Privacy Notice

Last updated: March 29, 2023 Numinus Wellness Inc., its affiliates and professional corporations or similar entities that are managed by any of them (together referred to as “Numinus”, “we”, “us”, or “our”) are committed to protecting the Personal Information we collect, use and disclose during the delivery of our services, the operation of websites owned and operated by Numinus Wellness Inc. (including any and all pages whether available publicly or requiring a password to access them, the “Website”), and the activities of our ongoing business (herein referred to as  the “Services” in this document). Our privacy policies and practices have been designed to comply with the privacy legislation applicable in the jurisdictions in which we operate. Our collection, use and sharing of your information is only based on your permission or where permitted by applicable law. This Privacy Statement sets forth the privacy principles, procedures and safeguards we use to protect Personal Information.  This Privacy Statement should be read in conjunction with the Terms of Service for our website. Please note: This Privacy Statement does not cover certain services, such as research activities, services provided through Numinus affiliated or Numinus managed clinics and software applications made available by Numinus (“Other Services”), which are subject to their own privacy policies that address the collection, use, retention, and disclosure of Personal Information (each a “Service Specific Privacy Statement”). Your Consent and Agreement to the Terms of Use By accessing this Website, you agree and consent to the collection, use, retention, and disclosure of your Personal Information (defined below) as set out in this Privacy Statement.  Your continued use of this Website is subject to your agreement with, and consent to,this Privacy Statement. If you do not want Numinus to collect, use, retain, or disclose your Personal Information in the way identified in this Privacy Statement, you should not use our Services. Please also refer to “Location of Data”, “Payments” and “Educational Courses” for information concerning the location of processing and storage of personal information and such activities bythird-party vendors. Changes to these Terms of Use Numinus may change this Privacy Statement at any time without notice. The updated Privacy Statement will be effective on the date that it is posted on the Website. Please review the Privacy Statement at regular intervals with reference to the date noted at the top of thePrivacy Statement.  Previous versions of this Privacy Statement are available upon request. If we make significant changes, we will provide a more prominent notice (including email notification, if appropriate).Your continued use of the Website after any changes are posted will constitute your acceptance of those changes and your consent and agreement with them. Personal Information This Privacy Statement covers our collection, use, and disclosure of any information about identifiable individuals or that can be used to identify individuals (“Personal Information”), which may include information relating to the health status of an individual’s physical or mental health or condition (“Personal Health Information”).Personal information is NOT: (a) information about someone who has been deceased for more than 30 years, (b) information about a corporation or other non-individual legal person, or (c) a name, title, or contact information that identifies someone in their business, professional, or official capacity, even if they conduct their business from home. We collect Personal Information directly from you when you engage our Services, contact us via mail or email, sign up for email alerts, or otherwise provide it when you use our Services. This information may include your name, email address, mailing address, and other information that you provide. We indirectly collect names, email addresses and other business contact information about individuals who we consider to be prospective customers and business partners (“Prospects”) from publicly available sources and third-party service providers. We use this information to contact Prospects about our products and services. We may also use information regarding Prospects for marketing purposes described elsewhere in this Privacy Statement. Collection of Personal Health Information is limited to information provided by you in a communication to Numinus or information postedby you on certain areas of the Website (“User Content”). You are not obligated to provide any Personal Health Information to Numinus to use this Website or obtain Services through this Website. Please refer to the applicable Service Specific Privacy Statement for information about our handling of Personal Information and Personal Health Information in the context of Other Services. For information regarding data collection on our websites, see “Cookies, Tracer Tags & Web Beacons” and “Analytics”below. Identifying Purposes Numinus will only collect, use, retain or disclose Personal Information that is necessary to fulfill the purpose of the collection. Numinus uses and/or discloses Personal Information to:

• Act in accordance with terms that an individual has consented to.
• Create an account to access and use our learning management system, in the case of educational services.
• Book an appointment.
• To make referrals.
• To pay for services.
• Deliver requested products and Services.
• Respond to your requests for information, whether relating to products or Services, subscribing for our newsletter, or any other type of interaction initiated by you.
• Identify your geographical location for the purposes of presenting information that complies with applicable laws.
• Contact you for the purposes of providing you with Service updates and notifications relating to the Services.
• To send Electronic Communications (defined below).
• When you register for events, webinar or contests, for the purposes of administering such events, webinar or contests, including with any third-party sponsors or co-sponsors.
• To advertise on third-party networks and websiteplatforms.
• Assess your eligibility for, and to conduct,research projects, where specific conditions are met and with your agreement.
• Manage investor relations.
• Monitor system usage, server and software performance, improve system design, create benchmarks and conduct trending analyses, including use of analytics. Please refer to “Analytics”.
• Perform statistical analyses and generate anonymized data (that does not identify you) related to the use of the Services.
• Assist you with technical support issues. Most technical issues can be resolved without Numinus viewing your Personal Information.
• Comply with any laws, regulations, court orders, subpoenas, or other legal process or investigation (including law enforcement investigations and proceedings) and to protect ourselves from harm or to enforce our rights or defend ourselves.
• To protect others from harm, in compelling circumstances affecting health or safety of an individual.
• Bill, process and/or collect payment. Please refer to “Payments” for disclosures relating to online credit card payments.
• To respond to an agent or other representative authorized by the individual to make inquiries on their behalf.

