Well.ca Privacy Policy
Last Updated: February 14, 2024

This Privacy Policy provides information about how Well.ca Inc. ("Well.ca"/"we"/"us"/"our") collects, uses, stores and shares information about viewers and users ("you"/"user") of our website located at http://well.ca (the "Website").

Consent: By using the Website, you consent to the use of your Personal Information as described in this Privacy Policy and as otherwise identified to you.

"Personal Information" is information about an identifiable individual, such as your name, address, e-mail address, credit card information, birth date and language preference.

"Non-Personal Information" is information that is typically collected, used or disclosed to or by us in a manner that it not identifiable to an individual, or has been de-identified, (except where indicated herein), such as the domain used to access the Website, the type and version of browser or operating system being used by visitors to the Website, aggregate information such as demographic statistics of our users (e.g. average age or geographical allocation of our users), number of visitors, what pages users access or visit, and average time spent on the Website, and information that is de-identified and cannot be associated with an identifiable individual.

Although our collection, use and disclosure of Non-Personal Information is not subject to privacy laws or this Privacy Policy, herein we include information about our handling of such information in the interest of providing transparency with respect to the operation of the Website.

What type of Personal Information does Well.ca collect and how is it used?

Well.ca collects information that helps us process your purchases and personalize and improve your shopping experience. Here are examples of the types of information that we gather:

• Registration: To make purchases through the Website, you must register for an account and provide certain Personal Information to us such as your name and email address.

• Purchases: When you make a purchase through the Website, we may collect the following information: e-mail address, billing address, mailing address, pseudonyms, phone number, IP address, personal preferences, and group affiliations. We may connect you with a third-party payment provider to facilitate your purchase. During checkout, you have the option to have us remember your credit card number for future purchases. We do this using a technology called "payment tokenization". That's just a fancy way of saying we don't actually store your credit card number. Instead, when you complete a purchase, we use your credit card number to obtain a secret token - a special random string of letters and numbers - from the credit card payment provider. Then, when you want to make your next purchase, instead of sending your credit card number to the credit card payment provider, we send the secret token. Just like all of our other financial transactions, this communication is set up to take place over a secure, encrypted communication line. We may use third party freight providers to deliver your purchases, and accordingly we share your name, phone number, email address and shipping address with such providers for the purposes of completing your delivery.
• Mobile Location Data: Well.ca does not collect information about your mobile devices location. However, our third-party partners (as described below) collect this deidentified information in aggregate.

• Communications with us: When you contact us through email, telephone, chat, social media private/direct message or through submitting a Customer service inquiry, customer review or survey, entering a contest on Well.ca, we may collect the information that you provide to us in the course of the communication to help respond to you or for purposes related to your communication.

• Transactional Notifications: We may provide notifications for certain activities relating to your use of our Services despite your indicated e-mail preferences regarding marketing communications; for example, we may send you notices of any important updates regarding your orders, or updates to our Privacy Policy or Terms of Use.

• Marketing Communications: If you opt-in to receive marketing communications from us, we will keep you up to date on our products and services. You may withdraw your consent to receiving marketing communications at any time by following the opt-out instructions in each communication, or by contacting our customer care department via https://well.ca/contactus.

• Statistics: We also collect statistics about the products purchased through the Website. This information will be kept confidential; however, aggregate statistics that do not personally identify an individual will be kept by us and may be made available to other members or third parties.

• System Logs & Cookies: Like many websites, we use "cookies" to collect certain types of information when your Web browser accesses our Website. Cookies are alphanumeric identifiers that are placed on your computer's hard drive to enable our systems to recognize your browser and to provide features such as remembering the products that you searched for on your last visit. Well.ca uses cookies to remember information you gave us so that you don't have to re-enter the information each time you visit our Website. You can prevent your computer from accepting new cookies. Most browsers tell you how to do so in their "help" section. Because cookies allow you to take advantage of some of Well.ca's features, we recommend you leave them turned on. For instance, if you block certain cookies, you may not be able to complete your purchase.

• IP Address: Your IP address is reported by your web browser whenever you visit a page on the Website. This information is recorded together with your registration information on our databases and used, for example, to help verify access.

• Advertisements: Advertisements appearing on the Website may be delivered by us or one or more third-party web advertisers. These third party web advertisers may set cookies. These cookies allow the advertisement server operated by that third-party to recognize your computer each time they send you an online advertisement. Accordingly, advertisement servers may compile information about where or whether you viewed their advertisements and which advertisements you clicked on. This information allows web advertisers to deliver targeted advertisements that they believe will be of most interest to you. The Privacy Policy applies to cookies placed on your computer by us, but does not cover the use of cookies by any third-party web advertisers. For the privacy practices of such third-party web advertisers, you should consult the applicable privacy policy for the relevant third-party web advertiser(s).

In most cases, we will collect personal information directly from you when you purchase or interact with us about a product or service that we offer or provide. Occasionally, we may collect de-identified or aggregated personal information from a third party based on your consent or as otherwise permitted by law.

In what circumstances do we disclose and transfer Personal Information?

We have put in place contractual and other organizational safeguards with our agents to ensure a proper level of protection of your Personal Information. In addition to those measures, we will not disclose or transfer your Personal Information to third parties without your permission, except as specified in this Privacy Policy.

We may share Personal Information with service providers that help with our business activities. Including (though not limited to) web professionals who help us operate and improve our website; payment partners who enable us to process your transactions; email service providers, so we are able to communicate with you regarding your inquiries, orders, promotions and any other necessary information; carrier partners who help us ship and deliver your order; and third party marketing platforms (including social media platforms) who enable us to show you special offers and market our products across the internet to those who have opted in.

