Privacy Policy

The Jack & Jill Health Inc. (“JackHealth,” “we,” or “us”) Privacy Policy (“Policy”) was last updated on September 9, 2026. The most up-to-date version of this Policy is posted at https://jack.health/privacy-policy. We reserve the right to revise this Policy at any time to reflect changes in Applicable Law, our practices or the JackHealth Platform.

At JackHealth we want you to feel confident and protected by providing you with clear information about how we handle your Personal Information and Personal Health Information (“Information”).
JackHealth is committed to your privacy by complying with applicable federal laws and regulations including the Personal Information Protection and Electronic Document Act (“PIPEDA”) and provincial health legislations.

Definitions
The words and phrases used in this policy have the same meaning as in JackHealth’s Terms of Use.
“Authorized Healthcare Prescriber” means a physician or nurse practitioner registered to practice in a Province or Territory of Canada and is permitted to provide Healthcare Services and/or Informational Services through the JackHealth Platform.
“Authorized Healthcare Professional” means a regulated health professional registered to practice in a Province or Territory of Canada and is permitted to provide Healthcare Services and/or Informational Services through the JackHealth Platform.
“Applicable Law” means laws and regulations JackHealth, Authorized Healthcare Prescribers, Authorized Healthcare Professionals and Users must abide by.
“Device” means a mobile or desktop device owned or controlled by a User and is used to access JackHealth Services.
“Healthcare Services” means providing health care including the discussion of PHI by an Authorized Healthcare Prescriber or Authorized Healthcare Provider through the JackHealth Platform.
“Informational Services” means offering general information about a disease or condition, and not patient specific health information. It is for educational purposes only and for clarity. It does not include a diagnosis, treatment or advice based on observation, examination or assessment of a particular patient.
“JackHealth Platform” means the hardware, software, applications, websites, content, products and services owned and/or operated by JackHealth Inc., that enables Authorized Healthcare Prescribers and Authorized Healthcare Providers to deliver Healthcare Services and Informational Services to Users.
“Personal Health Information” (“PHI”) means information specific to an individual’s health or healthcare that is subject to Applicable Law and that is collected, created, compiled, used, disclosed or otherwise transmitted and/or stored on or by means of the JackHealth Platform.
“User” (“you”, “your”) means an individual who has created and registered a JackHealth User Account in accordance with our Terms of Use and is eligible to receive Healthcare Services and/or Informational Services through the JackHealth Platform.
JackHealth Corporation uses a number of safeguards to protect the privacy of Users and the confidentiality of their Information. When discussing Informational Services, PHI is not required, and we advise you not to submit this information in the course of accessing Informational Services.

After reviewing this policy, if you still have questions, contact our Chief Compliance Officer as indicated below.

What is Personal Information?
Personal Information is any information which identifies you. This could include, but is not limited to your name, contact information, and information related to your PHI. This could include information related to your family health history, identification of a User to provide healthcare services, and your JackHealth username and password.

How is Personal Information collected by JackHealth?
Personal Information is collected in compliance with PIPEDA, and other provisions under Applicable Law. Personal Information is collected to register Users, create User accounts (“Account”), authenticate login credentials, and personalize the User experience while using the JackHealth Platform.

JackHealth may collect Personal Information from Users directly, and/or from third parties, where we (and/or the third party) have obtained your consent, or as otherwise permitted by law.

JackHealth will collect and use Information only as necessary to provide our services. This includes to develop, assess, and improve our services. We will only collect Personal Information if non-identifying information is not sufficient. We minimize our collection and use of Personal Information to what is needed for the purposes stated above. For example, we do not record the audio or video portions of interactions between Users and Authorized Health Care Practitioners and between Users and Authorized Health Care Providers through the JackHealth Platform.

How do we use User Personal Information?
JackHealth will obtain consent and use Personal Information only as necessary to provide our services, such as:

• To facilitate, administer, and confirm User eligibility to access JackHealth services

• To provide services requested on your behalf (e.g. contact your pharmacy)

• To facilitate communications with applicable service providers in your jurisdiction with whom we have a contractual relationship including, but not limited to Physicians, Nurse Practitioners, and Pharmacists

• To track User purchases, arrange for refills and manage prescription renewals

• For billing purposes, including private insurance and provincially insured services

• To personalize Users experience while using the JackHealth Platform, including updates and service announcements

• To obtain feedback regarding our operations and improve the services of JackHealth

• To investigate legal claims

• For loss prevention, anti-fraud purposes, and to comply with regulatory and legal requirements

• Other purposes as permitted by law, and for which JackHealth may obtain consent

When and to whom is User Personal Information shared?
Jack&Jill Health uses several safeguards to protect the privacy of Users of the JackHealth Platform and the confidentiality of their Information. Instances in which Information can be shared include:

