CANAMERICA PLUS PROGRAM PRIVACY POLICY

Last revised: May 1, 2025

ACS 247 Ltd. ("ACS", "we", "us", or "our") values the privacy of individuals who use ACS's Website (as defined below), health service administration platform and its branded programs (including, but not limited to, (CANAMERICA Plus, CanAmerica, CanAmerica+), and other products and services we may offer from time to time (collectively, the "Program"). This "Privacy Policy" describes: (1) the personal information and personal health information we gather from individuals that access or use the Program (collectively, "users", "you" or "your"); (2) how we use and disclose such information; and (3) the steps we take to protect such information. By using the Program, you consent to our Terms of Service and our privacy practices, which privacy practices are described in this Privacy Policy.

As encouraged by the Personal Information Protection and Electronic Documents Act ("PIPEDA"), the commentary in this Privacy Policy has been drafted to reflect privacy issues specific to ACS. We will continue to review this Privacy Policy to make sure that it remains current with exceptions, changing technologies, industry standards and applicable laws. If we make changes to this Privacy Policy, a revised version will be posted on our Website. In the event any modification is material (in ACS's sole discretion), we will provide you with reasonable notice before such modifications take effect. Your continued use of the Program thereafter constitutes your acceptance of such modifications.

Definitions

authorized representative: A duly authorized representative of a Program User appointed in accordance with our Terms of Service.

collection: The act of gathering, acquiring, recording, or obtaining personal information from any source, including third parties, by any means.

consent: Voluntary agreement for the collection, use and disclosure of personal information for defined purposes. The form of consent we seek may vary, depending upon the circumstances and the type of personal information. In determining the form of consent, we take into account the sensitivity of the personal information and your reasonable expectations. Consent may be provided directly by you, or by your authorized representative, in accordance with applicable law.

disclosure: Making personal information available to a third party, under their control and as used or disclosed by them for their own purposes, independent of services the third party performs for or on behalf of ACS.

employee: An employee of, or an independent contractor to, ACS. The inclusion of independent contractors within the definition of "employee" is for convenience of reference only, and should in no manner imply that such independent contractors are our employees within the meaning of employment legislation or are in an employee-employer relationship with us.

guardian: The parent, legal guardian, caregiver or person acting as a parent in the absence of a parent or legal guardian, of a Program User (as defined in this section) that is under the age of majority in your jurisdiction.

NSP: A network service provider, which includes but is not limited to, prescribers who are authorized to issue treatment plans for the Program User, which treatment plans may contain a written direction directing that a stated amount of a drug be dispensed or that non-prescription goods be provided, as well as other providers of health care or related services, pharmacists or pharmacies.

personal information: Information about an identifiable individual, including, but not limited to, personal health information.

Program User: An individual accepted for enrollment to access and use a branded Program.

Program User Questionnaire: Information and response to questions which are relevant to the Program User's participation in the Program.

third party: An individual or organization outside of ACS.

use: The treatment, handling, and management of personal information by and within ACS or by a third party on behalf of ACS and with the knowledge and approval of ACS.

Website: Our website, https://www.canamericaplus.com.

Scope and application

This Privacy Policy applies to personal information, in any form, collected, used or disclosed by ACS through the provision of the Program.

This Privacy Policy does not impose any limits on ACS's collection, use or disclosure of the following information:

information about an individual that is publicly available and is specified by regulation pursuant to PIPEDA;
personal information that is not collected, used or disclosed, for commercial purposes;
non-personally identifiable information; and
the name, title, business address or telephone number of anyone, where the collection, use or disclosure of such information is solely for the purpose of communicating with the person about their employment, business or profession (collectively, "Business Contact Information").

The application of this Privacy Policy is subject to the requirements and provisions of PIPEDA, and any other applicable legislation or regulation. If you reside in the United States or certain Canadian provinces, such as British Columbia, Alberta or Québec, then the substantially similar privacy law of your jurisdiction will apply to our handling of your personal information, rather than PIPEDA. In that case, reference in this Privacy Policy to PIPEDA will be deemed to include your jurisdiction's substantially similar privacy law.

How we collect and use personal information

Except as set out in this Privacy Policy, we only collect personal information about you with your knowledge and consent. Generally, this means we collect personal information directly from you when you use the Program. Occasionally, we may collect personal information from third party sources, such as an NSP, but only when the third party collects the personal information with your knowledge and consent, or where otherwise authorized by the law.

NSPs in our network may share your personal information among themselves, as well as our affiliated entities for the purpose of safely and effectively filling an order.

We may collect and process all or some of the following information about you, from the following sources, and for the following purposes:

Personal information collected

Collection source

Purpose for collection

We may collect the following personal information about you, or about your child, in the case where the Program User is a child:

contact information, including phone number, fax number and email address;
name;
address;
Postal Code or ZIP Code;
credit card information;
banking information;
date of birth;
gender;
height;
weight;
nationality;
ethnicity;
whether you are a smoker;
alcohol and narcotic consumption;
medical providers;
available medical charts;
known allergies;
medical history;
medications both prescribed and over the counter medicines taken and for what reason(s);
current and past prescribed treatment plans. As well as any nutraceutical / holistic remedies taken;
imaging, laboratory results, DNA or genetic test result; and
personal health information & personal as well as family history.

