Biron Health Group Inc. Privacy Policy

We are committed to complying with the laws applicable to our operations, specifically the Act respecting the protection of personal information in the private sector and other laws of the province of Quebec and the federal laws of Canada, and their regulations (hereinafter, the "applicable laws"). This Policy has been prepared taking into account Applicable Laws, and therefore the rights and obligations set forth in the Policy may not be consistent with the privacy requirements of all jurisdictions. If you use Biron's websites or rely on Biron's services and you are not a resident of Quebec, please note that by providing your personal information, you are deemed to consent to: (i) the collection, use and disclosure of your personal information in Quebec; and (ii) the collection, use and disclosure of your personal information in accordance with the laws of the province of Quebec (which may differ from the privacy laws of the jurisdiction of your residence) and this Policy.

This policy applies to personal information collected by Biron, regardless of the means by which it is collected, such as in person (at our locations and clinics or at border crossings and airports), by telephone, or via our websites or mobile applications on which this Policy is posted, such as www.biron.com, www.medvue.ca/ or imagix.biron.com (as well as the various online portals available from these sites, such as MyBiron) (collectively, " Websites "). You can find more information on this topic in the section What companies are covered by the Privacy Policy?

In this policy, we describe what personal information we collect, how we use, disclose and manage it, as well as the ways in which you can access, update or correct your personal information and the choices you have regarding your privacy.

In some cases, at the time of collection of your personal information, we may provide you with additional information relating to the processing of your personal information. We may also, in some cases, obtain specific consent from you to use or disclose your personal information.

a. Which Companies Are Covered by the Privacy Policy?

Biron’s activities are structured around the following five service groups:

• Laboratory, Sampling and Nursing Care
• Medical Imaging
• Sleep
• Genetics
• Business

This policy therefore applies to all our affiliates and partner companies or clinics (and their respective subsidiaries), the main ones being Biron Medical Laboratory, Biron Sleep Care, Biron Corporate Health and Biron Genetics, as well as partner medical imaging clinics operating under the Imagix and Medvue banners.

b. What Does the Privacy Policy Include?

This policy describes how we handle your personal information, specifically, what information we collect and how we collect, use, share, protect and store it. In addition, we explain what your privacy choices are and how you can exercise those choices.

This policy applies to you in all situations where you interact with Biron and we collect information about you. For example, this may occur when you use our services (such as when you have a blood sample taken at a point of care, receive care at a clinic, are examined by a Biron health care professional as part of your employment), are selected for screening at borders or airports, visit our Websites, or communicate with us by any means.

Please note that specific notices or additional terms and conditions may apply to the processing of your personal information. These additional notices or terms and conditions apply in addition to this policy. For example:

• When you use sleep apnea treatment equipment, you must agree to specific terms of use governing the processing of information captured by the equipment, and transmitted to Biron and the equipment manufacturer.
• In certain cases, Biron will ask you to fill out a consent form for your personal information to be transferred to a third party, for example when you want us to transmit it to your insurer or employer.

We collect only the personal information reasonably required to provide and manage our services and business operations. We collect your personal information in a variety of ways. We collect it, for example, directly from you, from third parties, when you visit our Websites or through medical equipment you use in the course of the care we provide to you.

a. Definition of “Personal Information”

“Personal Information” means any information that identifies you or could reasonably be associated with you. The personal information we collect may include, but is not limited to, the following:

• Identity and contact information, such as first and last name, date of birth, residential address, telephone number, email address, gender, height and weight, and health insurance number.
• Health-related information, such as all or part of your medical file, a medical certificate with or without a diagnosis, the fact that you consulted a physician or other health professional, the date of the consultation, your list of medications, prescriptions issued, and information related to your genetic profile.
• Information on specific products and services that you have purchased from Biron, including in our online stores.
• Payment information (such as credit card information) if you make a purchase on our Websites.
• Information collected automatically when you visit our Websites.

Information that is aggregated and/or anonymized, and cannot be associated with an identifiable individual, is not considered personal information.

b. Collection of Your Personal Information

We generally collect personal information as follows:

Directly From You

You may provide us with personal information directly, for example, in person at our points of service and clinics, during a teleconsultation, by mail, email, telephone, fax or through our Websites.