We share Personal Information with our partners as reasonably needed for them to provide the relevant services to us. Our servers and service partners may be located in Canada and outside of Canada (e.g. in the United States) and accordingly your Personal Information may be available to government or other agencies pursuant to the laws of the relevant jurisdictions.

Important Exceptions: We may disclose your Personal Information to third parties if we have reason to believe that disclosure is necessary to identify, contact or bring legal action against someone who may be causing injury to or interference with (either intentionally or unintentionally) our rights or property, other users of the Website, or anyone else (including the rights or property of anyone else) that could be harmed by such activities. We may also disclose Personal Information with your consent, or without your consent when we believe in good faith that such disclosure is required or permitted by applicable law.

Without limiting disclosures that may be permitted or required by applicable law, we may also disclose your Personal Information in connection with a corporate re-organization, a merger or amalgamation with another entity, a sale of all or a substantial portion of our assets or stock, including any due diligence exercise carried out in relation to the same, provided that the information disclosed continues to be used for the purposes permitted by this Privacy Policy by the entity being given access to the information.

Security: The security of your Personal Information is important to us. We implement a variety of measures (such as technical, contractual, administrative, and physical security measures) which are designed to protect the Personal Information that we collect, including measures to limit access to information only to staff who need access to perform their employment duties.

In certain areas, such as when you provide credit card or other payment information to us, we seek to protect the security of your credit card and other payment information during transmission by, for example, using Secure Sockets Layer (SSL) encryption technology.

You are also responsible for helping to protect the security of your Personal Information. For instance, never give out your Well.ca account information or your password to third parties. We will never ask you to provide such information to us over the phone or in writing.

Notwithstanding our security safeguards, it is impossible to guarantee 100% security in all circumstances. If you have any questions about security or have reason to believe your interaction with us is no longer secure (for example, you feel the security of any account you might have with us has been compromised), you must immediately notify us of the problem by emailing us at privacy@well.ca.

Retention: We will keep your Personal Information for as long as it remains necessary for the identified purpose or as permitted or required by law, which may extend beyond the termination of our relationship with you. We may retain certain data as necessary to prevent fraud or future abuse, or for legitimate business purposes, such as analysis of aggregated, non-personally-identifiable data, account recovery, or if permitted or required by law.

Amendment of this Policy: We reserve the right to change this Privacy Policy at any time. If we decide to change this Privacy Policy in the future, we will update the Last Updated Date at the beginning of this Privacy Policy. Any non-material change (such as clarifications) to this Privacy Policy will become effective on the date the change is posted and any material changes will become effective 30 days from their posting on the Website. Unless stated otherwise, our current Privacy Policy applies to all Personal Information that we have about you. The date on which the latest update was made is indicated at the top of this document. We recommend that you print a copy of this Privacy Policy for your reference and revisit this policy from time to time to ensure you are aware of any changes. Your continued use of the Website signifies your acceptance of any changes.

Access and Accuracy: You have the right to request access to the Personal Information we hold about you in order to verify the Personal Information we have collected in respect to you and to have a general account of our uses of that information. Upon receipt of your written request, we will provide you with a copy of your Personal Information in accordance with applicable law, corporate retention policy and lawful timing, subject to information which we are permitted or required to withhold.

We take steps to try to keep your Personal Information accurate and up-to-date. Should you wish to update or confirm your information, you may contact Well.ca at the address or email below. You have a responsibility to ensure that your information is kept up to date, including using the features of the Website to update, correct, delete or add to your Personal Information as appropriate.

Data Governance and Security Measures We maintain policies and practices which ensure the protection of your Personal Information. Depending on the volume and sensitivity of the information, the purposes for which it is used and the format in which it is stored, we implement a combination of measures to protect your Personal Information, some of which include:

• Internal policies and procedures that define the roles and responsibilities of our employees throughout the information life cycle and limits their access to such information on a "need-to-know" basis, as described in this Privacy Policy.

• If information is collected or stored in electronic format, technical safeguards such as encryption, firewalls, antivirus software and similar measures, more fully described in the definitions above.

• A designated Privacy Officer to monitor our business compliance with applicable data protection laws.

• Employee privacy and data security training.

• Procedures for receiving, investigating, and responding to complaints or inquiries regarding information handling practices, including any security incidents involving Personal Information.

• Framework governing the retention and destruction of Personal Information, including a Records and Information Management program that adheres to applicable statutory requirements with respect to the management, retention and disposal of company records and Personal Information.

• Contractual protections to ensure that service providers with whom we share Personal Information maintain adequate privacy protections and standards. For example, we generally require our service providers to be subject to our right to audit, to limit their use and retention of Personal Information to what is necessary to provide their services and to notify us in case of any actual or suspected security incident.

Contact Us: You can help by keeping your account information up to date on the website such as a change of address or telephone number. Your email address can be updated with our Customer Care team. If you would like to request access to your information, if you have any questions, comments or suggestions related to your privacy or if you find any errors in our information about you, please contact our Chief Privacy Officer in writing: Well.ca LLC, Chief Privacy Officer, 935-B Southgate Drive, Guelph, ON. N1L 0B9 or at privacy@well.ca.

You also have the right to contact your privacy regulator. For example, if you are an Ontario resident with questions or concerns relating to your health information, you may contact: Information and Privacy Commissioner of Ontario, 2 Bloor Street East, Suite 1400, Toronto, Ontario, M4W 1A8.

For provincial specific privacy rights for Quebec residents: If you are a Quebec resident and you have questions or comments about our efforts to protect your personal privacy, or if you require additional information about our privacy practices, please contact us at compliance@mckesson.ca. You may also write to our Privacy Officer at: McKesson Canada Corporation, Attn: Privacy Officer, 2300, Meadowvale Blvd., Mississauga, ON, L5N 5P9.