STI Technologies Limited Privacy Policy

STI Technologies Limited is a healthcare technology company that manages patient benefit programs, patient support programs, and related activities. We improve access to medications by leveraging available reimbursement funding and innovative technology to engage patients in their own healthcare. STI offers free prescription savings cards and other program services for the users of pharmaceutical drugs. These programs are funded by participating pharmaceutical manufacturers.

STI respects your concerns about privacy and takes the protection of personal information very seriously. Personal information is any information that identifies you or by which your identity may be deduced, and includes sensitive information like personal health information or financial information. We comply with all Canadian federal and provincial privacy laws, and are responsible for the personal information we collect and hold. Our representatives have been trained about our privacy policies and practices. Unless compelled to do so by law or we sell off any part of STl's business operations, STI will never sell your personal information. Similarly, unless compelled or permitted by law, we will never use your personal information for purposes not described in this policy. In this policy, we will refer to your personal information simply as “information”.

IF YOU ARE A PATIENT:

WHAT PERSONAL INFORMATION MAY BE COLLECTED?

The personal information we collect from or about patients will include some or all of the following, depending on which of STI’s services you are using:

Patient name
Mailing address
Date of birth
Email address
Telephone number (home and/or cell)
Prescription drug(s) used
Health care professional’s name and contact information
Pharmacy at which the drug is dispensed
Drug insurer information or benefit carrier information (if applicable)
Detailed transaction information about your individual prescription transactions at pharmacies
Spousal insurance information
Income and information about dependents
Medical history
Advocate information (an advocate is a person you have authorized to act on your behalf)

HOW DO WE USE YOUR INFORMATION?

We will use your information to manage your use of any STI services or of any manufacturer programs which we administer. We will also use your information in order to monitor and improve our existing services, and to develop new services. It is possible that we may use any of the above information through certain technologies in order to make automated decisions about your eligibility for certain programs and services, and for the automated processing of claims you submit in connection with those programs and services.

We may also use your information to conduct research and to develop statistics about our services, manufacturer programs, and the healthcare sector. Though we may disclose or sell those research and statistics to third parties, any information which can identify individual patients will first be completely removed.

Here are some additional details about STI’s different types of services, and about how we may collect information about you and use that information in connection with those services:

PATIENT BENEFIT PROGRAMS

Patient benefit programs provide the same benefits to all patients regardless of their individual circumstances. Typically, no patient information is required in order for a patient to receive their benefit. In some instances, an activation step may be required in order to turn the benefit on, or minimal patient information and consent may be collected in order to communicate with the patient moving forward. In connection with these programs, your information is typically collected in three ways: when you enroll in the program using our online patient portal or in pharmacy, when the pharmacy submits benefits claims about your individual prescription transactions through our online pharmacy portal, or when you submit benefits claims manually by mail, fax, or email.

PATIENT SUPPORT PROGRAMS

Patient Support Programs (PSPs) are programs that require additional patient information and consent in order to enroll the patient in the program and to assign a financial benefit to that individual patient. These solutions often allow customized financial support for each patient. The information which must be collected as part of these PSPs varies by manufacturer.

If you enroll in a PSP, you will be required to accept that program’s Terms and Conditions, which are set by the manufacturer, as well as STI's privacy policy. These programs may involve communications between patients and case workers or nurses at STI, the manufacturer, or their contracted service partners. Those communications, and the collection of information from you during those communications, can take place by phone, SMS, or email. Any information provided to STI or its case workers for the PSP will be stored in STI's secure Patient Management Platform, or within the secure environments of our supporting service providers, and will be used to provide you the program services. As well, when you participate in a PSP, we will collect information about your individual benefits claims when the pharmacy submits benefits claims about your individual prescription transactions through our online pharmacy portal, or when you submit benefits claims manually by mail, fax, email, or phone.