For example:

• When you come to a point of service for a medical examination, test, or treatment, we collect your personal information necessary to perform the required services and to communicate the results, if applicable. We also collect your health information resulting from the tests or examinations that were performed.
• When you participate in a teleconsultation with a health practitioner, we collect personal information necessary to provide the required services and health care. Use of a telemedicine platform is subject to the relevant provider’s privacy policy and you will be asked to consent before the recording of any teleconsultation.
• When you contact us by phone to make an appointment, we collect the personal information necessary to complete the appointment booking process.
• We may record calls to our customer service centre for quality control purposes. In this case, we will inform you at the beginning of the call.
• When you purchase a Biron Genetics kit, we collect information related to your genetic profile in order to provide you with this product.
• We collect the personal information related to a medical prescription when you submit it to us electronically.
• When you use a chat service on our Websites to discuss with a Biron representative (in this case, you must at all times comply with the instructions communicated through the chat interface.

Other Sources

Occasionally, we may receive personal information from other sources. In these cases, we only receive it with your consent or as required or permitted by law (for example, to meet our regulatory obligations).

For example:

• If you are required to undergo a pre-employment medical examination, your employer may provide us with information about you.

From the Medical Equipment You Use

In some cases, we may receive personal information through your medical equipment, with your consent.

For example:

• When you use sleep apnea treatment equipment, we may have access to a portal to view the data captured by the equipment, with your consent.

Through Our Websites

We may collect certain types of information electronically through your contact with our Websites using technologies (either our own or third party technologies) such as cookies and web beacons.

We use the information collected to adapt our Websites to the preferences of the user concerned, to compile statistics about the consultation and use of our Websites and our electronic communications (such as our newsletters) in order to improve them, and to present you with Biron advertisements with the help of our partners.

For example:

• We may use your geographic location to determine the language in which our Websites are displayed when you visit them.
• Subject to applicable laws, we may use the pages you visit on our Websites to present you with personalised advertisements on our partners’ websites.

The technologies we employ include, but are not limited to, the following:

• Cookies, which are small text files that are stored on your computer when you visit a website so that information can be saved between visits, such as your login credentials or language preferences. Thus, cookies allow you to log in quickly when you visit our sites.
• Web beacons, which are small image files containing information about you, such as your IP address, that can be downloaded when you visit a website or open an email. This allows us to understand your online behaviour, monitor our email delivery, and provide you with interest-based advertising. These tools also allow our third-party tracking tools to gather information, such as your IP address, and provide this back to us in an anonymized, aggregate form (i.e. in a manner that prevents us from identifying you personally). Aggregate information refers to personal information compiled and expressed in a summary form where no personal identifiers are included.

We use Google Analytics and HotJar, which are services that use cookies to analyze your use of our Websites, generate reports for us on the activities of visitors to our Websites, and provide other services related to the use of the Websites and the Internet. This information is not transmitted to us in a form that can identify you.

You can remove or disable some of these technologies at any time through your browser. However, if you do so, you may not be able to use certain features of our Websites. To learn more about the privacy choices available to you, please visit How Do I Change My Privacy Choices?

We use technologies such as cookies or pixels to perform various functions on our websites. You will find more information on the use of these technologies in the Cookie Policy.

We use your personal information to provide you with our services, to manage our business operations, to communicate offers and information that we believe will be of interest to you, to enhance your overall client experience, and for other purposes permitted or required by law.

In particular, we use your personal information for the following purposes:

a. To Offer You Our Services

We use your personal information to provide you with our services and, more specifically, for the following purposes:

• Verifying your identity. For example: if you contact us for information about your health record, we will ask you for information to confirm your identity.
• Providing our services to our patients and clients, including our corporate clients. For example: to carry out analyses of samples you have submitted to us, to perform an on-the-job medical examination or to provide you with genetic counselling.
• Enabling you to shop for products online or in person. For example: you can buy equipment on our online shop.
• Determining if our products and services are right for you. For example: if you contact us about certain sleep treatments, we will ask you some questions in order to offer you a treatment adapted to your situation.
• Administering your file, including your online portal, to better meet your needs. For example: We may group the information relating to the various services you obtain from Biron (for example, samples and sleep) in a single file in order to better meet your needs, offer quality client service, and better understand our clients and their needs.
• Answering your requests and questions. For example: you can contact us by phone about our services, to obtain information about your file or to make an appointment.

