The Medicine Shoppe PRIVACY AND CONFIDENTIALITY NOTICE

PLEASE READ THIS PRIVACY POLICY CAREFULLY. IT APPLIES TO YOUR USE OF THE MEDICINE SHOPPE LANGLEY/MEDICINE SHOPPE SURREY WEBSITE (THE “WEBSITE”), THE MEDICINE SHOPPE LANGLEY/MEDICINE SHOPPE SURREY® APP (THE “APP”) AND THE Medicine Shoppe Langley/Medicine Shoppe Surrey® WEB APP (THE “WEB APP”, AND TOGETHER WITH THE WEBSITE AND THE APP, THE “PLATFORM”).

BY USING THIS PLATFORM, YOU UNDERSTAND THAT THE PLATFORM MAY COLLECT AND USE YOUR PERSONAL INFORMATION (INCLUDING DEMOGRAPHIC AND PERSONAL TRANSACTION INFORMATION, AND HEALTHCARE AND PRESCRIPTION INFORMATION) FOR SUCH PURPOSES AS (I) SUBMITTING AND MANAGING PRESCRIPTIONS WITH YOUR CLOSEST OR PREFERRED MCKESSON BANNER PHARMACY; (II) LOCATING YOUR CLOSEST MCKESSON BANNER PHARMACY; (iii) INFORMING YOU ABOUT PRODUCTS/SERVICES THAT MAY BE OF INTEREST TO YOU, AND (iv) PROVIDING YOU WITH RELEVANT REMINDERS, PROMOTIONS, AND HEALTH AND WELLNESS INFORMATION AS WELL AS CUSTOMIZED ADVERTISEMENTS, THERAPIES, OR PRODUCTS THAT MAY BE RELEVANT TO YOUR HEALTH CONDITIONS.

BY USING THE PLATFORM, YOU ALSO AGREE TO THE COLLECTION OF YOUR PERSONAL HEALTH INFORMATION, INCLUDING INFORMATION ABOUT YOUR MEDICAL CONDITIONS, FROM THE PHARMACY TO WHICH YOU CONNECT AND FROM ANY OF THE OTHER PHARMACY BANNERS PARTICIPATING IN THE PROGRAM AT WHICH YOU RECEIVE PHARMACY SERVICES. THIS PERSONAL HEALTH INFORMATION MAY INCLUDE INFORMATION THAT WAS COLLECTED BY THESE PHARMACIES BEFORE YOU ENROLLED IN THE APP. YOU ALSO AGREE TO THE COLLECTION OF YOUR PERSONAL HEALTH INFORMATION DIRECTLY FROM PHYSICIANS OR HEALTH CARE PROVIDERS AS AUTHORIZED BY YOU FROM TIME TO TIME.

At Pharmessor Group Corporation (“Pharmessor”), wholly-owned subsidiary of McKesson Canada Corporation (“McKesson”, “we” or “us”), we value the trust that our members place in us to appropriately use and protect personal information. The Platform is owned and administered by McKesson, and allow you to, among other things, (i) submit, transfer and manage prescriptions with your closest or preferred Pharmessor banner pharmacy; (ii) locate your closest Pharmessor banner pharmacy; (iii) participate in our loyalty programs, and (iv) access the digital flyer for your pharmacy.

You will be required to provide a specific express consent to register on the App. You can always decide which component(s) of the Platform you wish to use, and you can always decide which information you provide to us through the Platform. We encourage you to read this Privacy Policy in full to understand our privacy practices. If you do not agree with our policy and practices, do not use the Website, and do not download, register with or use the App. By using the Website or the App, you agree to this Privacy Policy and consent to our use and disclosure of your personal information as described in this Privacy Policy.

