Privacy Notice

Date: 2020-12-30

Thank you for reviewing the Aleafia Health Privacy Notice. This Privacy Notice will help you understand how Aleafia Health handles your personal information. You agree to the most recent version of this Privacy Notice when you continue to use our websites and services, so please read this Privacy Notice carefully.

In this Privacy Notice, the term “Aleafia Health” means Aleafia Health Inc. and its affiliates and brands, including Canabo Medical Clinics, GrowWise Health, Emblem Cannabis Corporation, Aleafia Farms Inc., “Emblem”, “Symbl” and others we add in the future. When we refer to “personal information” we mean information including health information that is about or that relates you or that could be used in combination with other information to identify you.

How you interact with us affects what personal information we collect and use. Use the links below to help you navigate to the relevant sections of our Privacy Notice.

Sharing Personal Information within Aleafia Health and Third Parties

Personal Information We Collect, Use and Disclose

Website visitors

Newsletter Subscriptions

Patients

E-Commerce Purchasers

Physicians, Nurse Practitioners and other Healthcare Providers

Applicants for Employment and Independent Contractors

Investors

Minors

Securing Your Personal Information

Third-Party Service Providers

Third-Party Websites

International Transfers of Personal Information

Business Transactions

Our Legal Disclosure Obligations

Your Rights and Choices

Retention of Your Personal Information

Updating Your Personal Information

Questions and Complaints

Contact Us

Changes to this Privacy Notice

Sharing Personal Information within Aleafia Health and Third Parties

We share personal information within the Aleafia Health family of companies in order to provide you with the services that you request. For example, you may authorize one of our medical clinic physicians to share your medical document authorizing the use of cannabis with Emblem in order to facilitate your purchase of Emblem products.

If you purchase cannabis products from Emblem, we will share the types and quantities of products you purchased with the physician who provided us with your medical document if your physician requests that information. Please speak with your physician for information on their personal information handling practices.

Personal Information We Collect, Use and Disclose

The personal information we collect, use and disclose about you depends on how you interact with us. Please read all of the sections below that apply to you.

Website Visitors

We collect personal information on our websites in order to provide you with the information and services you request, to fulfill regulatory obligations, to secure our websites, and to understand and improve our websites and our business.

For example:

  • You do not need to provide us with your name to browse our websites. However, we will request your name if you fill out an online form to ask a question or submit information to us or log into some restricted areas of our websites.
  • Some of our websites require visitors to tell us their date of birth and province of residence. We ask for this information to comply with laws that restrict who may receive information about our cannabis products and services.
  • We use “cookies” on our website. A cookie is a small text file that use in combination with your browser. Cookies help us recognize you when you return to visit our site using the same browser. We use cookies for a variety of purposes including to let us know that you have previously told us your date of birth and province of residence.
  • We collect IP addresses, browser type information and other device technical information for the purposes of providing the website content to you in a format that works on your device and for troubleshooting issues with how our website functions with different browsers.
  • We use third party analytics providers such as Google Analytics and LinkedIn Analytics. These analytics providers help us understand how visitors navigate through our website and whether they came to us from an advertisement that we placed on another website. These analytics providers do not provide us with your name. However, we may learn information through these analytics providers such as your approximate location from your IP address. For example, you can learn more about how Google uses information from websites that use Google Analytics here.
  • We use third-party service providers who display our advertising when you conduct a search, such as using Google, or when you are on other websites or use social media, such as Facebook or LinkedIn. When you interact with these advertisements, our third-party service providers may record that you saw the advertisement and visited our website. These third-party providers do not provide us with your name.

We also aggregate information about you with information from other users to that we can understand trends relating to what information visitors find useful, when visitors use our websites, where visitors are located, how visitors found us, and more. This aggregate information does not identify individual visitors. Aggregated information about the use of our websites may be disclosed to our service providers, regulatory bodies, and others.

