Privacy Policy

September 25, 2025

Laboratoire Riva Inc. (together, “we”, “our” or “us”) are committed to collecting, using, disclosing and otherwise processing personal information in accordance with applicable privacy laws, including personal information pertaining to patients, health care professionals, individuals working for our business partners as well as our potential personnel.

This privacy policy (“Privacy Policy”) applies to our collection, use or disclosure of personal information obtained through our interactions with you. The terms “you” or “your” refers to those individuals to whom the personal information relates.

Please read this Privacy Policy before providing your personal information to us. If you do not agree with this Privacy Policy, please do not request, participate in or use our services (including our clinical trials, patient support or research programs or other services) (collectively, “Services”) which require that you provide your personal information, nor provide us with your personal information in any other way.

This Privacy Policy is provided to you in a FAQ format solely for your convenience. However, please note that all of the terms and conditions of this Privacy Policy apply so please review them in their entirety. Please click on the relevant question to see the response:

WHAT IS “PERSONAL INFORMATION”?

The term “personal information” is information that identifies you as an individual or relates to an identifiable individual as interpreted by applicable privacy laws. Examples include your name, your residential address and your personal cell number. Personal information does not generally include business contact information.

The term “personal information” also includes Sensitive Information. “Sensitive Information” means personal information that reveals sensitive information such as health and medical conditions, sexual orientation or sexual life, political opinions/views, race/ethnic origin, religious and philosophical beliefs. We only collect Sensitive Information where necessary and only with your consent. Please do not send us any Sensitive Information except when specifically requested to do so. Personal information could include technical information, but only when it can identify you as an individual. Information that is aggregated/de-identified and cannot be associated with an identifiable individual is not considered “personal information”.

DO WE OBTAIN YOUR CONSENT WHEN COLLECTING YOUR PERSONAL INFORMATION?

We only collect information by lawful means. When we collect, use or share your personal information, we do so with your consent or as otherwise permitted or required by law. Consent can be “implied” or “express” depending on the situation. You may withhold or withdraw your consent for us to collect, use or share your personal information, as long as there are no legal or contractual requirements for us to process your information.

Depending on the situation, it may be reasonable to imply a consent from your actions (e.g., you made a request for information by email or voicemail).
We may ask for your express consent in some situations (e.g., when collecting Sensitive Information). Demonstrating express consent includes when you verbally consent, sign a document, or tick a box.
We might have your indirect consent - you may have given your consent to one of our suppliers or business partners who then provides us with your personal information under contract (e.g., a recruiting agency who provides your c.v. to us).

If you withdraw your consent, depending on the circumstances, it may impact our ability to serve you. In some situations, the law allows us to collect, use or disclose personal information without your consent - for example, if it is clearly in your interests (such as a medical emergency or a threat to your safety).

HOW DO WE COLLECT YOUR PERSONAL INFORMATION?

We collect personal information from a variety of sources depending upon who you are (e.g., a health care professional, a patient or a job applicant) and the context of the collection. We generally collect information directly from you but on sometimes, we may collect personal information from publicly available sources or third parties, but only with your consent or as permitted or required by applicable law. The table below provides more details. ⁺

If you submit any personal information about someone other than yourself, you represent that you have the authority to do so and to permit us to use the personal information in accordance with this Privacy Policy. We may combine the personal information that we collect/collected directly from you with information obtained from other sources.

