09 June 2026

myRequest® Privacy Policy

Reformulary Group Inc. (“Reformulary Group”, “we”, “us” or “our”) is committed to protecting the privacy and confidentiality of any personal information, including personal health information, which you or your authorized representative (“you” or “User”) may provide, or that we may obtain, when a request for myRequest® Services (defined in section 1 below) is submitted to us using:

  1. the myRequest portal (the “Portal”);
  2. the myRequest form or other forms we may provide or make available (“Request Forms”); or
  3. other secure means that we may provide or make available.

The purpose of this privacy policy (this “Privacy Policy”) is to provide information concerning Reformulary Group’s privacy practices and policies, including:

  • how and why Reformulary Group collects personal information;
  • how Reformulary Group intends to use personal information;
  • with which parties Reformulary Group may share personal information; and
  • contact information should you have questions or concerns about Reformulary Group’s practices.

This Policy is designed to comply with applicable privacy legislation in Canada, including the Personal Information Protection and Electronic Documents Act (“PIPEDA”). You should read this Privacy Policy carefully. This Privacy Policy is incorporated into and forms part of and is subject to our Terms of Service. [https://reformulary.com/terms/].

BY SUBMITTING A REQUEST FOR MYREQUEST SERVICES TO US, YOU ARE CONFIRMING THAT YOU ARE AUTHORIZED TO AGREE (INCLUDING UNDER APPLICABLE AGE OF MAJORITY LAWS) AND THAT YOU ARE AGREEING TO THE TERMS OF THIS PRIVACY POLICY AND CONSENTING TO OUR POLICIES AND PRACTICES FOR THE COLLECTION, USE, STORAGE AND DISCLOSURE OF PERSONAL INFORMATION. IF YOU ARE NOT AUTHORIZED TO AGREE TO OR YOU DO NOT AGREE WITH THIS PRIVACY POLICY, YOU SHOULD NOT ACCESS AND USE MYREQUEST SERVICES.

IF YOU ARE AGREEING TO THIS PRIVACY POLICY AS AUTHORIZED REPRESENTATIVE ON BEHALF OF ANOTHER INDIVIDUAL, YOU REPRESENT AND WARRANT THAT YOU HAVE THE AUTHORITY TO BIND SUCH INDIVIDUAL TO THIS PRIVACY POLICY AND THAT BY AGREEING TO THIS PRIVACY POLICY YOU ARE DOING SO ON BEHALF OF SUCH INDIVIDUAL. In such circumstances, the terms “you” or “User” shall refer to such individual and to the authorized representative in his or her capacity as authorized representative. For example, when this Privacy Policy speaks of collection, use, storage or disclosure of your personal information, it is referring to the personal information of the individual on whose behalf the authorized representative is agreeing to this Privacy Policy and to any personal information of the authorized representative. An authorized representative may be a parent, spouse, caregiver, substitute decision-maker, employer, health benefits plan provider or administrator, or other person or entity with the authority to submit a request for myRequest Services on behalf of another individual. Reformulary Group reserves the right to request proof from such authorized representative that he or she has the authority to bind another individual to this Privacy Policy.

This Privacy Policy is in effect as of April 2026.

OVERVIEW OF OUR PRIVACY PRACTICES

Our privacy practices are summarized here. Under this Privacy Policy, Reformulary Group:

  1. collects personal information, including personal health information, when you submit a request for myRequest Services and in the course of delivering myRequest Services to you, or when you make inquiries to us;
  2. collects, uses and discloses this information, including disclosing this information to third party consultants, advisers, experts, reviewers or other parties as set out in the particular myRequest Service information materials made available to you prior to or at the time of your request for a specific myRequest Service, as required to provide myRequest Services;
  3. may share this information with third party service providers, including Amazon Web Services, operating in Canada for the purposes of administering, hosting and supporting the myRequest Services, including our Portal;
  4. except as set out in items (2) – (3) above, does not share your personal information with third parties without your consent unless authorized by you or required by law, as part of the sale of a business or as disclosed to you when the information is collected;
  5. retains your personal information in compliance with our legal obligations and only as long as necessary for the purposes for which it was collected;
  6. allows you to withdraw your consent to the collection, storage, use and disclosure of your personal information at any time, subject to legal and contractual restrictions and reasonable notice;
  7. mitigates the risk and impact of potential harms involved in the disclosure of personal information through the adoption of reasonable physical, technical and organizational procedures appropriate to the sensitivity of the data in an effort to safeguard the personal information you provide to us;
  8. may sell or transfer non-identifiable information such as summary or aggregated de-identified personal information for research, marketing and analytics purpose; and
  9. provides you with updates if there are any changes to this Privacy Policy and our privacy practices through announcements sent or notified directly to you, posted on our Portal or made available on related sites in connection with the myRequest Services.