Newsletter Subscriptions

You may subscribe to our newsletters or consent to receive other communications from us. We use the email address you provide to us to deliver the newsletter and other communications about special offers, product information, or other messages related to our cannabis products brands, to medical cannabis more generally, or other topics. Our newsletter subscriptions contain small image files that allow us to understand when you have opened or interacted with our newsletter. We collect this information so that we can better understand what is relevant to our subscribers and how frequently the find our newsletters useful in order to provide better content. You may terminate your subscription at any time by using the links provided to you in our communications or by emailing us at Privacy@AleafiaHealth.com.

Patients

We collect personal health information (PHI) from patients. If you are a patient of one of our clinics, this information may include:

  • your name, address, email address, phone number, date of birth, veteran status, health card information, health history, family health history; and
  • information related to assessment, diagnosis, medication, counseling, treatment and education programs you participate in.

Our primary uses for the PHI we collect are:

  • to provide assessment, treatment and other health care services; and
  • to obtain payment for healthcare services, including through provincial insurance plans.

We also use PHI to conduct research, for quality assurance evaluations, to comply with legal and regulatory requirements and to plan, administer and manage our operations.

We usually only collect PHI directly from you or your referring physician with your express or implied consent. For example, in order to register you as a patient, we will ask you to provide us with a physician referral form (unless we allow you to make a self-referral). The physician referral form will ask your physician to provide us with PHI such as:

  • name, address, email address, phone number, date of birth, and health card information;
  • the nature of the referral; and
  • information related to your current physical and mental health.

With limited exceptions, we only disclose PHI directly to you and other healthcare providers in your circle of care unless you provide us with your consent or implied consent.

However, there are situations when we might collect personal information from third parties or disclose that information to third parties without your consent. We cannot list all of the situations this might occur in this Privacy Notice. The following list is an example of some of the situations that collection or disclosure may occur without your consent:

  • if you have a substitute decision-maker;
  • to reduce a significant risk of serious bodily harm;
  • to comply with a court order or statutory legal requirement;
  • in a legal proceeding that you are involved in with us; or
  • for research permitted under applicable health privacy laws.

E-Commerce Purchasers

Aleafia Health’s affiliate, Emblem Cannabis Corporation, is licensed to sell cannabis for medical purposes through our ecommerce websites. If you wish to purchase cannabis from our website, a physician must provide a medical document authorizing the use of cannabis for medical purposes.

In order to make a purchase on our website, we will collect your name, residential address, shipping address, email address, phone number, date of birth, gender, veteran status, quantity of dried cannabis prescribed by your physician or nurse practitioner, dosage frequency. When you make a purchase, we will collect transaction information, including the type and quantity of products you purchase. Our third-party service provider will collect your payment card information to process the purchase. You can store your payment card for future use; however, we will only have a tokenized version of your payment card and not the actual payment card number.

We use your personal information to provide you with the products and services you request, to fulfill regulatory obligations, and to understand our customers’ preference and to improve our products and business. For example, we use your personal information to:

  • enable registration and access to your account;
  • enable you to view our products and services;
  • fulfill your orders and ship them to your address;
  • comply with our regulatory requirements to determine that you are entitled to purchase cannabis and to track dates, quantities and other details of purchases;
  • protect us against error and fraud;
  • understand how many customers we have, and their purchasing preferences;
  • respond to questions or reviews by Health Canada; and
  • respond to requests made by your insurance providers to review your insurance claims.

Physicians, Nurse Practitioners and other Healthcare Providers

If you are a referring physician or you are a physician or nurse practitioner providing a medical document on behalf of your patient to facilitate the purchase of cannabis, we collect your name, designation, contact information and billing number. We may also offer physicians, nurse practitioners and other healthcare providers with cannabis education programs to assist in assessment and authorization training and cannabis treatment options. If you enroll in one of these programs, we will collect your name, email address and contact information.

We use the information about physicians we collect to comply with our legal and regulatory requirements, including, for example, to verify the information provided to us. In certain circumstances, we may be required to disclose such information to applicable licensing authority that governs the practice of their profession.