INNOVICARES® PROGRAM

STI offers a unique program called innoviCares. innoviCares acts like a patient benefit program and allows patients to receive financial support for multiple brands under one card or program. The innoviCares program does not require enrolment or registration in order to gain access to its financial benefit; however, innoviCares offers added program services and communications that can be made available to the patient if the patient chooses to register their innoviCares card. Only once you provide your express consent through your optional registration in innoviCares will we collect and use your information in connection with the program and as detailed above. Your enrolment in innoviCares, and your sharing of information with us in relation to your enrolment, is done through our online patient portal.

INFORMATION FROM PHARMACIES

The claim information that pharmacies provide STI is submitted to us in accordance with the standard rules of electronic claims transmission defined by the Canadian Pharmacists Association (CPhA). This is the same information provided to Canadian insurers and other benefits carriers. Claim information is used by STI to determine eligibility for coverage, and to verify, assess, pay, and audit claims. Once used for those purposes, we anonymize this information before we save it or use it further. This means that the information ceases to be personal information because it cannot be used to identify you.

IF YOU ARE A HEALTHCARE PROFESSIONAL:

Healthcare professionals include doctors and other prescribers, as well as pharmacists, nurses, and other members of the patient’s care team who interact with STI in connection with patient participation in benefits programs, PSPs, or innoviCares.

STI or its clients may distribute prescription savings cards and program materials to prescribers and pharmacists, which prescribers and pharmacists may in turn provide to their patients. STI may collect, from its own representatives or from its clients, information about the prescribers and pharmacists to whom cards were distributed. In turn, STI may use, analyze, and disclose that information, alone or in connection with information obtained by STI through the submission of claims under those cards, in order to help STI, our clients, and potential clients:

Administer and coordinate their benefits programs and PSPs
Assess and improve their current or future benefits programs and PSPs
Identify and understand prescriber interests and preferences with respect to current or future benefits programs and PSPs

In the Province of Quebec, where express consent is required from prescribers and pharmacists in order to disclose information about their engagement with cards and card programs to third parties, we will not provide our clients or potential clients with any such information without the prescriber’s or pharmacist’s consent. We may, however, produce general analytics and statistics for our current or potential clients using that data, provided we first remove any information that can be used to identify the prescribers or pharmacists.

If you are a prescriber or pharmacist that has a direct relationship with a manufacturer, they may ask us to assist them in the processing or analyses which they are legally permitted to perform using information they have collected from or about you in connection with that relationship, in which case we will perform that processing or analyses strictly for that specific client, and we will not use that information for any other purpose.

CUSTOMER SERVICE

If you are a patient or pharmacist and have a general question or require assistance in submitting a claim, we have a customer service team that you can contact for that purpose. If you contact our customer service team, we will ask you for information required only to answer your question or concern. This information may include your name, phone number and/or email address. We will retain this information to personalize your experience with us and better assist you the next time you contact us.

INFORMATION ABOUT EMPLOYEES, EMPLOYMENT CANDIDATES, AND OTHER PERSONNEL

For the purposes of this privacy policy, “Personnel” includes, but is not limited to, any employee (permanent or temporary), director, officer, contractor, worker, temporary worker, job applicant, or retiree of STI, and any and all of their respective dependents.

We will collect, process, store, and use information about Personnel in order to carry out and support our human resources functions and activities, including but not limited to (i) evaluation of qualifications for an employment position; (ii) provision of employment benefits; (iii) administration and management of employees, compensation, stock options, grants and purchase plans, bonuses, retirement, training, and career planning; (iv) utilizing employee skills and ongoing employee resource allocation; (v) communicating with employees or their emergency contacts; (vi) administration of the company's business including budgeting, manpower planning, and organizational design; (vii) authentication of the individual's identity when gaining access to computer system applications; (viii) information data changes; (ix) employment status changes; (x) travel and expense planning and reimbursement; (xi) evaluation of employee performance and time management; and (xii) management of Personnel performance, including implementation, investigation, and reporting on compliance and discipline procedures and matters. In addition, for job applicants, their information will be used for the evaluation of suitability of the applicant for a position, or to assess and contact them in connection with future positions. We may use automated decision-making processes in connection with these evaluations and assessments, including for pre-screening of applicants. STI may, at its discretion and with the consent of the candidate where required by law or otherwise obtained, perform such background checks as deemed appropriate to evaluate this suitability. Further information concerning how STI collects, uses, shares and safeguards the information of any employee (permanent or temporary), director, or officer is available to such Personnel in STI’s internal privacy and information technology policies, and those of its parent organization (IQVIA).