Even with the physical, technical and organizational measures adopted by Reformulary Group to safeguard your personal information, there is a residual risk of the loss of, unauthorized access to, or unauthorized disclosure of your information which could result in financial or other harm to you.

Further information with respect to our privacy practices is set out below.

1. OVERVIEW OF OUR SERVICES

Reformulary Group provides you with services in connection with processing your request for one of the following external review or other services (collectively, “myRequest Services”):

  1. review of drug exception requests;
  2. review of drug appeal requests;
  3. review of specialty drug requests; or
  4. other services provided by Reformulary Group.

MyRequest Services are performed by external consultants, advisers, experts and reviewers, such as doctors, pharmacists and other healthcare professionals (collectively, the “External Assessors”). We retain External Assessors to review the information you provide and to make recommendations or decisions about or to provide advice on whether to accept or decline your request (the “Request Decision”). Once the Request Decision is reached, it is communicated to you, your health benefit plan provider, plan administrator or other parties as set out in the particular myRequest Service information materials provided to you prior to or at the time of your request for a specific myRequest Service.

2. WHAT INFORMATION DO WE COLLECT?

Information is collected when you submit a request to us for one of the myRequest Services and in the course of delivering myRequest Services to you. Only information that is reasonably necessary is collected. The information we collect comes directly from you and our External Assessors. We may also collect information from other parties as specified in the particular myRequest Service information materials made available to you for the purposes of providing myRequest Services to you. The types of information we collect about you include:

(a) Contact Information: When you initiate a request for myRequest Services, either by (i) completing a registration process on our Portal; (ii) submitting a Request Form electronically; (iii) mailing or delivering a Request Form; or (iv) using other secure means that we may provide, you will be asked to provide various contact information, including your name, address, postal code, e-mail address or other personally-identifiable information as may be reasonably requested by us from time to time.

(b) Required Information: When you submit a request for myRequest Services, you will need to provide personally-identifiable information which may include personal health information. This may include information about you, your health benefits plan provider, your physician, and the prescription drugs that you take and/or are prescribed. You may also be asked to provide additional documentation, including documents completed and signed by your physician, in support of your request.

The Portal is made available to you for submitting the Required Information to us. You may also choose to provide the Required Information using a Request Form and sending or delivering the completed Request Form or making the information contained in it available to us. Note that if you choose to use our Request Form, we will enter the Required Information into our Portal on your behalf for the purposes of processing your request.

(c) Website Usage Information: When you access our Portal, the Portal uses “cookies”. Cookies are a technology that installs information on a website user’s computer to permit the website to recognize future visits using that computer. This information may include the date and time you access the Portal, the Internet address ofthe website from which you linked directly to the Portal, the Internet Protocol (IP) address assigned to you byyour Internet service provider, the operating system and browser you are using and any information accessedon the Portal. Cookies enhance the convenience and use of the Portal. For example, the information providedthrough cookies is used to recognize you as a previous user of the Portal, to track your activity at the Portal inorder to respond to your needs, to offer personalized web page content and information for your use, and to otherwise facilitate your website experience. You may choose to decline cookies if your browser permits, butdoing so may affect your use of the Portal and your ability to access certain features of the Portal.

We may also collect personal information from you when you contact us directly or through the Portal with inquiries. As e-mail communication is not a secure medium, if you have concerns about providing personal information by e-mail, you should mail or deliver to us such information at the address set out at the bottom of this Privacy Policy.

If you contact us, we may keep a record of the correspondence but we do not make any use of your e-mail address or other contact information, other than to respond to the communication. In the event we wish to use your personal information for any purpose, other than as set out in this Privacy Policy, we will obtain your consent before using the information.

The myRequest Services are not directed at children and we do not knowingly collect information from individuals under the age of majority in their province or territory of residence unless such information is submitted by an authorized representative with authority to accept and who has accepted this Privacy Policy on behalf of such under-age person.

