purchases of medical cannabis products; 
• patient services, product complaints, adverse-reaction reports and recalls; 
• communications and other interactions with Cannara; and 
• other activities described in this Privacy Policy. 

This Privacy Policy does not apply to Cannara employees, former employees or employment candidates in their employment-related interactions with Cannara. Those matters are governed by Cannara’s internal employee and candidate privacy policies.

1. Who Is Responsible for Your Personal Information
Cannara Biotech (Québec) Inc. is responsible for personal information collected in connection with its medical cannabis program and the websites and services covered by this Privacy Policy.
Cannara has designated a person responsible for the protection of personal information, sometimes referred to as the Privacy Officer.

Privacy Officer
Name: Brian Sherman 
Title: General Counsel and VP Legal Affairs
Email: privacy@cannara.ca
 

Mailing address:
Cannara Biotech (Québec) Inc.
333 Décarie Boulevard, Suite 200
Ville Saint-Laurent, Québec H4N 3M9
Questions, requests and complaints concerning personal information may be directed to the Privacy Officer using the contact information above.

2. What is Personal Information
Personal information is information that relates to an individual and allows that individual to be identified directly or indirectly. Certain personal information is sensitive because of its medical, biometric or otherwise intimate nature, or because the context in which it is used or communicated creates a high reasonable expectation of privacy. Information relating to medical cannabis authorization, medical documents, health conditions, product use, adverse reactions and patient status is treated by Cannara as sensitive personal information.

3. Whose Information we Collect
Depending on the nature of the interaction, we may collect personal information concerning:

• visitors to our websites; 
• applicants to the medical cannabis program; 
• registered patients; 
• adults responsible for a patient under the Cannabis Regulations; 
• healthcare practitioners; 
• persons receiving shipments on behalf of a patient where permitted by law; 
• customers and prospective customers; 
• persons who contact patient services; 
• persons submitting complaints, product-quality concerns or adverse-reaction reports; and 
• representatives of suppliers, service providers and business partners. 

We collect different information depending on the person’s relationship with Cannara. General website visitors are not required to provide medical-program information unless they apply for or participate in the medical program.

4. Personal Information We Collect

4.1 Identity and Contact Information
We may Collect:

• first and last name;
• date of birth;
• residential, mailing and shipping addresses;
• email address;
• telephone number;
• preferred language;
• account username and authentication information;
• government-issued identification information where required for identity or eligibility verification; and
• signatures and declarations submitted in connection with registration.

4.2 Medical-Program Registration Information
For applicants and patients in Cannara’s medical cannabis program, we may collect:

• the medical document authorizing the use of cannabis (the “Medical Documents”) issued by the patient’s healthcare practitioner;
• the name, profession, business address and contact information of the healthcare practitioner;
• the authorized daily quantity and period of use;
• the medical document’s issue date and period of validity;
• information contained in an application to register or amend a registration;
• the identity and contact information of an adult responsible for the patient, where applicable;
• a healthcare practitioner’s consent to receive cannabis products on behalf of a patient, where applicable;
• registration status, registration document and related correspondence;
• documentation relating to the transfer of a Medical Document from another licensed seller;
• information required to verify eligibility and continued compliance with the Cannabis Regulations; and
• information relating to the amendment, suspension, expiry, transfer or revocation of a registration.

We do not intentionally request diagnostic or treatment information that is not reasonably necessary for registration, regulatory compliance, patient safety or another identified purpose.

4.3 Order and Transaction Information
We may collect:

• products ordered;
• quantities purchased;
• order dates and frequency;
• prices, taxes, discounts, refunds and credits;
• billing information;
• payment confirmation and transaction-reference information;
• order cancellations, replacements and returns;
• patient purchase limits and available authorized quantities; and
• records required for accounting, tax, audit and regulatory purposes.

Full payment-card information is processed by our payment-service provider and is not intended to be stored by Cannara. Cannara may retain limited transaction information such as the card type, the last digits of a payment card, payment status and transaction-reference number.

