Peoples Pharmacy endeavors to provide its shareholders, members, employees, and customers with the highest quality of services and products. To provide this high level of service, information about individuals is sometimes collected, used and/or disclosed as a result of legal, administrative, promotional and internal management purposes. This personal information helps Peoples Pharmacy form strong relationships with these individuals and as such we treat this information with the highest degree of integrity. Peoples Pharmacy complies with all federal and provincial legislation as it pertains to the protection of personal information of all individuals associated with our business. Further to these legal requirements, we have adopted the following privacy principles, policies and practices to ensure we protect the privacy of individuals associated with Peoples Pharmacy.

Principle 1 — Accountability

We are responsible for personal information under our control. We have designated a Privacy Officer who is accountable for the organization’s compliance with these privacy principles.

.1 The Privacy Officer has the authority to ensure Peoples Pharmacy complies with our privacy principles, policies, and practices. The Privacy Officer may delegate another individual to act on their behalf. Other individuals within the organization may be responsible for the day-to-day collection and processing of personal information.

.2 If personal information in our possession or custody is transferred to a third party for processing, we will use contractual or other means to provide adequate safeguards of the personal information while the information is being processed by a third party.

.3 We have implemented policies and practices to give effect to the privacy principles, including: (a)the implementation of procedures to protect personal information; (b)the establishment of procedures to receive and respond to complaints and inquiries; (c)the training of staff and communicating to staff information about our policies and practices; and (d)the development of information to explain our policies and procedures.

Principle 2 — Identifying Purposes

We shall identify the purposes for which personal information is collected at or before the time the information is collected.

.1 We will inform individuals of the purposes that their personal information will be used either orally or in writing.

.2 If we decide to use personal information that has been collected for a purpose not previously identified unless the new purpose is required by law, we shall obtain the consent of the individual before information will be used for that purpose.

.3 Employees of our organization who are involved in collecting personal information will be able to explain to individuals the purposes for which the information is being collected.

Principle 3 — Consent

We will not collect, use, or disclose personal information without the knowledge and consent of the individual who is the subject of the information, except in circumstances where the law permits or requires otherwise.

.1 We will seek consent for the use or disclosure of the information at the time of collection. In certain circumstances, consent with respect to use or disclosure may be sought after the information has been collected but before use.

.2 When collecting personal information, we shall advise the individual of the purposes for which the information will be used either orally or in writing.

.3 We will not, as a condition of the supply of a product or service, require an individual to consent to the collection, use, or disclosure of information beyond that required to fulfill the explicitly specified, and legitimate purposes.

.4 The form of the consent we obtain may vary, depending upon the circumstances and the type of information. In determining the form of consent to use, we shall take into account the sensitivity of the information.

.5 Consent may be implied consent or express consent provided verbally, electronically, in writing or by an action or inaction. Consent may be collected from the individual who is the subject of the information or from their legal representative and/or guardian.

.6 An individual may withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. We shall attempt to inform the individual of the implications of such withdrawal with the understanding that withdrawal of consent by the individual could affect the services we provide the individual.

Principle 4 — Limiting Collection

We will limit the collection of personal information to that which is necessary for the purposes of providing service to the individual.

Principle 5 — Limiting Use, Disclosure, and Retention

Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information shall be retained only as long as necessary for the fulfillment of those purposes. After that time it shall be destroyed or rendered anonymous.

Principle 6 — Accuracy

We shall attempt to make personal information as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.

.1 We shall not routinely update personal information unless such a process is necessary to fulfill the purposes for which the information was collected.

.2 Personal information that is used on an ongoing basis, including information that is disclosed to third parties, should generally be accurate and up-to-date unless limits to the requirement for accuracy are clearly set out.

Principle 7 — Safeguards

We shall ensure that personal information is protected by security safeguards appropriate to the sensitivity of the information. 1. Security safeguards are used to protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification.

2. Safeguards will vary depending on the sensitivity of the information that has been collected, the amount, distribution, the format of the information, and the method of storage.

3.The methods of protection we utilize include but are not limited to: (a) physical measures, for example, locked filing cabinets and restricted access to offices; (b) security clearances and limiting access on a “need-to-know” basis; and (c) technological measures, for example, the use of passwords and encryption.

.4 Our employees are made aware of the importance of maintaining the confidentiality of personal information through training and signing of a “Confidentiality Agreement.”

Principle 8 — Openness

Upon request, we will make available to individuals specific information about our policies and practices relating to the management of personal information.

.1 To assist individuals with their requests about our privacy policies, our Privacy Officer can be contacted. The Privacy Officer, or their designate, shall assist individuals seeking information about our privacy policies.