IF YOU ARE FROM THE GENERAL PUBLIC – E.G. PATIENT OR A CONSUMER OR JOB APPLICANT
Sources	Methods	Examples: Type of Individual and purposes
Directly from you	In person Mail Phone Email Online forms or other means	You may have contacted us because you had an inquiry or a concern about one of our products or Services. You may choose to apply for a job with us. You may choose to apply/participate in one of our clinical trials, patient support or research programs or other Services.
ThirdParty Sources	Recruiting agencies Your current and past employers Background checking services Government and regulatory body registry databases	As a job applicant, we may have obtained your c.v. from a third-party recruiter to whom you had provided your consent to share such information and we may verify your qualifications.
	Your health care professional (e.g. family doctor), health insurers, caregivers and others	You may choose to apply/participate in one of our clinical trials, patient support or research programs or other Services and we may need information from third parties.
Public Sources	Public websites e.g., LinkedIn	As a job applicant, we may conduct research about you including reviewing your profile on LinkedIn to whom you had provided your consent to share such information.
IF YOU ARE A HEALTH CARE PROFESSIONAL, INCLUDING CLINICAL INVESTIGATORS (“HCP”)
Sources	Methods	Examples:Type of purposes
Directly from you	In person Mail Phone Email Online forms or other means	You may have interacted with us to learn about our products or Services. You attended one of our conferences or participated in one of our clinical trials or other programs.
Third Party Sources	Contract research organizations Other HCPs and clinical trial investigators Background checking services Your current and past employers Government and regulatory body registry databases Data brokers or business partners Government Agencies	We may obtain your personal information so we can reach out to you to introduce our products or Services so that you can make informed treatment decisions for your patients, to invite you to participate in our clinical trials or to become a speaker for one of our conferences. We may need to verify your qualifications to ensure that you are qualified to be a speaker, our clinical trial investigator, etc.
Public Sources	Public websites e.g., Professional registries and accreditation bodies

WHAT INFORMATION DO WE COLLECT AND WHY?

We limit the collection of personal information to what is reasonably required to fulfill the purposes for which it was collected. We never sell, rent or lease your personal information. We collect and use your information for the following general purposes:

To manage our everyday business needs which include: notifying you of changes to our products or Services, deploying and managing our IT applications and systems (including the maintenance of our CRM database - if you are an HCP), managing our contracts, monitoring, managing and investigating incidents or concerns, ensuring business continuity and disaster recovery, maintaining security and protecting us from and preventing fraud as well as ensuring corporate governance and reporting;
To research, analyze, develop, manage and improve our business operations, our products, Services, and to test new products or Services;
To understand your needs, the suitability of our products or Services, and assess future needs;
To market our products or Services to health care professionals;
To provide Services that are customized to you;
To request and administer your feedback to improve and manage our relationship with you;
To meet our legal and regulatory obligations, including to enforce our legal rights; and
To fulfil other purposes related to any of the

The table below illustrates the specific types of information we may collect and the related purposes depending on the nature of our relationship and what Service you apply for or use:

GENERALLY – WE COLLECT THE FOLLOWING
Information Collected/Obtained (Note: Not all information will be collected, these are just examples.)	Purpose(s)
Contact information and preferences: e.g., Name, email address, username, mailing address and/or phone number.	To authenticate you; and/or To communicate with you and/or respond to you (e.g., addressing your request, inquiry or complaint).
Information associated with clinical trial, patient support and other health related programs: Supplemental identity information and preferences: e.g., contact information of patients, patients’ relatives, caregivers, powers of attorney, next of kin and HCPs, date of birth, gender, health insurance number, and other similar identifiers. Medical/health information e.g., information provided by your HCP, information about physical and mental health conditions and diagnoses, treatments for medical conditions, genetic information, family medical history and medications you might be taking. Insurance and financial information e.g., financial need information, insurance policy and coverage information (including claims history and related identifiers).	To determine your eligibility for, coverage of and enrollment in certain programs to which you apply such as clinical trials, patient support programs and compassionate use programs; To address and manage incidents arising from such programs or which are under our responsibility (e.g. adverse events); To administer, manage, analyze, and improve such programs; To investigate fraud; and/or To comply with our regulatory monitoring, record keeping and reporting obligations including those related to pharmacovigilance, product complaints and patient safety.
Job applicant information and third-party sourced information (including publicly available information): e.g., application forms, resumés, cover letter, reference letters, interview records and background verification (such as police records, and media and social media searches)	To consider you for employment (current or future positions); To plan and implement staffing and recruitment activities; and/or To verify your professional credentials.
Pharmacovigilance activities: e.g. information received concerning side effects and adverse events which may have occurred in connection with our products. Such information may be provided directly by you or by your pharmacist or health care professional.	To monitor the safety and efficacy of our Products. To inform health authorities if and as required by applicable law. To otherwise fulfil our legal obligations.
Business partner: e.g., records, service provision history and transactional information which may include name, address, telephone number, survey information, records of services purchased, obtained or considered or other services provision histories. Note: many jurisdictions do not consider business information, including contact information as “personal information”.	To establish and maintain business relationships with you (e.g., where you are our supplier); and/or To manage our contractual obligations and your ongoing relationship with us (e.g., where you are our supplier).

