Privacy Policy

Introduction

Cameron Stewart LifeScience Canada Inc. ("CSL", "we", "our", "us") is a leading supplier of solutions benefiting patients, healthcare providers and payors (the "Programs") including our RxHelp, Therapy FA, InnomarSTART and any other portals supported by RxHelp. CSL is committed to protecting Personal Information, including Personal Health Information.

Purpose & Scope

This Privacy Policy ("Policy") describes how CSL collects, uses, discloses, and maintains Personal Information about individuals, which may include members of the public, patients, pharmacists, nurses, nurse practitioners and other healthcare providers (hereinafter collectively referred to as "you"). This Policy applies to Personal Information collected by CSL in Canada, including through our websites, software, apps or user interfaces (the "Platforms") or as part of your interaction with us by telephone, email, and letter mail. This policy is not intended to cover information other than Personal Information, such as business or anonymous information. In the event of a conflict between this Policy and the privacy policies of CSL affiliates, this Policy shall prevail in respect of the CSL Platforms or your interactions with CSL.

Please read this Privacy Policy carefully. By accessing or using our Platforms, by participating in the Programs, or submitting your Personal Information to us, you consent to the collection, storage, use and disclosure of your information in accordance with this Privacy Policy.

In this Policy,

"Personal Health Information" means information that identifies or can identify an individual and relates to the state of the individual’s health or the treatment they are receiving. More specifically, personal health information means diagnostic, treatment and care information, and/or health registration information, including the list of medications an individual has been prescribed.

"Personal Information" means information in any format about an identifiable individual, including name, date of birth, gender, email address and phone number. Personal Information may include Personal Health Information. Business contact information is not Personal Information. Business contact information includes any information that individuals make available for the purpose of communicating with them in relation to their employment, business or profession, such as the individual’s name, title or office, work address, work telephone number, work fax number or work email address.

Amendments

CSL reserves the right to amend and/or supplement this Policy at any time, including in response to changes in CSL’s operations, the law, and/or decisions of governmental agencies and regulators. Any changes we make will become effective when we post a modified version of the Policy on this website. The date that this Policy was last amended will appear in the top right-hand corner of the website’s Privacy Policy Section. If you provide CSL with your Personal Information, or the Personal Information of others (with their consent or otherwise as permitted by law), you will be understood to agree to CSL’s collection, use, disclosure and/or maintenance of the information in accordance with this Policy as amended from time to time. Questions about the meaning or implications of any of the provisions of this Policy may be directed to CSL as indicated in the "Contact Information for Privacy Officer" section below.

Collection and Use of Personal Information

We collect Personal Information in the following ways:

• Directly from you. For example, you may submit Personal Information to us, such as your email address and the list of medications prescribed to you, by filling in fields through the website or mobile application, or by corresponding with us by email or otherwise. You may always limit the amount and type of Personal Information that CSL receives about you by choosing not to enter any Personal Information into forms or data fields on our websites or mobile applications.
• Automated technologies or interactions. As you interact with our Platforms, we may automatically collect technical data about your equipment, browsing actions and patterns. We collect this information by using cookies and other similar technologies (see the "Cookies" section below).
• Third parties. We may receive information about you from third parties including, for example, our business partners, collaborators or service providers, or your pharmacist and other health care providers;

We use Personal Information for the following purposes:

• to facilitate requests that you have made, including for electronic content (for example, when you provide your email
• address to us and identify medications prescribed to you, to have an RxHelp ONE Card sent to your email address);
• to communicate with you, including to authenticate your identity and ensure that your information is correct and accurate;
• to address your inquiries and complaints;
• for claim administration including payment, adjudication and auditing of drug claims: to fulfill the purposes for which you provided the data or that were described when it was collected;
• to keep you informed about our programs and services, including notifying you about updates to our websites, mobile applications, products, or services (for example, when you opt-in to receiving certain commercial electronic messages from us);
• to develop, enhance or market our products and services;
• to manage our organization and day-to-day organizational and operational needs;
• to maintain and improve the security and functionality of our products and services;
• to establish and maintain communication with service providers;
• to comply with our legal and regulatory obligations; and
• to fulfil other purposes related to any of the above.

Sharing and Transfer of Personal Information;

We may share your information with our affiliates, collaborators, business partners and service providers (e.g., internet service providers, hosting companies, data processing and storage, fulfillment services, technical support, delivery services, and financial institutions) to assist us in providing you services, perform functions on our behalf or for our internal business purposes.

For example, your Personal Information may be shared with third party organizations or businesses, including adjudicators or pharmaceutical companies sponsoring our Programs, which may receive your Personal Information from CSL and use it to determine your eligibility to participate in the Programs and the level of benefit or reimbursement you receive under the Programs.

CSL may also provide reports on our Programs containing Personal Information to third parties, including government, pharmaceutical companies and other interested healthcare parties.

CSL imposes privacy requirements on its service providers through agreements. The requirements limit the service provider’s access, use and disclosure of your Personal Information to that required for the provision of its services. CSL requires the service provider to protect the information to the same degree that CSL would were it providing the services directly.

