PRIVACY POLICY

Last updated: 2023-09-27

Laboratoire CoeurWay Inc., a Canadian commercial company ('Coeurway', 'our', 'we') takes your privacy and the protection of your Personal Information seriously. This Privacy Policy (the 'Policy') describes our practices regarding the protection of Personal Information, the types of Personal Information we may receive or collect from you, and how we use, disclose, host, and secure it, including Health Personal Information, so that you can make informed and wise choices.

This Policy applies to the services we offer and to our platform accessible at https://app.coeurway.com (our 'Platform'). However, we would like to draw your attention to the fact that the rights and obligations described in this Policy do not cover third-party websites that may be linked or mentioned on our Platform. These third-party websites have their own privacy policy, and we encourage you to read them carefully.

We ask you to read this Policy carefully to understand our policies and practices regarding the collection, processing, and storage of Personal Information, Health Personal Information, or any other information to provide us with your informed consent where applicable. If you do not consent to this Policy, you cannot use the Platform.

When creating a professional account on the Platform, you will need to accept our Subscription Agreement and the Policy to complete your registration. You should not use the Platform unless you have fully understood and accepted the Subscription Agreement and the Policy. As a patient, a healthcare professional using the Platform will ask you to read and accept a consent form before they can collect or otherwise transmit your Personal Information on the Platform. If you cannot accept the consent form, we invite you to immediately inform your healthcare professional and let them know that they cannot use the Platform during your consultations or otherwise transmit your personal information.

1. PERSONAL INFORMATION

For the purposes of this Policy, 'Personal Information' means any information concerning an identifiable person, including information that can be used alone or with other information to identify, contact, or locate a single person.

'Health Personal Information' (or HPI) is information about an individual that allows direct or indirect identification and is directly or indirectly related to their physical or mental health, including the patient's name, date of birth, medical history, medical treatments, medical test results, medication list, and any other health information. HPIs may be found in medical records, healthcare professional treatment notes, consultations, and communications between the patient and healthcare professionals.

2. WHAT PERSONAL INFORMATION DO WE COLLECT?

The Personal Information we collect may include, but is not limited to:

• Your contact details such as your name, first name, email address, postal address, and phone number to identify and correspond with you;
• Your Platform login and usage information such as the date you registered on the Platform, your username, password, IP address, browser or device information;
• Your banking, transactional, credit card, or other financial data when a payment is made from the Platform. This information will be collected and processed by a third party in accordance with industry standards (PCI) and will not be collected or used by Coeurway;
• Your personal health information that you may share with healthcare professionals using the Platform and that would be relevant and necessary for a consultation with a healthcare professional, such as your symptoms, medical history, clinical observations, appointment history, diagnosis, prescriptions, allergies, investigation results, and treatment information, as well as biological data about you (height, age, weight, etc.);
• Your personal, family, financial, or legal situation information that you may share with a healthcare professional using the Platform during a consultation, such as your job, biography, personal goals;
• Your health administrative information that may be necessary in your dealings with a healthcare professional, such as administrative information to identify you or establish your social benefits;
• Technical information about your use of the Platform, such as your login information, usage dates of the Platform, geolocation, web browser type and version, time zone settings, system used, and information about your internet connection, the equipment used to access the Platform, submitted content, and certain details about your usage;
• Technical information about your interactions with the Platform, such as visited pages, click paths to, through, and from the Platform, interaction times, searched content, page response times, Platform errors, duration of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), methods used to leave the page;
• Any other Personal Information you have provided to us.

3. HOW DO WE COLLECT YOUR PERSONAL INFORMATION?

Directly from you
In general, we collect the Personal Information we need directly from you, for example, when you fill out the Platform registration form, when you communicate with us, or when you use the Platform. For more information about information collection through cookies, we invite you to read the section 'How do we use cookies?'. If you are a patient, subject to your consent to a consent form provided by a healthcare professional using the Platform, we may also collect your Personal Information directly from you during the recording and processing of audio and exchanges during a consultation.

With your consent
We generally collect your Personal Information with your consent, unless applicable law provides an exception to this principle (for example, to comply with our legal obligations, when necessary to establish, exercise, or defend a legal action or judicial process).

