Privacy Policy

Last updated October 2014


This Privacy Policy sets out the privacy policies and practices for Pure Natures Wellness Inc. doing business as Aphria (“Aphria”) with respect to the collection, use, and disclosure of personal information in connection with the website aphria.ca (the “Site”).

Personal Information is any information about an identifiable individual. Aphria recognizes the sensitivity of Personal Information. It should only be collected and retained for legitimate purposes and must be handled with care and respect. In providing our services it will be necessary to collect and use Personal Information about our customers. In doing so, we are committed to protect your right to have your Personal Information collected and used transparently and responsibly.

Aphria is committed to respecting your privacy rights. Our Privacy Policy ensures that all of your Personal Information is handled properly with procedures that meet or exceed all Federal and Provincial requirements. To the best of our ability it will remain confidential and secure. Our Privacy Policy can be reasonably modified from time to time as may be desired or required. Reasonable notice will be provided of any substantial changes to the terms of the Privacy Policy. Aphria shall not collect, use, or disclose any Personal Information about any party (an “Individual”) without that Individual’s knowledge and consent, except as herein provided or as may be specifically permitted or required by applicable law.

Any questions regarding this Privacy Policy or complaints about Aphria’s use or handling of Personal Information may be directed to Aphria’s Privacy Officer (the “Privacy Officer”) using the contact information provided below.

Aphria

Attention: Privacy Officer P.O. Box 20009

269 Erie St. South

Leamington, Ontario N8H 3C4

Email: info@aphria.com

Any complaints received regarding Aphria’s use or handling of Personal Information will be investigated within a reasonably timeframe. Upon concluding the investigation, the Privacy Officer will respond to the complaint and, if necessary, Aphria will take appropriate measure to rectify the situation and maintain compliance with applicable law.

A. Collection and Use of Personal Information General.

Aphria collects and uses Personal Information in a lawful manner and only when it is reasonably necessary to do so for the provision of requested services, products, or information or as may be required or permitted by applicable laws, including without limitation the Marijuana for Medical Purposes Regulations (the “MMPR”). This information is generally provided voluntarily by an Individual in applying for our services, purchases Products, or shares information on the Site. However, information relevant to the requested services may also be obtained from authorized representatives and/or appropriate regulatory bodies.

Whenever Aphria requests Personal Information, we will explain why that Personal Information is required. The collected Personal Information will be used only for the stated purpose, a requisite ancillary purpose, or for such other purposes to which the customer may later consent.

Consent for the collection, use, and disclosure of Personal Information may be express or implied, physical or electronic, given in writing, orally, or by toggling a check-off box, or by inference from the Individual’s conduct, such as (without limitation) by use of the services or products.

Personal Information Posted by the Individual

From time to time, Aphria may offer interactive services which allow an Individual to share information with other Individuals on the Site, such as message boards, user reviews, or similar functions. These features may permit an Individual to publish personal information about him or herself or about another individual. By submitting such information, the Individual represents:

• that the Individual consents to its collection, retention, and public disclosure by Aphria; and

• that the Individual has obtained the same consent from any other Individual whose Personal Information is being posted, as applicable.

Aphria does not monitor or moderate information submitted or posted by the users of the website and accepts no responsibility or liability for any content, including without limitation Personal Information, posted in this way.

If an Individual believes that his or her Personal Information has been posted a third party without consent, that Individual should contact Aphria at info@aphria.com to notify Aphria so that the complaint may be investigated and the content removed if it is appropriate to do so.

Cookies

Additionally, ‘cookies’ from this website may collect non-personal information. A cookie will not collect any information that is not otherwise provided to us. Cookies allow a website to identify repeat visitors through an ID number cached in that computer. Cookies can be disabled or cleared using the tools of any web browser.

Examples of Personal Information Use

Without limiting the generality of any of the foregoing, Aphria may use an Individual’s Personal Information as follows:

When an Individual registers for the Site, Aphria collects and retains personal information such as the Individual’s name and contact information. Aphria will use this information to confirm the Individual’s registration status and to maintain the Individual’s Account.

In order to provide some services governed by the MMPR to an Individual, Aphria is required by law to collect certain personal information about that Individual, including about the Individual’s health care information.

When an Individual purchases a product or service, Personal information, including credit card or other financial information, is collected about that Individual. Aphria will use this information as reasonably necessary to process the transaction.

From time to time, Aphria may obtain the Individual’s consent to use the Individual’s contact information to provide newsletters, alerts, bulletins, or other similar communications.

Aphria will also retain and may use Personal Information voluntarily provided by an Individual for another purpose to develop and improve its product services and offerings.

From time to time, Aphria may offer interactive services which allow the Individual to share information with other users of the Site, such as message boards, user reviews, or other similar functions. Aphria will collect and use such Personal Information in accordance with the terms hereof.

Aphria may collect demographic and profile data in connection with the Site and may use such data to tailor each Individual’s experience at the Site and to display the Site content according to the Individual’s preferences.

Aphria will use and or disclose Personal Information in order to comply with the requirements of the MMPR and other applicable law; and

Aphria will use and or disclose Personal Information in order to carry out various functions with and for you in order that you may take advantage of the products or services offered on the Site.

B. Personal Access

Individuals are entitled, with certain legal restrictions, to access and review their Personal Information held by Aphria. Such legal restrictions include, without limitation, if providing access to the personal information would impede a criminal investigation or result in the disclosure of other protected information. Aphria will respond within a reasonable timeframe to all such requests for access and revision and either provide access to the Personal Information or, if permissible, explain why access is denied.

