PRIVACY POLICY

Protecting the privacy and security of your personal information is of the utmost importance to us at Patient Voice Partners Inc. and, as applicable, one or more of its affiliates (collectively “PVPA”). PVPA respects your privacy and is committed to protecting it through our compliance with this privacy policy (the “Policy”). This Policy describes the types of Personal Information (defined herein), which can include personal and sensitive health information (collectively, “Personal information”), we may collect from you or that you may provide on the PatientVoicePartners.com website, mobile application, and any related products, websites and services, as well as the tools, services, mobile application, social media, and any other digital platform or other service operated, used or provided by PVPA and any program, including but not limited to, advisory boards, focus groups, insight sessions, interviews, discussion rooms/boards or discussions, forums, conferences, advocacy, research projects or related activities, services, workshops, connection to third parties, or surveys (collectively, “Services”), and our practices for collecting, using, maintaining, protecting, and disclosing that Personal Information. It also describes the choices available to you regarding our use of your Personal Information and how you can access and update it. By continuing with and/or using the Services, you are agreeing to and providing your consent to abide by the Policy. The Policy is incorporated within the Terms and Conditions Policy.

This Policy is a legally binding agreement between you and PVPA. If you are providing your personal information to PVPA or entering into an agreement with PVPA, you are doing so on behalf of either yourself or a business or other legal entity, you represent that you have the authority to bind such entity to this agreement, in which case the terms “you” shall refer to such entity. If you do not have such authority, or if you do not agree with the terms of this Policy, you must not accept it and may not access and use the Services. By accessing and using the Services, you acknowledge that you have read, understood, and agree to be bound by the terms of this Policy. This Policy does not apply to the practices of companies that we do not own or control, or to individuals that we do not employ or manage. If you disclose information on other sites not part of PVPA, you are subject to the privacy customs/policies of those sites. We encourage you to ask questions before you disclose personal information. This Policy shall be governed by and interpreted in accordance with the law of the Province of Alberta and the laws of Canada applicable therein. If any part of this Policy is held to be void, invalid or otherwise unenforceable, PVPA may elect either to modify the void, invalid or unenforceable part to the extent necessary to render it legal, valid and enforceable or to sever the void, invalid or unenforceable part, in which event the remainder of this Policy will continue in full force and effect.

Automatic collection of information

When you open the Website or use the Mobile Application, our servers automatically record information that your browser or device sends. This data may include information such as your device’s IP address and location, browser and device name and version, operating system type and version, language preferences, the webpage you were visiting before you came to the Services, pages of the Services that you visit, the time spent on those pages, internet service provider, planform type, the information you search for on the Services, access times and dates, and other statistics.

Information collected automatically is used only to identify potential cases of abuse and establish statistical information regarding the usage and traffic of the Services. This statistical information is not otherwise aggregated in such a way that would identify any particular user of the system.

Collection of Personal Information

You can access the patientvoicepartner.com website main page without telling us who you are or revealing any information by which someone could identify you as a specific, identifiable individual. If, however, you wish to use some of the features offered on the Services, you may be asked to provide certain Personal information (e.g. name and contact info, country of residence, etc.) for the purposes of contacting you and certain health information (e.g. diagnosed medical condition(s)/disease(s), treatment experience(s), experience with the health care system, including without limitation access to and use of the health care system and/or resources, and anything related to disease management including without limitation medications/treatments/devices, etc.) for the purpose of assigning you to the correct Services and determining your level of expertise to be able to articulate experiences in any area of disease management and treatment for the purpose of developing improvements in, creating better service offerings, innovation development in any area of disease management and treatment, including access to health care system delivery by those organization(s) seeking insights. You acknowledge you voluntarily choose to submit this information and provide us with permission to proceed where you or someone on your behalf (e.g. caregiver) has disclosed such information to us, including information submitted or disclosed by telephone, mail, electronically or by any other means.