By a healthcare professional, with your consent
As a patient of a healthcare professional using the Platform, subject to your consent to a consent form provided by the professional, we may collect your Personal Information directly from the healthcare professional who may submit their notes, remarks, audio recordings, and other information about you.

Refusal to collect and withdrawal of your consent
You have the right, if you wish, to refuse the processing of your Personal Information. You may also, at any time, and subject to reasonable notice and applicable legal or contractual restrictions, withdraw your consent (if applicable) to the processing of your Personal Information in our possession by contacting us. However, you should be aware that if you choose not to provide us with your Personal Information, this may prevent you, for example, from using the Platform, as some of this information is essential for its use. If you are a patient, this could prevent your healthcare professional from using the Platform. You can contact us as indicated in the 'How to contact us?' section for any questions on this subject.

4. WHY DO WE COLLECT YOUR PERSONAL INFORMATION?

For specific and limited purposes
Coeurway generally collects your Personal Information for the purposes listed below (collectively the 'Purposes').

a) To provide you with the Platform and our services

We collect and use your Personal Information to allow you to access the Platform and access the services offered there, including information, services, or reports you request access to. More specifically, we use your personal information:
- To determine your eligibility, identify, and authenticate you;
- To process and classify information about you, your practice as a healthcare professional, or your patient record;
- If you have given your express consent, to provide you with general recommendations and information on practices and studies aimed at improving your physical and mental health;
- To create and administer your user account once you are registered on our Platform;
- To communicate with you regarding your registration on the Platform and your account and to respond to your requests on the Platform or our products and services in general.

b) For the administration of our business We may use your Personal Information for reasons related to our business and the proper management of our administration. More specifically, we may use your personal information as follows:
- To fulfill our obligations and assert our rights under any contract we may have with you, including rights under our Subscription Agreement, including billing and collection, or to comply with legal requirements;
- To ensure the security of the Platform.
c) To provide you with necessary support and assistance We may use your Personal Information to respond to your requests for assistance, support, or information related to the Platform or our services. More specifically, we may use your personal information as follows:
- To respond to your requests for information, assistance, and support;
- To provide you with personalized assistance based on your previous requests.

d) For study, research, marketing, and statistical purposes We may use your Personal Information for study, research, marketing, and statistical purposes, including to improve the Platform, our products or services, our marketing, or our relationships and experiences with customers. More specifically, we may use your personal information as follows:
- To inform you of our new offers;
- To create statistics to demonstrate the usefulness of the Platform;
- To conduct research to determine how to improve the Platform, certain services, or develop new ones.

To send you messages

We may use your Personal Information to communicate with you in various circumstances (sending newsletters, emails, news, updates, written communications, etc.) (the 'Messages'), including:
- To inform you of new product or service versions, new partnerships, and other key information about the Platform;
- To inform you of changes to the Platform or any product or service we offer or provide through it;
- To provide you with useful health information and other information on trends and best practices in health, mental health, and wellness and other relevant topics related to our services and the Platform.

You may choose not to receive Messages as indicated in the 'Contact Us' section or through the unsubscribe link included in the Messages. However, Coeurway may continue to send you Messages to inform you of available updates, critical technical issues related to the Platform, or to provide you with important information about your account (if applicable).

For any other purpose compatible with the Platform's purpose

With your explicit consent, we may use your Personal Information for any other purpose compatible with the Platform's purpose.

5. DECISIONS BASED EXCLUSIVELY ON AUTOMATED PROCESSING

Specifically, you understand that as part of the Platform's operation, we use technologies based on artificial intelligence. This allows:
- Recording exchanges during consultations between the healthcare professional and the patient;
- Recording the healthcare professional's notes and comments on a patient's record;
- Automatically converting these recordings into text;
- Analyzing and classifying these transcriptions into the patient's medical record.

You understand that these technologies based on artificial intelligence make automatic decisions based exclusively on automated processing regarding, in particular, the cleaning of recordings (removal of silences, hesitations, etc.), transcription of recordings into text, analysis of transcriptions, or their classification in patients' records.

