This Notice of Privacy Practices explains:
If you have any questions about this this Notice, please contact our General Counsel.
INDIVA understands that you entrust your data to us. We value that trust. Our collection and use of customer data is guided by our corporate principle of Customers First and subject to our INDIVA Responsible Information Management program.
We may use the information we collect for the following primary reasons:
We may combine information collected from different sources (see section on What We Collect & Share). Below is a summary of some of the ways we collect and use information:
The rest of this Notice refers to the collection & use codes above (FUL; ADV; OPS; SEC). This is so you can better understand why we collect & use different types of information in accordance with our privacy practices and our Responsible Information Management program.
INDIVA collects your personal information to help us manage, maintain, and develop the services, products, and operations we provide. Below are included some examples of how we use your data:
To create and maintain a strong, mutually beneficial relationship with you, our user, and provide to you or receive from your information and/or products and services.
To provide users with the option to create and access an account on our website, allowing them easier access to products, services, and other features.
Enabling reviews of INDIVA products and services in order to understand your need for our products and services and to continually improve these products and services.
Enable us to receive and accept your requests regarding our products and services. This includes how you prefer to be contacted, receive your order, etc.
Allowing INDIVA to safeguard the website and company from errors, fraudulent behaviour, theft of any kind, and/or damage to products and property of any kind.
Enabling INDIVA to operate in accordance in all applicable regulations or regulatory processes in each respective region our services are available in.
INDIVA collects personal information and personal health information about you, the user, in connection with the provision of healthcare services we provide, including:
Providing medical cannabis to you
Providing users with resources related to medical cannabis.
Maintaining communications with you to keep you apprised of information which may be of assistance or interest to you.
Helping physicians, registered nurses, or other healthcare providers as required.
Replying to insurance provider requests made by or on behalf of the user for insurance claims to the extent applicable.
Tracking and managing your record as an INDIVA client and patient of medical cannabis (including cannabis purchased, services used, effects of medical cannabis, & more.)
Receiving and/or processing payments.
INDIVA collects and keeps different types of personal information in respect of the individuals with whom we interact. Information collected by INDIVA can include:
We collect various information when you create a profile, place an order, create a registry or take advantage of other programs online or in store. Information we may collect includes: name, address (billing and shipping), postal code, e-mail address, telephone number(s), cellular phone number(s), credit card number(s), birth date, and security question answers.
We understand if you might need some space so to opt out of this policy please click here
We may collect information related to your visit to our website, including the IP address and domain used to access our website, the type and version of your browser, the website you came from to access our website, the page you entered and exited at, any website page within our website that is viewed by that IP address and what country you are from. We use this information to monitor our website's performance (such as number of visits, average time spent, page views) and for our business purposes such as working to continually upgrade our website.
We may place a "cookie" on the hard drive of your computer to track your visit. A cookie is a small data file that is transferred to your hard drive through your web browser that can only be read by the website that placed the cookie on your hard drive. The cookie acts as an identification card and allows our website to identify you and to record your passwords and preferences. The cookie allows us to track your visit to the website so that we can better understand your use of our website so that we can customize and tailor the website to better meet your needs. Most web browsers are set to accept cookies. However, on most web browsers you may change this setting to have your web browser either: (i) notify you prior to a website placing a cookie on your hard drive so that you can decide whether or not to accept the cookie; or (ii) automatically prevent the placing of a cookie on your hard drive. It should be noted that if cookies are not accepted, you may not be able to access a number of web pages found on the website.
Finally, our website may contain links to other websites that may be subject to less stringent privacy standards. We cannot assume any responsibility for the privacy practices, policies or actions of the third parties that operate these websites. INDIVA is not responsible for how such third parties collect, use or disclose your personal information. You should review the privacy policies of these websites before providing them with personal information.
Transaction Information includes items purchased, date and time of your transaction, for online purchases. When you make a purchase, we may share information about you and your transaction with other companies necessary to process your transaction or offer you products or services that may be of interest.
INDIVA collects personal information directly from individual users on the website. If INDIVA requires additional personal information from you but that information is held by a third party INDIVA will obtain permission from you prior to getting that information from the source. In such cases permission will be obtained directly from you or will be implied by your actions.
