Maple Corporation Privacy Policy

Policy

Maple Corporation (“Maple”, “we”, “us”) last updated this Privacy Policy (“Policy”) on September 23, 2021. We post the current version of the Policy at www.getmaple.ca/privacy. We reserve the right to amend the Policy at any time to account for changes in Applicable Law, our practices and the Maple Platform. Please check to see if we have amended the Policy since you last used the Maple Platform to ensure you are aware of (and agree to) our current privacy practices.

Definitions

The following provides the meaning of certain terms used in this Policy. If not defined below, the capitalized words and phrases in this Policy have the same meaning as in Maple’s Terms of Use. “Maple Platform” means collectively the hardware, software, applications, websites, Content, products and services owned and/or operated by us to enable the provision of remote Healthcare Services to Users, among other purposes. “Information” means collectively “Personal Information” (information about an identifiable User as further defined in Applicable Law) and “Personal Health Information” or “PHI” (information about a User’s health or healthcare as further defined in Applicable Law). A “User” is an individual registered to use the Maple Platform, including unless otherwise specified, as part of a customized program provided by a third party. A “PCH User” is a User also registered to use Loblaw’s PC Health application. Unless we make a distinction, “Users” means all Users. Health professionals (“Authorized Providers”) are collectively, “Authorized Physicians” (physicians registered to practice medicine in a province or territory of Canada) and “Authorized Non-Physician Providers” (regulated health professionals other than physicians registered to practice in a province or territory of Canada) registered to use the Maple Platform to provide “Healthcare Services” (services in the Authorized Provider’s scope of practice). Authorized Providers provide Healthcare Services in a “Consultation” which includes a review by an Authorized Provider to determine if the requested Healthcare Services are able to be provided on the Maple Platform. “Applicable Law” in relation to Maple, Authorized Providers or Users, means the laws and regulations including privacy laws and regulations to which each is subject. “Content” means general information about health related topics posted on the Maple Platform, access to which is not the delivery of healthcare services (including diagnosis, care or treatment), does not replace and cannot be relied upon as healthcare services.

Agreement with Maple

If you are an Authorized Provider, your arrangement with Maple – your rights and obligations and those of Maple - is set out in the agreement between you and Maple or, if you are providing Healthcare Services on behalf of a third party organization that has contracted with Maple, in the agreement between you and the third party organization with which you are associated. If you are a User, the arrangement between you and Maple – your rights and obligations and those of Maple – is set out in Terms of Use and where applicable, supplementary Terms. The Terms of Use for PCH Users may differ from those for other Users to take into account supplementary Terms for use of the PC Health application.

Application of this Policy

This Policy describes Maple’s management of Information, including the purposes for which we collect, use and disclose Information and the safeguards we use to protect Information. This Policy does not apply to the collection, use, retention, disposal, destruction, and protection of Information by Authorized Providers through the Maple Platform, which is part of the Authorized Provider’s records. The Maple Platform is a tool used by Authorized Providers that does not alter their obligations or responsibility for Information they collect. Authorized Providers are subject to privacy legislation and professional requirements that govern their record keeping and management of Information, regardless of the tools they use to collect, use, disclose and hold the Information. Please direct any questions you have about how an Authorized Provider will treat your Information to the Authorized Provider.

Overview of the Maple Platform

As mentioned, Authorized Providers are responsible for their collection, use, disclosure, retention, destruction and protection of Information. The following is an overview of how the Maple Platform functions and may not apply to any particular Authorized Provider or particular Consultation.

