This Pharmaceutical activities Privacy Notice ("Notice") complements and forms an integral part of the Privacy Policy of Metro ("Policy"). In the event of any conflict or inconsistency between this Notice and the Policy, and subject to compliance with legal requirements relating to the protection of Personal Health Information, the Policy shall prevail. Terms used in this Notice have the same meaning as in the Policy unless the context clearly indicates otherwise.

This Notice should be read in conjunction with any other privacy notices or statements made available to Customers of pharmaceutical establishments (the "Pharmaceutical Establishments") in the Metro Inc. pharmacy division network (the "Pharmacy Division") where pharmacy services are offered.

With this Notice, the Pharmacy Division provides Customers of the Pharmaceutical Establishments with additional details on how their Personal Health Information is collected, used, disclosed, retained and protected in connection with the services that are offered by the Pharmaceutical Establishments or, as the case may be, by the Pharmacy Division, including when Customers consult or use the Sites developed by the Pharmacy Division (including the MaSanté and Health Record applications, which are services offered to Customers by owner-pharmacist affiliated with the Pharmacy Division and in Metro Ontario Pharmacies Limited's pharmacies operating in Ontario).

This Notice applies to the network of Pharmaceutical Establishments affiliated with the Pharmacy Division located in Quebec, Ontario and New Brunswick.

This Notice is governed by the laws to the protection of Personal Information applicable in the provinces of Quebec, Ontario and New Brunswick:

Quebec: the Act respecting the protection of personal information in the private sector and its regulations, and the Act respecting health and social services information and amending various legislative provisions and its regulations.

Ontario: Personal Information Protection and Electronic Documents Act (PIPEDA) and regulations and Personal Health Information Protection Act (for personal health information).

New Brunswick: Personal Information Protection and Electronic Documents Act (PIPEDA) and Personal Health Information Privacy and Access Act.

When a Customer uses the pharmaceutical or health care services offered by a Pharmaceutical Establishment affiliated with the Pharmacy Division, the following Personal Information about the Customer may be collected, used, disclosed, retained and protected, in accordance with applicable laws, by the Pharmaceutical Establishment and by various stakeholders, including the Pharmacy Division, through the Pharmaceutical Establishment's laboratory computer system:

• the Customer's name, postal address, telephone number, date of birth and e-mail address if the Customer wishes to be contacted by e-mail;
• the Customer's Personal Health Information contained in his or her health record and that relating to pharmaceutical services received or requested;
• additional Personal Information required to meet the Customer's health needs, such as information on his drug insurance coverage, information on his health care professionals, etc.

All Personal Information collected in this way shall be included in the definition of Personal Health Information as defined in the Policy.

Customers' Personal Health Information is collected for the following purposes:

• provide the Customer with any pharmaceutical service or health care required by the Customer's health condition, as provided for by applicable laws and regulations and which may be offered in a pharmacy, such as filling a prescription, recommending products to the Customer in connection with the Customer's health needs, responding to the Customer's health needs, assisting physicians and other health professionals in managing the Customer's pharmacological treatment;
• offer Quebec customers, through the MaSanté or Health Record application, personalized services such as consulting their pharmacological records and other health-related documentation, renewing their prescriptions, tracking their medication reminders, providing pharmaceutical or healthcare information and services, as well as to better understand customer needs and improve the product and service offering;
• offer Ontario customers, through MOPL's online service, personalized services such as access to their prescription history, prescription refills, medication reminder follow-up, consultation of documentation, pharmaceutical or health care information and services;
• maintain an up-to-date database of Customers' health information to assist other health professionals, as required;
• give third-party payers in private and public drug insurance networks access to the information they need to reimburse products and services, and transmit this information to them;
• recall or modify pharmacological treatment: the personnel of the Pharmaceutical Establishment may contact the Customer after filling a prescription to follow up on the pharmacological treatment;
• develop new services related to pharmaceutical services and health care to better serve customers, using only de-identified information; and/or
• contact Customers or their healthcare professionals in the event of a product recall.

The Personal Health Information collected may also be used for statistical or research purposes in accordance with the law. This information will then be de-identified (the Customer's name or other identifying information will be removed so that it will no longer be possible to identify or associate the information with the Customer) and aggregated (this information will be combined with a set of de-identified information from other Customers).

In the course of the activities of the Pharmaceutical Establishments and those of the Pharmacy Division, Personal Information concerning a Customer may be disclosed and communicated to Third Parties, to certain service providers and partners and to employees and officers of the Pharmaceutical Establishments, where permitted by law.

Only Personal Information related to the Customer's health that is necessary to provide these services will be disclosed.

In addition, employees and officers of a Pharmaceutical Establishment may access, use or disclose a Customer's Personal Health Information when necessary to render pharmaceutical or health care services to the Customer.

The Pharmacy Division and the Pharmaceutical Establishments retain Personal Information only as long as necessary for the achievement of the purposes for which it was collected or as required by law to ensure compliance with their legal and regulatory obligations.

For more information on this subject, please consult the " Personal Information Retention" section of the Policy.

In certain circumstances, the law allows the Customer to restrict or refuse access to all or part of their Personal Information. In such cases, please notify the Privacy Officer of the Pharmaceutical Establishment concerned to obtain the necessary information and the implications of this decision.

For all comments, questions, concerns or complaints regarding your Personal Health Information, including requests for access to information collected through the MaSanté and Health Record application, please contact the privacy officer of the Pharmaceutical Establishment concerned.

If you have any questions about this Notice or the Policy, please or contact the Chief Privacy Officer of the Pharmacy Division at:

For Pharmaceutical Establishments operated under The Jean Coutu, Brunet or any other related banners in Quebec, Ontario and New Brunswick:

by mail:

Metro Inc. (Pharmacy Division)

Attention: Chief Privacy Officer

245 Jean Coutu Street

Varennes, Quebec

J3X 0E1

-or-

by e-mail

[email protected]

For Metro Pharmacy and Drug Basics pharmacies in Ontario:

by mail:

Metro Ontario Pharmacies Limited

Attention: Chief Privacy Officer

5559, Dundas Street West

Etobicoke, Ontario

M9B 1B9

-or-

by e-mail

[email protected]

Effective date: September 22, 2023