IF YOU ARE A HEALTH CARE PROFESSIONAL, INCLUDING HEALTHCARE PROVIDERS AND CLINICAL INVESTIGATORS (“HCP”), WE MAY ALSO COLLECT THE FOLLOWING:
Information legally required or permitted by applicable laws e.g., social insurance number (job context).	To comply with our legal obligations or to comply with any reasonable request from competent law enforcement agents or representatives, judicial authorities, governmental agencies or bodies, including applicable data protection authorities; To inform a third party in the context of a possible merger with, acquisition from/by or demerger by that third party; To defend ourselves in legal proceedings; To protect our and your rights, interests, and safety and the rights, interests, and safety of others; To investigate and resolve incidents, and complaints or disputes; and/or As otherwise permitted under applicable laws or as otherwise authorized by you.
Any other information you choose to provide about yourself or your household.	We will only collect such information if we have a reasonable purpose for collecting such information and you have consented to such purposes.
Information Collected/Obtained (Note: Not all information will be collected, these are just examples.)	Purpose(s)
Contact and other HCP information: e.g., professional credentials, educational and professional history, institutional and government affiliations, information included on a resume (such as name, email address and/or phone number and languages spoken), prescribing and dispensing information and patterns as well as medical opinions, preferences and feedback. Note: Business contact information is generally excluded from the definition of “personal information”.	To communicate with you, address your requests and manage our relationship (e.g., fulfilling a request to meet to learn about our products, providing samples, etc.); To better understand your specialities and interests to better customize our Services to you and inform you about our products and Services that may be of interest or useful to you; To present our products and provide our Services to you and improve them based on your feedback and interactions; To invite you to participate in surveys about our products and Services; To develop or enhance marketing activities (e.g., sending our newsletters where you have provided your email address or inviting you to participate in an educational seminar); To assess your eligibility to participate (and where eligible, enroll you) in our Services, including for our clinical trials as well as our patient support and research programs; and/or To comply with our regulatory monitoring, record keeping and reporting obligations including those related to pharmacovigilance, product complaints and patient safety.
Details about our interactions with you (e.g., Company hosted events or activities you attended, meetings with our reps, etc.) e.g. attendance details, your opinions, preferences and feedback, prescribing and dispensing information and patterns related to our products and the agreements you have executed with us.
Publicly available information related to your practice e.g., license information, disciplinary history, prior litigation and regulatory proceedings, and other due diligence related information.	For the purposes set out above as well as to confirm contact or financial information; To verify your standing as an HCP; To investigate fraud.
Information associated with our clinical trial, patient support, conferences and other special programs (“Special Programs”): e.g., funding request, payment and reimbursement amounts and banking information.	To enroll you in our Special Programs and provide our Services to you in the context of such programs; To administer, manage, analyze, and improve such programs; To reimburse you and process payments to you if you act as one of our speakers, clinical investigator, etc.; To address and manage incidents arising from such programs or which are under our responsibility (e.g. adverse events).

DO WE USE DE-IDENTIFIED, AGGREGATED AND/OR ANONYMIZED INFORMATION?

Yes, we do generate de-identified, aggregated or anonymized information using personal information. Such information does not reveal your identity.

We use such information to conduct research, compile aggregate data sets, statistics and reports and to perform analytics about our products and Services, service standards, business operations, and trends for our use and our third-party service providers, including to understand how we are performing, or to develop relevant products or Services.

DO WE SHARE YOUR PERSONAL INFORMATION WITH THIRD PARTIES?

Yes, we do but we never sell, rent or lease your personal information. We will disclose personal information we have collected to third parties, including to those located outside of your province or territory, only: (a) when requested by or authorized by you; (b) as set out in the table below; and (c) to the extent necessary to fulfill the identified purposes. These third parties are required to protect the data, and limit use and disclosure of the information for the specific purposes for which we supplied it. For further details regarding the sharing of personal information, please see the table below.

