1. Collection, use and disclosure of personal information - applicants, clients, responsible individuals and health care practitioners
Creating and account: To create an account, we will collect the following Personal Information from you: your username, password, and verification that you are Canadian and over the age of 18. In order to comply with the Marijuana for Medical Purposes Regulations (“MMPR”), we collect the following Personal Information to register applicants as clients:
Registration Application: To register as a client, we collect the following Personal Information in our application form: the applicant’s name, date of birth and gender. We also require information about the residence (whether a private residence or an institution such as a shelter) of the applicant, namely the residential address, telephone, fax, email address and mailing address if different than the residence address. If the applicant’s residence is not a private residence, the type of residence and its name must also be provided. If the applicant is under the care of another responsible individual, we also require the name, date of birth and gender of that individual. Additionally, we require the name, mailing address and telephone number of the applicant’s health care provider if the provider has consented to receiving the medical marijuana shipment on the applicant’s behalf.
Medical Document: To use medical marijuana in Canada, an individual must obtain a Medical Document from a health care practitioner who is permitted to provide such a Medical Document. Accordingly, in order to register a client, we require the applicant’s health care practitioner to complete a Medical Document which includes the following information: the health care practitioner’s name, profession, business address, telephone, fax, email address, province of registration and registration number; the patient’s name, date of birth and location of consultation; and dosage information (daily quantity and period of use). The health care practitioner also has the option to provide us with the patient’s diagnosis and additional comments.
Consent Form: In order to register a client, we are required to verify the information on the applicant’s Medical Document with the applicant’s health care practitioner who has completed the Medical Document. Accordingly, the Consent Form must be completed so that we have permission to contact the applicant’s health care practitioner for this purpose. We collect the following information on the Consent Form: the applicant’s name (and if applicable, the name of the applicant’s substitute decision maker); the applicant’s address, telephone, fax and email address; and the name of the applicant’s health care practitioner.
In certain circumstances, the MMPR requires us to disclose Personal Information to Canadian government or professional licensing authorities:
Information Concerning Clients and Individuals Responsible for Clients: In certain circumstances, the MMPR require us to provide information about our clients or persons responsible for our clients to police, for example the daily quantity of marijuana that is specified on the applicable Medical Document. We will only provide such information where required by law, and only after verifying in a reasonable manner that the person requesting the information is a member of a Canadian police force. In order to request such information from us, a police officer must first provide us with the full name, date of birth and gender of the person whom they are investigating under the Controlled Drugs and Substances Act.
Information Concerning Health Care Practitioners: Information we collect about health care practitioners will be used to comply with the MMPR requirements, for example to verify the information provided on Medical Documents. In certain circumstances, we may be required under the MMPR to disclose information we have obtained about health care practitioners to the relevant licensing authority that governs the practice of their profession.
Regulatory Compliance Audits and Regular Reporting Obligations: The Minister of Health has the authority to audit our records in order to ensure we are complying with the regulatory requirements of our license. Additionally, Bedrocan Canada is required to provide regular reporting to the Minister of Health. Accordingly, Personal Information may be made available to the Minister of Health and/or the Minister’s representatives.
Additional collection, use and/or disclosure of information:
Medical Marijuana Orders and Deliveries: We will use your Personal Information in order to maintain your account with us and to process your medical marijuana orders and deliveries. We will deliver medical marijuana using a bonded courier or other delivery method permitted by the MMPR.
Confirmation: We will use your Personal Information in order to confirm certain information relating to your prescription and the other documents you provide to us in accordance with our obligations under the MMPR from time to time.
Support: Applicants and clients may contact us for support, for example to ask questions about different strains or for assistance in speaking to health care practitioners about medical marijuana. We may use any Personal Information disclosed to us in this context for the purposes of answering such questions and providing such assistance as well as for the other purposes described in this Policy.
Feedback: If you become a client of Bedrocan Canada, you have the option to provide us with feedback for example on the effectiveness of the type of strain you are using. If you disclose Personal Information to us as part of this feedback, we may use such Personal Information for the purposes described in this Policy.
Aggregate Statistics: We may also use information we collect about you in the aggregate for statistical purposes, for example to identify the demographics of our clients, the types of diagnoses that our clients are using medical marijuana to treat, and the types of strains that are most beneficial for different diagnoses. We may publish and/or disclose aggregate statistics to third parties but never any identifiable personal information except in accordance with this Policy.
2. Collection, use and disclosure of personal information - website
Support: Visitors to our web site may contact us for support, for example to ask questions about different strains or for assistance in speaking to health care practitioners about medical marijuana. We may use any Personal Information disclosed to us in this context for the purposes of answering such questions and providing such assistance as well as for the other purposes described in this Policy.
Your IP address is reported by your web browser whenever you visit a page on the Website. This information is recorded together with your registration information on our databases.
3. Additional Disclosures
From time to time we may share your personal information with our employees, contractors, consultants, affiliates and other parties who require such information to assist us with managing our relationship with you, including third parties that provide services to us or on our behalf. For example, we may share your personal information from time to time with third party call center service providers and/or third party information technology and data processing service providers so that we may operate our business. As a result, your personal information may be collected, used, processed, stored or disclosed in the United States. As such, your personal information may potentially be accessible to law enforcement and national security authorities of that jurisdiction.
To the extent permitted by law, we may disclose your Personal Information to third parties without your consent if we have reason to believe that disclosing this Personal Information is necessary to identify, contact or bring legal action against someone who may be causing injury to or interference with (either intentionally or unintentionally) our rights or property, or anyone else (including the rights or property of anyone else) that could be harmed by such activities. We may disclose Personal Information when we believe in good faith that such disclosure is required by and in accordance with the law.
4. Accountability for Personal Information
Security: The security of your Personal Information is important to us. We use commercially reasonable efforts to store and maintain your Personal Information in a secure environment. We take technical, contractual, administrative, and physical security steps designed to protect Personal Information that you provide to us. We have implemented procedures designed to limit the dissemination of your Personal Information to only such designated staff as are reasonably necessary to carry out the stated purposes we have communicated to you.
You are also responsible for helping to protect the security of your Personal Information. For instance, never give out your account information or the password for your account.
Access and Accuracy: You have the right to access the Personal Information we hold about you in order to verify the Personal Information we have collected in respect to you and to have a general account of our uses of that information. Upon receipt of your written request, we will provide you with a copy of your Personal Information, although in certain limited circumstances, we may not be able to make all relevant information available to you such as where that information also pertains to another individual. In such circumstances we will provide reasons for the denial to you upon request. We will endeavor to deal with all requests for access and modifications in a timely manner. We will make every reasonable effort to keep your Personal Information accurate and up-to-date, and we will provide you with mechanisms to update, correct, delete or add to your Personal Information as appropriate. You can help by keeping us informed of any changes such as a change of address or telephone number. As appropriate, this amended Personal Information will be transmitted to those persons to whom we are permitted to disclose your information. Having accurate Personal Information about you enables us to give you the best possible service.
Contact Information and Complaints: If you would like to access your information, if you have any questions, comments, if you find any errors in the Personal Information we have about you, or if you would like to make a complaint about our handling of your Personal Information, please contact our Chief Privacy Officer Cailey Greenberg at: firstname.lastname@example.org. You may also make a complaint under the PHIPA to the Information and Privacy Commissioner of Ontario by completing this form. If you reside in another Canadian jurisdiction, you may file a complaint with the relevant authority in your jurisdiction. You may also contact our CPO who can provide you with the contact information and process for filing a complaint in your jurisdiction. You may also file a complaint with the Privacy Commissioner of Canada under PIPEDA by completing this form.