b. Managing Our Business Operations

We use your personal information for several reasons in connection with our business operations, which include:

• Deploying and managing our information technology applications and systems. For example: when necessary to ensure the security of our networks.
• Managing and facilitating the use of our Websites. For example: by means of cookies or other similar technologies.
• Enabling your participation in surveys or, if applicable, contests, promotions, polls, chats, seminars or workshops. For example: we can send you a satisfaction survey after an appointment.
• Ensuring the safety of the public, our clients, employees and property. For example: when necessary to ensure safety in a clinic.
• Protecting ourselves and other organizations from error and fraud. For example: we may verify the personal information of our clients in the context of compliance audits.
• Monitoring and investigating incidents, and managing claims. For example: we may use our clients’ personal information when necessary in connection with a claim.
• Meeting our legal and regulatory obligations. For example: we may need to use our customers' personal information to provide reports to government authorities and their authorized representatives and agents.

c. Our Communications With You

We may use your personal information, with your consent, to communicate with you in various ways for the following purposes:

• Send you our newsletters, while offering you the ability to unsubscribe at any time.
• Inform you in various ways (e.g., by email, phone, text message or direct mail) about our programs, products, services, special offers, promotions, contests or events that may be of interest to you. For example, we may send you a promotion if you need to replace equipment or if we think you might be interested in a Biron service you do not use.
• Provide you with personalized advertising about our products or services, if we believe they may be of interest to you.

To receive our commercial emails, you must give us your consent, where required by law. Without this consent, we cannot send them to you.

If, after having consented to receive them, you no longer wish to receive our commercial emails and would like to unsubscribe, please follow the unsubscribe procedure that appears in each of these messages. You can find more information on this subject in the section entitled “How Do I Change My Privacy Choices?”

d. Data Analysis and Research

We may use your personal information to conduct data analysis and research to improve or develop health-related products and services, programs, promotions, contests or events, and to better understand our clients. In such cases, we will generally aggregate and/or anonymize your personal information so that it no longer includes information from which you can be identified.

For example, we may conduct data analysis and research for the following purposes at any time, in accordance with applicable laws:

• Determining the effectiveness of a treatment and finding ways to improve it or developing tools to improve diagnosis or imaging reading.
• Conducting health and genetic research.
• Improving the performance of our Websites and developing content that better meets the interests of our visitors.
• Measuring the effectiveness of our marketing and developing campaigns that meet the needs of our clients.
• Developing new health products and services that meet the needs of our clients.
• Conducting data analysis, and research and development to develop new tools such as algorithms or reports.

We may share your personal information among Biron entities or with our service providers (companies that perform activities on our behalf) and other third parties (with your consent or where otherwise permitted by law) for the purposes described in this policy and in accordance with applicable law (for example, under Quebec's Act respecting the sharing of certain health information). We do not sell your personal information, except in the event of a sale or transfer of part of our business.

The Biron entities (described in Which Companies Are Covered by the Privacy Policy?) may share personal information among themselves and use it for the purposes described in this policy. This allows each Biron entity to comply with applicable laws, regulations and requirements, and ensures that your information is consistent, accurate and up to date. In addition, it increases the quality and relevance of the services you receive, and improves your interactions with Biron through easier access to your information within the group . In addition, we may share aggregated and/or anonymized information to third parties (including government, pharmaceutical companies, physicians, nutritionists, pharmacists, drug manufacturers, and others involved in health care or the medical field).

We do not share your personal information with any person or company outside our group of companies except as set out below:

a. Service Providers

We may share personal information with our service providers. These service providers assist us in providing our services, conducting our business operations, operating our technology systems, applications and infrastructure, and implementing our internal procedures and our advertising and marketing strategy. For example, they provide us with services such as data hosting, email deployment, marketing, sales, and personal information processing or analysis. We may also outsource certain services we provide to our clients to third parties, including laboratories and healthcare professionals.