Third Party	For what purpose
To our subsidiaries and affiliates To our third-party suppliers such as agents, suppliers or providers who are acting on our behalf or jointly with us.	To obtain their products and/or services so that we can fulfill the purposes described above in Section Erreur ! Source du renvoi introuvable. - e.g., those related to employment and recruiting, legal advice, IT and system administration, customer relationship management, auditing, clinical research studies, customer support, advertising, payroll/payment processing, cloud storage, fulfillment and delivery of our products and Services, analytics and marketing; To meet our legal and compliance requirements and operational needs; and/or To carry out a business transaction, including a corporate re-organization, bankruptcy, merger or amalgamation, or the sale of all or some of our assets.
To our business partners	To co-promote products and Services; To meet our legal and compliance requirements and operational needs; and/or To carry out a business transaction, including a corporate re-organization, bankruptcy, merger or amalgamation, or the sale of all or some of our assets.
To research organizations	For research purposes in compliance with applicable law.
To regulators, law enforcement, government authorities, and other third parties as otherwise permitted or required pursuant to this Privacy Policy and applicable laws.	To comply with applicable laws, rules, regulations, governmental and quasi-governmental requests, court orders, or subpoenas. For example, we may be required to disclose personal information to report an adverse event/side effect to Health Canada relating to one of our products. To enforce this Privacy Policy or other agreements; and/or To protect our rights, property, or safety or the rights, property, or safety of others, to exercise, establish or defend our rights or to detect, prevent, or respond to fraud, intellectual property infringement, cybersecurity intrusions, or other illegal activities.
To other third parties	Other than the purposes listed above, we may, with your implied or express consent, share or disclose your personal information to other third parties or when permitted or required by applicable laws.

WHAT RIGHTS AND CHOICES DO YOU HAVE ABOUT YOUR PERSONAL INFORMATION?

Applicable laws provide you with certain rights with respect to the collection, use, disclosure and processing of your personal information. However, your rights may differ depending on where you live and the circumstances of the request. To exercise any of your rights, contact us at confidentialite@labriva.com and we will provide you with current, step-by-step instructions. Your privacy is important to us, so where necessary, we may ask you to provide sufficient information to verify your identity before we respond to your requests. We will process your request within 30 days or a longer period if required or permitted by law, in which case you will be notified of the extension. Where we deny your request in any way, we will inform you of the denial and provide an explanation of our actions and the reasons for the denial.

The rights described in the table below are not absolute rights and may be subject to certain legal, business or contractual requirements. Applicable laws may allow or require us to deny or partially deny your request.

Rights regarding your personal information	Description
Right to be informed	You have a right to know how your personal information is collected, used, disclosed and otherwise handled. This Privacy Policy generally fulfills this requirement but feel free to contact us at confidentialite@labriva.com if you have any questions or concerns.
Right of Access and Rectification	You have the right to request access to the personal information we hold about you. Please note that we can only grant requests for access to personal information which is in our custody or under our control. Where we are acting on behalf of a third-party and that party is accountable for your personal information, we will refer your request to that third party. Please identify the third party your request refers to (if possible), to simplify this process. You have the right to request us to correct any inaccurate, ambiguous or incomplete personal information that we hold about you.
Right to withdraw your consent	You have a general right to withdraw your consent for the collection, use or disclosure of your personal information and request deletion of your personal information. Note however that if you refuse to provide your information or ask us to delete certain personal information, it may be difficult or even impossible to provide our products or Services or address any of your queries or requests. Note that even with a withdrawal of consent, you may still continue to receive legally required or permitted notices or messages.
Right to object to collection, use or disclosure	You have the right to object to the collection, use or disclosure of your personal information. You may not necessarily want a complete deletion of your personal information. In that case, you can ask us to refrain from using your personal information for specific situations. For example, you can advise us that you no longer want us to send you any marketing materials. Please note that it may be necessary to disclose your personal information and your opt-out preference to third parties to allow them to remove or suppress your name from future solicitations.
Right to portability	You may have a right to request a copy of your personal information that we process so that you can transfer your personal information from one IT environment to another in a safe and secure way.
Right to submit complaints	You have the right to submit a complaint to us or to a competent regulatory authority. However, we hope that you will first consult with us, so that we may work with you to resolve any complaint or concern you might have.