We may share Personal Information about you if we reasonably believe that disclosing the information is needed to:

• comply with any valid legal process, governmental request, or applicable law, rule, or regulation;
• protect the rights, property, and safety of us, our users, or others; or
• detect and resolve any fraud or security concerns.

We may also transfer your Personal Information to third parties as an asset in connection with a proposed or completed merger or sale (including transfers made as part of insolvency or bankruptcy proceeding) involving all or part of CSL or as part of a corporate reorganization or other change in corporate control.

De-Identification

CSL may de-identify and aggregate your Personal Information so that the information no longer is identifiable as information relating to you. For example, we may collect information for internal analyses of our pharmaceutical solutions Programs based on non-patient specific aggregate data, and we may compile and provide reports and analyses based on this non-patient specific aggregate data to our business partners and collaborators.

Cookies

CSL may use cookies, beacons, pixels, behavioral analytics tools or other technologies to help identify you, store information relevant to your use of the Platforms, and to help provide you with a more efficient and enjoyable online experience.

When you visit our Platforms, including our websites or mobile apps, we assign you a unique number, which is stored in one or more cookies on your computer or mobile device’s hard drive. When you visit our Platforms we may collect, using electronic means, technical information. This information may include the IP address of your computer and mobile device, which browser you used to access the website, your operating system, resolution of screen, location, language settings in browsers, the website you came from, and searched for keywords (if arriving from a search engine).

This technical data is aggregated and used to measure and improve the effectiveness of our website, mobile applications and our services. We may share this non-identifying information in aggregate. We do not attempt to combine technical information with Personal Information we collect. You can block the use of cookies by activating the settings in your browser but if you choose to withhold consent, or subsequently block cookies, you may not be able to access all or part of the content of our Platforms.

Notice and Consent

CSL gives notice and obtains consent for the collection, storage, use and disclosure of Personal Information, where it is required by law, in several forms (including through this Privacy Policy or other means) depending on the circumstances, sensitivity of the data, and whose Personal Information it is collecting. You may withdraw your consent to the collection, storage, use and disclosure of your Personal Information by contacting our Privacy Officer, subject to legal or contractual restrictions and reasonable notice. Doing so may prohibit certain communications or transactions with CSL.

CSL will not use or disclose your Personal Information for purposes other than those for which it was collected, except with your consent or as required or permitted by law.

Safeguarding Information

CSL uses commercially reasonable physical, technological and administrative safeguards to protect your Personal Information against theft, loss and unauthorized access, use (including copying and modification), disclosure and disposal while at rest and in transit. The nature of the safeguards we use varies depending on the sensitivity, format, and the scope of the required distribution of the information, however they may include:

1. by way of physical measures: safe storage of records, locked filing cabinets, and restricted access to offices;
2. by way of administrative/organizational measures: limiting access of personnel; and
3. by way of technological measures: the use of passwords for access to our network systems, encryption and audits.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your Personal Information, we cannot guarantee the security of your Personal Information. Any transmission of Personal Information is at your own risk.

Retention of Personal Information

CSL retains your Personal Information only for as long as is necessary for the purpose for which it was collected or as required or permitted by applicable law. When your Personal Information is no longer required, it will be destroyed or de-identified.

Cross Border Storage and Transfers of Personal information

We are based in Canada. However, some of our service providers, collaborators, business partners or affiliates may access, process or store certain of your Personal Information outside of your province, territory or Canada in the course of their relationship with us. This means your Personal Information will be subject to the local laws of the jurisdiction where it is transferred which may not be as comprehensive as your own, and in certain circumstances, other foreign governments, courts, law enforcement agencies or regulatory agencies may be entitled to access your Personal information. By using our Products, products, services or our Platforms, you consent to the collection, storage, and processing of your information in Canada and in any country to which we may transfer your information in the course of our operations.

Children’s Privacy

Our Platforms are not intended for children under 16 years of age. If we learn that a child has volunteered Personal Information to us, including on our Platforms without the consent of a parent or legal guardian, we will take measures to delete such information from our systems.

Third Party Links

Our Platforms may contain links allowing users to visit other sites operated by other organizations. We are not responsible for the privacy practices or content of any of such third party websites or platforms to which we link. We do not have any control over such third party websites or platforms, and therefore we have no responsibility or liability for the manner in which the organizations that operate such linked websites or platforms may collect, use, or disclose, secure and otherwise treat Personal Information. If you access such third-party websites or platforms, either directly or via the website, you should review the privacy policy of each site.

Access, Inquiries, and Correction

Except in the limited circumstances established by law, you may obtain access to your Personal Information. You may also request that we correct your Personal Information where you believe it to be out of date or otherwise inaccurate. Requests for access or correction must be made in writing and should be addressed to our Privacy Officer. Please note that we may need to confirm your identity or request additional details in order to process your request.

You may obtain more information about how we manage your Personal Information or raise any privacy-related requests or complaints with us by contacting our Privacy Officer.

Contact Information for Privacy Officer The Privacy Officer may be contacted at:

3470 Superior Court, Oakville, Ontario, Canada L6L 0C4

Tel: 905-847-4260

Email: privacy.officer@cslifescience.com