For example:

• In order to serve our clients, we can use third party laboratories that have expertise in performing certain types of tests.
• Our patient records can be hosted with an Electronic Medical Record (EMR) provider.
• We may use an email service provider to send you our newsletter.
• We may use the chat platform of a service provider to offer you a service allowing you to chat live with a Biron representative.
• We may use a service provider’s telemedicine platform to offer teleconsultation with a healthcare professional.
• We may use third-party online payment platforms to process purchases on our Websites.

By using Biron’s services, you consent to having your personal information transit through the systems of suppliers that allow us to interact with various electronic medical records (EMRs).

b. Sale or Transfer of Our Business or Other Transaction

We may decide to sell or transfer all or part of our business to a third party, merge with another entity, secure our assets or proceed with any other financing or other strategic capital transaction (including insolvency or bankruptcy proceedings), restructuring, share sale or other change in corporate control. You consent to the sharing of your personal information when required for the purposes of such a transaction.

c. Other Permitted Reasons

The law permits or requires the collection, use or disclosure of personal information without consent in limited circumstances (for example, to investigate suspected or actual illegal activity, to prevent such activity, including fraud, or to assist government and law enforcement agencies). These circumstances include those where permitted or required by law and those where it is necessary to do so to protect us, our employees, our customers or others. In such circumstances, we will disclose only as much personal information as is reasonably necessary to fulfill the purposes.

If you use our services and have a health insurance number issued by the Régie d'assurance maladie du Québec (RAMQ), please note that under the Act respecting the sharing of certain health information, Biron may be required to disclose your health information to authorized persons through the Dossier santé Québec. By using our services, you consent to such disclosures.

If you undergo a COVID-19 screening performed by Biron, please note that under the applicable laws of Quebec and Canada (for example, the Quebec Public Health Act and the Quarantine Act of Canada, the emergency orders issued under these laws and ministerial orders related to the COVID-19 pandemic), Biron may be required to disclose your personal information to authorized persons, including the Institut national de santé publique du Québec (INSPQ) and the Public Health Agency of Canada (PHAC), as well as to their authorized representatives and agents.

d. With Your Consent

In addition to the purposes identified above, we may, with your express or implied consent and subject to applicable law, communicate or share your personal information to persons or entities outside our group of companies.

For example:

• With your consent or at your express request, we may share your information with your insurer, employer or treating physician, among others.

d. Outside of Quebec

In order to provide you with the services you have requested, we may have to use service providers located outside Quebec which are under contract with Biron. In such cases, we may need to disclose your personal information to them or entrust them with the task of collecting, using, communicating or storing such information on Biron’s behalf.

If we need to communicate your personal information to a service provider located outside Quebec for purposes other than those for which we collected it, we will need to obtain your consent before doing so.

In all cases, before disclosing personal information to service providers located outside Quebec, we ensure that your personal information will be adequately protected. Such disclosure will only take place if, after analysis, we consider that the provider affords your information adequate protection equivalent to that applicable in Quebec.

By using our services and visiting our Websites, you consent to the collection, use and sharing of your personal information as described in this policy. In some cases, your consent may be “implied”, meaning that your permission is deemed to be given based on your action or inaction at the time of collection, use or sharing of your personal information.

Generally, we will seek your consent when we wish to use your personal information for a new purpose or for a purpose other than those identified in this policy or otherwise at the time of collection, for example, in a specific consent form or in the terms and conditions of a service to which you subscribe.

You may withdraw your consent at any time, except in limited circumstances, including where we are bound by legal or regulatory requirements or where you have contractual obligations to us. You can find more information on how to manage your privacy preferences at How do I change my privacy choices?

If you choose not to provide us with certain personal information or if you withdraw your consent, where it is possible to withdraw consent, we may not be able to provide our services to you.

You have choices about the way Biron handles your personal information. You can always withdraw your consent for your personal information to be used for purposes other than those that are absolutely necessary for the provision of our services, without this having any consequences on the services you receive from Biron.

For example

• You can always refuse to receive advertising communications from Biron.

You have different options to make your choices:

a. Within Your MyBiron Account

If you have a MyBiron account, you can update your communication preferences.

b. When You Register or by Contacting Us Directly

You can always choose not to receive marketing messages from Biron by email by clicking on “unsubscribe” in any email you receive.