Upon request, we can specify for each case:
- The personal information used;
- The reasons and logic behind each decision;
- The main factors the AI takes into account. Concerning these decisions, you have specific rights in addition to those otherwise available:
1) You have the right to access, rectify, or contest all these decisions (for example, an automatic transcription) by contacting us as provided in the Privacy Policy.
2) If you contest such a decision, you can also contact us as provided in the Privacy Policy to have it reviewed.

6. HOW DO WE SHARE OR DISCLOSE YOUR PERSONAL INFORMATION?

Coeurway does not rent or sell any of your Personal Information to third parties and will not share it with third parties without your consent unless necessary by law or for the reasons set out below.

With our employees

As part of their work, our employees may need to access your Personal Information, for example, when you contact us or request assistance. Their access is limited to what is necessary to perform their duties.

With service providers and strategic partners

Coeurway may share your Personal Information with its service providers and partners to provide the Platform, such as payment and hosting service providers, voice transcription service providers, automated text analysis service providers, or cybersecurity service providers.

Our service providers may have access to your Personal Information for a limited time as part of these activities. When Coeurway uses third parties to process any Personal Information, Coeurway strives to implement commercially reasonable contractual and technical protections to ensure that these third parties keep all Personal Information they process strictly confidential.

Please note that these third parties may be located outside your geographical location (province, territory, or country). In this case, Coeurway takes commercially reasonable steps, as indicated below in the 'Where are your Personal Information hosted and transferred?' section.

When required by applicable laws

We may also share your Personal Information if required by law or if we believe in good faith that such action is necessary to: (i) comply with the law; (ii) comply with the order of a competent judicial authority in any jurisdiction; (iii) comply with a legal process served on Coeurway; (iv) protect and defend the rights or property of Coeurway; (v) enforce or verify your compliance with any agreement you have entered into with Coeurway, if applicable; (vi) prevent fraud or any other illegal activity perpetrated through the Platform; or (vii) act in urgent circumstances to protect the personal safety of Platform users or the public in general.

During a business transaction

We may share your Personal Information without your consent when our business transactions require it. In such circumstances, we may also share all or part of your Personal Information with the concerned third party (or their advisors) for the purposes of a due diligence process.

For other purposes, with your consent

When you have expressly consented, your Personal Information may be shared with other third parties. For example, there may be specific cases where additional conditions apply, and through these, we clearly indicate that specific third parties process your Personal Information.

7. THIRD-PARTY SERVICES AND PLATFORMS

We may sometimes include links on the Platform to third-party sites or services that we do not control. If you click on one of these links, you will be directed to sites we do not control. Please read the privacy policies of these sites, applications, or platforms that may collect Personal Information to understand their privacy policies and personal information collection practices.

8. WHERE ARE YOUR PERSONAL INFORMATION HOSTED AND TRANSFERRED?

Your Personal Information may be stored by Coeurway in regions other than your province, territory, or country of residence, including Canada, the United States, and the province of Quebec. Coeurway may also subcontract the processing or storage of your Personal Information or otherwise share your Personal Information with third parties located elsewhere, in regions other than your province, territory, or country of residence.

In this case, we strive to limit access to Personal Information for these third parties to what is necessary to perform the tasks assigned to them. Please note that we also strive to establish contractual agreements with these agents and service providers to ensure the confidentiality and security of your Personal Information. This may include implementing robust and effective security measures.

Additionally, Coeurway will ensure that your Personal Information is adequately protected by appropriate technical, organizational, or other legal means. If you wish to obtain more information about these security measures, please contact us as indicated in the 'How to contact us?' section.

9. HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION?

Personal Information will only be kept for as long as necessary to fulfill the Purposes or as required by law. At the end of this period, we strive to safely destroy, erase, or anonymize this Personal Information, in accordance with relevant legal, regulatory, and contractual requirements.

To determine the appropriate retention period for your Personal Information, we consider the quantity, nature, and sensitivity of Personal Information, the potential risk of harm from unauthorized use or disclosure of your Personal Information, the Purposes for which we process your Personal Information and the possibility of achieving those Purposes by other means, as well as applicable legal, regulatory, tax, accounting, or other requirements.

