Privacy Policy

Sampling Technologies Incorporated (STI) believes that the protection of personal privacy is a fundamental value. This is particularly true of sensitive personal health and medical information. STI complies with all Federal and Provincial laws respecting privacy, especially the Personal Information Privacy and Electronic Document Act of Canada (PIPEDA). A basic principle of STI’s privacy policy is that STI does not actively collect personal information about patients and does not use or disclose the personal information of any patient except as permitted by PIPEDA (see Note 1: STI Privacy Code).

STI’s Business

STI provides pharmaceutical sampling solutions that benefit patients, providers and payers. Patients are individuals who receive a free sample of a medication or medical device. Providers are doctors and other health-care professionals, including pharmacists. Payers are the pharmaceutical companies whose medications and medical devices are provided free of charge as samples to patients.

Definitions

STI uses the following definitions in its privacy policy:

Anonymous information is factual or subjective information which cannot reasonably or easily be connected to an identifiable individual. Examples of anonymous information include age or gender when they cannot be associated with any particular individual; prescribing habits of physicians in aggregate; and the location of a pharmacy where a SmartSample was redeemed.

Collect or Collection is the gathering of information, especially personal information.

Consent means that the individual gives permission for STI to collect, retain, use, or disclose personal information. Express consent occurs when individuals explicitly give permission, orally or in writing. Implied consent occurs when individuals can reasonably be thought by their actions (or inaction, in appropriate circumstances) to give permission.

Disclose or Disclosure means sharing information collected or retained by STI with people or organizations outside of STI.

Personal information is factual or subjective information regarding an identifiable individual. Examples include the age, gender, medical records, or address of an identifiable individual. It does not include the age, gender or other information that cannot reasonably be associated with an identifiable individual (see anonymous information, above).

Payer means a pharmaceutical company who makes or distributes a medication or medical device and is involved in a program with STI for the use of SmartSamples.

Patient means a person who receives one or more SmartSamples from a prescriber.

Prescriber means a health care professional or provider who can sign a SmartSample and give it to a patient.

Provider means a health-care professional involved in the distribution or redemption of a SmartSample and includes prescribers.

Retention means storing or holding information whether by physical means such as documents or electronic means such as computer databases or other files.

Use means handling or treating information internally within STI. Examples of use of personal information include using an individual’s address, telephone number, or e-mail address to communicate with him or her; and providing information about an individual’s activities to employees of STI for the purpose of helping that individual to use STI’s products or services.

STI and the personal information of patients

Collection

STI does not actively collect personal information. When a patient presents STI’s SmartSample to a pharmacy, STI makes no effort to collect patient-identifying information. STI merely asks the pharmacist to provide it with the unique card number on the SmartSample and with anonymous information about the birth-date and gender of the patient. In other words, while the birth-date and gender of the patient submitting the SmartSample is collected, STI does not seek any information which would identify the individual patient. If STI inadvertently receives a patient’s personal information, it immediately takes steps to make that information anonymous.

Retention

STI does not retain any patient’s personal information without the express consent of the patient.

Use

Because STI does not retain or actively collect personal information of patients, it can not and does not use such information.

Disclosure

Because STI does not retain or actively collect personal information of patients, it can not and does not disclose such information to any third parties.

Consent

Because STI does not actively collect, or retain, or use personal information, STI does not need to seek any patient’s consent.

NOTE re STI’s adjudicator:

STI, in common with almost all pharmacies and medical insurance plans uses an electronic services provider, called an adjudicator, to process the redemption of SmartSamples. If a pharmacy inadvertently sends the adjudicator personal information for STI, the adjudicator retains the personal information. STI will not ask the adjudicator to reveal that personal information to STI unless STI is required to do so by law or when a medical emergency arises and the information is necessary for the health and safety of individuals. For example, in the case of a medication recall, STI may need to identify which individuals have received that medication. STI will ask its adjudicator only for such personal information as is absolutely necessary for such purposes.

How does STI use the information it collects? STI uses the anonymous information about age and gender together with information about the medication and where and when it was dispensed to provide reports to the pharmaceutical company who provided that free medication or medical device. So, for example, STI might provide a report informing the reader about the average age of people using a particular medication or how many of those people are male or female. But STI never discloses the age or gender of an identifiable person.

STI and the personal information of Prescribers

The information that STI collects through the redemption of SmartSamples does not include any personal information of prescribers. No prescriber’s name, address, or any other personal information is submitted to STI through the pharmaceutical adjudication process described above.