Scope

This Privacy Policy applies to the Platform and the use of the Platform by members. Accordingly, it applies to McKesson and all of its affiliates and subsidiaries, as well as their websites, mobile applications and banners, to the extent that any of these entities collect, use, disclose, or receive personal information in connection with the operation of the Platform:

• Pharmessor Group Corporation (whose banner pharmacies include, Uniprix and Proxim);

• Rexall Pharmacy Group Ltd. and its affiliates Rexall/Pharma Plus Pharmacies Ltd., Rexall/Pharma Plus Pharmacies (BC) Ltd. and Rexall/Pharma Plus Pharmacies (Sask) Ltd. (“Rexall”);

• McKesson Canada Corporation (whose banner pharmacies include I.D.A., Guardian);

• Medicine Shoppe Langley/Medicine Shoppe Surrey Corporation;

• McKesson Specialty Prescription Services Corporation (which owns McKesson Canada’s Well.ca Pharmacy); and

• Well.ca ULC (which owns and operates the www.well.ca website).

In this Privacy Policy, McKesson and its affiliates and subsidiaries, including Rexall, are referred to as the “McKesson Group”.

This Privacy Policy applies to the Platform exclusively. Different entities in the McKesson Group may have separate websites, sub-domains, software applications, and services through other web, mobile, or cloud platforms which are unrelated to the Platform and that are not subject to this Privacy Policy or which may have their own privacy policies.

Definition of Personal Information

Throughout this Privacy Policy, we use the term “personal information”, which is any information relating to an identifiable individual. This may include, for example, your contact information, your account information and your health information. It may also include other types of more technical information, but only when this information can identify you as an individual. This Privacy Policy does not cover information that is de-identified and/or aggregated and cannot be associated with an identifiable individual, since this information is not considered to be personal information.

Personal Information We Collect

When you use the Platform, we may collect personal information about you. The personal information we collect may include, for example:

• Contact and demographic information, such as your name, gender, date of birth, contact information (postal code, city and province/territory, email address, shipping/billing address, telephone number).

• Account and transaction information, such as your password management information and security questions and answers, as well as information related to your participation in the Platform (including, for example, products that you choose to purchase).

• Technical information, when this information can identify you as an individual, for instance if it is related to other information you provide. This may include information that you share or make visible on the Internet, including usage information (i.e. your interactions with the Platform, searches and location information), log data (when you access the Platform, our servers automatically receive and log information from your browser), information from your device (hardware model, operating system version, unique device identifiers, location, and available mobile network information), IP address, cookie information, the pages and functionality requested, and information available through to your device’s camera, photo library, or microphone, if you choose to provide the Platform access to those tools.

• Health information, which may include information about such things as your health conditions, medication purchases, prescription history, and underlying diagnosis.

• Third party apps, if you choose to give us access to that information.

How We Collect Information

We may collect personal information about you in different ways when you use the Platform:

• From you directly, for instance through your enrolment in the Platform; your interactions with us (for example, when you communicate with us); your purchase of medications, health products, or other products from participating retailers; or your participation in surveys, marketing promotions, or contests. You may also provide us with personal health information through other means (for instance, verbally to your pharmacist, or through a survey).

• Through your online or electronic activity when using the Platform, whether through the Website, or otherwise, including through self-reported information and communications with us through or with respect to the Platform. The Platform allows you to self-report your health information. For example, you can enter medical documents, or health-related information such as allergy information, through the Platform.

• From the McKesson pharmacy management software should you choose to use the pharmacy services functionality of the Platform. In such case, your personal health information such as purchases of medication may be collected or generated by your pharmacist or your healthcare provider(s). When you fill in information about yourself on the Platform or sign up for the App, the information about you in the McKesson pharmacy management software will be made available to the Platform and App. This includes information that was collected by the software before you enrolled in the App. It includes information from any of the banner pharmacies providing services to you, at which you fill prescriptions or otherwise receive pharmacy services.

How We Use Your Personal Information

Different entities in the McKesson Group, including McKesson affiliates or subsidiaries, use the personal information we collect for the following purposes related to the Platform:

To operate the Platform and manage our business, including to:

• enable your participation in contests, promotions, and surveys

• understand your preferences, needs, and consumer behavior and improve your customer experience

• display and provide relevant and personalized content and advertisements through various channels based on information collected about you, including your demographic, account and personal transaction information; for example, if you often purchase diapers, we may inform you of offers on baby formula

• activate your network services to connect to the App or your selected pharmacy’s database

• provide you with the products and services requested and register you for a points card or other type of loyalty card

• perform diagnostic services such as error reporting in order to improve the Platform

• communicate with you and manage your account

• investigate and manage complaints

• meet our legal and regulatory obligations.