We do not have any Services where making a purchase is offered or possible and will NEVER request any credit card information from you. We receive and store any information you knowingly provide to us when you create an account, or fill any forms on the Services. When required, this information may include the following:

– Account details (such as user name, unique user ID, password, etc.)
– Contact information (such as email address, phone number, etc.)
– Basic personal information (such as name, country of residence, preferred language, etc.)
– Sensitive personal information (such as ethnicity, religious beliefs if they impact your choice of health care offerings or services, mental health, gender, sex, birth year, etc.)
– Patient or caregiver status
– Biometric information (such as facial recognition, fingerprints, etc.)
– Proof of identity (such as a photocopy of a government ID, validation system, etc.)
– Payment information (such as bank details, etc.)
– Geolocation data of your device (such as latitude and longitude)
– Certain features on the mobile device (such as contacts, calendar, gallery, etc.)
– Information about other individuals (such as your family members, friends, etc.)
– Sensitive health information (e.g. diagnosed medical condition(s)/disease(s), treatment experience(s), experience with the health care system, including without limitation access to and use of the health care system and/or resources, and anything related to disease management including without limitation medications/treatments/devices, etc.)
– Any other materials you willingly submit to us (such as articles, images, feedback, etc.)

You can choose not to provide us with your Personal Information, but then you may not be able to take advantage of some of the features on the Services. Users who are uncertain about what information is mandatory are welcome to contact us. PVPA is committed to the protection of your Personal information and will make reasonable efforts to ensure the confidentiality of your information, including as required by applicable laws.

You acknowledge and agree another person you have authorized (such as a family member, caregiver, etc.) to access health-related information about you, they can use, disclose, share, distribute, display, and/or transmit that information, including communicating that information to others. If you do not want others to have this ability, you should not provide others with access to your Personal information.

You acknowledge and understand that PVPA is collecting and maintaining any Personal information shared or collected via Services, unless otherwise required by local law and is used as outlined herein in use and processing of collected information. You understand why you have been asked to disclose Personal Information, including any individually identifying information, and am aware of the risks or benefits of consenting, or refusing to consent, to the disclosure of Personal Information. You understand that you may revoke this consent in writing at any time and processing will remain subject to any managing and retention requirements, described herein.

Privacy of children

We do not knowingly collect any Personal Information from or market to children under the age of 18. If you are under the age of 18, please do not submit any Personal Information through the Services. If you have reason to believe that an individual under the age of 18 has provided personal information to us through the Services, please contact us to request that we delete that child’s Personal Information from our Services.

Managing Personal information

You are able to delete certain Personal Information we have about you. The Personal Information you can delete may change as the Services change. When you delete Personal Information, however, we may maintain a copy of the unrevised Personal Information in our records for the duration necessary to comply with our obligations to our affiliates and partners, and for the purposes described below. If you would like to delete your Personal Information or permanently delete your account, you can do so on the settings page of your account on the Services or simply by contacting us.

Disclosure of information

Depending on the requested Services or as necessary to complete any transaction or provide any Service you have requested, we may share your information with our trusted subsidiaries and joint venture partners, affiliates, contracted companies, and service providers (collectively, “Service Providers”) we rely upon to assist in the operation of the Services available to you and whose privacy policies are consistent with ours or who agree to abide by our policies with respect to Personal Information. To the extent you provide PVPA with Personal information, the use and disclosure will be pursuant to your permission granted by participating in Services and as allowed by privacy laws, to include the use and disclosure for treatment feedback, payment, health care system operations, for notifications and other purposes, connection to outside Services, as required by law/judicial/administrative proceedings, law enforcement purposes, research, public health and disclosure if de-identified and as a limited data set. For purposes not described above, PVPA will ask for authorization before disclosing of any personal identifiers and you consent to release of Personal information publicly (e.g. media release, research project, educational video displayed publicly, etc.). PVPA can not control and is not responsible for personal recognition at private closed Services (e.g. you may recognize someone at the program or vice versa), including by any observers. If you provided authorization for Services, you may revoke it, in writing, at any time, except to the extent that such action has been taken in reliance on the authorization.

Upon providing my Personal Information, I am aware of PVPA may use my Personal Information in any way, including without limitation for marketing purposes and/or for explicitly transferring such Personal Information to third-parties (including outside of the European Union and/or the United States) for the purposes of contacting you for Services for which you have requested to participate in and/or as applicable. For certainty, PVPA cannot and will not (i) ask for your credit card information; (ii) ask for your health card/health number information; and (iii) sell your health information to a drug manufacturing company so that the company can mail you a letter encouraging you to buy a certain drug instead of the one you are using. According to health protection laws, there are exceptions related to the sharing and use of your information related to treatment and health service offerings which will be adhered to.

PVPA reserves the right to use or disclose information without any notice to you where we reasonably believe it is needed to (i) comply with any law, regulation, court order or any legal process (ii) respond to information requests by law enforcement or other government authorities (iii) investigate and help prevent security threats, fraudulent activity, or unauthorized, inappropriate or illegal activity involving PVPA or (iv) enforce and/or protect PVPA rights and property.