Applicants for Employment and Independent Contractors

We collect personal information from applicants for employment or independent contractors who we hire to assist us in our business. If you are an applicant for employment or an independent contractor, this information may vary depending on the nature of the position that we have available. This information may include name, contact information, past employment and volunteer activities, education and credentials and other information that you provide to us with your application or response to a request for proposal. In some cases, this information may include a criminal records check, credit check, and/or a credentials check.

We usually collect personal information directly from candidates for employment and independent contractors. However, we may also obtain information from references you provide and from third parties during our process of conducting background checks.

Investors

If you are an investor, we collect personal information about you if you are a registered shareholder or a non-objecting beneficial owner. We also collect personal information about from you if you communicate with us as part of our investor relations activities or a shareholders’ meeting. We use the information we collect from you to provide you with newsletters and updates about our organization, to communicate with you about your investment in our organization and to send you notices and materials required by law. In limited situations, we may be required by law to allow third parties to inspect or obtain copies of lists of our investors.

Minors

Our websites are not for minors. You may use our websites only if you are of the age of majority in the location where you reside (or you are under the supervision of your parent or legal guardian). You must also satisfy any other provincial age restrictions on accessing the content on our websites.

We may require you to tell us your age before we allow you to access some of our sites or restricted areas of our site. You must provide us with accurate information about your birth date. We collect this information in order to comply with laws that restrict who can access information about cannabis and cannabis accessories.

Securing Your Personal Information

You have a role to play in securing your personal information. Please make sure that your computer, mobile phone or other device has an up to date operating system and anti-virus protection. Do not use unsecure public WiFi connections. Be alert for phishing emails and other communications that try to trick you into believing that they are from us and ask you for more information.

We use, technical, administrative and physical safeguards to protect your personal information. We choose safeguards that are commercially reasonable and appropriate to the sensitivity of your personal information. We do not guarantee complete security. There is always some risk that a third party could evade our security.

Third Party Service Providers

Like most organizations, we use third-party service providers to assist us provide you with the website and our services. For example:

  • our websites are also hosted by third-party service providers;
  • we use third parties to ship our products to you;
  • we use third-party analytics providers that provide us with information on how our websites are used and help us understand whether our marketing of employment opportunities, products and services is effective;
  • we use third-party service providers to place and promote our advertisements and to report to us on how visitors interacted with our advertisements;
  • if you make a purchase, your payment will be processed by our third-party payment processor;
  • third-party service providers to host and provide software that powers our electronic medical records (EMRs); and
  • we use third-party service providers to assist us in our investor relations communications and sending other communications to investors that are required by law.

Third parties must implement appropriate security measures to comply with applicable privacy laws.

Third-Party Websites

Our websites may include links to third-party websites. These links are for your information and convenience. This Privacy Notice does not apply to those third-party websites. Please review any privacy policies on those websites.

International Transfers of Personal Information

If you are a patient of one of our clinics, your electronic medical record is stored in Canada and we limit the circumstances where your personal health information might be stored outside of Canada. For example, your personal health information may be transmitted, processed or stored outside of Canada when we use third party service providers or transmit information between our clinics and companies over the internet.

The personal information collected through our other services may be stored or processed outside of Canada if our service providers are located in another country.

If your personal information is transferred outside of Canada, then it may become subject to the laws of the country to which it is transferred. Those laws may be different than those in Canada. In some cases, those laws may afford you fewer rights than the laws of Canada.

Business Transactions

We may disclose or transfer your personal information to another party as part of a business transaction. A business transaction could include (among other things) the sale of all or part of our business, obtaining a loan and granting security on our assets. We will only share information that is necessary for the purposes of allowing the other party to evaluate the business transaction and/or to complete the transaction.

Your Rights and Choices

You have certain rights and choices with respect to how we use and disclosure your personal information.

