Last updated March 9, 2017
As used in this document, “personal information” shall have the meaning given to this term in PIPEDA and similarly used terms, i.e. “personal health information” in PHIPA, under applicable provincial legislation.
COLLECTION AND USE OF PERSONAL INFORMATION
We collect personal information when Clients register with us, purchase products or otherwise share information with us, including via email, phone or our website. This information includes:
- given name, surname, date of birth and gender;
- contact information including the Client’s mailing address, phone number, and email address, as applicable; if applicable, the given name, surname, date of birth and gender of one or more persons who are responsible for the Client, as well as contact information for such persons;
- prescription or other medical document, issued by an authorized medical practitioner; given name, surname, professional status and address of the health care practitioner who issued a prescription or other medical document on behalf of the Client;
- if applicable, the consent of the health care practitioner to receive shipments on the Client’s behalf; order details about the product sold or provided, including the quantity ordered; and the address to which the product is to be shipped.
- THC will not use personal information for purposes other than those for which it was collected, except with a Client’s consent or as required or permitted by applicable law. Consent may be expressed or implied, and given in writing by using or not using a check-off box, electronically, orally, or by the Client’s conduct, such as use of our services or products.
We use personal information to facilitate Client registration, to deliver requested products or services, to answer Client questions and as otherwise required or permitted by the Marihuana for Medical Purposes Regulations (Canada) (“ACMPR”) and other applicable laws.
We may also use information we collect about you in the aggregate for statistical purposes, i.e. to identify the demographics of our Clients, the types of diagnoses that our Clients are using medical marijuana to treat, and the types of strains that are most beneficial for different diagnoses.
If you opt-in to receive marketing communications from us, we will keep you up to date on our products and services. You may withdraw your consent to receiving marketing communications from us at any time by following the opt-out instructions in each email, or by contacting us by phone or email.
When a Client contacts us for support or with questions, we may use personal information previously disclosed by that Client for the purposes of providing the requested support or in answering the Client’s questions.
DISCLOSURE OF PERSONAL INFORMATION
The Minister of Health has the authority to audit our records in order to ensure we are complying with the regulatory requirements of our license. Additionally, we are required to provide regular reports to the Minister of Health. These reports may include Client personal information.
In addition, under the ACMPR and other applicable laws, we may be required to disclose some or all of a Client’s personal information to government officials, law enforcement personnel and other competent authorities and regulatory bodies.
We may publish and/or disclose aggregate statistics to third parties but never any identifiable personal information except in accordance with this Policy.
STORAGE AND THIRD PARTY SERVICE PROVIDERS
THC uses third-party service providers to store and process data, including personal information, on its behalf. Either THC, its service providers, or its or their agents may use servers or other facilities located outside of Canada for this purpose. When acting on our behalf such service providers and agents are only authorized to collect, use, or disclose a Client’s personal information in the manner described in this Policy. However, the government, courts, law enforcement, security, or regulatory agencies of the other jurisdiction may be able to obtain access to or disclosure of personal information as permitted by the laws of that other country.
COOKIES AND IP ADDRESSES
We protect personal information against loss, misuse, and alteration with security measures appropriate to the sensitivity of the information, including through the use of physical, organizational, and technological measures and appropriate training of employees.
RETENTION OF PERSONAL INFORMATION
We will keep your personal information for as long as it remains necessary for the purpose for which it was collected or as required by applicable law, which may extend beyond the termination of our relationship with you. In addition, we may retain certain data as necessary to prevent fraud or future abuse, or for legitimate business purposes, such as analysis of aggregated, non-personally-identifiable data. All retained personal information is subject to this Policy.
Even if you request that your personal information be removed from our databases, we may not be able to completely delete all your personal information due to technological, legal and/or regulatory constraints.
ACCOUNTABILITY FOR PERSONAL INFORMATION
We have designated an individual to manage and monitor regulatory compliance, this Policy, and the security of personal information that is within our control. The name and contact information of our CPO is set out below.
If you have any questions about this Policy or our collection, use, disclosure or retention of personal information or if you find any errors in the personal information we have about you, please contact us by email at firstname.lastname@example.org.
You may make a complaint under the PHIPA to the Information and Privacy Commissioner of Ontario by completing this form:
If you reside in another Canadian jurisdiction, you may file a complaint with the relevant authority in your jurisdiction. You may also contact our CPO who can provide you with the contact information and process for filing a complaint in your jurisdiction. You may also file a complaint with the Privacy Commissioner of Canada under PIPEDA by completing this form:http://www.priv.gc.ca/complaint-plainte/ps_pipeda_e.asp.