To communicate with you, including to:

• take or verify instructions from you and respond to inquiries

• communicate changes to policies and procedures that affect you, including this Privacy Policy

• subject to your right to withdraw consent to receive commercial electronic messages, to offer you the opportunity to voluntarily participate in contests or surveys and to market products and services that may be of interest to you (including products and services offered by third parties or other members of the McKesson Group).

To conduct data analytics and market research, including to:

• identify usage trends, perform data analysis and audits, and better manage and develop our business and operations, including to improve or to develop new products, services, programs, promotions, contests or events

• better understand our customer base. When doing so, we generally will use non-sensitive information (no health information) and will only use your information in an aggregated format or with direct personal identifiers removed. For example, we may analyze members’ data and determine that certain household products are sold more prevalently in certain geographic areas, but this information will only be created and shared with third parties on a de-identified and/or aggregated basis.

If you choose to use pharmacy services, to operate pharmacy services and to provide you with information about your prescriptions and healthcare, including to:

• remind you of specific actions you need to take regarding your medications

• inform you of relevant government policies related to your prescription coverage

• provide you with health and wellness related information

• allow you to fill and re-fill prescriptions electronically

• understand your preferences, needs, and consumer behaviour and improve your customer experience

• present you with customized information and advertisements for therapies and products that are relevant to your health condition(s).

How We Share Your Personal Information

We share your personal information when this is needed to allow you to participate in the Platform and our programs.

We may share your personal information only in the ways described in this Privacy Policy:

• McKesson Group. We may share personal information among different entities in the McKesson Group, including McKesson affiliates or subsidiaries, for the purposes identified in this Privacy Policy.

• Third-party service providers. Personal information may be disclosed to such organizations or individuals whose services are retained by Medicine Shoppe Langley/Medicine Shoppe Surrey in connection with the Platform, including suppliers, and companies contracted to process and manage transactions, redemption requests, research, analysis, and communications, advertising agencies, direct marketing agents, data processing and storage firms as well as mailing houses, and providers of administrative support service. These agents, representatives, or organizations must sign a confidentiality agreement that includes data security provisions and may only use the information disclosed to them for the purposes mentioned in the agreement, after which they must return the information to us or destroy the information, without keeping a copy. They are prohibited from disclosing the information to third parties without obtaining appropriate consent in advance.

• With third parties, at your request or as permitted or required by law. We may need to share information with companies, organizations, or individuals outside of Medicine Shoppe Langley/Medicine Shoppe Surrey if we have a good faith belief that access, use, preservation, or disclosure of that information is reasonably necessary to:

• meet applicable laws, regulations, legal processes, or enforceable governmental requests

• enforce applicable terms of service, including investigation of potential violations

• detect, prevent, or otherwise address fraud, security, or technical issues

• protect against harm to the rights, property, or safety of our members, Medicine Shoppe Langley/Medicine Shoppe Surrey, or the public as required and/or permitted by law

• engage in a merger, acquisition, reorganization, or sale of all or a portion of Medicine Shoppe Langley/Medicine Shoppe Surrey’s assets.

Otherwise, we may share members’ information with third parties, but only to the extent that such information has been properly de-identified and/or is provided on an aggregated basis.

Consent

The Platform does not collect, use, or disclose personal information from you for any purposes other than those specified in this Privacy Policy unless permitted or required by law. Consent may be express or implied. Consent can be “express” through words or by specific acts (such as oral or written consent) or implied by your conduct, where it would be reasonable for us to infer that you have agreed to the collection, use, or disclosure of your personal information. Because the Platform involves the collection of personal information which may be more sensitive (for example, personal transaction information and health information) and the use of such information to provide you with customized information and advertising relevant to your situation, your express consent will be required when you register for the App.

By submitting information to us in connection with the Platform, or using the Platform, you are providing your consent to the collection, use, and disclosure of your personal information as set out in this Privacy Policy, and pharmacy staff may rely on that consent. We may also be entitled by law to contact you for commercial purposes, subject to your right to withdraw consent detailed below.