In the event PVPA goes through a business transition, such as a merger or acquisition by another company, or sale of all or a portion of its assets, your user account, and your Personal Information may be among the assets transferred.

We are committed to maintaining the security of Personal information by using appropriate administrative, technical, physical, and electronic controls to try and prevent unauthorized access, misuse, loss or alteration of your Personal information. If we share personal information with Affiliates and/or Service Providers, we have strict contractual legal controls regarding protection, use and disclosure of the information. Organization(s) seeking insights generally receive anonymous or de-identified data, unless you have otherwise consented, and are contractually required to keep it in de-identified form and not attempt to re-identify data or allow others to do so.

Service Providers are not authorized to use or disclose your information except as necessary to perform services on our behalf or comply with legal requirements. Service Providers are given the information they need only in order to perform their designated functions, and we do not authorize them to use or disclose any of the provided information for their own marketing or other purposes. We will share and disclose your information only with the following categories of Service Providers:

– Affiliate programs
– Cloud computing services
– Communication and collaboration services
– Data analytics services
– Data storage services
– Government agencies
– Performance monitoring services
– Product engineering and design services
– Sales and marketing services (e.g. related to PVPA business to help improve offerings)
– User authentication services

We may also disclose any Personal Information we collect, use or receive if required or permitted by law, such as to comply with a subpoena or similar legal process, and when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

Retention of information

We will retain and use your Personal Information for the period necessary as long as your user account remains active, to enforce our agreements, resolve disputes, and otherwise for use as described herein, all in accordance with applicable laws.

Transfer of information

Depending on your location, data transfers may involve transferring and storing your information in a country other than your own. You hereby explicitly agree to the transfer of your Personal Information to countries outside the European Union for the purposes of providing and processing the Services or in the cases provided for by the GDPR and will be processed in your interest.

You are entitled to learn about the legal basis of information transfers to a country outside the European Union or to any international organization governed by public international law or set up by two or more countries, such as the UN, and about the security measures taken by us to safeguard your information. If any such transfer takes place, you can find out more by checking the relevant sections of this Policy or inquire with us using the information provided in the contact section.

Data protection rights under the GDPR

If you are a resident of the European Economic Area (“EEA”), you have certain data protection rights and we aim to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Information. If you wish to be informed what Personal Information we hold about you and if you want it to be removed from our systems, please contact us. In certain circumstances, you have the following data protection rights:

(i) You have the right to withdraw consent where you have previously given your consent to the processing of your Personal Information. To the extent that the legal basis for our processing of your Personal Information is consent, you have the right to withdraw that consent at any time. Withdrawal will not affect the lawfulness of processing before the withdrawal.

(ii) You have the right to learn if your Personal Information is being processed by us, obtain disclosure regarding certain aspects of the processing, and obtain a copy of your Personal Information undergoing processing.

(iii) You have the right to verify the accuracy of your information and ask for it to be updated or corrected. You also have the right to request us to complete the Personal Information you believe is incomplete.

(iv) You have the right to object to the processing of your information if the processing is carried out on a legal basis other than consent. Where Personal Information is processed for the public interest, in the exercise of an official authority vested in us, or for the purposes of the legitimate interests pursued by us, you may object to such processing by providing a ground related to your particular situation to justify the objection. You must know that, however, should your Personal Information be processed for direct marketing purposes, you can object to that processing at any time without providing any justification. To learn whether we are processing Personal Information for direct marketing purposes, you may refer to the relevant sections of this Policy.

(v) You have the right, under certain circumstances, to restrict the processing of your Personal Information. These circumstances include: the accuracy of your Personal Information is contested by you and we must verify its accuracy; the processing is unlawful, but you oppose the erasure of your Personal Information and request the restriction of its use instead; we no longer need your Personal Information for the purposes of processing, but you require it to establish, exercise or defend your legal claims; you have objected to processing pending the verification of whether our legitimate grounds override your legitimate grounds. Where processing has been restricted, such Personal Information will be marked accordingly and, with the exception of storage, will be processed only with your consent or for the establishment, to exercise or defense of legal claims, for the protection of the rights of another natural, or legal person or for reasons of important public interest.

(vi) You have the right, under certain circumstances, to obtain the erasure of your Personal Information from us. These circumstances include: the Personal Information is no longer necessary in relation to the purposes for which it was collected or otherwise processed; you withdraw consent to consent-based processing; you object to the processing under certain rules of applicable data protection law; the processing is for direct marketing purposes; and the personal data have been unlawfully processed. However, there are exclusions of the right to erasure such as where processing is necessary: for exercising the right of freedom of expression and information; for compliance with a legal obligation; or for the establishment, to exercise or defense of legal claims.

