Last updated October 2014
Personal Information is any information about an identifiable individual. Aphria recognizes the sensitivity of Personal Information. It should only be collected and retained for legitimate purposes and must be handled with care and respect. In providing our services it will be necessary to collect and use Personal Information about our customers. In doing so, we are committed to protect your right to have your Personal Information collected and used transparently and responsibly.
Aphria shall not collect, use, or disclose any Personal Information about any party (an “Individual”) without that Individual’s knowledge and consent, except as herein provided or as may be specifically permitted or required by applicable law.
Attention: Privacy Officer
P.O. Box 20009
269 Erie St. South
Leamington, Ontario N8H 3C4
A. Collection and Use of Personal Information General
Aphria collects and uses Personal Information in a lawful manner and only when it is reasonably necessary to do so for the provision of requested services, products, or information or as may be required or permitted by applicable laws, including without limitation the Marijuana for Medical Purposes Regulations (the “MMPR”). This information is generally provided voluntarily by an Individual in applying for our services, purchases products, or communicates with Aphria online or otherwise. However, information relevant to the requested services may also be obtained from authorized representatives and/or appropriate regulatory bodies. Whenever Aphria requests Personal Information, we will explain why that Personal Information is required. The collected Personal Information will be used only for the stated purpose, a requisite ancillary purpose, or for such other purposes to which the customer may later consent.
Consent for the collection, use, and disclosure of Personal Information may be express or implied, physical or electronic, given in writing, orally, or by toggling a check-off box, or by inference from the Individual’s conduct, such as (without limitation) by use of the services or products.
Personal Information Posted by the Individual
From time to time, Aphria may offer interactive services which allow an Individual to share information with other Individuals on our website or through social media. These features may permit an Individual to publish personal information about him or herself or about another individual. By submitting such information, the Individual represents:
that the Individual consents to its collection, retention, and public disclosure by Aphria; and that the Individual has obtained the same consent from any other Individual whose Personal Information is being posted, as applicable.
Aphria does not monitor or moderate information submitted or posted by the users of its website or social media and accepts no responsibility or liability for any content, including without limitation Personal Information, posted in this way.
If an Individual believes that his or her Personal Information has been posted a third party without consent, that Individual should contact Aphria at email@example.com to notify Aphria so that the complaint may be investigated and the content removed if it is appropriate to do so.
Examples of Personal Information Use
Without limiting the generality of any of the foregoing, Aphria may use an Individual’s Personal Information as follows:
When an Individual registers for our website, Aphria collects and retains personal information such as the Individual’s name and contact information. Aphria will use this information to confirm the Individual’s registration status and to maintain the Individual’s registered account.
In order to provide some services governed by the MMPR to an Individual, Aphria is required by law to collect certain personal information about that Individual, including about the Individual’s health care information.
When an Individual purchases a product or service, Personal information, including credit card or other financial information, is collected about that Individual. Aphria will use this information as reasonably necessary to process the transaction.
From time to time, Aphria may obtain the Individual’s consent to use the Individual’s contact information to provide newsletters, alerts, bulletins, or other similar communications.
Aphria will also retain and may use Personal Information voluntarily provided by an Individual for another purpose to develop and improve its product services and offerings.
From time to time, Aphria may offer interactive services which allow the Individual to share information with other users of the Site, such as message boards, user reviews, or other similar functions. Aphria will collect and use such Personal Information in accordance with the terms hereof.
Aphria may collect demographic and profile data in connection with our website and may use such data to tailor each Individual’s experience at the website and to display the website content according to the Individual’s preferences.
Aphria will use and or disclose Personal Information in order to comply with the requirements of the MMPR and other applicable law; and
Aphria will use and or disclose Personal Information in order to carry out various functions with and for you in order that you may take advantage of the products or services offered on the Site.
B. Personal Access
Individuals are entitled, with certain legal restrictions, to access and review their Personal Information held by Aphria. Such legal restrictions include, without limitation, if providing access to the personal information would impede a criminal investigation or result in the disclosure of other protected information. Aphria will respond within a reasonable timeframe to all such requests for access and revision and either provide access to the Personal Information or, if permissible, explain why access is denied.
Accurate Personal Information is required for efficient and effective delivery of product and services. Individuals may contact the Privacy Officer using the contact information provided above to modify or correct any Personal Information. Corrections will be made within a reasonable timeframe.
Requests for access to Personal Information should be made to firstname.lastname@example.org.
C. Disclosure of Personal Information General
It will be necessary for Aphria to disclose Personal Information to certain third-party agents or service providers in carrying out the requested services or as necessary for completing the otherwise permitted uses of Personal Information. Personal Information may also be provided to Aphria’s professional advisors in connection to its business operations. In any such case, Aphria shall ensure that any such parties accessing your Personal Information have appropriate safeguards in place to reasonably ensure the protection of your Personal Information.
It may also be necessary for Aphria to disclose Personal Information to law enforcement officials, regulatory bodies, or government agencies for the purposes of investigating or preventing drug, fraud, or other offences as may be required or permitted by applicable law, including without limitation the MMPR.
Aphria may also disclose Personal Information to establish or exercise our legal rights or defend against legal claims or in connection with an emergency that warrants use or disclosure of the information.
Disclosure in compliance with Law
Without limiting the generality of the foregoing, please expressly note that under the MMPR and other applicable laws, Aphria may be required to disclose some or all of and Individual’s Personal Information to government officials, law enforcement personnel, the International Narcotics Control Board, or competent authorities of foreign governments. This information includes:
the Individual’s given name, surname, date of birth and gender;
contact information including the Individual’s mailing address, phone number, and email address, as applicable;
if applicable, the given name, surname, date of birth and gender of one or more persons who are responsible for the Individual, as well as contact information for such persons;
a valid prescription or other medical document issued by an authorized medical practitioner;
the given name, surname, professional status and address of the health care practitioner who issued a prescription or other medical document on behalf of the Individual;
if applicable, the consent of the health care practitioner to receive shipments on the Individual’s behalf;
order details about the product sold or provided, including the quantity ordered; and
the address to which the product is to be shipped.
Use or Disclosure for Research Purposes
In order to improve its processes, products, and service offerings, Aphria may from time to time make use of aggregated and non-identifying information (“Aggregated Data”) for research purposes. Such purposes include, without limitation, better understanding the needs and wants of its customers and users. Aphria may disclose such Aggregated Data, which will not personally identify any Individual, to its affiliates, agents, service providers and business partners for these purposes.
From time to time, Aphria may request an Individual’s consent to use or disclose Personal Information for research purposes, such as (without limitation) information relating to that Individual’s use of medical marijuana. This may include, without limitation, invitations to complete surveys or participate in studies to be conducted by Aphria or a third party. Aphria will not use or disclose Personal Information for such research purposes without the Individual’s express consent, which may be withheld or denied without consequence to the Individual.
D. Retention and Security Retention Timeframes
Aphria will not retain any Personal Information, except as may be required by any Federal or Provincial record keeping requirements, longer than is necessary to fulfill the purpose(s) for which the Personal Information was provided. This may involve the retention of your Personal Information for a period exceeding your actual relationship with Aphria. Once your Personal Information is no longer required to fulfill the stated purpose or to comply with applicable laws, it will be either destroyed or converted into an anonymous format.
Storage and Processing Outside of Canada
Threats to Personal Information include loss, misuse, theft, inadvertent disclosure, and improper modification. At all times, Aphria employs appropriate physical and digital measures to safeguard your Personal Information. Access is limited to authorized personnel who are appropriately trained to handle Personal Information.