Right to Withdraw Consent

Consent may be withdrawn at any time, subject to legal, regulatory, or contractual restrictions and reasonable notice; however, without such consent, we may not be able to provide you with services relating to the Platform.

• Commercial Electronic Communications. You can always limit the communications that we send to you. You may choose to stop receiving our newsletter or marketing emails by following the unsubscribe instructions included in these emails, contacting us using the contact information listed in the Contact Information section of this Privacy Policy below, or updating your account preferences through the Platform. Please note that even if you opt-out of promotional communications, we may still need to contact you with important information about your account, and content made available or displayed to you via the App will remain customized for you.

• Health information: You can always modify the health information you make available within the Platform by accessing your account and making the relevant changes or by calling the call centre at any time using the Contact Information listed in the Contact Information section of this Privacy Policy below.

Account deletion can be completed through the call centre using the contact information listed in the Contact Information section of this Privacy Policy. You may also discontinue information collection by uninstalling the App using the standard uninstall processes as may be available as part of your mobile device or via the mobile application marketplace or network.

Access Rights

You have the right to access and update the personal information we maintain about you. Please contact your selected pharmacy (the pharmacy whose name and contact information appears on your prescription label) to request access to, correct, or delete any personal information that you have provided to the pharmacy via this Platform.

In addition, if you wish to update your personal information that is saved in the Platform, you may make the changes directly yourself by logging into your App account and amending your information accordingly. Please note that changes you make directly to your personal information in the App will not be automatically transmitted to your selected pharmacy, so you will need to notify the pharmacy separately as outlined above.

You can also contact us directly any time at the address listed in the Contact Information section below for any type of request regarding the information you know or believe we hold about you.

Retention

Information, including personal and/or health information, may remain on your digital device for as long as the App is installed on your device. In addition, if, instead of using the App to directly take a photo of your prescription, you choose to upload a prescription photo from your photo library, the prescription photo in your photo library will be saved there in accordance with your personal settings. For ease of use, the App temporarily stores some user provided information, such as user name and passcode, until the App is closed.

We will retain your personal information to meet our contractual obligations to you and for as long as your account is active or potentially active, is reasonably useful for commercial purposes, or as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. We may also retain de-identified and/or aggregate information beyond this time for research purposes and to help us develop and improve our services, as detailed in the section entitled How We Use Your Personal Information. You cannot be identified from de-identified and/or aggregate information retained or used for these purposes.

Children’s Privacy

This Program is not intended for any member under the age of 18, and we do not knowingly collect personal information from children under the age of 18. We do not knowingly allow children under the age of 18 to enroll in the Platform. We request that minors do not use this Platform or submit any personal information through the App.

How We Protect Your Information

As a key provider of services and technology to the healthcare industry, the McKesson Group has implemented programs to address the privacy and security requirements of protecting health information. The McKesson Group has also established appropriate physical, technical, and administrative safeguards to protect the personal information we collect from or about our members and the information that they provide us. We restrict access to personal information to McKesson Group employees, contractors, and agents who need to know the information to process it for us, and who are subject to confidentiality obligations and only share your information as detailed in the section How We Share Your Personal Information above. The safety and security of your information also depends on you. Where you have chosen a passcode for access to certain parts of the App, you are responsible for choosing an appropriate passcode and for keeping this passcode confidential. We ask you not to share your passcode with anyone.

Personal information is usually transmitted in an encrypted form using SSL encryption. Notwithstanding our security safeguards, it is impossible to guarantee 100% security in all circumstances. If you have any questions about security or have reason to believe your interaction with us is no longer secure (for example, you feel the security of any account you might have with us has been compromised), you must immediately notify us of the problem by contacting Medicine Shoppe Langley/Medicine Shoppe Surrey by sending an email to compliance@mckesson.ca.