(vii) You have the right to receive your Personal Information that you have provided to us in a structured, commonly used, and machine-readable format and, if technically feasible, to have it transmitted to another controller without any hindrance from us, provided that such transmission does not adversely affect the rights and freedoms of others.

(viii) You have the right to complain to a data protection authority about our collection and use of your Personal Information. If you are not satisfied with the outcome of your complaint directly with us, you have the right to lodge a complaint with your local data protection authority. For more information, please contact your local data protection authority in the EEA. This provision is applicable provided that your Personal Information is processed by automated means and that the processing is based on your consent, on a contract which you are part of, or on pre-contractual obligations thereof.

Use and processing of collected information

We act as a data controller and a data processor in terms of the GDPR when handling Personal Information, unless we have entered into a data processing agreement with you in which case you would be the data controller and we would be the data processor.

Our role may also differ depending on the specific situation involving Personal Information. We act in the capacity of a data controller when we ask you to submit your Personal Information that is necessary to ensure your access and use of the Services. In such instances, we are a data controller because we determine the purposes and means of the processing of Personal Information and we comply with data controllers’ obligations set forth in the GDPR.

We act in the capacity of a data processor in situations when you submit Personal Information through the Services. We do not own, control, or make decisions about the submitted Personal Information, and such Personal Information is processed only in accordance with your instructions. In such instances, the user providing Personal Information acts as a data controller in terms of the GDPR.

In order to make the Services available to you, or to meet a legal obligation, we may need to collect and use certain Personal Information. If you do not provide the information that we request, we may not be able to provide you with the requested products or services. Any of the information we collect from you may be used for the following purposes:

– Create and manage user accounts
– Deliver products or services
– Improve products and services
– Send administrative information and/or Services
– Send marketing and promotional communications (e.g. related to PVPA and Services available to you)
– Send product and service updates
– Respond to inquiries and offer support
– Request user feedback
– Improve user experience of Services
– Post customer testimonials
– Deliver targeted advertising
– Identify you when you visit the Services and/or personalize Services (content, advertising, programs, services, etc.)
– Enforce terms and conditions and policies
– Protect from abuse and malicious users
– Respond to legal requests and prevent harm
– Provide service communications regarding specific Services (e.g. program registrations, contracts, etc.)
– To complete and meet the needs for which the information was provided
– Respond to your emails/online requests for Services, including information
– Assign you to and offer you participation in, based on your Personal information, relevant Services
– Process contracts and payment related to Services
– Meet internal audit requirements and/or legal obligations
– Run and operate the Services, including any business requirements

Processing your Personal Information depends on how you interact with the Services, where you are located in the world and if one of the following applies: (i) you have given your consent for one or more specific purposes; this, however, does not apply, whenever the processing of Personal Information is subject to California Consumer Privacy Act or European data protection law; (ii) provision of information is necessary for the performance of an agreement with you and/or for any pre-contractual obligations thereof; (iii) processing is necessary for compliance with a legal obligation to which you are subject; (iv) processing is related to a task that is carried out in the public interest or in the exercise of official authority vested in us; (v) processing is necessary for the purposes of the legitimate interests pursued by us or by a third party. We may also combine or aggregate some of your Personal Information in order to better serve you and to improve and update our Services.

We rely on the following legal bases as defined in the GDPR upon which we collect and process your Personal Information:

– User’s consent
– Performance of a contract
– Our own legitimate interests
– Research or statistics for the benefit of the public

Note that under some legislations we may be allowed to process information until you object to such processing by opting out, without having to rely on consent or any other of the legal bases above. In any case, we will be happy to clarify the specific legal basis that applies to the processing, and in particular whether the provision of Personal Information is a statutory or contractual requirement, or a requirement necessary to enter into a contract.

California privacy rights

Consumers residing in California are afforded certain additional rights with respect to their Personal Information under the California Consumer Privacy Act (“CCPA”). If you are a California resident, this section applies to you.