4.4 Shipping and Delivery Information
We may collect:

• the authorized shipping address associated with a patient registration; 
• shipping instructions; 
• carrier and tracking information; 
• delivery status and proof of delivery; 
• failed-delivery and returned-shipment information; 
• the identity of an authorized recipient where applicable; 
• correspondence concerning lost, delayed, damaged or misdelivered shipments; and 
• information required to investigate a carrier claim.

4.5 Patient-Service and Communication Records
We may collect and retain:

• emails and other written correspondence; 
• telephone-call details and notes; 
• customer-service and support tickets; 
• inquiries and complaints; 
• communication preferences; 
• requests to access or correct personal information; and 
• other information voluntarily provided during interactions with Cannara. 

Cannara will provide notice where a telephone call is recorded and will obtain consent where required by law.

4.6 Product Complaints, Adverse Reactions and Recalls
Where a patient reports a product-quality issue, safety concern or adverse reaction, we may collect:

• the product name, lot number and package information; 
• the quantity and manner of use; 
• the timing and duration of use; 
• a description of the complaint or reaction; 
• relevant health or medication information voluntarily provided by the patient; 
• photographs of the product and packaging; 
• follow-up information; 
• the outcome of Cannara’s investigation; and 
• information required for reporting to Health Canada or another competent authority. 

Patients should provide only information that is relevant to the complaint, reaction or investigation.

4.7 Website and Device Information
When a person accesses our websites, we or our service providers may automatically collect:

• Internet Protocol address; 
• browser and device type; 
• operating system; 
• language settings; 
• referring and exit pages; 
• pages viewed and functions used; 
• date, time and duration of visits; 
• session and authentication information; 
• approximate location derived from an Internet Protocol address; 
• cookie and similar-technology identifiers; and 
• diagnostic, fraud-prevention and security information. 

4.8 Information from Other Sources
We may receive personal information from:

• healthcare practitioners; 
• named responsible adults; 
• a patient’s authorized representative; 
• another holder of a licence for sale when a Medical Document is transferred; 
• Health Canada and other government authorities; 
• payment processors; 
• shipping carriers; 
• identity-verification and fraud-prevention providers; and 
• other persons where authorized or required by law.

5. How We Collect Personal Information
We may collect personal information:

• directly from the individual; 
• through application and registration forms; 
• through the Site and patient account; 
• during checkout and order fulfilment; 
• by telephone, email or other communications; 
• from a healthcare practitioner or responsible adult; 
• from another licensed seller during a transfer; 
• through cookies and similar technologies; 
• from service providers acting for Cannara; and 
• from governmental or regulatory authorities where permitted by law. 

Where personal information is collected from another person, Cannara will do so only where the individual has consented or where the collection is otherwise authorized by law.

6. Purposes for Which We Use Personal Information
Cannara may use personal information for the following purposes. 

6.1 Administering the Medical Cannabis Program
We use personal information to:

• receive and assess registration applications; 
• verify identity, eligibility and ordinary residence in Canada; 
• validate Medical Documents; 
• register patients; 
• establish and maintain patient accounts; 
• identify and verify responsible adults; 
• issue and amend registration documents; 
• process transfers of Medical Documents; 
• calculate and enforce authorized purchasing limits; 
• maintain required medical-program records; 
• communicate with healthcare practitioners where permitted or required; and 
• amend, suspend, expire, transfer or revoke registrations in accordance with applicable law. 

The Cannabis Regulations prescribe information and documentation relating to medical-program registration, sales, reporting and record retention.

6.2 Processing Orders and Providing Products
We use personal information to:

• receive, verify and accept orders; 
• process payments; 
• calculate taxes, shipping charges and refunds; 
• prevent duplicate or impermissible orders; 
• prepare and ship products; 
• provide shipment tracking; 
• respond to delivery issues; 
• process cancellations, replacements, returns and refunds; and 
• maintain transaction records. 

