TELUS Health Pharmaconnect Privacy

Commitment

Effective as of July 8, 2022

Our privacy commitment to you:

At TELUS Health^[1] we respect our customers’ privacy and take great care to safeguard personal information, which includes personal health information. As part of our ongoing commitment to putting customers first, we have a long- standing policy of protecting privacy. We believe that an important part of protecting privacy is to be clear about how we handle customers' personal information, and to make information about our approach easily accessible.

While the TELUS Privacy Code sets out the general principles that govern the collection, use and disclosure of our customers’ personal information^[2], we have also developed this TELUS Health Privacy Commitment to provide you with more specific details about our privacy practices supporting our health related products and services^[3].

We have learned from our customers that sometimes you just want the big picture, while other times you may want more details or examples of how a policy or process works. For this reason, we have structured this Privacy Commitment in layers.

Importantly, both our Privacy Code and Privacy Commitment reflect the requirements of Canada’s applicable privacy legislation, including the Personal Information Protection and Electronic Documents Act, and applicable provincial health legislation^[4] along with our own continuing commitment to customer privacy. The bottom line is that we want you to understand the purposes for which we collect, use and disclose personal information and about our customers. The following is a summary of our privacy practices.

Why we collect personal information

If you are a TELUS Health customer, TELUS Health collects certain personal information from or about you. We collect personal information only for the following purposes:

To establish and maintain a responsible commercial relationship with you and to provide ongoing service.

Here are some examples of what we mean by this:

When you apply for a service, we may set up an account and collect personal information such as name, address, date of birth, preferred language, TELUS

Health account number(s), any other authorized users, unique account security PIN(s) and email address;

In order to confirm your identity and/ or conduct a credit check, we may ask for acceptable identification or identifying information;
We collect and use some personal information to confirm your identity when you contact us. For example, when you contact us, we will ask to confirm some personal information to verify it’s actually you and not someone trying to access your account without authorization;
For billing purposes, we collect records of the services you use; we also collect payment information to set up pre-authorized payments, if you choose to do so;
Some of our products and services invite you to provide personal information in order to allow you to use and access that personal information as part of the functionality of the product or service. For example, for you to take advantage of our TELUS Baby Health service, you will be invited to enter personal information about your baby;
We may require certain technical information from you, such as your wireless device information, telephone number, email, and operating system in order to set up some of our services or to assist you in troubleshooting service issues.

To understand your needs and preferences. Here are some examples of what we mean by this:

We maintain a record of the products and services you receive from us, and we may collect additional information about the usage and patterns associated with those products and services so that we can better meet your needs and preferences;
We may collect or infer information about you or your preferences for particular products, services or lifestyle activities from information you provide us about yourself when you tell us your preferences, or when your usage activities indicate what your preferences are.

To develop, enhance, market or provide products and services. Here are some examples of what we mean by this:

From time to time, we review and analyze personal information and your use of our products and services:

To help us provide tailored content and services, such as personalized product recommendations and special offers from TELUS Health and others that we think will interest you;

To recommend a new feature of the applications you use;

To better understand your preferences, and to help us develop or enhance our products and services;

To recommend a new service or TELUS app that we think you’ll enjoy based on your existing services with us or the apps you use.

We may note that you have certain TELUS products and services and offer you a discount if you bundle services;
We may de-identify personal information to conduct research or analytics to derive insights or to share that de-identified information or insights with our partners to assist in research, planning, or product and service development^[5].

We note that our customers who do not wish to receive these types of recommendations or offers may choose to be removed from our marketing lists at any time.

To manage and develop our business and operations. Here are some examples of what we mean by this:

We may collect personal information to help us manage our day-to-day operations efficiently, and to plan, manage and secure our systems;
We analyze how many customers use our systems and customer usage patterns to help us make our systems more efficient. We may use video surveillance to monitor and/ or record the activity that occurs around TELUS stores, premises or infrastructure;
We monitor activity on our networks to detect and prevent fraud to protect both our customers and our business;
We record interactions, such as chats with or telephone calls to or from TELUS Health service representatives for quality assurance and training purposes; our systems may also conduct real-time analytics on such interactions to identify trends and patterns to help us serve you better;
We collect information about visits to our websites (such as www.telus.com and telushealth.com) to optimize our TELUS Health web properties, and for security purposes.

To meet legal and regulatory requirements. Here are some examples of what we mean by this:

We may collect or preserve personal information in response to a court order;
We need to collect certain personal information to comply with statutory obligations, including our tax reporting obligations.

When we share personal information

We take great care with what information we share, and why. There are circumstances where we share some personal information about our customers:

To facilitate and improve the provision of products and services to you. Here are examples of what we mean by this. We may share personal information with:

A person seeking information as an agent of a customer, such as a customer’s legal representative, or as an authorized user under his or her account, if we are satisfied that the person is authorized to receive the information;
Other TELUS business units to help us serve our customers better and to provide them with services from different parts of our company.

To enable our service providers and partners to help us serve you better.

We may share personal information with our suppliers, agents or other organizations or individuals contracted to TELUS Health to perform services or functions on our behalf where they require the information to assist us in serving you. We strive to minimize the amount of personal information that we share with our service providers and partners; we share the information reasonably necessary to achieve the stated purpose, and require that it only be used to achieve that stated purpose.

Examples of what we mean by service providers or partners include organizations that:

Conduct research on our behalf, such as customer satisfaction surveys;
Perform data processing on our behalf, such as printing customer statements;
Administer special TELUS Health programs with partners, such as a rewards program or special contests;
To provide you with an enhanced service as part of some of our service offerings, with your express consent, we may share your personal information with your electronic health record or with other parties, such as your health care providers or your pharmacy.

For credit-related purposes.