3. WHAT DO WE USE YOUR PERSONAL INFORMATION FOR?

Reformulary Group collects and uses personal information, including personal health information, that you provide or that we collect in the course of providing myRequest Services to you, for instance when you access and use our Portal, submit a Request Form or otherwise communicate with us, for the following purposes:

  • To provide you with myRequest Services that you have requested from us, including using the information you submit through our Portal, a Request Form or other secure means to review your request and communicate the Request Decision to you;
  • To register you with our Portal and to authenticate Users for security purposes;
  • To provide customer service and support to you;
  • To contact you in connection with your request for myRequest Services, the Portal’s User account and your inquiries;
  • To administer our Portal and User account(s) and to manage the e-mails and other communications that we send or receive;
  • To understand, research and improve our myRequest Services , including to compile aggregated non-personally identifiable information for research, marketing and analytics purposes;
  • To track your activity on our Portal;
  • To improve our Portal’s performance and functionality;
  • To enforce our Terms of Service and other service agreements relating to the myRequest Services;
  • As permitted by, and to comply with, applicable laws and regulations;
  • To protect you, our customers and us and our service providers against fraud;
  • To notify you in connection with any changes to the myRequest Services or this Privacy Policy;
  • If you opted in to allow us to do so, to communicate with you about Reformulary Group, our products and services; and
  • Other purposes permitted by law.

4. HOW DO WE STORE YOUR PERSONAL INFORMATION

Reformulary Group currently stores and processes personal information provided to it or that it collects on servers located in Canada. Reformulary Group may, in the future, use other service providers to store and process your personal information. These service providers are only permitted, and all other service providers are only and will only be permitted, to store and process your personal information, and are not otherwise authorized to collect, use or disclose your personal information, except in accordance with the purposes set out in this Privacy Policy or as required by applicable law.

We may transfer your personal information to affiliates or other trusted third party service providers that operate in Canada so that they may store and process personal information on our behalf. By accessing and using myRequest Services or otherwise providing us with personal information, you agree to your personal information being transferred in accordance with the terms of this Privacy Policy and applicable data protection laws and regulations.

We take reasonable precautions to keep your personal information secure and require any third parties that handle or process your personal information for us to do the same. Access to your personal information is restricted to prevent unauthorised access, modification or misuse and is only permitted among our employees, agents or other third party service providers (including External Assessors) on a need-to-know basis. Notwithstanding such measures, we cannot guarantee that our security measures will prevent unauthorized access to, copying or use of your personal information or prevent your personal information being stolen or altered.

5. DO WE DISCLOSE ANY PERSONAL INFORMATION TO OUTSIDE PARTIES?

We will keep personal information that you provide to us private, and will disclose such personal information only in accordance with this Privacy Policy.

Reformulary Group does not sell, rent, or lease to third parties any personal information it collects from you. Reformulary Group may disclose or share personal information with its authorized employees, agents, affiliates, service providers including Amazon Web Services and legal representatives for the purposes described in this Privacy Policy. For example, we share your personal information with our External Assessors in order to provide you with the myRequest Services you have requested. We may also share your personal information with other parties as set out in the particular myRequest Service information materials made available to you prior to or at the time of your request for a specific myRequest Service.

If Reformulary Group is involved in the sale or transfer of some or all of its business, then Reformulary Group may disclose your personal information in connection with the sale or transfer but will require the acquiring organization to agree to protect the confidentiality of your personal information in a manner that is consistent with this Privacy Policy.

Reformulary Group may also sell or transfer non-identifiable information, such as summary or aggregated de-identified personal information for research, marketing and analytics purposes. For instance, we may analyze de-identified personal information in order to better understand our customers and market trends and may share our analysis and reports with third parties. This non-identifiable information is anonymized such that it cannot be used alone, or in combination with other information, to identify a specific individual and therefore is considered and treated as non-personal information for the purposes of this Privacy Policy.

We will not otherwise share your personal information with third parties without your consent, unless authorized or required by law or as disclosed to you when the information is collected or as specified in the particular myRequest Service information materials made available to you prior to or at the time of your request for a specific myRequest Service (including in this Privacy Policy). Reformulary Group may disclose your personal information to a government institution or agency that has asserted its lawful authority to obtain the information or where Reformulary Group has reasonable grounds to believe the information could be useful in the investigation of an unlawful activity, or to comply with a subpoena or warrant or an order made by a court, person or body with jurisdiction to compel the production of information, or to comply with court rules regarding the production of records and information, or to protect the Reformulary Group’s rights and property. Where it is justified or permitted to disclose your personal information to third parties, the use and disclosure of such information will be limited so that only that information which is required is used or disclosed.

The Portal, or related sites providing access to myRequest Services and e-mail or other messages or information we may send or make available to you sometimes contain hypertext links to the websites of third parties. We are not responsible for the privacy practices or the content of such third-party websites. Linked websites are maintained by third parties. Such links are provided for your convenience and reference only. Reformulary Group does not operate or control, in any respect, any information, software, products or services available on such third party websites. The inclusion of a link to a website does not imply any endorsement of the services or the site, its contents, or its sponsoring organization.