6.3 Patient support and communications
We use personal information to:

• respond to questions and requests; 
• provide patient services; 
• send registration, account, order and shipping communications; 
• provide notices concerning expiry or renewal of registration; 
• communicate important product, regulatory or service information; 
• investigate complaints and disputes; and 
• administer privacy requests. 

6.4 Health, safety and product quality
We use personal information to:

• investigate product complaints; 
• assess suspected quality or safety issues; 
• investigate adverse reactions; 
• administer product recalls; 
• contact affected patients; 
• comply with pharmacovigilance, reporting and recordkeeping obligations; 
• improve product quality and safety; and 
• protect the life, health or safety of an individual where necessary. 

6.5 Legal and regulatory compliance
We may use personal information to:

• comply with the Cannabis Act, the Cannabis Regulations and licence conditions; 
• respond to lawful requests from Health Canada, tax authorities, courts, law-enforcement agencies and other authorities; 
• satisfy tax, accounting, audit and corporate-record obligations; 
• establish, exercise or defend legal claims; 
• detect and prevent fraud, diversion, misuse and unlawful activity; 
• enforce Cannara’s terms, policies and agreements; and 
• comply with other applicable legal obligations. 

6.6 Operating, securing and improving our services
We may use information to:

• operate and maintain our websites and systems; 
• authenticate users; 
• protect patient accounts; 
• detect security threats and unauthorized activity; 
• troubleshoot technical issues; 
• measure website performance; 
• understand how our services are used; 
• improve website functionality and patient services; 
• conduct privacy, security and operational assessments; and 
• generate aggregated or anonymized information.

6.7 Marketing and commercial electronic messages
Cannara may send newsletters, product announcements, promotions or other commercial electronic messages only where it has the consent or other lawful authority required under Canada’s anti-spam legislation. Patients may withdraw consent to marketing communications at any time by using the unsubscribe mechanism in the message or contacting Cannara. Withdrawal from marketing communications will not prevent Cannara from sending transactional, registration, safety, recall, legal or regulatory communications.

7. Accuracy
Cannara takes reasonable steps to ensure that personal information is accurate, complete and up to date as necessary for the purposes for which it is used or disclosed. Individuals are encouraged to notify Cannara of any inaccurate or outdated information.

8. Consent and Other Legal Authority
Cannara obtains consent to collect, use or disclose personal information where consent is required.
The form of consent may vary depending on:

• the sensitivity of the information; 
• the reasonable expectations of the individual; 
• the purpose of the processing; and 
• the circumstances of the interaction. 

Cannara will generally seek express consent for the collection, use or disclosure of sensitive personal information where required by law. Consent must be meaningful. Cannara will provide information in clear language concerning the personal information being collected, the purposes for which it will be used, the categories of persons to whom it may be communicated and the consequences of refusing or withdrawing consent where applicable. Canadian privacy regulators emphasize that individuals must understand the nature, purposes and consequences of the processing to which they consent.  Cannara may also collect, use or disclose personal information without consent where permitted or required by law, including where necessary:

• to comply with a legal or regulatory obligation; 
• to prevent or detect fraud; 
• to respond to an emergency threatening life, health or safety; 
• to investigate a breach of law or agreement; 
• to establish, exercise or defend a legal claim; or 
• for another purpose authorized by applicable privacy legislation. 

An individual may withdraw consent to processing based on consent, subject to reasonable notice and legal or contractual restrictions. Withdrawal may prevent Cannara from providing certain services. For example, Cannara cannot maintain a medical-program registration or process an order without information required by the Cannabis Regulations.

9. Information Concerning Minors and Responsible Adults
The medical cannabis framework permits an adult responsible for a patient to participate in the registration process where applicable. Where a responsible adult submits information concerning a patient, the responsible adult represents that they are authorized to provide the information and act for the patient in accordance with applicable law. Cannara may collect information concerning both the patient and the responsible adult to:

• process and maintain the patient’s registration; 
• verify the adult’s identity and role; 
• administer the patient account; 
• process orders; 
• communicate concerning the patient’s registration, products or safety; and 
• satisfy applicable regulatory requirements. 