If you wish to obtain more information on this subject or otherwise request the deletion of your Personal Information under this Policy, we invite you to contact us.

10. HOW DO WE PROTECT YOUR PERSONAL INFORMATION?

With necessary and appropriate measures

Coeurway has implemented security measures to protect your Personal Information. The standard security measures we use depend on the type of information collected. However, Coeurway uses electronic, physical, and procedural safeguards to protect your Personal Information. We encourage you to be cautious when using the internet, including not sharing your access or passwords. If you believe that an unauthorized account has been created using your name, please contact us as indicated in the 'How to contact us?' section.

Children's privacy

The Platform is only available and designed for individuals aged 14 and over. As a healthcare professional, if you believe your access has allowed the collection of Personal Information from children under 14, you can contact us as indicated in the 'How to contact us?' section.
As a patient, if you are an individual under 14 years of age, a parent or legal guardian must accept the consent form for you to allow the healthcare professional to use the Platform. If you are a parent or legal guardian and believe that your child under 14 has provided Personal Information without your consent, you can contact us as indicated in the 'How to contact us?' section.

11. HOW DO WE USE COOKIES?

A cookie is a small text file that is stored in a dedicated location on your computer, mobile device, tablet, or other device when you use your browser to visit an online service. Other tracking technologies, such as web beacons and tracking pixels, may be used for similar purposes. In this Policy, all these tracking technologies are collectively referred to as 'Cookies'. Any Personal Information collected using Cookies by Coeurway or on its behalf (if applicable) is treated with the same level of confidentiality as any other Personal Information held by Coeurway.

Strictly necessary cookies

These Cookies are necessary for the operation of the Platform and cannot be disabled in our systems. Strictly necessary Cookies must be present for the Platform to perform basic functions and may include logging in, adding training courses and other services to a cart, or electronic billing. They allow a user to navigate from one page to another without losing their previous actions within the same session.

Non-essential cookies

If you have consented to their use, Coeurway and/or its third-party partners may also use non-essential Cookies in connection with the Platform, including the following:
• Functionality cookies (also known as 'preference cookies'): These Cookies are not essential to the provision of our services. They allow for the customization and improvement of the user experience. For example, if you have consented to their use, these Cookies will retain your communication preferences.
• Performance cookies (also known as 'statistical cookies' or 'analytical cookies'): These Cookies are not essential to the provision of our services. If you have consented to their use, we use performance Cookies to understand how you interact with our Platform, to produce location reports, and to have error analysis reports on the Platform. Our partners may also use this type of Cookies to analyze your use of our Platform and provide us with information about it. These Cookies are for statistical purposes only.

Disabling cookies you have consented to

Except for strictly necessary Cookies, we will only place Cookies on your device if you consent to it, and these Cookies will be retained for a maximum period of 13 months from the time they are installed on your device. At the end of this period, your consent will be required again. You can also manage your Cookies by changing your browser or device settings. For more details on how to configure your browser, please consult the help center for Chrome, Safari, Firefox, Internet Explorer, Edge, or Opera. However, if you choose to refuse Cookies, some pages or sections of our Platform may not display correctly, or some features may no longer be available.