STI and anonymous information

STI uses anonymous information it has collected for its own internal analyses of the distribution and use of medical samples.

STI also prepares reports to disclose to third parties, including government, pharmaceutical companies, and others involved in health care. Those reports are based on anonymous information, usually in aggregate form, and do not disclose any personal information. For example, STI may provide to its pharmaceutical and other clients reports about the timing and geographic distribution of the redemption of SmartSamples at pharmacies. Those reports may also include information about the gender and age range of patients redeeming SmartSamples. Because it is not possible to associate the age range or gender with any particular individual, such information is anonymous, not personal, information. For example, it may be reported that a SmartSample for medication X was redeemed at a particular pharmacy on a particular date by some unknown person who is male and is in the age range 10-20. STI may also provide reports which show how many samples were redeemed in a certain geographic area, defined by postal forward sorting areas (the first three characters of a postal code), by one or more patients with a particular birth-date and gender. Because such information does not reveal any patient’s name or place of residence or other identifying information, such information is anonymous.

Web site privacy policy

STI does not collect personal information about visitors to its web sites without their express consent. If you provide personal information in an e-mail STI to ask a question or make a comment, STI will provide that personal information only to STI employees who are involved in answering your question or processing your comment and need to know that information for those purposes. To the extent possible, the individual to whom your e-mail is assigned will try to obtain an answer or process your comment in a way which does not reveal your personal information to other STI employees. The personal information you provide will not be disclosed to third parties unless STI has obtained your express consent or STI is required by law to reveal it. (STI might be required to reveal if ordered to do so by a court, for example, or in response to a valid subpoena or warrant.)

STI PRIVACY CODE

STI’s compliance with the 10 Privacy Principles of PIPEDA and CSA Q830-96

Principle 1. Accountability

An organization is responsible for personal information under its control and shall designate an individual or individuals who are accountable for the organization's compliance with the following principles.

1.1 STI has designated a Privacy Officer who is charged with overseeing STI’s compliance with the principles of the Model Code for the Protection of Personal Information. STI’s Privacy Officer has the full support of the senior management of STI and has the authority to intervene on privacy issues at STI. The Privacy Officer may delegate other individuals within STI to act on behalf of the Privacy Officer.

1.2 The name of STI Privacy Officer is available on request by phoning 902.450.5500 or by sending an e-mail to privacy@samplingtechnologies.com.

1.3 STI enters into contractual arrangements with other organizations who provide processing of personal information on STI’s behalf to ensure a level of protection required by PIPEDA and the CSA Model Code for the Protection of Personal Information.

1.4

a) STI implements procedures to protect personal information (see Principle 7, below) ;

b) STI implements procedures to receive and respond to complaints and inquiries (see Principles 8, 9, and 10, below);

c) STI trains its staff about STI’s privacy policies and practices

d) STI has prepared this document and other material to explain STI’s policies and procedures for protecting personal information.

Principle 2. Identifying purposes

The purposes for which personal information is collected shall be identified by the organization at or before the time the information is collected.

2.1 STI documents the purposes for which personal information collected in three places:

(a) in this document;

(b) in the STI Privacy Policy available on STI’s website and by contacting STI’s Privacy Officer as explained in 1.2, above;

(c) on written documents provided to individuals at or before the time personal information is collected from those individuals.

2.2 Consistent with the Limiting Collection Principle, STI collects only the personal information that is necessary for the purposes STI has identified and documented (See Limiting Collection, Principle 4.)

2.3 STI identifies the purpose for the collection of personal information at the time of collection either orally or in writing.

2.4 If STI decides to use personal information it has collected for a use different than that which was identified at the time of collection, it will document that new use in the places described in 2.1. (See also description at Consent Principle, Principle 3, below.)

2.5 All STI personnel who collect personal information have been informed of the reasons why that personal information is being collected and are trained to explain it to the individuals from whom it is being collected.

2.6 See related information at Limiting Collection (Principle 4) and Consent (Principle 3).

Principle 3. Consent

The knowledge and consent of the individual are required for the collection, use, or disclosure of personal information, except where inappropriate. (See Note 1)

3.1 STI collects, uses, or discloses personal information only with the consent of the individual. Usually STI will seek that consent at or before the time of collection, but may seek consent later if STI intends to use that personal information for a new purpose. STI will seek consent for that new purpose at or before the time of the new use.

3.2 STI tries to use plain language that clearly expresses the intended purpose for which personal information will be used before seeking the individual’s consent.