As described in this Policy in the information collection section above, we have collected the categories of Personal Information listed below in the past twelve (12) months:

– Personal identifiers (such as email address, phone number, etc.)
– Sensitive personal information (such as ethnicity, religious beliefs, mental health, etc.)
– Proof of identity (such as a photocopy of a government ID, validation system, etc.)
– Certain features on the mobile device (such as contacts, calendar, gallery, etc.)
– Information about other individuals (such as your family members, friends, etc.)
– Personal health information (e.g. diagnosed medical condition(s)/disease(s), treatment experience(s), experience with the health care system, including without limitation access to and use of the health care system and/or resources, and anything related to disease management including without limitation medications/treatments/devices, etc.)
– Person’s characteristics (such as age, gender, etc.)
– Biometric information (facial recognition, fingerprints, etc.)
– Audio, visual, electronic, or other types of recordings
– Professional or employment information
– Internet or other electronic network activity
– Geolocation data
– Education records

In addition to the rights as explained in this Policy, California residents who provide Personal Information as defined in the statute to obtain Services for personal, family, or household use are entitled to request and obtain from us, once a calendar year, information about the categories and specific pieces of Personal Information we have collected and disclosed.

Furthermore, California residents have the right to request deletion of their Personal Information or opt-out of the sale of their Personal Information which may include selling, disclosing, or transferring Personal Information to another business or a third party for monetary or other valuable consideration. To do so, simply contact us. We will not discriminate against you if you exercise your rights under the CCPA.

In some instances, you may have the opportunity to provide Personal Information in exchange for a financial payment or difference in Services which means any difference in the rate charged for any Services to any user related to the collection, retention, or sale of Personal Information, including through the use of discounts, financial payments, or other benefits or penalties, or any difference in the level or quality of any Services offered to any user related to the collection, retention, or sale of Personal Information.

How to exercise your rights

Any requests to exercise your rights can be directed to us through the contact details provided in this document. Please note that we may ask you to verify your identity before responding to such requests. Your request must provide sufficient information that allows us to verify that you are the person you are claiming to be or that you are the authorized representative of such person. If we receive your request from an authorized representative, we may request evidence that you have provided such an authorized representative with power of attorney or that the authorized representative otherwise has valid written authority to submit requests on your behalf.

You must include sufficient details to allow us to properly understand the request and respond to it. We cannot respond to your request or provide you with Personal Information unless we first verify your identity or authority to make such a request and confirm that the Personal Information relates to you. For your protection, we may only implement requests with respect to Personal information associated with the particular email address that you use to send us your request and/or is on file as your point of contact.

We strive to keep our records as accurate as possible. You may, under applicable laws, have a right to access, correct, modify or delete your Personal information. To do so, please contact us. We will need to understand whether you would like to have your Personal information suppressed from our database or otherwise let us know what limitations you would like to put on our use of your Personal information. We will try to comply with your request as soon as reasonably practicable. Please note that we may need to retain certain information for recordkeeping purposes and/or to complete any transactions that pre-date your request for a change or deletion and some changes/deletions may need to occur at completion of event. There may also be residual information that will remain in our databases and other records, which will not be removed.

Our Services use “cookies” to help personalize your online experience. A cookie is a text file that is placed on your hard disk by a web page server. Cookies cannot be used to run programs or deliver viruses to your computer. Cookies are uniquely assigned to you, and can only be read by a web server in the domain that issued the cookie to you. If you choose to decline cookies, you may not be able to fully experience the features of the Services.

We may use cookies to collect, store, and track information for security and personalization, to operate the Services, and for statistical purposes. For further information on the cookies we collect and their purpose, see our terms and conditions. Please note that you have the ability to accept or decline cookies. Most web browsers automatically accept cookies by default, but you can modify your browser settings to decline cookies if you prefer.

Data analytics

Our Services may use third-party analytics tools that use cookies, web beacons, or other similar information-gathering technologies to collect standard internet activity and usage information. The information gathered is used to compile statistical reports on user activity such as how often users visit our Services, what pages they visit and for how long, etc. We use the information obtained from these analytics tools to monitor the performance and improve our Services.

Do Not Track signals

Some browsers incorporate a Do Not Track feature that signals to websites you visit that you do not want to have your online activity tracked. Tracking is not the same as using or collecting information in connection with a website. For these purposes, tracking refers to collecting personally identifiable information from consumers who use or visit a website or online service as they move across different websites over time. How browsers communicate the Do Not Track signal is not yet uniform. As a result, the Services are not yet set up to interpret or respond to Do Not Track signals communicated by your browser. Even so, as described in more detail throughout this Policy, we limit our use and collection of your Personal Information. For a description of Do Not Track protocols for browsers and mobile devices or to learn more about the choices available to you, visit internetcookies.com