12. WHAT ARE YOUR RIGHTS?

a) Access and correction of Personal Information

Depending on your situation, it is important that the Personal Information and Health Personal Information we hold about you is accurate and up-to-date. Please keep us informed of any changes to your Personal Information or Health Personal Information. The law gives you the right to request access to the Personal Information we hold about you and to correct it. This also applies to your patient record managed on the Platform by healthcare professionals, including all HPIs it contains.
You can view and modify your Personal Information by logging into the Platform if you are a healthcare professional or by contacting us if you are a patient. If you wish to view, verify, correct, or withdraw your consent to the use of your personal information, you can do so by contacting us as provided in the Policy.
We may ask you for specific information to help us confirm your identity and your right of access, and to provide you with the Personal Information we hold about you or to make the changes you request. Applicable law may authorize or require us to refuse to give you access to all or part of the Personal Information we hold about you, or we may have destroyed, erased, or anonymized your Personal Information in accordance with our record retention obligations and practices. If we cannot give you access to your Personal Information, we will explain why, subject to any legal or regulatory restrictions such as:
- Information protected by attorney-client privilege.
- Information that is part of an official dispute resolution process.
- Information that concerns another person and would reveal their Personal Information or confidential business information.
- Information contained in patient records: subject to applicable legal limitations, you have the right to access your patient record as it is accessible on the Platform. If you request a copy of your patient record, it will be provided to you for a reasonable fee. You can request access to your patient record by contacting us. Access to your patient record may be temporarily refused if providing access poses a significant risk to your health according to the opinion of the healthcare professional concerned. Access to your patient record will also be refused if disclosure is likely to have a significant adverse effect on your physical, mental, or emotional health according to the healthcare professional, or to reveal personal information about a third party or the existence of such information and disclosure may seriously harm that third party, unless the third party consents or in an emergency threatening the life, health, or safety of the individual concerned. We use reasonable means to ensure that the information in your patient record is accurate. If you identify inaccuracies, you can request that a note be made on the record indicating the inaccurate information.
We may not comply with a request to change information if we believe the change would violate a law or legal requirement or render the information incorrect.
If you are concerned about our response or wish to correct the information provided, you can contact us as provided in this Policy.

b) Withdrawal of consent

When you have given your consent to the collection, use, and disclosure of your Personal Information, you may have the legal right to withdraw your consent in certain circumstances. To withdraw your consent, if applicable, contact us as provided in this Policy. Please note that if you withdraw your consent, we may not be able to provide you with a specific product, service, or consultation and/or you may no longer be able to access the Platform. We will explain the consequences at that time to help you make your decision.

c) Right to de-indexing

The right to de-indexing allows you to request that Coeurway stop disseminating your Personal Information or de-index any hyperlink associated with your name that provides access to Personal Information if such dissemination causes you harm or contravenes the law or a court order.

d) Right to data portability From September 2024, you will be able to request that Coeurway provide you with the computerized Personal Information in its possession in the form of an intelligible written transcript and in a structured and commonly used technological format. Alternatively, you can also simply ask Coeurway to confirm the existence of Personal Information concerning you. You can request that this Personal Information be provided to any person or entity authorized by law to collect such information. Coeurway will only provide you with the Personal Information it has collected from you and may exclude certain Personal Information under applicable laws (such as Personal Information it has created or inferred about you). Coeurway also reserves the right to refuse such a request if it raises serious difficulties under applicable laws.

e) Other rights and exercise of these rights Depending on applicable laws, you may have other rights regarding your Personal Information that are not otherwise listed above. We invite you to write to us with this request and provide relevant information about this right to allow us to assess its implementation.
To exercise any of your rights (to the extent they are available), please contact us as indicated in the 'How to contact us?' section.

13. HOW TO CONTACT US?

If you have any questions about any aspect of this Policy, if you wish to send a comment, file a complaint, or exercise any of the rights available to you under applicable laws, please do so through the 'Contact Us' link on the Platform, when available, or please contact our Privacy Officer as follows:
Privacy Officer
Address: 2186 Rue Roussel, Chicoutimi, QC, G7G2Y3
Email: francois.dufour@coeurway.com
Phone number: 581-490-1757
Your request may be accepted or refused by Coeurway under applicable laws. Coeurway will promptly take corrective action when it becomes aware of any breach of this Policy. Coeurway cannot be held responsible for any indirect, incidental, consequential, or punitive damages related to this Policy. You can file a complaint with the competent authority at any time if you believe that Coeurway is not processing your Personal Information in a manner consistent with this Policy or applicable laws.

14. MODIFICATIONS AND UPDATES TO THE POLICY

Coeurway may, at its discretion, update, revise, modify, or supplement this Policy from time to time. If significant changes are made to the Policy, you will be informed when you log in and/or we will send you a link to the new version of the Policy. The Policy and any related documents, if applicable, will be published on our Platform. Coeurway asks its users to review and accept the revised Policy before continuing to use its Platform.