3.3 Sometimes STI requires an individual to consent to the collection of some personal information for the purpose of providing that individual with a product or service. When STI seeks such consent, STI will not require the individual to consent to collecting any more information or for any other purpose than is connected with providing that product or service.

3.4 STI recognizes that medical information is sensitive personal information and takes the sensitivity of information into account when designing written consent forms or oral consent communications.

3.5 STI takes into account the use and disclosure that people would reasonably expect when consenting to providing their personal information to STI. If an individual requests that we send information to him or her, for example, STI assumes that any address or contact information would be used to reply to that request and that the information may also be used to follow-up about a request or complaint. STI does not assume, however, that the individual would expect to receive other communications from STI not related to the original request. STI does not obtain consent through deception.

3.6 STI tries to obtain express consent for the collection, use, or disclosure of personal information whenever possible.

3.7 STI obtains consent to the collection, use, or disclosure of personal information in a number of ways:

a) orally, when personal information is obtained by telephone or, in some circumstances, in face-to-face conversation;

b) in writing by signed consent form setting out the purpose for collecting the personal information

c) by action, as, for example, by continuing to use STI’s web site in certain ways after having been informed that continued use is taken by STI as consenting to the collection of certain personal information as clearly stated on the web site.

3.8 People who have consented to the collection of personal information by STI for a particular purpose may withdraw their consent at any time. Such withdrawal must be explicitly made and in accordance with any contractual restrictions they may have voluntarily accepted at the time they originally consented. STI will always make clear the implications of withdrawing consent.

Principle 4. Limiting collection

The collection of personal information shall be limited to that which is necessary for the purposes identified by the organization. Information shall be collected by fair and lawful means.

4.1 STI collects only the kind and amount of personal information necessary to carry out the purposes identified at the time of consent and collection. STI’s Privacy Policy and other privacy documents specify the type of information STI collects. This Privacy Code and other STI documents, as appropriate, specify STI’s information-handling policies and practices in fulfillment of the Openness principle (Principle 8).

4.2 Because STI believes that personal information should be collected by fair and lawful means, STI tries to use plain language to describe the purposes for which personal information is collected, used, or disclosed and tries to use consent forms that clearly express what the individual is consenting to. STI does not obtain consent for the collection, use, or disclosure of personal information by deceit.

Principle 5. Limiting use, disclosure, and retention

Personal information shall not be used or disclosed for purposes other than those for which it was collected, except with the consent of the individual or as required by law. Personal information shall be retained only as long as necessary for the fulfillment of those purposes.

5.1 STI always documents any new purpose for which personal information is collected (see Principle 2.1).

5.2 STI has developed, and will continue to develop, guidelines and procedures respecting the retention of personal information, including minimum and maximum retention periods. These guidelines are available on request in accordance with the Openness Principle (Principle 8).

5.3 When personal information is no longer needed for the purpose(s) identified, STI will destroy or erase it, as appropriate, or will render the information anonymous. STI continually develops and reviews its guidelines and procedures governing the destruction of personal information or of making it anonymous.

Principle 6. Accuracy

Personal information shall be as accurate, complete, and up-to-date as is necessary for the purposes for which it is to be used.

6.1 STI strives to ensure that the personal information it collects is as accurate, complete, and up-to-date as possible consistent with interests of the individual.

6.2 STI does not routinely update personal information except such information as is required for the purposes for which it was collected.

6.3 STI does, however, try to make sure that personal information used on an ongoing basis is kept up-to-date. For example, STI tries to keep contact information up to date for those individuals who wish to receive regular communications from STI.

Principle 7. Safeguards

Personal information shall be protected by security safeguards appropriate to the sensitivity of the information.

7.1 STI protects personal information against loss or theft, and against unauthorized access, disclosure, copying, use, or modifications through it s established security safeguards no matter what format the information is in.

7.2 The nature of the safeguards STI uses varies depending on the sensitivity and format of the personal information and depending on what format the information is in and on how the information is distributed. More sensitive information is protected more carefully.

7.3 STI uses different measures of protections to fit the circumstances:

a) Physical security such as locked file cabinets and restricted access areas for information held in physical form such as documents;

b) Established policies relating to access to information on a “need-to-know” basis;

c) Technological and physical security for information kept in electronic format, including physical restricted access to computers holding personal information as well as passwords and encryption.

7.4 STI trains its employees and contractors in the importance of maintaining the confidentiality of personal information.