Accurate Personal Information is required for efficient and effective delivery of product and services. Individuals may contact the Privacy Officer using the contact information provided above to modify or correct any Personal Information. Corrections will be made within a reasonable timeframe.

Requests for access to Personal Information should be made to info@aphria.com.

C. Disclosure of Personal Information General

It will be necessary for Aphria to disclose Personal Information to certain third-party agents or service providers in carrying out the requested services or as necessary for completing the otherwise permitted uses of Personal Information. Personal Information may also be provided to Aphria’s professional advisors in connection to its business operations. In any such case, Aphria shall ensure that any such parties accessing your Personal Information have appropriate safeguards in place to reasonably ensure the protection of your Personal Information.

It may also be necessary for Aphria to disclose Personal Information to law enforcement officials, regulatory bodies, or government agencies for the purposes of investigating or preventing drug, fraud, or other offences as may be required or permitted by applicable law, including without limitation the MMPR.

Aphria may also disclose Personal Information to establish or exercise our legal rights or defend against legal claims or in connection with an emergency that warrants use or disclosure of the information.

Aphria shall not otherwise disclose Personal Information to third parties for commercial or other reasons, except as may be specifically required to comply with applicable laws. Except as may be specifically provided in this Privacy Policy, Aphria will obtain an Individual’s consent prior to disclosing any Personal Information or otherwise using Personal Information for purposes other than those for which it was explicitly or implicitly given.

Disclosure in compliance with Law

Without limiting the generality of the foregoing, please expressly note that under the MMPR and other applicable laws, Aphria may be required to disclose some or all of and Individual’s Personal Information to government officials, law enforcement personnel, the International Narcotics Control Board, or competent authorities of foreign governments. This information includes:

the Individual’s given name, surname, date of birth and gender;

contact information including the Individual’s mailing address, phone number, and email address, as applicable;

if applicable, the given name, surname, date of birth and gender of one or more persons who are responsible for the Individual, as well as contact information for such persons;

a valid prescription or other medical document issued by an authorized medical practitioner;

the given name, surname, professional status and address of the health care practitioner who issued a prescription or other medical document on behalf of the Individual;

if applicable, the consent of the health care practitioner to receive shipments on the Individual’s behalf; order details about the product sold or provided, including the quantity ordered; and the address to which the product is to be shipped.

Use or Disclosure for Research Purposes

In order to improve its processes, products, and service offerings, Aphria may from time to time make use of aggregated and non-identifying information (“Aggregated Data”) for research purposes. Such purposes include, without limitation, better understanding the needs and wants of its customers and users. Aphria may disclose such Aggregated Data, which will not personally identify any Individual, to its affiliates, agents, service providers and business partners for these purposes.

From time to time, Aphria may request an Individual’s consent to use or disclose Personal Information for research purposes, such as (without limitation) information relating to that Individual’s use of medical marijuana. This may include, without limitation, invitations to complete surveys or participate in studies to be conducted by Aphria or a third party. Aphria will not use or disclose Personal Information for such research purposes without the Individual’s express consent, which may be withheld or denied without consequence to the Individual.

D. Retention and Security

Retention Timeframes

Aphria will not retain any Personal Information, except as may be required by any Federal or Provincial record keeping requirements, longer than is necessary to fulfill the purpose(s) for which the Personal Information was provided. This may involve the retention of your Personal Information for a period exceeding your actual relationship with Aphria. Once your Personal Information is no longer required to fulfill the stated purpose or to comply with applicable laws, it will be either destroyed or converted into an anonymous format. Storage and Processing Outside of Canada

Aphria makes use of third-party service providers to store and process data, including personal information, on its behalf. Any of Aphria, its service providers, and/or either’s agents may use servers or other facilities located in the United States of America for this purpose. When acting on Aphria’s behalf, such service providers and agents are only authorized to collect, use, or disclose an Individual’s personal information as described in this Privacy Policy. Notwithstanding the foregoing, the government, courts, law enforcement, security, or regulatory agencies of the United States of America may be able to obtain access to or disclosure of personal information as permitted by the laws of that country.

Security

Threats to Personal Information include loss, misuse, theft, inadvertent disclosure, and improper modification. At all times, Aphria employs appropriate physical and digital measures to safeguard your Personal Information. Access is limited to authorized personnel who are appropriately trained to handle Personal Information.

E. Targeted Advertising

Aphria has agreements with third party advertising services, including without limitation AdRoll (“Advertisers”), to present you with advertising on third party Web sites based on your previous interaction with the Site. The techniques Advertisers employ do not directly collect personal information, but could be used to collect identifiable information about your online activities over time and across different Web sites.

You can learn about AdRoll’s Privacy Policy here and you can opt out of targeted advertising by visiting this page.

F. Opt Out

Canada’s Anti Spam Legislation (“CASL”) is recently enacted legislation regulating commercial electronic messages, including without limitation newsletters, updates, and offers (a “CEM”). In compliance with CASL, Aphria will not send CEMs without the express or implied consent of an Individual. Any individual who wishes to revoke their consent may opt out of receiving future CEMs by following the conspicuous unsubscribe mechanism contained in each CEM in accordance with CASL or by contacting the Privacy Officer as described above. Any such opt-out will not apply to any communications that are required by law, such as to comply with obligations under the MMPR.