De-Identified or Anonymous Data We generate anonymous or de-identified information data from the use of the Services, such that it is not reasonably foreseeable that the information could be used, alone or in combination with other information, to identify an individual. Numinus may also generate and analyze de-identified data to create comparative statistical benchmarking reports across client groups or sectors to better understand mental health trends, to improve our operations, products and services and for the purposes of business planning or financial modelling. De-identified data or anonymous data is the property of Numinus and may be disclosed to third parties, in our sole discretion. Consent Numinus will collect, use, retainand/or disclose your Personal Information based on your consent, which may be explicit (e.g., where you must tick a box to indicate your consent) or implicit, where the reason for the collection is obvious and voluntary (e.g., to contact you by email in connection with Services you have requested or to send you communications you have subscribed for). You may withdraw your consent to the use of your Personal Information at any time by contacting us at privacy@numinus.com (including a copy of the message) or by clicking on the unsubscribe mechanism found in the message.  Please note that certain communication relating to transactions, information and Services renderedmay be required by law or regulation and cannot be unsubscribed from. Withdrawing consent, requesting the deletion of your personal information, or asking Numinus to restrict or limit the processing, sharing or transfer of your personal information may also result in a loss of access to the Services. We won’t delete data that we’re required or permitted by law to retain. Please refer to “Location of Data” as your use of this website constitutes consent to store certain information outside of Canada. For the greatest clarity,for those located in Canada or the United States, this consent does not permit collection, use and storage of your clinical/personal health information from Numinus’ Electronic Medical Record to be stored outside of your country of residence unless provided in a Service Specific Privacy Statement. Please also refer to “Payments” and “Educational Courses” for details of third-party vendors who may collect, use, and store your personal information in connection with certain Services offered through this Website. Your use of these Services constitutes your consent to those activities. Consent to Electronic Communications Numinus makes available information related to mental health and educational material through the Website. Numinus may use your email address and other contact information in your profile for the purposes of providing you with information, newsletters, invitations, offers, surveys and other communications in relation to the services that Numinus offers (collectively, “Electronic Communications”). You can unsubscribe from Electronic Communicationsat any time by clicking the “unsubscribe” link included at the bottom of each email. Alternatively, you can opt out of receiving email marketing Electronic Communications by contacting us using the contact information provided in the “Contact” section below, including a copy of the communication you wish to unsubscribe from. Please note that you may continue to receive transactional, informational or Service-related communications from us even if you unsubscribe from marketing communications. Please note that certain third-party providers may send electronic communications to you, should you open an account through our website(s). Please refer to “Payments” and “Educational Courses”. Disclosure Numinus will not sell, rent, trade or otherwise disclose your Personal Information to any third-parties for any purpose other than those specified in this Privacy Statement, the Website Terms of Service or disclosed at the time of collection, unless we obtain your consent to do so. Numinus may disclose Personal Information among its affiliates or with professional corporations or similar entities operating clinics managed by one of them, as necessary for the purpose of delivering Services or responding to your request for Services or information. Numinus may participate in medical and mental health research projects from time to time, including with third-party partners. Numinus may generate de-identified information and disclose this information to third-parties who are part of the research project and bound to use the data for the purposes of the study only. Where you apply to participate in a research project, including a clinical trial, we may share information with third-party research partners in accordance with certain conditions and your agreement. Your personal information may be transferred (or otherwise made available) to third-parties that provide services to us or on our behalf.Third-party services include, but are not limited to, technology services, email and mail distribution, cloud storage services, payment card processing, delivery of educational courses, referrals, and employment recruitment.Any third-party service providers we use to deliver the Services do not have the right to use the Personal Information we disclose to them beyond what is necessary for them to provide the services on our behalf. Numinus may disclose Personal Information for the purposes set forth under “Identifying Purposes” above, and where there is a lawful basis for doing so and it is reasonably necessary to:

• enforce our Terms of Service or other terms, conditions or agreements.
• to protect our operations or customers, for the establishment, exercise or defence of legal claims and to investigate or prevent actual or suspected loss or harm to persons or property.
• in connection with a corporate reorganization, merger, or sale (including transfers made as part of insolvency or bankruptcy proceedings), and/or change of control, including among professional corporations or similar entities managed by Numinus.

