LEGAL

Privacy Policy.

Effective: [DATE — set on publication] Last updated: [DATE]

1. Who we are

This site, phant.ca, is operated by Phant, a brand of Canadian National Pharma Group (CNPG), a company incorporated in Canada with offices in Abbotsford, British Columbia. In this Privacy Policy, "Phant", "we", "us", and "our" refer to Phant and CNPG.

For privacy-related enquiries, contact us at info@cnpg.ca with the subject line Privacy.

[COUNSEL] Confirm whether a Data Protection Officer (DPO) needs to be named under UK/EU GDPR. If yes, name and contact the DPO here.

2. What this Policy covers

This Privacy Policy explains what personal information we collect when you visit phant.ca, how we use it, who we share it with, and the rights you have over it. It applies to:

Visitors to phant.ca, including the public Landing, Canada, and Medical pages.
People who submit one of our enquiry forms (Request COA, Sales Enquiry, Market Enquiry, Retailer Account Request).
Recipients of any direct correspondence from a Phant or CNPG email address.

It does not apply to the authenticated retail portal at phant.ca/retail, which has its own data terms accepted at sign-up.

3. What we collect

We collect the following categories of personal information:

Information you provide directly through forms:

Your name
Your role (where relevant — e.g., prescriber, pharmacist, distributor)
Your organisation (where relevant)
Your country
Your email address
Your phone number (where you provide it)
Free-text content of any enquiry message
For retailer account requests: business name and cannabis retail licence number

Information collected automatically when you visit the site:

IP address
Browser type and version
Operating system
Referring website
Pages visited and time spent
Approximate geographic location derived from your IP address

We do not knowingly collect special category data (health information, biometric data, sexual orientation, religious belief, political opinion, etc.). Where you mention health information voluntarily in a free-text enquiry — for example, a patient describing a condition — we treat that information with the heightened care it requires and process it only to respond to your enquiry.

[COUNSEL] Confirm whether the analytics tooling actually selected stores IP addresses (depends on configuration). If full IP is stored, this disclosure is correct; if anonymised IP is stored, adjust accordingly.

4. How we use it

We use your personal information for the following purposes, on the following legal bases:

Purpose	Legal basis (UK / EU GDPR)
To respond to your enquiry submitted through a form	Performance of a contract / legitimate interests
To send you the documentation you have requested (e.g., Certificate of Analysis, prescriber brief)	Performance of a contract
To process retailer account applications	Performance of a contract / legitimate interests
To meet our regulatory obligations (e.g., pharmacovigilance reporting, traceability)	Legal obligation
To improve the site and understand how visitors use it	Legitimate interests
To detect and prevent fraud, abuse, or unlawful access	Legitimate interests

We do not use your personal information for marketing or to send you newsletters unless you have explicitly opted in. We do not sell your personal information.

5. Who we share it with

We share your personal information only with the following categories of recipients, and only as necessary for the purpose:

Our hosting and infrastructure providers — for example, the platform that hosts this site, the service that processes form submissions, and the email service that delivers our responses.
Our licensed medical distributors in your market — where you have submitted an enquiry that requires routing to the regulated distribution chain in your country.
Our professional advisers — including legal, accounting, and regulatory advisers, where necessary.
Regulators and law enforcement — where required by law, including under pharmacovigilance reporting obligations.

We require all third parties that process your personal information on our behalf to do so under a written agreement that includes appropriate data protection terms.

[COUNSEL] Confirm specific named processors here once tech stack is finalised — hosting platform, email/forms provider, analytics provider. Each one needs a Data Processing Agreement on file.

6. International transfers

Phant operates from Canada. The information you submit may be transferred to, stored in, or processed in Canada and other jurisdictions where our service providers operate. Where personal information is transferred outside the United Kingdom, the European Economic Area, or your home jurisdiction, we use appropriate safeguards including:

Transfers to jurisdictions covered by an adequacy decision (Canada is recognised as adequate for transfers from the UK and EU under existing decisions).
Standard Contractual Clauses where required.
Binding Corporate Rules where applicable.