• Healthcare Services. Authorized Providers collect Information about you (or any Registered Dependent, as defined below), that you provide during a Consultation, verbally or in texts, including Information that you enter or upload to the Maple Platform. Authorized Providers have access to Information through the Maple Platform that includes: the details that you provide in your consultation request; information you’ve entered or uploaded to profiles and medical records; information created during earlier interactions through the Maple Platform with other Authorized Providers; the name, email address, phone number, gender, date of birth and province/territory that you provided when you registered; and your emergency contact’s name and contact information. Authorized Providers use Information to provide you with Healthcare Services and, as noted above, must comply with the privacy legislation and medical record-keeping obligations to which they are subject. Authorized Providers may create Information in the Maple Platform, such as prescriptions, sick notes and notes about your Consultation. They may export or print copies of your Information. Authorized Providers may, but are not required to, email or text your emergency contact if they believe that you are presenting with a healthcare emergency. You are responsible for advising your emergency contact that you are providing his or her name and contact information to Maple and Authorized Providers, and for obtaining any necessary consent from your contact for the provision and use of that information in connection with the Maple Platform.
• Other Services. Maple provides services that support the provision of Healthcare Services, which may include receiving, reviewing and scanning or otherwise uploading laboratory test results to the Maple Platform, faxing prescriptions to pharmacies, and obtaining referrals for consultations with certain specialists, collecting information (such as that in referral letters and health card numbers) required for scheduled appointments. Maple provides some of these services to Authorized Providers (for example, the receipt and preliminary review of laboratory results), or Users (for example faxing prescriptions and arranging referral to specialists). These services require the use of Information.
• Maple may expand the services available through the Maple Platform from time to time to include services that are healthcare related but not Healthcare Services (such as navigational services to assist you to access Healthcare Services on the Maple Platform). Unless otherwise advised, Maple Personnel will deliver these services. Maple Personnel receive privacy and security training and commit to complying with Maple’s obligations in connection with Information to the extent applicable to their role, as more particularly described below in the section on Safeguarding Information.

Maple’s collection and use of Information

Maple collects and uses Information to the extent necessary to develop, evaluate, improve and provide the Maple Platform and related services. We do not collect or use Information if non-identifying information will suffice. We do not record the audio or video portions of Consultations. More specifically:

• Collection. We collect and use your Information to register you, create your User account (“Account”), authenticate you when you log in, and personalize your experience while using the Maple Platform. We use the place of residence and date of birth that you provide when registering for an Account to confirm your eligibility to use the Maple Platform.
• When required for access to services insured by provincial health plans, we collect your provincial health number on behalf of the Authorized Provider providing the insured services to you and use and disclose the number to bill provincial health plans for insured services.
• If you are legally authorized to make healthcare decisions for an individual (a child or a parent for example), you may create a profile for them by providing their first and last name, gender and date of birth (each such person a "Registered Dependent"). We use the date of birth and your assertion of their relationship with you to confirm your eligibility to obtain Healthcare Services for Registered Dependents and their eligibility to receive Healthcare Services.
• Use for Storage. If you choose to enter, upload and store your Information or that of Registered Dependents in the Maple Platform, such as medical records or the name and contact information for an emergency contact, we will use Information as required maintain it on the Maple Platform.
• Use for Services, Operation and Development of Maple Platform. We use Information that you upload, or which an Authorized Provider creates as part of a Consultation to make it available to you when you access your Account.
• We use Information to provide you with services that you request us to perform on your behalf, such as securely faxing your prescription to your chosen pharmacy.
• We use Information to notify you by text or email about services that you request, such as to notify you about the status of a Consultation or prescription order.
• We use Information to the extent required to operate, deliver and support the Maple Platform.
• We may use Information for loss prevention, anti-fraud purposes, and to comply with regulatory and legal requirements.
• We may use Information to help us create, develop, evaluate, and improve the Maple Platform and Content.
• Use to Determine Eligibility for Healthcare Services, Authentication. In connection with a request for Healthcare Services, you may provide the reason for your request (symptoms, prescription renewal or sick note). We pass along the Information you provide, your age and gender (and for certain Consultations including those booked rather than provided on demand your name) to an Authorized Provider to determine whether your request is for Healthcare Services that an Authorized Provider may deliver remotely through the Maple Platform. If the Authorized Provider confirms that your request is eligible, we identify the Authorized Provider to you and forward the Authorized Provider the Information you provided in your request, your name and where applicable, the name of your Registered Dependent. Unless you have elected to withhold access to information held in the Maple Platform about you (or your Registered Dependent), the Authorized Provider will be able to view the Information in addition to the Consultation specific Information we forward.
• We may collect and use location data through GPS technology and your IP address where applicable to services you have requested, for example to ensure that we connect you to an Authorized Provider or pharmacy that is licensed or authorized to provide services in the jurisdiction where you are located.
• We use your IP address for security purposes, to authenticate you before providing information about your Account activity in your Account settings.
• Medical emergencies. If you submit Information in connection with a request for Consultation that in the view of the reviewing Authorized Provider indicates that you are in need of emergency services, Maple reserves the right to use any of the contact information you have provided to contact you. The contact will be strictly to inform you that an Authorized Provider has viewed and declined your request for a Consultation because your symptoms suggest a healthcare emergency.
• Essential and Non-Essential Communications. From time to time, we may send Users service announcements, including information about our latest products, updates to our policies, Terms of Use and software (“Essential Communications”). We may send Users who opt-in to receive the information, information such as newsletters, or information about any upcoming events that we believe may be of interest or apply to them (“Non-Essential Communications”). Users may opt-out of receiving Non-Essential Communications at any time by logging into their User Account and updating their preferences. For clarity, service announcements including updates to our policies, Terms of Use and software are Essential Communications not subject to an opt-out.