We may share personal information with credit bureaus:

To evaluate a customer’s creditworthiness;
For the purposes of monthly reporting on the status of your payment history with TELUS Health.

We may share your personal information with collection agencies to collect an account if your account has been referred for collection.

For emergency purposes.

We may share personal information with a public authority, agent of a public authority or other party if, in the reasonable judgment of TELUS Health, it appears that there is imminent danger to the life, health or security of an individual which could be avoided or minimized by disclosure of the personal information.

Where required by law or applicable regulation.

We share personal information with law enforcement, other government agencies or other parties if we are required to do so to meet legal and regulatory requirements; for example, if TELUS Health is required to provide records to law enforcement in response to a valid court order.

Personal information collected by TELUS Health may be stored and processed in Canada or another country. In either case, the personal information is protected with appropriate security safeguards, but may be available to foreign government agencies under applicable law. When we do transfer data outside the country, we strive to minimize the amount of personal information that we transfer, using de-identification or other means where appropriate.

Some of the ways we respect your privacy

TELUS Health has appointed a Chief Data & Trust Officer to oversee the TELUS Health Data & Trust Office. The Office is responsible for maintaining an accountable privacy management program
specifically designed to protect your privacy, and for setting policies and procedures to earn and maintain your trust in our data handling practices;
We have embraced the seven foundational principles of Privacy by Design, striving to embed these privacy enhancing principles into all of our product and service development processes;
TELUS Heath maintains a robust information security governance program to protect your personal information with appropriate security safeguards. Our safeguards include administrative, physical and technical security controls. We protect the privacy of your personal information through contractual and other means when we are working with other companies;
We may de-identify personal information for a variety of reasons, including to safeguard it, or where de-identified information will serve the purposes for retaining the information.

For example, we may de-identify certain usage or health trend data for long term planning where individual customers' personal information is not required. We may also de-identify information prior to conducting analytics that don’t require personal information;

We respond in a timely manner to your requests for access to your personal information;
We take privacy and security training and awareness seriously, and we use a variety of different methods to assist our TELUS ealth team members in respecting and protecting your privacy;
Unless you provide your express consent, TELUS Health does not disclose your personal information to marketers of third-party products to enable targeted advertising, or for any other purpose;
We have a team dedicated to responding to your privacy inquiries or concerns; the team can be contacted at privacyhealth@telus.com;
We are committed to being transparent with you about how we handle your personal information, including through this Commitment and our Privacy Code and our privacy page;
We use cookies, in a limited manner and for purposes consistent with this

Commitment. For more information, please refer to our Cookies Notice;

Privacy legislation generally sets out certain circumstances under which organizations may collect, use or disclose personal information without consent.

Examples include emergency circumstances;

or the investigation of a contravention of laws. Other than under such specified circumstances, TELUS Health will not collect, use or disclose your personal information for any purpose other than those identified in this Commitment, our Privacy Code, your Customer Service Agreement, or our Service Terms, except with your consent; and
TELUS Health will continue to review this Commitment to ensure it is relevant, remains current with changing technologies and laws, and continues to meet your evolving needs.

Choices we offer you

We rely on your consent to continue to collect, use and disclose your personal information for the purposes we have identified to you. However, we want you to know that you do have choices and can refuse or withdraw your consent as follows:

You may have your name removed from one or more of our marketing lists, such as our telephone, mail or email marketing lists. We use these lists to inform you of relevant products, services and special offers that may be of benefit to you;
You may delete your account. To delete your account, navigate to the ‘Settings’ option under the ‘My Account’ option and select the “Account” option. Next, click the ‘Delete account’ link at the bottom of the page and follow the prompts;
You may refuse to provide personal information to us. You may also withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. However, in either case, this may limit our ability to serve you and may force us to cancel some or all of the services you receive from us;
For further information about the above options please contact privacyhealth@telus.com.

Unless you tell us otherwise, we will assume that we have your consent to continue to collect, use and disclose your personal information for the purposes we have identified to you.

Questions?

We want you to be comfortable with how we protect the privacy of the personal information you entrusted to us. If you have questions that are not addressed in this Commitment or our Privacy Code, please refer to our Frequently Asked Questions; you can also call us or email privacyhealth@telus.com.

[1] In this Privacy Commitment, the words “we”, “us”, “our”, or “TELUS Health” refer to TELUS Health and Payment Solutions and its subsidiary companies, The word

“TELUS” alone refers to TELUS Communications Inc. and its subsidiary companies, as they may exist from time to time, including those subsidiaries or divisions that carry on business under the names TELUS, TELUS Communications, TELUS Mobility, TELUS Quebec, Koodo, Public Mobile and PC Mobile, and TELUS Health but does not include independent dealers and distributors of TELUS products and services.

[2] The TELUS Privacy Code and this Commitment do not limit the collection, use or disclosure by TELUS Health of information that is publicly available. This includes: (a) a customer’s name, address, telephone number, and email address, when listed in a directory or available through directory assistance; and (b) other information about the customer that is publicly available and is specified by regulation pursuant to the Personal Information Protection and Electronic Documents Act or other applicable legislation. This Commitment and TELUS Privacy Code do not apply to information regarding TELUS Health corporate customers, which are covered under the TELUS Health and Payment Solutions Privacy Policy. The TELUS Privacy Code and the privacy practices described in this Commitment are subject to the provisions of all applicable legislation and regulations.

[3] The definitions set out in the TELUS Privacy Code apply to this Commitment.

[4] Examples of applicable provincial health legislation include Ontario’s Personal Health Information Protection Act, , Alberta’s Health Information Protection Act, and British Columbia’s Personal Health Information Access and Protection of Privacy Act.

[5] De-identifying information involves adding information or removing identifiers, such that the information can no longer reasonably be associated to a specific individual.