INDIVA reserves the right to retain third party services and INDIVA may also receive personal information about you collected by those third parties at any point, during the third party’s rendering of services for us or otherwise. In such cases INDIVA will take all reasonable measure to be sure that the third party organization has been permitted and has the right to share your personal information with INDIVA.
We collect information from a variety of sources, including: information provided by you, transaction information, technology-enabled services, and information we collect about you from third party sources. The following are select examples of the types of information we may collect and share:
INDIVA's medical cannabis operations include the following activities and closely related activities:
Operating and maintaining a marijuana production facility and all of the related responsibilities.
Making medical cannabis available and distributing it to individuals qualified as evidenced by a medical document officiated by Health Canada.
Educating interested parties and stakeholders (investors, healthcare practitioners, various government officials, patients) regarding medical cannabis and its effects. INDIVA may collect information at any point from any person using any resources accessed from INDIVA online or in person.
For you to qualify to obtain medical cannabis from INDIVA, we require you to follow legal regulations and provide INDIVA with:
A document known as a "Medical Document" filled out and submitted by an authorized healthcare practitioner.
The INDIVA Medical Document requires the following information to be provided:
(i) The details of your healthcare provider - name, official profession, clinic address, telephone, fax, email, province of registration, and medical license number; (ii) The name and date of birth of birth of the patient for whom the medical document is being written; location of the consultation which led to the medical document being filled out; and (iii) information about recommended dosage for the patient, dosage referring to the product, quantity used, and period of use. The form also has room to allow a medical practitioner to provide INDIVA with your diagnosis and additional comments regarding the treatment.
The authorization form is included in the medical document package and must be received by INDIVA in order for us to verify the information in your Medical Document with the healthcare practitioner who filled out the Medical Document.
Healthcare Practitioner Information
Information collected by INDIVA about healthcare practitioners (doctors, nurse practitioners) is a requirement which allows INDIVA to cooperate with legal and regulatory requirements. An example is using this information to verify the Medical Documents we received are correct. There exists a possibility that INDIVA will be required to disclose this or any other personal information to the authorities which governs the practice of a respective profession.
The following section describes various types of technologies we use when you interact with us online, shop through our online stores, and your choices regarding those technologies:
Cookies, Pixel Tags, and Flash Cookies (FUL, ADV, OPS, SEC)
A Cookie is a small piece of computer code sent by a website and online stored on the hard disk of your computer. A pixel tag (also known as a tracking pixel, web beacon, or clear GIF) is an embedded image on a website that may register a user's website activity. A Flash Cookie (also known as a Local Shared Object) is a data file stored on your computer by the websites that you visit (click here for more details). Flash Cookies provide similar functionality as Cookies, but are based on different technology, provide richer data collections, and are persistent; they do not go away when you exit your browser and generally cannot be deleted through your browser option tools.
At INDIVA we use two kinds of Cookies: session cookies and persistent cookies. Session cookies exist only for as long as your browser remains open. We use session cookies, for example, to manage items added to your shopping bag. Persistent cookies last from visit to visit; they do not go away when you exit your browser. We use persistent cookies to enable an easier log-in process, give you a more personalized shopping experience, or help you navigate our website more efficiently. For example, we use persistent cookies to show you items you have previously browsed. From time to time, we may use Flash Cookie(s) on our website(s), for example, to enable or control richer Flash-based content.
If you block cookies from indiva.com, you will not be able to make purchases on our websites.
Do Not Track (DNT) (ADV, OPS)
INDIVA does not currently recognize and process Do Not Track signals from different web browsers. Customers may manage their preferences for tracking across sites in the Interest-Based Advertising section above. For more information on Do Not Track please visit http://allaboutdnt.org/.
This section details, in one place, how you may express preferences including electing to opt-out of some data collections or uses.
Your consent with regard to INDIVA collecting, using, and/or disclosing your personal information is important. For information which can reasonably not be considered sensitive, your consent may be implied, deemed using an opt-out system, or express. Express consent is given either orally, electronically, or in writing. Implied consent is defined as consent which can reasonably be inferred from your actions (or inaction) on our website.
If we are permitted or required by applicable laws or regulations we will collect and/or disclose your personal information without your knowledge or consent.