Third party service providers

Maple uses third-party software and service providers for a variety of services including but not limited to technical, operational and other business, and marketing services. For example, our live User support chat (Users may get troubleshooting and related technical assistance but not Healthcare Services through the chat function) is provided through a third party service provider. We require our third party service providers to limit their use of Information (that you or we provide or allow them to access) to that necessary for their services, and to have security measures in place that are appropriate for the protection of Information. Some of our service providers operate from outside of Canada, which means that Information they use on our behalf for their services may be subject to the law of country or state in which they operate (“Country”) including lawful orders to produce the Information to among others, the government of the Country, its law enforcement and other agencies including where applicable national security authorities, and courts.

For additional details about Maple's third party service providers, please see https://www.getmaple.ca/subprocessors/.

Third party payers

As described in the Maple Platform Terms of Use, by authorizing someone else (a “Third Party Payer”) to pay the Fees and/or Membership Fees for your Healthcare Services, you are representing to Maple, and Maple will rely on your representation, that you consent to Maple:

1. using the email address provided to us by the Third Party Payer to communicate with you regarding the Maple Platform and Healthcare Services;
2. disclosing the information that you have requested Healthcare Services to the Third Party Payer to permit Maple to process payment for the Healthcare Services; and
3. notifying the Third Party Payer of any changes or termination of your access to the Maple Platform.

If you have questions about the Information shared between us and Third Party Payers, please contact us as indicated below.

Maple’s disclosure of Information

Emergency contacts, on consent. We disclose Information to emergency contacts as described above and for purposes for which we have User consent, including consent to disclose Information to an insurer or other Third Party Payer.

Compliance, Fraud Prevention. We disclose Information to the extent we, in our good faith judgment, are required to do so to comply with Applicable Law including to respond to a subpoena, order, or similar obligation to produce information, establish or exercise Maple’s legal rights including defend against legal claims, detect, investigate, suppress, prevent or take action regarding illegal or prohibited activities, including without limitation suspected fraud and threats to the reputation or safety of any person.

Business transactions. We may disclose Information for the purposes of conducting required due diligence or the completion of a business transaction such as a merger, acquisition or asset sale. We will comply with any applicable legal requirements, including agreements and notice requirements that apply to the disclosure of Information for such transactions.

Maple’s retention/deletion of Information

Unless we notify you otherwise, we will retain your Information on the Maple Platform until you (or Maple) close your Account. On termination, Maple will provide you an opportunity to print or copy your Information with the exception of notes of Authorized Providers. To allow Authorized Providers to exercise any right they have at law to withhold Information they create, only Authorized Providers may provide access to their notes on the Maple Platform, and any request for access should be made directly to them.

After the grace period provided for you to print or copy your Information (with the limitation described above), we will delete the Information associated with your Account, except for any Information that Maple is required to retain under Applicable Law or Information required by an Authorized Provider in connection with Healthcare Services. Maple will delete the latter once the Authorized Provider makes a copy or terminates his or her account with Maple. When Information is deleted, it is removed from our active database. Any Information that remains in our backup is securely stored and isolated from any further processing until deletion is possible.

Accessing and correcting Information

You can access your Information or that of Registered Dependents by logging in to your Account at https://app.getmaple.ca/login.

You may update or otherwise correct your Information, except Information an Authorized Provider has viewed or created. To update or correct Information an Authorized Provider has viewed, or request a correction of Information an Authorized Provider created, you will need to contact the Authorized Provider outside of the Maple Platform.