Cannara will take into account the patient’s age, capacity, circumstances and rights when determining how consent, access and communications should be handled.

10. How We Disclose Personal Information
Cannara does not sell personal information. Cannara may disclose personal information as described below.

10.1 Cannara affiliates
We may disclose personal information to Cannara affiliates where reasonably necessary to operate shared information technology, finance, compliance, legal, quality-assurance, customer-service or administrative functions. Access is limited to personnel who require the information for an identified purpose.

10.2 Service providers
We may disclose personal information to service providers that perform services for Cannara, including:

• website and e-commerce platform providers; 
• cloud-hosting and data-storage providers; 
• payment processors; 
• identity-verification and fraud-prevention providers; 
• shipping carriers and logistics providers; 
• email and communications providers; 
• customer-service and support-platform providers; 
• information-technology and cybersecurity providers; 
• analytics and cookie-management providers; 
• professional advisers, auditors and insurers; and 
• document-storage and secure-destruction providers. 

Service providers may use personal information only to perform services for Cannara or as otherwise permitted by law. Cannara uses contractual and other measures appropriate to the sensitivity of the information and the nature of the service. A current description of Cannara’s principal service providers and applicable processing locations may be made available at {SUBPROCESSOR PAGE URL} or on request to the Privacy Officer.

10.3 Healthcare practitioners and responsible adults
We may communicate personal information to:

• the healthcare practitioner who issued a patient’s Medical Document; 
• a named responsible adult; 
• a person legally authorized to act for the patient; or 
• another healthcare professional, 
• where the communication is requested or authorized by the patient or is otherwise permitted or required by law.

10.4 Governmental and regulatory authorities
We may disclose personal information to Health Canada, the Canada Revenue Agency, provincial authorities, courts, law-enforcement agencies and other governmental or regulatory bodies where required or authorized by law.

10.5 Business transactions
Cannara may disclose personal information in connection with a proposed or completed financing, reorganization, merger, acquisition, sale of assets or similar business transaction where permitted by law and subject to appropriate confidentiality and use restrictions.

10.6 Legal, safety and fraud-related disclosures
Cannara may disclose personal information where reasonably necessary to:

• comply with a subpoena, warrant, court order or other lawful demand; 
• investigate fraud, diversion, security incidents or unlawful activity; 
• enforce a contract or protect Cannara’s legal rights; 
• protect the rights or safety of Cannara, a patient or another person; or 
• respond to an emergency threatening life, health or safety.

11. Processing Outside Québec
Cannara and its service providers may process or store personal information outside Québec, including elsewhere in Canada and, where applicable, in other countries. Personal information processed outside Québec may be subject to the laws of the jurisdiction in which it is processed and may be accessible to courts, law-enforcement agencies or governmental authorities in that jurisdiction. Before communicating personal information outside Québec, Cannara will conduct the assessment and implement the safeguards required by applicable Québec privacy legislation. Information concerning applicable processing locations may be obtained by contacting the Privacy Officer.

12. Retention and Destruction
Cannara retains personal information only for as long as reasonably necessary to:

• fulfil the purposes for which it was collected; 
• maintain an active patient registration; 
• provide products and services; 
• investigate complaints and adverse reactions; 
• administer recalls; 
• comply with cannabis, tax, accounting and other legal obligations; 
• resolve disputes; 
• enforce agreements; and 
• establish, exercise or defend legal claims. 

Retention periods vary depending on the nature of the information. Cannara’s retention schedule addresses categories including:

• registration applications and Medical Documents; 
• patient registration records; 
• orders and invoices; 
• shipping and delivery records; 
• product complaints and adverse-reaction records; 
• recall records; 
• patient-service communications; 
• payment transaction references; 
• privacy requests and complaints; 
• consent records; and 
• website and cookie information. 