• Transferring Personal Information to a provider of our services such as Physicians, Nurse Practitioners, Pharmacists, telephone support or data storage and processing providers

• In the event of an emergency at the reasonable judgement of JackHealth or a third party service provider, disclose with whom we have a contractual relationship to emergency contacts, a public authority, an agent of public authority, or another party

• Disclosure of Information to an insurer with consent

• Disclosure of Personal Information to a potential acquirer in connection with a transaction involving the sale of some or all of the business of JackHealth

When and how do we obtain consent?
Consent is obtained at that time Personal Information is collected, prior to the use or disclosure of this Information for any purpose. Consent can be provided electronically, in writing, or orally. The form of consent required, including whether it is expressed or implied, depends on the sensitivity of the Information, and reasonable User expectations in the circumstances. We may rely on a third party to obtain your consent to the sharing of Personal Information with us.

You may withdraw consent at any time by providing JackHealth with notice in writing, expressly instructing that your personal health information not be used, or disclosed for healthcare purposes without consent.
Where do we store Personal Information?
We store your information in electronic format within Canada, using computer systems with restricted access and housed in facilities using physical security measures. More generally, we have in place appropriate physical, technological, and organizational safeguards to protect Information against loss, theft, and unauthorized access, use and disclosure.

J&J Health Mobile App
This section applies specifically to the J&J Health mobile application (“Mobile App”). The Mobile App is a personal weight and GLP-1 medication tracking tool. It does not provide medical advice, diagnoses, treatment recommendations or prescribing services.

When a User creates an account or uses the Mobile App, JackHealth may collect:

• The User’s email address, which is used to register, authenticate and manage the User’s account;

• A unique User or account identifier; and

• Health information entered by the User, including weight, target weight, height, body mass index, medication, dosage, injection date, injection site, symptoms and free-form descriptions of symptoms.

This information is linked to the User’s Mobile App Account. JackHealth uses it to authenticate the User, save and display the User’s information, provide progress summaries, operate the Mobile App and protect the security of the User’s account.

The Mobile App does not collect a User’s first or last name. It does not collect product-interaction information for analytics and does not use Personal Information for third-party advertising, advertising measurement or tracking Users across apps, websites or services owned by other companies.

JackHealth may transmit this information to service providers that support the Mobile App’s authentication, hosting, database storage and processing functions. These service providers may process the information only to provide services to JackHealth and are subject to appropriate confidentiality and data-protection requirements. JackHealth does not sell this information or share it with data brokers.

Information collected through the Mobile App is protected, stored and retained in accordance with the security, storage and retention provisions of this Policy.

Users may initiate a request to delete their Mobile App Account through the account settings within the Mobile App. After verifying the request, JackHealth will delete the account and associated Personal Information within 30 days, except for information that JackHealth is legally required or permitted to retain. JackHealth will notify the User when the deletion has been completed.

How long will we use, disclose, or retain User Personal Information?
Unless we otherwise give you notice, we will retain your Information on the JackHealth Platform on your behalf until such times as you or we terminate your User Account. On termination of your User Account, we will delete the Information associated with your User Account.
JackHealth will use and disclose your Information as long as necessary to fulfil the purposes for which they were collected and as permitted by law.

How can Users review Personal Information that we have collected, used, or disclosed or correct inaccurate Personal Information?
You can access your Information to check that it is accurate, complete, and up to date by making a request to help@jack.health.

Users can update and correct any Information except Information an Authorized Healthcare Prescriber or Authorized Healthcare Provider has viewed or created. To correct Information that has been viewed or created during a Healthcare Services consultation making a request to help@jack.health.

Contact the Authorized Healthcare Prescriber or Authorized Healthcare Provider who provided the Healthcare Services to access or request the correction of Information in their notes on the JackHealth Platform or that they hold in their medical records.

How fast will we respond to User written requests?
We will attempt to respond to each User written request within 30 days of receipt. We will advise Users in writing if we cannot meet your request within this time limit. You have the right to make a complaint to the Privacy Commissioner of Canada, and/or the appropriate provincial privacy governing body.

Is there a cost for User to request details about their Personal Information or our privacy practices?
JackHealth will not charge any costs for Users to access their Personal Information in our records, or to access our privacy practices without first providing Users with an estimate of appropriate costs, if any. Users may be requested to provide sufficient information to permit access to the existence, use, or disclosure of their Personal Information. Any such identifying information shall be used only for this purpose.

Do you verify Users requesting their Personal Information?
Users could be requested to provide sufficient information to permit access to the existence, use, or disclosure of their Personal Information. Any such identifying information will be used only for this purpose.