  • Access. You have the right to request access to your personal information. If you are a patient of one of our clinics, please contact the clinic to obtain access to your personal health information. For all other access requests, please Contact Us. We endeavour to respond to all access requests within 30 days. In some cases, we may charge you a small fee for access. We will advise you as soon as possible before you incur fees. In some cases you may not have the right to access your personal information. If that applies to all or some of your requests, we will provide you with the reason we are refusing you access.
  • Restrictions on Disclosure. If you are a patient of one of our clinics, you have the right to restrict the members of your circle of care that we share your personal health information with. To exercise this right, please contact the clinic. Please understand that limiting sharing may result in some healthcare services not being able to be provided to you by certain healthcare professionals.
  • Direct Marketing. You can unsubscribe from our marketing communications at any time. You can unsubscribe using the links provided to you in your email or Contact Us. In addition, if you are a patient of one of our clinics and have given us permission to use your personal health information for marketing purposes, you can withdraw that consent at any time. Please Contact Us or contact the clinic where you were treated.
  • Advertising. You can opt-out of advertising programs that track your activities across multiple websites to deliver personalized advertising content to you. Please visit Digital Advertising Alliance of Canada Opt-Out Page, NAI Opt-Out Page and the Ad Choices Opt-Out Page. These websites provide tools that identify member companies that have placed cookies on your browser and provides mechanisms to opt-out of those cookies. You will still receive other types of advertising from participating companies, including Aleafia Health; however, it will not be based on your interests. Deleting browser cookies can remove your opt-out preferences, so you should use these tools periodically to ensure that your preferences are up-to-date. You can opt-out of the use of your mobile device’s advertising ID by adjusting your mobile device advertising preferences. For Android devices, open your Settings App > Google > Ads. For iOS devices, go to Settings > Privacy > Advertising.

Retention of Your Personal Information

We retain your personal information for the longest period of time that is necessary to fulfill the purposes for which we collected it, to meet our legal obligations and to protect our rights. For example, if you are a patient of one of our clinics, we will retain your personal health information for at least 10 years after the last entry in your medical record. If you are a minor, your personal health information will be retained for at least 10 years after you reach the age of majority. We may retain your personal information longer if you have raised concerns about the treatment you were provided. We will keep transaction records for purchases on our e-commerce websites for at least 7 years.

Updating Your Personal Information

We strive to maintain accurate and current information about you. Please tell us if your personal information changes.

Please tell us if you think we have information about you that is inaccurate. If we do not agree with you, we will tell you. For example, if you are a patient of one of our clinics, we may refuse to update a record because:

  • the record is not incomplete or inaccurate for the purposes for which we collected, use or have used the information;
  • the record was not originally created by us and we do not have sufficient knowledge, expertise and authority to correct the record;
  • the request consists of a professional opinion or observation that a health care provider has made in good faith; or
  • the request is frivolous, vexatious, or made in bad faith.

We endeavour to respond to all requests for correction within 30 days. If you are a patient, and we disagree with you, you will be permitted to prepare a short statement of disagreement that we will append to your health record.

Questions and Complaints

Our staff will attempt to assist you with any question or concern that you have about how we handle your personal information.

If you are not satisfied, please contact us using the contact information below.

We will investigate and respond to your question or complaint. We endeavour to respond to all questions and complaints within 30 days.

Contact Us

If you have a question, complaint or concern about privacy email us at: Privacy@AleafiaHealth.com or by mail:

Aleafia Health Inc.

Attention: Privacy at Aleafia

85 Basaltic Road

Concord, Ontario

L4K 1G4

Changes to this Privacy Notice

We may change this Privacy Notice from time to time.

Effective as of December 30, 2020, this Privacy Notice replaced previous privacy notices and policies posted our websites. In this latest version of our Privacy Notice, we:

  • consolidated different the privacy notices and policies on our different websites;
  • provided you with more information about the personal information we collect and how we use it; and
  • provided you with more information about options on how to control your personal information and how to exercise your rights.