Privacy Policy

1. Purpose

Aurora Cannabis Inc., Aurora Cannabis Enterprises Inc. and affiliated companies (the “Company”) are committed to safeguarding the Personal Information of our employees, patients, physicians, customers and other stakeholders (the “Users”). This Privacy Policy describes the different types of Personal Information the Company handles and the Company’s privacy practices with respect to such Personal Information.

While your Personal Information may be collected by a specific entity affiliated with Aurora Cannabis Inc., that information will be managed collectively with all data collected by each of the affiliated entities. Your Personal Information will be comingled with the information collected by other entities into a single aggregate database. For the purposes of this Privacy Policy, the comingling of data collected by Aurora Cannabis Inc. and its affiliates shall not be deemed to be a disclosure of Personal Information to a third party. While your Personal Information may be transferred to affiliated entities, your Personal Information will at all times be held on the same conditions of confidentiality and with the same level of security consistent with this Policy.

The primary purposes of this Privacy Policy are to:

explain what Personal Information we collect and why we collect it; explain the choices you can make about how your information is collected and used; explain how we use Personal Information that we collect; implement methods to protect Personal Information; and establish methods to receive and respond to complaints and inquiries. This Privacy Policy establishes the Company’s policies and procedures with respect to all Personal Information collected, used and disclosed by the Company. This Privacy Policy applies to all employees of the Company, anyone that utilizes any of the services provided by the Company, and anyone that accesses any of the websites linked to this Privacy Policy and operated by the Company.

The Company’s websites may contain links to third party websites, applications and services. The information practices or the content of such other websites are governed by the privacy statements and policies of those websites. The Company encourages you to review the privacy statements and policies of those websites to understand their information practices.

Your privacy matters to the Company. Please take the time to get to know our practices, and if you have any questions, contact our Privacy Officer at privacy@auroramj.com or by phone toll free at 1 833 287-0772.

2. What is Personal Information or Personal Data?

Personal Information or Personal Data refers to any information about an identified or identifiable individual.

The term “personal information” has the same meaning as set out in the federal Personal Information Protection and Electronic Documents Act (PIPEDA), which means any information about an identifiable individual including contact information, name, address, phone number, email address, gender, date of birth, and any other data about yourself that you choose to provide electronically through the Website or otherwise, i.e. through the Patient Registration Application Form.

The term “personal health information” has the same meaning as set out in Ontario’s Personal Health Information Protection Act, 2004 (PHIPA) and includes information relating to your physical or mental health, as well as your health history, medical records, prescriptions and your health card number.

For the purposes of this Privacy Policy, the term “personal information” also encompasses “personal health information” where applicable.

Any data that has been collected in which all personal identifiers have been removed, such that the information could not reasonably be used to identify the individual, is not considered personal information or personal health information. This type of anonymized information may be used for research purposes.

We may use or disclose your collected personal information without your knowledge or further consent in limited circumstances where we are required to do so by law. In certain limited circumstances, we may be required to release your personal information in response to a court order, subpoena, search warrant, law or regulation. We will cooperate in responding to such requests, taking appropriate measures to ensure that the requester understands the sensitive nature of the personal information they may receive.

3. How do we obtain your consent to collect your Personal Information?

By using this website or by otherwise providing personal information to the Company, you agree to this Privacy Policy and that we may collect, use and disclose your personal information in accordance with it. You may withdraw your consent at any time in writing. Please contact our Privacy Officer at privacy@auroramj.com or by phone toll free at 1 833 287-0772 to find out how to withdraw your consent. We will obtain your consent before collecting, using or disclosing your personal information for new purposes unrelated to the purposes described in this Privacy Policy.

Typically, we will seek your consent at the time we collect your personal information. Your consent may be implied, deemed (using an opt-out mechanism) or express. Implied consent can be reasonably inferred from your action (e.g. entering into an agreement with us or providing payment) or inaction. Express consent can be given orally, electronically or in writing.

The Company will most often collect personal information directly from you. In cases where personal information is held by a third party, we will obtain your consent before seeking this information. In some cases, consent may be implied by your actions. Where we obtain your personal information directly from a third party, we will take reasonable steps to ensure that the third party has represented to us that it has the right to disclose your personal information to us.

Personal data collected on this website may also be combined with information you provide us through other sources such as other Company websites, product registration, call centres, or in conjunction with events such as trade shows, training seminars and conferences. Information that you supply will relate to the relationship that the Company has with you or your organization.