2426702 Ontario Inc operating as THCO (“THCO”/“we”/“us”/“our”) is committed to protecting your privacy and we take this obligation very seriously. The THCO Privacy Policy (“Privacy Policy”) describes our policies and procedures in relation to the collection, use and disclosure of personal information as governed by Personal Information Protection and Electronic Documents Act (“PIPEDA”), as well as personal health information in accordance with the requirements of the Personal Health Information Protection Act (“PHIPA”) in Ontario, and comparable legislation in other Canadian jurisdictions where THCO may operate. We strive to provide full transparency in everything we do, and to the best of our ability will ensure that all information entrusted to us remains confidential, secure, and accurate.
This Privacy Policy applies to: individuals registering to become patients, doctors or licensed producers within the THCO network; and if applicable, the substitute decision makers of applicants. In addition, this Privacy Policy also applies to anyone visiting the THCO website http://www.thco.ca/ (the “Website”).
For the purposes of this Privacy Policy, the term “Personal Information” shall include “personal information” as defined under PIPEDA as well as “personal health information” as defined under PHIPA. In addition, where THCO collects, uses and discloses Personal Information in other jurisdictions, other legislation may apply. THCO reserves the right to modify this Privacy Policy so that it is consistent with any applicable legislative requirements.
Except as set forth in this Privacy Policy, your Personal Information will not be collected, used or disclosed for any other purpose without your consent. Subject to regulatory requirements, you may withdraw your consent to our collection, use or disclosure of your Personal Information at any time, however doing so may result in your inability to continue using the Website, and our inability to continue to provide our products and services to you.
THCO only collects, uses and discloses information as required for the purposes of providing our services. We collect this personal information using only lawful methods either directly from the person concerned or their authorized representatives.
We will only use your personal information for the purposes outlined in this Privacy Policy or for reasons outlined to you at the time of collection. THCO will never sell or exchange any personal information we receive from you.
THCO only uses your personal information for the following purposes:
To process your registration application with us and determine your eligibility for our products and services;
To verify your medical declaration, your identity and other documentation you provide to us;
To offer products and services to you and to better understand your need for our products and services;
To process payment for our products and services;
To meet our legal and regulatory requirements; and
Other purposes consistent with these purposes.
Because we value your trust, we will only ask for personal information that we need and, when we ask you for additional personal information, we will let you know why we need it.
Creating an Account: To create an account, we will collect the following Personal Information from you: your username, password, and verification that you are Canadian and over the age of 18.
In order to comply with the Access to Cannabis for Medical Purposes Regulations (“ACMPR”), we collect the following Personal Information to register applicants as clients:
Registration Application: To register as a client, we collect the following Personal Information in our application form: the applicant’s name, date of birth and gender. We also require information about the residence (whether a private residence or an institution such as a shelter) of the applicant, namely the residential address, telephone, fax, email address and mailing address if different than the residence address. If the applicant’s residence is not a private residence, the type of residence and its name must also be provided. If the applicant is under the care of another responsible individual, we also require the name, date of birth and gender of that individual. Additionally, we require the name, mailing address and telephone number of the applicant’s health care provider if the provider has consented to receiving the medical marijuana shipment on the applicant’s behalf.
Medical Document: To use medical marijuana in Canada, an individual must obtain a Medical Document from a health care practitioner who is permitted to provide such a Medical Document. Accordingly, in order to register a client, we require the applicant’s health care practitioner to complete a Medical Document which includes the following information: the health care practitioner’s name, profession, business address, telephone, fax, email address, province of registration and registration number; the patient’s name, date of birth and location of consultation; and dosage information (daily quantity and period of use). The health care practitioner also has the option to provide us with the patient’s diagnosis and additional comments.
Consent Form: In order to register a client, we are required to verify the information on the applicant’s Medical Document with the applicant’s health care practitioner who has completed the Medical Document. Accordingly, the Consent Form must be completed so that we have permission to contact the applicant’s health care practitioner for this purpose. We collect the following information on the Consent Form: the applicant’s name (and if applicable, the name of the applicant’s substitute decision maker); the applicant’s address, telephone, fax and email address; and the name of the applicant’s health care practitioner.