.2 The Privacy Officer, or their designate, will assist with the following: (a) address any complaints or inquiries about our privacy policies; (b) assist individuals seeking access to personal information held by our organization; (c) provide a description of the type of personal information held by our organization, including a general account of its use; (d) provide a copy of any brochures or other information that explain our organization’s policies, standards, or codes as it pertains to privacy issues; and (e) provide a summary of what personal information is made available to related organizations (e.g., subsidiaries).

Principle 9 — Individual Access

Upon a written request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate.

.1 Upon written request, our Privacy Officer shall inform an individual whether or not Peoples Pharmacy holds personal information about the individual. Where appropriate, we shall allow the individual access to this information. We will not disclose information to the individual if the information contains references to a third party or another individual, is prohibitively costly to provide, cannot be disclosed for legal, security or proprietary reasons or is subject to solicitor-client or legal privilege. In addition, we shall provide an account of the use that has been made or is being made of this information and an account of the third parties to which it has been disclosed.

.2 The individual seeking access to their personal information will be required to provide written notice of their request and will need to provide identification (e.g. photo identification) considered adequate to the Privacy Officer before we shall provide an account of the existence, use, and disclosure of personal information. The information provided by the individual shall only be used for this purpose.

.3 In providing an account of third parties to which we have disclosed personal information about an individual, we will attempt to be as specific as possible. When it is not possible to provide a list of the organizations that we have actually disclosed information about an individual, we shall provide the individual with a list of organizations to which we may have disclosed information about the individual.

.4 We shall respond to an individual’s request within THIRTY days of receiving a written request. We may charge the individual a reasonable fee to cover the costs of providing this information. We shall inform the individual of this cost prior to providing this information. The individual can withdraw his or her request for this information if they do not wish to pay the estimated fee.

.5 If an individual successfully demonstrates the inaccuracy or incompleteness of personal information, Peoples Pharmacy shall amend the information as required. If the record cannot be amended (e.g. a legal document that cannot be changed or information is contained in a record produced by a third party), we shall make note of the discrepancy on the record. Where appropriate, the amended information shall be transmitted to third parties having access to the information in question.

Principle 10 — Challenging Compliance

An individual whose personal information is held by Peoples Pharmacy can address a challenge concerning compliance with the above principles to the Privacy Officer.

.1 The Privacy Officer shall address all complaints or inquiries about our policies and practices relating to the handling of personal information. The inquiry shall be responded to within THIRTY days and we will do our utmost to satisfy the individual’s concerns.

.2 The Privacy Officer shall investigate all complaints. If a complaint is found to be justified, Peoples Pharmacy shall take appropriate measures, including, if necessary, amending our policies and practices.

.3 If an individual is not satisfied with the response from Pharmacy Brands Canada or about our privacy policies and practices, they can contact: Office Of The Information And Privacy Commissioner (Calgary) Suite 500, 640 – 5th Avenue SW Calgary, AB T2P 3G4 Phone: (403) 297-2728 Fax: (403) 297-2711 Toll-Free: 1-888-878-4044 OR Privacy Commissioner Of Canada 112 Kent Street Ottawa, Ontario K1A 1H3 Phone: (613) 995-8210 Toll-free: 1-800-282-1376 Fax: (613) 947-6850 TTY: (613) 992-9190

What Personal Information Do We Collect and How is it Used?

Pharmacy Brands Canada needs to collect personal information about individuals in order to provide some of the products and services to our customers and partners. Personal information is usually collected directly from the individual but there are some exceptions where the information may be collected from affiliated pharmacies and other third parties (e.g. insurance companies, credit organizations, employers, etc.).

Personal information may be used: To determine eligibility for products and services and provision of our services

For accounting services related to our provision of products and services

For communicating with our shareholders, members, employees, and customers

To comply with applicable legislation

For the management of human resources-related functions

For administration of contests and draws and associated marketing For internal management purposes (e.g. planning, resource allocation, policy development, quality improvement, monitoring, auditing, evaluation, reporting, etc.)

We are committed to informing individuals of the purpose that their personal information is needed at the time the information is collected. We will not use personal information for any other purpose without getting the consent of the individual.

What Personal Information is Shared?

Pharmacy Brands Canada does not disclose personal information to businesses or individuals for the purposes of financial gain. As part of the provision of products and services, we may disclose information due to legal or regulatory requirements. Other companies or affiliates may provide services to our shareholders, members, employees, and customers on our behalf – we ensure that these companies protect personal information to our same standards.

Contact Information

Inquiries regarding Pharmacy Brands Canada privacy policies, procedures, and practices or requests for access to personal information must be made in writing to:

Privacy Officer Pharmacy Brands Canada 16504 – 121A Avenue Edmonton, AB T5V 1J