ONLINE SERVICES AND USER METRICS

Whether you are a patient, prescriber, pharmacist, client representative, employee, or employment candidate, you may use STI websites, online portals, and web-based services (including our software-as-a-service solutions) to interact with STI, learn about STI and our products and services, or use our services. While most of the information you provide us in the process of using those online tools is covered by this privacy policy, there are also certain specific types of information that we collect during your use of those tools in order to facilitate and manage your interaction with those tools. In order to learn more about that kind of information, and how we collect and use it, please consult our parent organization’s (IQVIA) Online Privacy Policy. That is also where you will find information about our use of Cookies in our online tools. If you are a client employee or representative who uses or engages with any of our products, services, or online tools, please note that we may also collect and provide information to that client about your use of our products, services, and tools, in connection with helping them monitor, understand, and/or optimize their use of those products, services, or tools.

HOW DO OUR EMPLOYEES ACCESS AND USE INFORMATION?

Your information is only available within STI to the STI employees who need access to it in order to provide you the service you have requested or perform the functions specifically contemplated in this privacy policy. If you are a patient, that can include employees who need to process your enrollment in a service, assess claims, perform audits, or issue payment under any program, or provide you with patient support under a PSP. Your information will then be anonymized before it is made accessible to other STI personnel who need to use it for any of the other purposes described in this policy, such as for producing analytics and statistics for STI or our clients and potential clients. However, even that anonymized information is only available to STI analysts on a need-to-know basis, and its access by other STI personnel is strictly controlled. Any personnel that STI determines is in violation of this policy will be subject to disciplinary action up to and including termination of employment, where applicable, in accordance with STI’s disciplinary procedures.

If you are a prescriber or pharmacist, your information can be accessed by STI employees responsible for processing or auditing claims, making payments, assessing or monitoring program mechanics and performance, or producing internal or client analytics on program performance, or on prescriber or pharmacist interests and needs with respect to the types of programs STI administers.

HOW DO WE SHARE YOUR INFORMATION?

STI uses third party service providers to provide some of its services, and to store, process, and use information about Personnel. As a result, we may need to share your information with those service providers, or have them collect that information from you. Those service providers can only use your information to perform services for STI, and STI will always require its service providers to take all the same precautions as we do to keep your information safe and secure.

As mentioned above, if you are a patient, we may also need to share the information you provide us, and information about your claims, to the manufacturers who sponsor any programs you are participating in. As well, if you report to STI any issues you are having with a pharmaceutical drug, such as side effects or difficulty administering the drug, we will also need to report that information to the manufacturer, so that they can follow up with you. As also mentioned above, your information will be used to help develop research and statistics which we will share with third parties, but we will always ensure that no information that identifies a patient is included in those research and statistics.

If you are a healthcare professional, please refer to the above section entitled “If You Are a Healthcare Professional” for details on the related information, analytics, and reporting we provide to our clients.

SECURITY OF INFORMATION

STI employs industry recognized security safeguards to protect any information provided to us from loss, misuse, and unauthorized alteration. We protect all information stored on our servers from unauthorized access using commercially available computer security products (e.g., firewalls), as well as carefully developed security procedures and practices. Although STI takes reasonable and prudent measures to protect our computer systems and any information that we have collected from unauthorized use, access, disclosure, misuse, alteration or destruction, no security measures can provide absolute protection. As such, we cannot guarantee the security of your information, and are not responsible for unauthorized use, access, disclosure, misuse, alteration or destruction of your personal information beyond our reasonable control. STI relies on industry leading professionals to support our programs, and we enter into detailed agreements with each of them. The agreements oblige those professionals to protect your information at least as well as STI does.

In certain circumstances, the third parties which assist STI in delivering STI’s services may require delivery of information by email. As described above, STI takes steps, aligned with industry best practices, to ensure the security of your information; however, it is impossible to guarantee the security of that information. By using our services, you agree to the inherent risks associated with email transmissions.