Privacy Settings

The Maple Platform offers you functionality and choices for protecting your privacy, which include:

• You may enable two-factor authentication on your Account to help prevent unauthorized access. If you do, in addition to entering your password to log in to your Account, we will send a code to your mobile number, which you will need to enter. This added security means that a third party would need both your login information and your mobile phone to access your Account.
• You have the option of using audio, chat, or video for Consultations.
• When requesting a Consultation, you may withhold Information, for example in your healthcare records from the Authorized Provider. Please be aware that Authorized Providers may be unable to provide you with Healthcare Services as a result. They will advise you of the implications of your choice.
• You may choose whether to receive communications by email or SMS.
• You can check your login history when you access the Maple Platform.

Please contact us directly at [email protected] if you require assistance using the privacy functionality described above or more generally have questions about how to use the Maple Platform. To protect your privacy, we may request information to verify your identity when you contact us.

Safeguarding Information

We only permit Maple personnel (“Personnel” which includes our employees, contractors and subcontractors) to access Information to the extent necessary to perform their designated functions. We require Personnel to complete privacy and security training and to commit to protecting Information by complying with our policies, procedures and Applicable Law.

We store your information in electronic format within Canada, using computer systems with restricted access and housed in facilities using physical security measures.

More generally, we have in place appropriate physical, technological, and organizational safeguards including access controls to protect Information against loss, theft, and unauthorized access, use and disclosure. Notwithstanding the safeguards we employ and our commitment to protecting Information, we cannot guarantee the security or error-free transmission or storage of Information. There are risks inherent in the use of electronic means to transmit and hold information in electronic format. These risks can be minimized but not eliminated by the use of appropriate security measures, such as the measures Maple employs. These risks include interception, loss, corruption, unauthorized access to, use and disclosure of Information, and delay in the availability of Information.

You play an important role in protecting your privacy and your Information and for that purpose, we ask you to do the following.

• Create a strong and unique password for your Account using Maple’s password strength estimator and update your password periodically.
• Do not share your Account or password with anyone. We will never ask you for your password, including in any unsolicited communication such as letters, phone calls or email messages, so please do not provide it and contact us if you receive such a request.
• Log out of your Account as soon as you finish using it, especially if you share the device you use to access the Maple Platform with anyone else.
• Password-protect your device with a strong and unique password.
• Choose a quiet, private location from which to receive Healthcare Services.

Maple’s use of de-identified Data

Maple obtains the authorization of Authorized Providers to collect from them and use data created by de-identifying Information so that it no longer identifies a User (“Data”). Maple may use Data for monitoring the compliance of Users and Authorized Providers with the Maple Platform terms of use, for making use of the Maple Platform (and more generally of patient-initiated telehealth services) more accessible and enhancing the experience for Users and Authorized Providers through analyzing Authorized Provider usage and utilization patterns, and designing surveys (to be posted and completed at the discretion of Users). We may also use or disclose Data for the purposes of academic research. We will not use Data to re-identify Users or for any other purpose prohibited by Applicable Law. We will only de-identify Information in a manner that complies with Applicable Law.

Cookies and similar technologies

The Maple Platform, email messages, and marketing materials use “cookies” and other technologies such as pixel tags and web beacons. We use these technologies to better understand the use of the Maple Platform, analyze trends, and administer, personalize and improve the experience of using the Maple Platform for Users and Authorized Providers. For more information about our use of cookies and your ability to accept or decline our use of cookies, please refer to our Cookie Policy, posted at https://www.getmaple.ca/cookie-policy/.

Maple uses cookies including third party cookies to obtain information about the use of the Maple Platform. Detailed information about our use of cookies is in our Cookies Policy, available at https://www.getmaple.ca/cookie-policy/.

Links to third party websites

The Maple Platform may contain links to websites that we do not own or operate. The provision of these links is not an endorsement of or referral to the linked websites. We provide the links solely for your convenience. We strongly encourage you to review the privacy policies and terms of use applicable to any site you visit. This Policy does not apply to linked sites or pages and we are not responsible for the content or privacy practices applicable to them or used by their operators.

Contact Us

If you have any questions, concerns or suggestions about our privacy practices, please contact our Chief Compliance Officer. Please include your name and contact information if you would like us to respond to you.

Maple Corporation
ATTN: Roxana Zaman - Chief Compliance Officer
[email protected]
(888)-886-4724
201-225 Richmond St W
Toronto, ON M5V 1W2