In certain circumstances, the ACMPR requires us to disclose Personal Information to Canadian government or professional licensing authorities:
Information Concerning Clients and Individuals Responsible for Clients: In certain circumstances, the ACMPR require us to provide information about our clients or persons responsible for our clients to police, for example the daily quantity of marijuana that is specified on the applicable Medical Document. We will only provide such information where required by law, and only after verifying in a reasonable manner that the person requesting the information is a member of a Canadian police force. In order to request such information from us, a police officer must first provide us with the full name, date of birth and gender of the person whom they are investigating under the Controlled Drugs and Substances Act.
Information Concerning Health Care Practitioners: Information we collect about health care practitioners will be used to comply with the ACMPR requirements, for example to verify the information provided on Medical Documents. In certain circumstances, we may be required under the ACMPR to disclose information we have obtained about health care practitioners to the relevant licensing authority that governs the practice of their profession.
Regulatory Compliance Audits and Regular Reporting Obligations: The Minister of Health has the authority to audit our records in order to ensure we are complying with the regulatory requirements of our license. Additionally, THCO may be required to provide regular reporting to the Minister of Health. Accordingly, Personal Information may be made available to the Minister of Health and/or the Minister’s representatives.
Additional collection, use and/or disclosure of information:
Medical Marijuana Orders and Deliveries: We will use your Personal Information in order to maintain your account with us and to process your medical marijuana orders and deliveries. We will deliver medical marijuana using a bonded courier or other delivery method permitted by the ACMPR.
Confirmation: We will use your Personal Information in order to confirm certain information relating to your prescription and the other documents you provide to us in accordance with our obligations under the ACMPR from time to time.
Support: Applicants and clients may contact us for support, for example to ask questions about different strains or for assistance in speaking to health care practitioners about medical marijuana. We may use any Personal Information disclosed to us in this context for the purposes of answering such questions and providing such assistance as well as for the other purposes described in this Policy.
Feedback:If you become a client of THCO, you have the option to provide us with feedback for example on the effectiveness of the type of strain you are using. If you disclose Personal Information to us as part of this feedback, we may use such Personal Information for the purposes described in this Policy.
Aggregate Statistics: We may also use information we collect about you in the aggregate for statistical purposes, for example to identify the demographics of our clients, the types of diagnoses that our clients are using medical marijuana to treat, and the types of strains that are most beneficial for different diagnoses. We may publish and/or disclose aggregate statistics to third parties but never any identifiable personal information except in accordance with this Policy.
Transactional Notifications:We provide notifications for certain activities relating to your use of our services, for example we may send you notices of any updates to our Privacy Policy.
Marketing Communications: If you opt-in to receive marketing communications from us, we will keep you up to date on our products and services. You may withdraw your consent to receiving marketing communications from us at any time by following the opt-out instructions in each communication, or by contacting us at [email protected].
Support: Visitors to our web site may contact us for support, for example to ask questions about different strains or for assistance in speaking to health care practitioners about medical marijuana. We may use any Personal Information disclosed to us in this context for the purposes of answering such questions and providing such assistance as well as for the other purposes described in this Policy.
System Logs & Cookies:Cookies are used by us to track content usage and traffic on the Website. A cookie is a feature of your web browser that consists of a text file that is placed on your hard disk by a web server. The Website uses cookies to help it compile aggregate statistics about usage of this Website, such as how many users visit the Website, how long users spend viewing the Website, and what pages are viewed most often. This information is used to improve the content of the Website. You can set your browser to notify you when you are sent a cookie. This gives you the chance to decide whether or not to accept it. If you disable cookies, you may not be able to take advantage of all of the features of the Website. We do not link any of the information we use in cookies to any Personal Information we have collected about you.
Your IP address is reported by your web browser whenever you visit a page on the Website. This information is recorded together with your registration information on our databases.
As at the date of this Privacy Policy, we share Personal Information about you only with our e-commerce platform and cloud server providers. Our servers may be located in Canada and/or the United States and accordingly your Personal Information may be available to Canadian and/or United States government or agencies under a lawful order, irrespective of the safeguards we have put in place for the protection of your Personal Information.
From time to time we may employ third parties to help us improve the Website, or our products and/or services or operations. These third parties may have limited access to databases which contain Personal Information solely for the purpose of helping us to improve the Website, or our products and/or services or operations, and they will be subject to contractual restrictions prohibiting them from using such Personal Information for any other purpose.