7. HOW DO WE PROTECT YOUR PRIVACY?

We keep the personal information we collect about you confidential in accordance with this Privacy Policy and retain such information only as long as necessary for the purposes for which it was collected. Access to your personal information is restricted to our authorized employees, agents, affiliates, service providers and legal representatives as described and for the purposes set out in this Privacy Policy. Personal information that is no longer required will be destroyed, erased or made anonymous according to our established guidelines and procedures.

We have adopted reasonable physical, technical and organizational procedures appropriate to the sensitivity of the data to protect the personal information you provide to us from loss, theft, unauthorized disclosure, copying and unauthorized use or modification. This includes limiting access of our employees to, and the use of, your personal information through the use of passwords and graduated levels of clearance. Notwithstanding these measures, no collection, storage or transmission of information over the Internet on websites or otherwise can be guaranteed to be 100% secure, and therefore we cannot ensure, warrant or guarantee the security of any such information.

By providing us with your personal information, including your personal health information, you consent to the collection, use, storage and disclosure of personal information for the purposes identified in and in accordance with this Privacy Policy. (This includes, where this Privacy Policy is accepted by an authorized representative on your behalf, to our dealing with the authorized representative on your behalf including in respect of the collection of your personal information from and disclosure of your personal information to such authorized representative.) Prior to us making your personal information available to any third party (other than as referred to in this Privacy Policy, e.g. to External Assessors), we will obtain your consent and let you know the identity of such third parties, the type of information that would be shared with them and why.

You may withdraw your consent to the collection, use, storage and disclosure of personal information about you at any time, subject to legal and contractual restrictions and reasonable notice. To do this, please contact our Privacy Officer by e-mail at PrivacyOfficer@reformulary.com. Please note that withdrawal of your consent to the collection, use, disclosure and storage of personal information may result in you being unable to continue using myRequest Services, including accessing our Portal.

9. VERIFYING AND AMENDING YOUR PERSONAL INFORMATION

Subject to certain exceptions prescribed by law, you will be given reasonable access to your personal information held by us and you may request that your personal information be corrected or updated. Under certain circumstances, it is possible that we may not be able to provide you with all of the information you may have requested. Exceptions may include information that is prohibitively costly to provide, information that contains references to other individuals, information that cannot be disclosed for legal, security or commercial proprietary reasons, or information that is subject to solicitor-client or litigation privilege. Fees may be applied to any copy of the requested personal information. We will provide the reasons for denying access upon request.

To access or amend your personal information, please e-mail or otherwise contact our Privacy Officer as set out below and we will assist you. You may be required to put your request in writing to confirm your request and identity. If you believe we have not dealt with your request to our satisfaction, you can submit a complaint to us to resolve your privacy-related issue.

We will make every reasonable effort to keep your personal information accurate and up-to-date. It is your responsibility to notify us of any changes to your personal information, including contact information, so we can contact you and inform you about updates to this Privacy Policy and any other relevant information with respect to your use of our Portal or myRequest Services you have requested.

10. COMPLAINT RESOLUTION PROCEDURE

We maintain procedures for addressing and responding to all inquiries or complaints from individuals about Reformulary Group’s handling of personal information. You may submit a privacy-related complaint by contacting our Privacy Officer. We will explain Reformulary Group’s complaint resolution procedure to you and investigate your complaint. If your complaint is justified, we will take all appropriate steps to resolve the issue, including changing our policies and practices if necessary. We will also let you know what other complaint procedures may be available to you.

11. PRIVACY POLICY CHANGES AND UPDATES

From time to time, we may need to update this Privacy Policy or our privacy practices or policies. We will let you know by posting changes on the Portal or our related sites that provide access to myRequest Services or through announcements sent or notified to you. Changes will be effective at the time of posting. It is your responsibility to review our Portal and such sites and to review any such announcements sent or notified to you for any changes. We may also notify you directly of any updates to this Privacy Policy or our privacy practices. Your continued access to myRequest Services, for instance through the use of our Portal, constitutes your consent to the contents of any updated policy.

This Privacy Policy was last updated in April 2026.

12. QUESTIONS?

If you would like more information about this Privacy Policy, the personal information collection, use, storage and disclosure policies and practices of the Reformulary Group or Reformulary Group’s policies and practices with respect to service providers, please contact our Privacy Officer by e-mail or at the address set out below.

You may also mail or deliver to us any documentation containing your personal information at: 55 York Street, Suite 200, Toronto, ON M5J 1R7.

Please let us know your questions or concerns and we will do our best to help you.

13. CONTACT

You may contact our Privacy Officer by email at PrivacyOfficer@reformulary.com.

You may also contact our Privacy Officer by mail or for delivery at 55 York Street, Suite 200, Toronto, ON M5J 1R7.