We collect this information from:

your Program User Questionnaire or your account information, provided by you to us over the phone or on our Website. Including any follow-up questions as well as any counseling;
any prescription(s) issued to you by a prescriber;
communication with or received from a prescriber, a care giver, a clinic, a care facility, or clinical staff;
communications between or among any of you, us or any provider;
communications we or a provider in our network may have with a prescriber, caregiver, or clinic staff to clarify any questions they have concerning a prescribed treatment plan for you or to obtain a prescription for you; and
any test or health data source that is made available to us, that we can integrate.

We may use this information to:

provide you with updates on service requests you submit;
assist you in accessing an NSP, including a pharmacy, and providing it with the information it needs to fill your initial or further service request or to provide you with a discount;
assist you with delivery of the product or service;
obtain payment with respect to a service request by us or by an NSP;
enable predictive algorithms and use AI to enhance our service, recommendations, and improve care;
help determine effectiveness of a treatment plan as well as alternatives;
determine if laboratory or diagnostic testing is recommended;
help access any anticipated, usual, or rare side effects one may experience.
provide you with up-to-date information on our policies and business practices;
provide you with informational and promotional material about products and other services available to Program Users. These include products and services provided by us or by NSPs;
help us determine which products or services to bring to your attention;
conduct customer satisfaction surveys;
manage our business, including such matters as accounting, directing and monitoring employee performance;
meet legal or regulatory requirements; and
protect our interests in the context of actual or potential regulatory or legal proceedings.

We may collect the following personal information about guardians, authorized representatives or Program Users:

any personal information identified in this table; and
any other personal information that an NSP may disclose to us, in accordance with their privacy practices and policies.

We collect this information from NSPs to which you provide your information, with your knowledge and consent.

We may use this information to fulfill any purpose identified in this table or section.

Further reference to "identified purposes" means the purposes identified in this section of this Privacy Policy. At times, we may engage the assistance of a third-party service provider to help us fulfil the identified purposes.

We will inform you of the purposes for collecting your personal information at or before the time of collection. Persons collecting may explain these purposes or direct you to a designated person within ACS who can.

We may depart from this Privacy Policy where required to do so by law or where it is reasonable for us to do so in light of exceptional circumstances, such as addressing an urgent threat to human life or health.

You may withdraw consent for the collection, use and disclosure of your personal information at any time, subject to legal or contractual restrictions and reasonable notice. For more information about withdrawing your consent, you may contact ACS's Chief Privacy Officer at privacy@ACS247.com.

Disclosure of personal information

ACS may disclose your personal information to an NSP or other third party in the following circumstances:

to fulfill the identified purposes (including providing personal information to NSPs, as part of the identified purposes);
to protect our rights or the rights and safety of our users, or as necessary in the event of a court order, regulatory inquiry or other lawful request;
in relation to a known or suspected violation of our Terms of Service, fraud prevention or other unlawful use, by sharing personal information with entities assisting us in an investigation and as may be required by applicable law;
in the event of a reorganization, merger, sale, assignment, bankruptcy, or similar business change, by transferring your personal information to that re-organized entity or new owner after the sale or reorganization for them to use in accordance with this Privacy Policy; and
where otherwise required or permitted by law.

We will only share necessary information for its intended purpose. When feasible, we will use confidentiality agreements or other measures to protect your sensitive personal information.

The personal information you provide to an NSP, will be accessible to that NSP. Once an NSP has access to your personal information, it is under their control and their use of the personal information will be handled in accordance with their privacy practices and policies.

Only our employees who require access for legitimate reasons or whose duties reasonably so require, are granted access to personal information.

We will retain personal information only as long as it remains necessary or relevant for the identified purposes or as required or permitted by law. We maintain reasonable controls, schedules and practices for personal information management retention and destruction. Personal information that is no longer necessary or relevant for the identified purposes, or is required by law to be retained, is destroyed, erased or made anonymous, as appropriate in the circumstances.

ACS's website

Our Website may use various technologies, from time to time, to:

help us customize your experience on our Website;
track your use of our Website for advertising, marketing, or promotional purposes;
help us determine whether you opened an email message from us; or
gather information to deliver information about products and services we think may be of interest to you.

The type of information we may collect by automated means includes:

your visiting domain name or IP address;
the device, browser, operating system type and screen resolution you use;
information on actions taken at our Website, such as navigation patterns (i.e., pages viewed and downloaded; job postings viewed, etc.) and the date, time, duration and number of times you visited our Website;
the previous site you visited; and
the geographical location (such as the country and city of origin) from where you accessed our Website.

This information enables us to:

customize the services we offer you, to improve our Website;
estimate our audience size and usage patterns;
store information about your preferences, allowing us to customize our Website according to your individual interests;
speed up your searches;
recognize you when you return to our Website; and
show our advertisements on external sites.

When you visit our Website, we may collect certain information by automated means such as through the use of cookies, other automated devices and website tracking tools such as Google Analytics. We use these tools to collect information about how our Website is used. Google Analytics generates statistical and other information about websites by means of cookies stored on users' computers. Google may collect, transfer, store, and process this information on its servers located in the United States.