You have the opportunity to withdraw your consent at any time. However, your withdrawal of consent is subject to contractual and/or legal obligations and notice within a reasonable time by contacting INDIVA’s General Counsel, who is INDIVA’s Chief Privacy Officer (contact information laid out below).
Any and all communications regarding consent must be written and address to INDIVA’s General Counsel.
The information contained in our records must be accurate and current to help us better serve you. If in the course of your relationship with INDIVA your personal information should happen to change, please inform us through our website.
In certain circumstances your request to change your information may be denied and instead we will append alternative text to the information in question.
To review your personal information please contact our General Counsel. As previously noted, any communication with our General Counsel must be made in writing.
When you make a request to access your personal information we may request information from you which will enable us to confirm your identity and right to access the information you are requesting. This personal information you provide for us will also help us find the personal information we have about you.
We reserve the right to charge a nominal fee for facilitating access to personal information we have. You will be notified of any fee in advance and will only pay if it you decide to proceed with accessing your information. Contact our General Counsel if you require assistance with your request.
You have the right to access the personal information we hold about you, although your right to do so is not absolute. There exist situations where laws and/or regulations allow and/or require INDIVA to withhold access to some or all the personal information we hold about an individual. In accordance with our record-keeping practices and obligations your information may be destroyed, erased, or made anonymous.
If it should come to be that we are unable to accommodate access to your personal information we will do our best to explain the reasons, except in cases where laws or regulations restrict our capacity to do so.
If you prefer that we not share your information with third parties for marketing purposes, you can contact us:
Note: It may take up to 10 business days to process your request.
Customer Survey Emails: We may send surveys, via e-mail, to our customers in order to collect opinions and feedback about their shopping experiences. To opt-out of receiving survey emails from INDIVA, you may use the unsubscribe link of any survey email.
Specialized Email Programs: You may have signed up for one of our specialized email programs. To opt-out of receiving emails from one of those specialized programs, you may use the unsubscribe link at the bottom of any of these emails.
Note: Operational emails (e.g. shipping confirmation or product recall information) do not provide an opt-out option.
Note on Opting-Out of Direct Mail: Because direct mailings are often prepared well in advance (12-16 weeks, in some cases) you may, for a period of time, continue to receive some physical mail after you send us your request.
For more information on Social Media see our Social Media Policy
If INDIVA, its parent company or any of its subsidiaries is sold to or otherwise acquired by a third party, all INDIVA data assets will become the property of the acquiring party. Such a party will be subject to any consent(s), opt-outs or other customer conditions on data. A change in data ownership may or may not include a notice on the primary online sites of INDIVA or affected subsidiary sites.
You may also make a complaint under the Ontario Personal Health Information Protection Act to the Information and Privacy Commissioner of Ontario by completing this form:
https://www.ipc.on.ca/health/report-a-privacy-breach/privacy-breach-report-form. If you reside in another jurisdiction, you may potentially file a complaint with the relevant authority in that jurisdiction.
INDIVA has put various procedural, technical, and administrative measures in place to safeguard the information we collect and use. We designed our technology-enabled services to accept orders only from Web browsers that permit communication through a Secure Socket Layer (SSL). SSL is an encryption standard that provides a layer of security while information is being transmitted over the Internet.
As a matter of policy, we do not disclose details regarding our security measures as this could be beneficial information to criminals and other bad actors.
Be advised, no security safeguards or standards are guaranteed to provide 100% security. You should always use appropriate self-protection measures and practice safe browsing on all websites. For more information on how you can securely shop with us, please review our Security Tips. The National Cybersecurity Alliance also provides comprehensive information to stay safe online.
Additionally, sometimes bad actors attempt to use our brand to create fake web pages, send fake texts or emails, and conduct other illegal activities to commit fraud or attempt to breach consumers’ security. We actively monitor for these illegal scams and shams. We provide FAQ’s and Consumer Protection Alerts in our Customer Protection Center (CPC) as we learn of these activities. If you receive anything with the INDIVA brand that seems suspicious, you can check to see if there is an alert on the CPC or call our customer service department.
We protect the personal information we collect about our clients to prevent loss, misuse, and/or alteration. INDIVA has in place physical, technical and organizational safeguards appropriate to the level of sensitivity of our clients’ personal information. Our security measures are designed to prevent unauthorized access and any other unauthorized activity.