The federal Cannabis Regulations contain specific record-retention obligations for holders of licences for sale in connection with the medical-access regime. Cannara will retain regulated records for at least the period required by those Regulations, even where an individual withdraws consent or closes an account. When personal information is no longer required, Cannara will securely destroy it or anonymize it in accordance with applicable law and Cannara’s retention and destruction procedures. Information will be considered anonymized only where it is reasonably foreseeable that the individual can no longer be identified, directly or indirectly, in accordance with applicable Québec requirements.

13. Cookies and Similar Technologies
Cannara’s websites may use cookies, pixels, software development kits, local storage and similar technologies. These technologies may be used for:

• authentication and session management; 
• shopping-cart and checkout functionality; 
• security and fraud prevention; 
• remembering language and other preferences; 
• website performance and diagnostics; 
• analytics; and 
• advertising or marketing, where applicable and consented to.

Where required by law, Cannara will obtain consent before using non-essential cookies or similar technologies.

14. Security Safeguards
Cannara maintains administrative, technical and physical safeguards appropriate to the sensitivity, quantity, use and format of the personal information in its custody or control. These safeguards include measures intended to restrict access to personal information, protect Cannara’s systems and facilities, manage service providers, train personnel and securely retain and destroy information. Medical, patient and other sensitive personal information is subject to heightened access and security controls. No security measure can eliminate every risk, and Cannara cannot guarantee absolute security.

15. Confidentiality Incidents 
Cannara maintains procedures to respond to unauthorized access to, use or disclosure of personal information, the loss of personal information and other confidentiality incidents. Cannara will investigate and address confidentiality incidents and will notify affected individuals and the appropriate privacy authorities where required by applicable law. Where PIPEDA applies, Cannara will report a breach to the Office of the Privacy Commissioner of Canada and notify affected individuals where the breach creates a real risk of significant harm. Cannara will also maintain records of breaches of security safeguards for the period required by law.

16. Privacy Rights
Subject to applicable law and any relevant exceptions, you may request:

• access to the personal information Cannara holds about you; 
• correction of information that is inaccurate, incomplete or equivocal; 
• information concerning the use or disclosure of your personal information; 
• withdrawal of consent where Cannara relies on consent; 
• a copy of eligible computerized personal information in a structured and commonly used technological format; and 
• the exercise of any other right available under applicable privacy legislation. 

Withdrawal of consent may prevent Cannara from maintaining a medical-program registration or providing certain products or services where the information is required by law or necessary to provide the requested service. Requests must be submitted in writing to Cannara’s Privacy Officer at privacy@cannara.ca. Cannara may take reasonable steps to verify the identity and authority of the person making the request. Cannara will respond within the period required by applicable law. If Cannara refuses a request in whole or in part, it will provide the reasons for the refusal and information concerning available recourse where required.

17. Changes to this Privacy Policy
Cannara may update this Privacy Policy from time to time to reflect changes to its practices, websites, medical cannabis program, service providers, technologies or legal and regulatory obligations. The revised Privacy Policy will be published on Cannara’s website, and the “Last Updated” date will be revised accordingly. Cannara will provide any additional notice or obtain any additional consent required by law before using or disclosing personal information for a materially different purpose.
Previous versions of this Privacy Policy may be requested from Cannara’s Privacy Officer.

18. Contacting Cannara and Making a Complaint
Questions, requests or complaints concerning Cannara’s handling of personal information may be directed to:

Privacy Officer
Cannara Biotech (Québec) Inc.
333 Décarie Boulevard, Suite 200
Ville Saint-Laurent, Québec H4N 3M9
Email: privacy@cannara.ca
Telephone: 514-543-4200 x 256

Cannara will review privacy complaints and respond within a reasonable period.
You may also contact the Commission d’accès à l’information du Québec or, where applicable, the Office of the Privacy Commissioner of Canada. You are not required to complete Cannara’s internal complaint process before contacting a privacy authority.