Marketing

We will not share your personal information with third parties, including NSPs, for their marketing purposes. We may send you our newsletter and promotional material about our own or NSP products, services, and discounts, unless you request otherwise.

We will honour any request you make to not receive promotional material from us. You can opt out of receiving such material at any time by speaking to a call centre representative or contacting our Chief Privacy Officer at privacy@ACS247.com.

Security of personal information

The security of your personal information is very important to us. We use physical, electronic, and administrative measures designed to prevent any unauthorized access, disclosure, copying, use, or modification of personal information. Safeguards include securing physical documents and technological measures by way of secure access and encryption. We store all personal information you provide to us on servers which are behind firewalls.

ACS employees are authorized to access personal information based only on their need to deal with the information for the reason(s) for which it was obtained. Safeguards are in place to reduce the risk that information will be disclosed or shared more widely than is necessary to achieve the purpose for which it was gathered. We also take measures to maintain the integrity of this information and to prevent it from being lost or destroyed.

We safeguard personal information shared with third parties through confidentiality agreements and specified usage terms.

Access to your personal information

You may access any personal information that we have concerning you, a minor of whom you are the guardian, or an individual of whom you are a duly authorized representative, and which has been collected, used or disclosed for a commercial purpose, by sending a written request to ACS's Chief Privacy Officer at privacy@ACS247.com. ACS may advise you in advance if there is a minimal charge to conduct a search of our records and will respond within thirty (30) days, or advise that the request for access is subject to an extension as authorized by PIPEDA.

To protect your privacy, you may be required to provide sufficient identification, in order to permit us to account for the existence, use and disclosure of certain personal information and to authorize access to such information. Any such information will only be used for this purpose.

We may not be able to provide personal information to you if doing so would violate the privacy of a third party or if certain personal information is subject to legal privilege, contains information proprietary to us or a third party, is too costly to retrieve, or cannot be disclosed for other legal reasons. If we are unable to provide access to all or part of your personal information, we will explain our reasons for such a decision.

Where you have been provided with access to your personal information, you will be able to challenge the accuracy and completeness of your personal information and have it amended as appropriate.

Personal information given to third parties will be subject to local laws. In rare cases, we may not be able to account for some collections, uses, or disclosures of personal information due to legal restrictions. Generally, though, we will detail the collection, use, and disclosure of personal information and identify its source when possible. We will also list organizations to which we have disclosed your information if an actual list cannot be provided.

If we have disclosed your personal information to an NSP, you may need to contact the NSP to receive a complete list of organizations to which they may have disclosed your personal information, and to access personal information which is under their control.

We will respond to your request for a copy of your personal information within thirty (30) days of receiving your request.

Accuracy of personal information

We make reasonable efforts to ensure that personal information we collect, use or disclose is as accurate, complete and up-to-date as necessary for the purposes for which it is to be used. Please be advised, however, that ACS uses and relies on information from NSPs, the accuracy of which we cannot control.

If you find any errors in our personal information holdings (including information provided by an NSP), we should be informed so that we can make the appropriate corrections. Where we are able and it is reasonable to do so, we will convey these corrections to the NSP when the personal information is not under our control. For personal information that remains in dispute, we will make note in our records of your opinion as to the accuracy of the relevant personal information.

We will remove information about you from our records at your request, unless it is reasonable for us to retain the information for a legitimate purpose, such as contractual restrictions.

Personal information of minors

Before we collect personal information about Program Users under the age of majority, we obtain permission from the verified guardian. Subject to reasonable notice and contractual restrictions, guardians may contact us at any time to revoke their consent, review the information we have collected from the respective Program User, request that we collect no additional information, or request that we delete their child's information.

Once personal information is disclosed to an NSP (regardless of whether the personal information is about a minor), the personal information becomes under the control of the NSP and, therefore, subject to the NSP's privacy practices and policies. For more information about an NSP's privacy practices or policies, you may contact that NSP.

Challenging compliance with privacy laws

All questions or concerns regarding our privacy practices should be directed to ACS's Chief Privacy Officer at privacy@ACS247.com.

We will review all complaints related to this Privacy Policy. If found to be justified, we will address them and adjust our policies as needed. You will be notified of the investigation results.

Language

You and ACS have requested and agree that this Privacy Policy and all documents related to this Privacy Policy be drawn up in English. Les parties ont demandé que cette convention ainsi que tous les documents que s'y rattachent soient rédigés en anglais.

Changes

We reserve the right to make reasonable changes to this Privacy Policy, from time to time, and will post any changes on our Website. By using our services after that change, our privacy commitments will in all respects be governed by the new version of the Privacy Policy.

General

This Privacy Policy is binding upon and enures to the benefit of the parties and their respective heirs, executors, legal representatives, successors and permitted assigns (as the case may be).

For questions or concerns about this Privacy Policy or ACS's information handling practices, contact us at: privacy@ACS247.com

Please also visit the Office of the Privacy Commissioner of Canada's website at https://www.priv.gc.ca/en/