7.5 STI uses measures such as shredding of documents and wiping of computer discs which contained personal information when the time comes to dispose or destroy personal information. (See Principle 5.3)

Principle 8. Openness

An organization shall make readily available to individuals specific information about its policies and practices relating to the management of personal information.

8.1 STI is committed to the principle of openness respecting its policies and practices relating to personal information. The methods by which an individual can get information about STI’s policies and practices are described on its website, in its Privacy Policy, and at the end of this document.

8.2 The information about STI’s policies and practices includes

a) contact information for STI’s Privacy Officer who is in charge of STI’s policies and practices and to whom complaints or inquiries can be forwarded: C. L. Kit Rigg (privacy@samplingtechnologies.com, or in writing to 1600 Bedford Highway, Suite 212, Bedford, NS B4A 1E8, or by phone: 902.450.5500);

b) how to gain access to personal information: by contacting the Privacy Officer;

c) a description of the type of personal information held by STI, including a general account of its use: generally, in the STI Privacy Policy;

d) copies of STI’s Privacy Policy, this Privacy Code, or any other brochures or information explaining STI’s policies, standards, and codes relating to personal information: obtain from the Privacy Officer;

e) a description of what personal information is made available to related organizations: obtain from the Privacy Officer.

8.3 STI makes information about its policies and practices relating to personal information available through its web-site (www.samplingtechnologies.com/privacy), by e-mail, by regular mail, and by phone, depending on the circumstances. Individuals may also get such information at STI’s office.

Principle 9. Individual access

Upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate. (See Note 2.)

9.1 Upon request, STI will inform an individual whether STI holds any personal information about the individual and, to the extent possible, the source of that information. STI will allow the individual to have access to their personal information, but, in certain circumstances may choose to do that through an appropriate medical practitioner. STI will also let the individual know what use has been or is being made of their personal information and to which third parties, if any, it has been disclosed.

9.2 When an individual wants an account of the existence, use, and disclosure of the individual’s personal information, STI may require the individual to provide information to enable it to respond to the request. Any information so provided will only be used for that purpose.

9.3 STI will endeavor to be as specific as possible about the third parties to whom it has disclosed an individual’s personal information. When STI cannot be specific, it will provide a list of third parties to which it may have disclosed that personal information.

9.4 STI will respond to an individual’s request as quickly as reasonably possible and at no, or as minimal as possible, expense. The information requested will be provided in a way which is generally understandable.

9.5 When an individual demonstrates the inaccuracy or incompleteness of personal information retained by STI, STI will amend the information by correcting, deleting or adding to the information where appropriate. STI will also, where appropriate, transmit the amended personal information to those third parties, if any, who have access to that information.

Principle 10. Challenging compliance

An individual shall be able to address a challenge concerning compliance with the above principles to the designated individual or individuals accountable for the organization's compliance.

10.1 STI’s Privacy Officer is accountable for STI’s compliance with PIPEDA and the Model Code for the Protection of Personal Information.

10.2 STI has developed a procedure to receive and respond to complaints or inquiries about STI’s policies and practices relating to the handling of personal information. Information about the procedure is contained in STI’s Privacy Policy or may be obtained from the Privacy Officer.

10.3 STI will investigate all complaints and take appropriate steps should the complaint be found to be justified.

NOTES

These notes form part of the Model Code for the Protection of Personal Information, CAN/CSA-Q830-96

Note 1 - respecting Consent, Principle 3.

In certain circumstances personal information can be collected, used, or disclosed without the knowledge and consent of the individual. For example, legal, medical, or security reasons may make it impossible or impractical to seek consent. When information is being collected for the detection and prevention of fraud or for law enforcement, seeking the consent of the individual might defeat the purpose of collecting the information. Seeking consent may be impossible or inappropriate when the individual is a minor, seriously ill, or mentally incapacitated. In addition, organizations that do not have a direct relationship with the individual may not always be able to seek consent. For example, seeking consent may be impractical for a charity or a direct-marketing firm that wishes to acquire a mailing list from another organization. In such cases, the organization providing the list would be expected to obtain consent before disclosing personal information.

Note 2 – respecting Individual Access, Principle 9.

Sampling Technologies Incorporated contact information:

Privacy Officer:

C. L. Kit Rigg

e-mail: privacy@samplingtechnologies.com

phone: 902.450.5500

Place of business and mailing address:

Sampling Technologies Incorporated 267 Cobequid Dr, Lower Sackville, NS B4C 4E6

Website:

www.samplingtechnologies.com