To the extent permitted by law, we may disclose your Personal Information to third parties without your consent if we have reason to believe that disclosing this Personal Information is necessary to identify, contact or bring legal action against someone who may be causing injury to or interference with (either intentionally or unintentionally) our rights or property, or anyone else (including the rights or property of anyone else) that could be harmed by such activities. We may disclose Personal Information when we believe in good faith that such disclosure is required by and in accordance with the law.
To the extent permitted by law, we may also disclose your Personal Information in connection with a corporate re-organization, provided that the information disclosed continues to be used for the purposes permitted by this Privacy Policy by the entity acquiring the Personal Information. We will provide notice of any corporate re-organization by posting a notice on our Website.
THCO will designate an individual (the “Chief Privacy Officer”/“CPO”) to manage and monitor regulatory compliance, this Privacy Policy, and the security of Personal Information that is within the control of THCO. The name and contact information of our CPO is listed at the end of this Privacy Policy.
Security: The security of your Personal Information is important to us. We use commercially reasonable efforts to store and maintain your Personal Information in a secure environment. We take technical, contractual, administrative, and physical security steps designed to protect Personal Information that you provide to us. We have implemented procedures designed to limit the dissemination of your Personal Information to only such designated staff as are reasonably necessary to carry out the stated purposes we have communicated to you.
You are also responsible for helping to protect the security of your Personal Information. For instance, never give out your account information or the password for your account.
Retention: We will keep your Personal Information for as long as it remains necessary for the identified purpose or as required by law, which may extend beyond the termination of our relationship with you. We may retain certain data as necessary to prevent fraud or future abuse, or for legitimate business purposes, such as analysis of aggregated, non-personally-identifiable data, or if required by law. All retained Personal Information will remain subject to the terms of this Privacy Policy. If you request that your name be removed from our databases, it may not be possible to completely delete all your Personal Information due to technological, legal and/or regulatory constraints.
Amendment of this Policy: We reserve the right to change this Privacy Policy at any time. If we decide to change this Privacy Policy in the future, we will post an appropriate notice on the home page at http://www.thco.ca. Unless stated otherwise, our current Privacy Policy applies to all Personal Information that we have about you. The date on which the latest update was made is indicated at the bottom of this document. We recommend that you print a copy of this Privacy Policy for your reference and revisit this Privacy Policy from time to time to ensure you are aware of any changes. Your continued use of the Website and/or our products or services signifies your acceptance of any changes.
Access and Accuracy: You have the right to access the Personal Information we hold about you in order to verify the Personal Information we have collected in respect to you and to have a general account of our uses of that information. Upon receipt of your written request, we will provide you with a copy of your Personal Information, although in certain limited circumstances, we may not be able to make all relevant information available to you such as where that information also pertains to another individual. In such circumstances we will provide reasons for the denial to you upon request. We will endeavor to deal with all requests for access and modifications in a timely manner.
We will make every reasonable effort to keep your Personal Information accurate and up-to-date, and we will provide you with mechanisms to update, correct, delete or add to your Personal Information as appropriate. You can help by keeping us informed of any changes such as a change of address or telephone number. As appropriate, this amended Personal Information will be transmitted to those persons to whom we are permitted to disclose your information. Having accurate Personal Information about you enables us to give you the best possible service.
Contact Information and Complaints: If you would like to access your information, if you have any questions, comments, if you find any errors in the Personal Information we have about you, or if you would like to make a complaint about our handling of your Personal Information, please contact our Chief Privacy Officer Walid Abdelaty at: [email protected]. You may also make a complaint under the PHIPA to the Information and Privacy Commissioner of Ontario by completing this form: http://www.ipc.on.ca/images/Resources/up-cudfrm_e.pdf. If you reside in another Canadian jurisdiction, you may file a complaint with the relevant authority in your jurisdiction. You may also contact our CPO who can provide you with the contact information and process for filing a complaint in your jurisdiction. You may also file a complaint with the Privacy Commissioner of Canada under PIPEDA by completing this form: http://www.priv.gc.ca/complaint-plainte/ps_pipeda_e.asp.
Last Updated: May 5, 2015