[COUNSEL] Confirm current adequacy status for Canada at the time of publication. The UK and EU adequacy decisions for Canada are limited to private-sector commercial activities; verify scope.

7. How long we keep it

We keep your personal information only for as long as necessary for the purpose we collected it for. In practice:

Enquiry correspondence — retained for up to 24 months after the most recent contact, to allow us to follow up on prior conversations and to maintain a record of clinical or regulatory enquiries.
Documentation requests (e.g., COA, prescriber briefs) — retained as part of our regulatory record-keeping for the period required under applicable medicines regulations in each market we supply, which may exceed 24 months.
Retailer account applications — retained for the duration of the retailer relationship, plus the period required by Health Canada record-keeping rules.
Pharmacovigilance records — retained for the period required under applicable medicines regulations in each market.
Analytics data — retained in aggregated form indefinitely; identifiable data is deleted within 14 months.

[COUNSEL] Confirm specific retention periods against Health Canada, MHRA, BfArM, SÚKL, SAHPRA, and TGA record-keeping requirements. The 24-month figure for enquiries is a defensible default; longer periods for regulatory records are jurisdiction-specific.

8. Your rights

Depending on the jurisdiction you reside in, you have some or all of the following rights over your personal information:

The right to access the personal information we hold about you.
The right to correct inaccurate or incomplete personal information.
The right to request deletion of your personal information, subject to our regulatory record-keeping obligations.
The right to object to certain processing.
The right to restrict processing in certain circumstances.
The right to data portability for information you have provided to us.
The right to withdraw consent at any time, where processing is based on consent.
The right to lodge a complaint with your data protection authority (in the UK, the Information Commissioner's Office; in Canada, the Office of the Privacy Commissioner of Canada; in the EU, your national data protection authority; in South Africa, the Information Regulator; in Australia, the Office of the Australian Information Commissioner).

To exercise any of these rights, contact us at info@cnpg.ca. We will respond within the timeframe required by your jurisdiction (one calendar month under UK and EU GDPR; 30 days under PIPEDA).

Some rights are subject to limitations — for example, we may be required by law to retain certain pharmacovigilance or batch-traceability information for a defined period and cannot delete it on request.

9. Cookies and tracking

This site uses cookies and similar tracking technologies. Our use of cookies is described in our separate Cookie Policy. You can manage your cookie preferences at any time using the cookie banner or the controls in your browser.

10. Security

We take appropriate technical and organisational measures to protect your personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These include encryption of data in transit, restricted access to personal information on a need-to-know basis, and regular review of our security practices.

No transmission of information over the internet is fully secure. We cannot guarantee the security of information you transmit to us, and you do so at your own risk.

11. Children's privacy

This site is not directed at children. The Canada Adult-Use site is restricted to visitors of legal cannabis age in their province (18 in Alberta, 21 in Quebec, and 19 in all other provinces and territories) by an age-gate at first visit. The Medical site is intended for medical professionals, licensed distributors, and adults researching cannabis-based medicines. We do not knowingly collect personal information from anyone under the age of majority in their jurisdiction.

If you believe we have collected personal information from a child, contact us at info@cnpg.ca and we will delete the information.

12. Changes to this Policy

We may update this Privacy Policy from time to time. The effective date at the top of this page indicates when it was last updated. Material changes will be communicated through a notice on the site at least 30 days before they take effect.

13. Contact

For privacy questions, requests, or complaints:

Email: info@cnpg.ca · subject line Privacy Post: Phant / Canadian National Pharma Group, 31270 Wheel Avenue, Abbotsford, British Columbia, Canada

[COUNSEL] Some jurisdictions (e.g., UK GDPR Article 27) may require an EU/UK representative if Phant has no establishment in those regions; confirm whether this applies.

This Privacy Policy was last updated on [DATE] and is published by Phant, a brand of Canadian National Pharma Group.