Who is accountable for my Personal Information?
In most of the provinces in which JackHealth operates, JackHealth has overall responsibility for protecting the privacy of your Personal Information, including PHI collected in connection with the provision of health services through the JackHealth Platform by a healthcare provider, such as a physician or nurse practitioner.

What safeguards are in place to protect User Personal Information?
JackHealth takes the security of your information seriously. We have measures in place to protect User Personal Information. This includes including physical, organizational, contractual and technological safeguards to protect Information from loss or theft, unauthorized access, disclosure, copying, use or modification.

JackHealth Personnel are obligated to protect Information by adhering to our policies, practices and Applicable Law.

Users play an important role in protecting your privacy and the confidentiality of your Information. You can do so by taking the following precautions:

• Create a strong and unique password for your User Account, using JackHealth’s password strength estimator, and update it periodically.

• Do not share your User Account or password with anyone. We will never ask you for your password, including in any unsolicited communication such as letters, phone calls or email messages, so please contact us if you receive such a request.

• Log out of your User Account once you are finished using it, especially if you share your Device with anyone else.

• Have a strong and unique password on your Device, too.

• Choose a quiet, private location from which to receive services from Authorized Healthcare Prescriber or Authorized Healthcare Provider
  ‍

Notwithstanding the safeguards we have and our commitment to protecting Information, we cannot guarantee the security or error-free transmission or storage of Information. There are risks inherent in the use of electronic means to transmit and hold Information in electronic format. These risks can be minimized but not eliminated using appropriate security measures, such as the measures JackHealth employs. These risks include interception, loss, corruption, unauthorized access to, use and disclosure of Information, and delay in the availability of Information.

Cookies and De-identified Data
This section applies to JackHealth websites, web-based services, email messages and marketing materials. It does not apply to the J&J Health Mobile App. The Mobile App does not collect product-interaction information for analytics and does not use Personal Information for third-party advertising, advertising measurement or tracking across apps, websites or services owned by other companies.

JackHealth may collect and use data collected through JackHealth websites and web-based services that no longer identifies an individual User. This data may be used to monitor and improve JackHealth websites and services, make them more accessible and useful, conduct research, produce statistical information and support product and marketing research. JackHealth will not use this data to re-identify an individual User.

JackHealth websites, email messages and marketing materials may use cookies and similar technologies, including pixel tags and web beacons. These technologies allow JackHealth to better understand how visitors use its websites and communications, identify which portions are most frequently visited and measure the effectiveness of advertisements and communications.

Users can configure their browsers to refuse cookies. If cookies are blocked, certain features of JackHealth websites may not function correctly.

JackHealth may use third parties, such as advertising platforms, ad exchanges and data companies, to display advertisements on JackHealth websites. These companies may use cookies or similar technologies to report visits, measure advertising effectiveness and display advertisements that may be relevant to a User’s interests, subject to Applicable Law and the User’s available privacy choices.

By using JackHealth websites without disabling cookies through the browser or available consent controls, a User consents to their use as described in this section. Additional information about interest-based advertising choices is available at https://youradchoices.ca/choices.

It’s your choice:
The JackHealth Platform offers you functionality and choices for protecting your privacy including:

• whether you want to use audio, chat, or video for interactions with Authorized Healthcare Prescribers or Authorized Healthcare Providers

• Withholding Information with the understanding that an Authorized Healthcare Prescriber or Authorized Healthcare Provider may be unable to provide you with Healthcare Services as a result. They will advise you of the implications of your choice

• any previous Information collected when seeking Informational services will not be accessible by Authorized Healthcare Prescriber or Authorized Healthcare Provider providing the services unless you specifically elect to provide access

• whether you would like to receive communications by email or SMS

• opting out of receiving non-essential communications by logging in to your User Account and updating your preferences. For clarity, service announcements including updates to our policies and Terms of Use and software are not considered non-essential communications

Contact
Please contact us directly at help@jack.health for assistance with using the privacy functionality or with any questions about using the JackHealth Platform.

You may contact us at any time to stop receiving emails or other correspondence from us or to seek assistance with viewing or correcting Information. Users of the J&J Health Mobile App may initiate a request to delete their Mobile App Account through the account settings within the Mobile App. After verifying the request, JackHealth will delete the account and associated Personal Information within 30 days, except for information that JackHealth is legally required or permitted to retain. JackHealth will notify the User when the deletion has been completed. A User who cannot access the Mobile App may contact help@jack.health for assistance with an account deletion request.

If you have any questions, concerns or suggestions about our privacy practices, please contact our Chief Compliance Officer. Please include your name and contact information if you’d like us to respond to you.

Jack & Jill Health Inc.
ATTN: Chief Compliance Officer
help@jack.health
1-877-328-2042
222 Bay Street, Suite 3000, P.O. Box 53,

Toronto, Ontario M5K 1E7