HOW DO WE PROTECT YOUR PERSONAL INFORMATION?

We take the security of your personal information very seriously and are committed to protecting your privacy by using a combination of administrative, physical, and technical safeguards. We will store your personal information in accordance with our retention policies or as otherwise required or permitted by law.

Your personal information may be stored in foreign jurisdictions, in which case it will be subject to foreign laws. We follow industry standards to protect your personal information – the level of standard depends upon the sensitivity of the information and the purposes for which it is to be used. Unfortunately, no method of storage or transmission over the Internet can be 100% secure, and so we cannot guarantee that your information will not be accessed, disclosed, altered, or destroyed by breach of any of our administrative, physical, and technical safeguards. Please exercise caution in disclosing personal information, as information sent over the internet is not necessarily secure.

MAY YOUR PERSONAL INFORMATION BE SENT OUTSIDE OF YOUR PROVINCE OR TERRITORY? ⁺

Yes, it is. In many situations, we collect, obtain, process or otherwise handle personal information within the same province or territory as where you reside. However, we deal with partners and service providers who are located around the world, and so, depending on where you reside, we may need to transfer and store your personal information outside of your province or territory and even outside of Canada.

By providing any personal information to us, you fully understand and, where required or permitted by applicable law, consent to the transfer and processing of your personal information outside of your local jurisdiction (e.g., outside of Quebec and even to other countries).

We will seek to protect your personal information when it is transferred outside of your local jurisdiction by: (i) processing it in a territory that provides an adequate level of protection for personal information based on the receiving jurisdiction’s data protection laws; and/or (ii) implementing appropriate safeguards to protect your personal information, such as requiring the recipient to comply with protective contractual clauses, or another lawful and approved transfer mechanism. However, please note that the laws in jurisdictions outside of your own regarding the processing of personal information may be less stringent than those in your jurisdiction and may not give you the same rights as you currently have. Your personal information may be subject to the law of the other jurisdiction, including any law permitting or requiring disclosure of the information to the government, government agencies, courts and law enforcement in that jurisdiction.

HOW LONG DO WE RETAIN YOUR PERSONAL INFORMATION?

We will store your personal information in accordance with our retention policies, this Privacy Policy, separate privacy notice or as otherwise required or permitted by law, after which your personal information will be securely destroyed or anonymized (so the information no longer identifies you).

Subject to legal requirements to retain your personal information, we will delete personal information we have under our control or custody at the earlier of the following circumstances:

Where the applicable retention schedule requires the deletion of the personal information;
The purpose for which the personal information has been collected/obtained has been fulfilled, can no longer be achieved or the personal information is no longer necessary for the original purpose;
Applicable laws and/or contractual obligations do not permit the contemplated collection, use or disclosure; or
Consent has been withdrawn.

HOW DO WE PROTECT CHILDREN’S PRIVACY?

We care about protecting children’s privacy. We do not knowingly collect, use or otherwise process any personal information about children in a manner which would be contrary to applicable laws. If we learn that we have collected any personal information from a child without verification of parental consent, we will delete that information from our database as quickly as possible.

HOW MAY WE CHANGE THIS POLICY?

We may modify or update this Privacy Policy from time to time. The “Effective Date” at the top of the Privacy Policy indicates when it was last updated. Any changes we make will become effective when we post a modified version of the Privacy Policy on our Site. By continuing to use our products or Services and/or engaging with us after we post any such changes, you accept the Privacy Policy as modified. It is your obligation to ensure that you read, understand and agree to the latest version of the Privacy Policy. If you do not agree to the changes in our Privacy Policy, it is your responsibility to stop participating in our programs, and/or requesting/using our products or Services.

HOW CAN YOU CONTACT US OR LODGE A FORMAL COMPLAINT?

We have appointed a Privacy Officer to ensure our compliance with applicable privacy laws and with this Privacy Policy. If you would like to exercise any of your rights set out above or if you have any questions, comments or complaints regarding this Privacy Policy or our handling practices of your personal information, please contact us at:

Email : confidentialite@labriva.com

Or mail us at:

Laboratoire Riva Inc.
Attention: Chief Privacy Officer
660 Blvd Industriel
Blainville, QC J7C 3V4