ACCESSING AND UPDATING PERSONAL INFORMATION

You have the right to request and review any of the information we may currently have about you. You may update or correct your personal information that has been provided to us or request that we delete it. Depending on the region in which you live, you may also have other rights with respect to your information, including the right to request a copy, the right to request certain additional information about how we collect, use, or protect your information, or the right to request additional details about how your information is used in any automated decision making process. We will take reasonable steps to make sure that any requests you make in connection with the above rights are processed in a timely and complete manner. STI will take reasonable steps to comply with any rights requests, unless we have a legal right to refuse. In order to comply with certain rights requests, it may be necessary for STI to transfer an individual’s information to or from another province, territory, or country. If STI determines that it is not required to agree with a rights request, we will provide you an explanation of why that determination has been made, and with a contact point for any further questions. To protect the privacy of data subjects, please also bear in mind that STI must take commercially reasonable steps to verify your identity before granting or processing your rights requests.

MOVEMENT AND RETENTION OF PERSONAL INFORMATION

Any information about patients which we collect in administering our programs and services is subject to transmission between the various provinces and territories of Canada, as it is transferred between different key points in our information processing network. That can include our own proprietary data storage facilities, as well as third-party data storage facilities where we have contracted STI-dedicated space. Similarly, inter-provincial/territorial transfer of information can take place between STI and its service providers, and between other third parties described in this policy, such as program sponsors, pharmacists, case workers, and other healthcare providers.

Information which we collect about healthcare providers and Personnel not only travels across provincial and territorial borders, but may also be transferred for storage and processing in other countries, including, but not limited to, the United States of America.

Financial information and other claim data received by STI will be retained for as long as required by applicable legal requirements, by contractual commitments, or for a period of seven years from the date the information was last used, whichever is longer. The same applies to information we receive about healthcare providers in claim data or which we collect in connection with a healthcare provider’s engagement with any of the programs we administer.

Other personal information received by STI for the purpose of providing PSPs will be retained in accordance with the policies of the manufacturer sponsoring the specific program, as well as any applicable legal requirements and contractual commitments. The retention period may vary by program.

Likewise, any information about Personnel will be retained as long as is required for the purposes for which it as collected, such as the managing of our employment or post-employment relationship, to assess future employment relationships, to resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our policies, and comply with applicable laws.

RESERVATION OF RIGHTS

STI reserves the right to collect, use, process, and disclose your information for the purposes, and in the ways, allowed by law or regulation. This can include, without limitation, secondary purposes that are consistent with the initial purposes for which the information was collected, and uses that are otherwise clearly for your benefit. Similarly, we may also use or disclose your information in order to comply with our legal and regulatory obligations, policies and procedures, and for internal administrative purposes. We also reserve the right to use or disclose your information as necessary and appropriate (i) in response to lawful requests by a court or public authorities, including to meet national security or law enforcement requirements, (ii) under the discovery process in litigation, (iii) to enforce STI policies or contracts, (iv) to collect amounts owed to STI, (v) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation or prosecution of suspected or actual illegal activity, or (vi) in order to protect or enforce our legal rights.

PRIVACY POLICY UPDATES

This privacy policy may be updated from time to time. The current version of the policy will always be posted on our website at https://smartsti.com/privacy/. We reserve the right to change our privacy practices and to apply the changed practices to all information we have about you. By using our services and programs, you agree to be bound by the terms of the most up-to-date version of this privacy policy, as located on the website at any given time.

CONTACTING STI

If you have any questions or concerns about STl's privacy practices or about the information which you have provided to us, or you wish to make inquiries or requests regarding your rights, please contact our Privacy Officer by email at privacyofficer@smartsti.com or write to:

STI Technologies Limited

Attention: Privacy Officer
38 Solutions Drive, Ravine Centre Two, Suite 200, Halifax, NS B3S 0H1

STI will respond to your inquiry in a timely and complete manner.

STI PRIVACY POLICY EFFECTIVE DATE: September 22, 2023