Cross-Border Transfer of Personal Information

When you use the Platform, your personal information may be transferred to and/or stored in another country where we or our service providers operate, including the United States. By enrolling with the App and/or using the Platform, you agree to such cross-border transfer of your personal information and understand that your information may be available to government authorities under lawful orders and laws applicable in foreign jurisdictions. Medicine Shoppe Langley/Medicine Shoppe Surrey will strive to protect personal information disclosed to third parties by contractual agreements requiring that those third parties adhere to confidentiality and security procedures and protections.

Cookies & Tracking Technologies

Medicine Shoppe Langley/Medicine Shoppe Surrey may use cookies (very small text files that are downloaded on your hard disk from certain web pages of the Website) to estimate its size audience. Cookies are then used to determine the extent of repeated use and the extent of use by a registered user versus an unregistered user to help Medicine Shoppe Langley/Medicine Shoppe Surrey better personalize the contents, banner, and promotion that you and other users may see on this site. Medicine Shoppe Langley/Medicine Shoppe Surrey will not disclose any of your personally identifiable information except when Medicine Shoppe Langley/Medicine Shoppe Surrey has your permission or under special circumstances, such as when Medicine Shoppe Langley/Medicine Shoppe Surrey believes in good faith that the law requires it. Medicine Shoppe Langley/Medicine Shoppe Surrey may disclose account information in special cases when it has reason to believe that disclosing this information is necessary to identify, contact, or bring legal action against someone who Medicine Shoppe Langley/Medicine Shoppe Surrey believes is in violation of Medicine Shoppe Langley/Medicine Shoppe Surrey’s rights.

We use cookies on the Platform where you are prompted to log in or that are customizable. If you have registered with our App, these cookies (1) may let us know who you are, (2) may be necessary to access your account information in order to provide personalized services, and (3) will provide us and our service providers with information that we will use to personalize the Platform in accordance with your preferences and interests. You may set your Web browser to notify you when you receive a cookie or to not accept certain cookies (these controls are typically found in the privacy settings for your browser). You do not need to enable cookies to visit our Website; however, if you decide not to accept cookies when visiting the Website, you may not be able to take advantage of all of the features of that site.

Analytics: We may use a third party such as Google Analytics to help us gather and analyze information about the areas visited on the Website (such as the pages most read, time spent, search terms, and other engagement data) in order to evaluate and improve the user experience and the convenience of the Website.

Interest-Based Advertising

We work with third-parties such as ad networks and other advertising companies that use their own tracking technologies (including cookies) on our Platform in order to provide you with tailored advertisements on our behalf. These companies may collect information about your activity across your different devices on our Platform and use this information to make predictions about your preferences, develop personalized content, and deliver ads that are more relevant to you.

Linking to Other Sites

Please remember that when you use a link to go from https://www.medicineshoppe.ca/ to another website, this Privacy Policy is no longer in effect. Your browsing and interaction on any other website, including any site that has a link on https://www.medicineshoppe.ca/, is subject to the rules and policies of that site. We encourage you to read the rules and policies of the sites you visit to further understand their procedures for collecting, using, and disclosing personal information.

Changes to this Privacy Policy

We may periodically update this Privacy Policy to describe new features, products, or services we offer and how it may affect our use of personal information about you and your controls. Since we may change this Privacy Policy, we recommend you check the current version available from time to time at https://www.medicineshoppe.ca/. If we make changes to this Privacy Policy, we will update the “Last Update” at the beginning of this Privacy Policy. We will inform you periodically, by means of brochures, correspondence, pop-up banners, the Website, or otherwise, of any significant change to this Privacy Policy. We may use one or a combination of these methods.

Contact Information

Privacy Office Contact

McKesson is committed to protecting your personal privacy. If you have questions or comments about our efforts to protect your personal privacy, or if you require additional information about our privacy practices, please contact us at compliance@mckesson.ca.

You may also write to our Privacy Officer at: McKesson Canada Corporation, Attn: Privacy Officer, 2300, Meadowvale Blvd., Mississauga, ON, L5N 5P9. We manage the personal information we collect from these offices.

You also have the right to contact your privacy regulator. For example, if you are an Ontario resident with questions or concerns relating to your health information, you may contact:

Information and Privacy Commissioner of Ontario
2 Bloor Street East,
Suite 1400
Toronto, Ontario
M4W 1A8