Location of Data Numinus head office is located in Canada, we operate in Canada and the United States and useservice providers located in Canada and the United States. Your Personal Information may be transferred outside of Canada and may be subject to the privacy laws applicable in those jurisdictions and/or to access by law enforcement in the United States. If you subscribe to our newsletter or provide personal information through the “Contact Us” section of thisWebsite, your information will be stored in Salesforce located in the United States.Similarly, if you contact our call centre, you will be asked for certain personal information to refer you to an appropriate clinic or other resource, to make an appoint, to validate your identity and to track and monitor the call. The information will be collected and stored in Salesforce. Information collected includes full name, phone number, email address, and any further information you voluntarily supply to the call centre or through the “Contact Us” function on this Website. Salesforce does not use or sell your information. However, if you are located in Canada, you are cautioned to provide only as much information as you are comfortable having stored in the United States. Please review Salesforce’s privacy policy for more information on how they handle personal information. Personal health information that forms part of your medical record is generally stored in the country where Services are provided, but may be transferred outside of that location for the purposes of providing Services, conducting an investigation or research projects (for example, to specialists located outside of the country where Services were provided for the purposes of a second opinion or in the context of an internal investigation). Where possible, records are anonymized prior to such transfer. Please refer to the applicable Service Specific Privacy Statement for details. We and our Canadian and U.S. third-party service providers may disclose your Personal Information in response to a search warrant or other legally valid inquiry or order, or to another organization for the purposes of investigating a breach of an agreement or contravention of law or detecting, suppressing or preventing fraud, or as otherwise may be required or permitted by applicable law or legal process, which may include lawful access by U.S. or foreign courts, law enforcement or other government authorities. Payments If you purchase a product or service from Numinus, we or our authorized third-party payment processor will collect your full name, payment information (including billing address, credit card number, expiry date and CVV code)in order to process the transaction and enable us to provide you with the Services you have purchased. Numinus will also provide an invoice, including a description of the services purchased, through the third-party payment processor. Payments are processed through Stripe. As such, your personal information will be collected by, and subject to its policies, and may be processed and stored in countries where Stripe operatesor where they have IT infrastructure.  Stripe may send you commercial electronic messages directly from its platform. We do not have a business associate agreement with Stripe. Information concerning Stripe’s handling of personal information can be located here: Stripe Privacy Center Educational Courses If you purchase or participate in an education course with Numinus, the course will be delivered through the Docebo platform. As such, your personal information will be collected by, and subject to its policies, and may be processed and stored in countries where Docebo operates or where they have IT infrastructure. Docebo may also send you commercial electronic messages directly from its platform. We do not have a business associate agreement with Docebo. Information concerning Docebo’shandling of personal information can be located here: Docebo - Privacy Policy - Docebo Retention Numinus retains Personal Information only as long as necessary to fulfill the identified purpose or as permitted or required by law, which may extend beyond the termination of our relationship with you. We may retain certain information as necessary to prevent fraud or future abuse, or for legitimate business purposes, such as analysis of aggregated, non-personally identifiable data, or if required by law. All retained Personal Information will remain subject to the terms of this Privacy Statement. When we have no ongoing legitimate business need to retain your Personal Information, we will delete it, anonymize it, or securely store it until deletion is possible. Individual Access  Subject to limited exceptions under applicable law, you have the right to access the Personal Information we hold about you in order to verify your Personal Information. You may request access to, make corrections to, or delete the Personal Information we hold about you at any time, subject to limited exceptions. In some circumstances, we may not be able to comply with your request. If this is the case, we will provide reasons for not complying. We may request certain Personal Information from you when you make such a request in order to verify your identity. Upon written request, we will provide you with a list of entities (e.g., third party service providers) to which we have disclosed your Personal Information, if applicable. Accuracy Numinus relies on you to ensure that the Personal Information you provide to us while using the Services is as accurate, complete and up-to-date as necessary for the purposes for which it is provided. If you require assistance correcting or updating your Personal Information, please contact privacy@numinus.com. Third Party Websites or Services It’s important to guard your privacy when you are online. If our Services contain links to other websites, this Privacy Statement does not govern those websites. Whether we have posted those links or other organizations or individuals have, you should read their Privacy Statements and make an informed decision about whether you want to use those websites or services.Please refer to “Payments” and “Educational Courses”. Social Media Accounts Numinus operates various social media accounts. If you choose to interact with Numinus though social media, all such interactions will be subject to the privacy policies of such social media companies. Numinus uses analytics on its social media posts. Please refer to “Analytics”. Data Subjects in the European Union and UK Numinus generally processes Personal Information with an individual’s consent, to fulfill contracts, and to pursue our legitimate business interests as described in this Privacy Statement. Data subjects located in the EU and UK have certain rights under European and UK law (including under the General Data Protection Regulation) with respect to Personal Information, including the right to request access to, obtain, correct, amend, delete, or limit the use of Personal Information. For more information or to exercise your rights related to your Personal Information, please contact our Privacy Officer at privacy@numinus.com. Notice to California Residents California consumers have a right to knowledge, access, and deletion of their personal information under the California Consumer Privacy Act. California consumers also have a right to opt out of the sale of their personal information by a business and a right not to be discriminated against for exercising their California privacy rights. Numinus does not sell the personal information of California consumers and does not discriminate in response to privacy rights requests. Numinus provides notice of our privacy practices in our Privacy Policy. The Privacy Policy includes what personal information is collected, the source of the personal information, and the purposes of use, as well as whether Numinus discloses that personal information and if so, the categories of third parties to whom it is disclosed. California consumers can exercise their rights directly by making a request to our Privacy Officer using the contact information provided below. We may ask you for information that we consider necessary to verify your identity for security and to prevent fraud. This information may include name, contact information, and information related to your transaction or relationship with Numinus, but the specific information requested may differ depending on the circumstances of your request for your security and to protect privacy rights. Security Measures We have taken reasonable technical, administrative, physical and organizational security measures to protect Personal Information against unintentional or unlawful destruction, loss, alteration, unauthorized disclosure, unauthorized access, and any other unlawful or unauthorized forms of processing under applicable law. We have implemented procedures designed to limit access to your Personal Information to only staff who need it to perform their duties and to carry out the stated purposes. We also train our team to follow our privacy and security practices and use contracts to ensure that third parties acting on our behalf also maintain reasonable and appropriate safeguards. Even so, it is important to remember that Numinus cannot guarantee that our system is 100% secure. There is always a risk using electronic communications and sharing information of any kind online. Numinus and Children Numinus does not knowingly or intentionally collect Personal Information from individuals who are under the age of 18. If we discover that Personal Information from individuals under the age of 18 has been collected, we will remove that information as soon as possible. Cookies, Tracer Tags & Web Beacons When you visit any of our websites, we collect information from you automatically. This includes the URL of the site you came from, your browser, your Internet Protocol (IP) address, date/time of access, data transferred, pages visited, amount of time on the websites, transactions conducted, and other “clickstream” data. This information is used to assist us in our marketing efforts, help diagnose technical problems, and to improve our websites. We may also collect “de-identified data” from website visitors, in other words data that does not identify an individual, to:

• Monitor system usage, server and software performance, in order to: improve system design, create benchmarks and conduct trending analyses.
• Perform statistical analyses and generate data related to how you use our website.

We use sessions and may use functional cookies on our website to deliver the desired functionality and user experience and analytics cookies to collect and analyze aggregate visitor behaviour. These toolshelp us better understand how our websites are used and to improve them, as well as provide visitors the benefit of not having to re-enter the same data repeatedly. You can disable cookies and still obtain access to most of our websites. We may also use “web beacons” to gather usage and performance data. Our websites may include web beacons, cookies, or similar technologies from third-party service providers. You have a variety of tools to control the data collected by cookies, web beacons, and similar technologies. For example, you can use controls in your internet browser to limit how the websites you visit are able to use cookies and to withdraw your consent by clearing or blocking cookies. Please also refer to “Analytics” below. Analytics The Website and other Numinus Communications also use web analytics services such as Google 4 Analytics (“G4A”) to help us gather and analyze information about the areas visited on the Website (such as the pages most read, time spent, search terms and other engagement data), click-throughs, and other information in order to evaluate and improve the user experience and the performance and content of the Website or communications, as applicable. For more information about Google Analytics please refer to Google’s data privacy and security on their website. Employment Information When you apply for a job with Numinus, we will collect Personal Information related to your applicationsuch as information contained in a resume, cover letter, or similar employment-related materials.We use this information for the purpose of processing and responding to your application. In the event you are hired, we will collect information required to manage the employment relationship and, in some cases, may conduct background, criminal, credential, reference and other checks. Please contact our Privacy Officer for more information about the management of recruiting and employee Personal Information. Questions and Complaints When contacting Numinus regarding any issue, please do not include any Personal Information (other than your contact information) or health information in the subject line or in the content of your message. Note that email is not a secure method for transmitting information. You may send your privacy-related questions, concerns or complaints to our Privacy Officer who is responsible for ensuring our compliance with this statement and privacy legislation. Attention Privacy Officer #801 – 33 Water Street, Vancouver, B.C., V6B 1R4 T: 1-833-686-4687 E: privacy@numinus.com Numinus will reply to complaints within 30 calendar days of receipt. If our Privacy Officer is unable to resolve your concern, you may also contact the Office of the Privacy Commissioner of Canada or the appropriate authority in your province, state or country.