Please note that even if you have indicated your choice not to receive commercial messages from us, we may still communicate with you in connection with a service, in accordance with applicable law (for example, to send you a customer service message, important product information, service notification or recall). In addition, it may take up to 10 business days to register a change of preference in all of our records.

c. Changing Your Browser Settings on Your Device

We use technology to enhance your client experience and present you with offers, including personalised advertising. Through technologies such as cookies, our Websites recognize you when you use or return to them, and can provide you with a seamless experience. You can remove or disable some of these technologies at any time through your browser. However, if you do so, you may not be able to use some of the features of our Websites.

Please refer to your browser instructions or help screen to learn how to block, delete and manage cookies on your computer or mobile device. You can also use the quick links below, depending on the type of browser that you are using: Internet Explorer, Google Chrome, Firefox et Safari.

d. Using Third Party Unsubscribe Functionality

We may use the services of third parties (for example, services such as Google Analytics or of social media platforms) that use certain technologies to analyze your browsing behaviour on our Websites. You can manage your privacy preferences with respect to the services of certain third parties, such as Google or Facebook, by using their platform’s unsubscribe feature. Please note that disabling, blocking or removing some of these technologies, such as cookies, may prevent your use of certain features of our Websites.

For example, Google Analytics uses cookies to analyze your browsing behaviour on our Websites. This information, which is transmitted to us in a form that does not identify you, comes from your device or browser settings related to advertisements. If you want to disable Google’s ad settings, go to http://www.google.com/settings/ads or use the Google browser add-on for deactivation, which can be found at https://tools.google.com/dlpage/gaoptout.

The security of your information is important to us and we are committed to protecting your privacy through a variety of organizational, physical and technological safeguards. We retain your personal information for as long as necessary to provide you with our services, to manage our business operation, and to comply with our legal and regulatory obligations.

a. How We Protect Your Personal Information

To protect your personal information, we employ administrative, technical and physical safeguards. Our goal is to prevent unauthorized access, loss, misuse, disclosure or modification of the personal information in our possession. We ensure that access to your personal information is restricted at all times to those Biron employees and agents who are legally required to have access. We also use these safeguards when we dispose of or destroy your personal information.

b. Where We Keep Your Personal Information

We use all reasonable security measures, which may include imposing contractual obligations on our service providers, to protect your personal information wherever it is used or stored.

Unless we are legally required or contractually obliged to keep your personal information in Canada, it may be transferred outside of Canada. For example, some of our service providers may be able to access, process or store your personal information outside of your province or territory, or outside of Canada, for the purposes of the services they provide to us. In this case, personal information is governed by the laws of the jurisdiction where it is used or stored, including any laws authorizing or requiring the sharing of the information to government authorities or agencies, courts and law enforcement authorities in that jurisdiction.

c. How Long We Keep Your Personal Information

We retain your personal information for as long as necessary to provide our services to you, to manage our business and to comply with our legal and regulatory obligations (for example, health care providers have statutory retention obligations with respect to patient records). When we no longer need it, we securely destroy your personal information or anonymize it (so that it can no longer be used to identify you).

Specifically with respect to personal information provided to Biron in connection with COVID 19 travel screening, such as the name of the country of origin or destination, dates of travel, passport or travel document number used, etc. (hereinafter, "COVID travel-related data"): once the test result is communicated to the patient and the disclosures to government authorities mentioned in 4. c) above are completed, the COVID Travel Data becomes inaccessible in an automated fashion through Biron's IT systems; it may become accessible again only if a correction is necessary (for example, in the event of an error in the result report), and then only by persons authorized to amend a laboratory test report and only to make the necessary correction. COVID trip data that has become inaccessible is automatically deleted by Biron's IT systems after a 30-day retention period. ).

We may make changes to this policy from time to time. Any changes we make will be effective when we post the revised policy on this web page. If we make any significant changes to the policy, we will post a notice on our Websites or contact you to inform you when required by law. By continuing to use our services after the modified version of the policy has been posted, you are accepting the changes to the policy, subject to any additional requirements that may apply. If you do not accept the changes to our policy, you must stop using our services. It is your responsibility to ensure that you read, understand and accept the latest version of the policy. The “Effective Date” at the top of this policy indicates when it was last updated.