Your data is collected by SilverCloud in a few ways:

• Data you give directly
• Data we collect automatically when you use SilverCloud

Here is a list of the categories of personal data that are collected and used, with examples. Some of these are optional. The purposes for why this information is collected are described below.

• First Name/Alias
• Email address
• Gender identification/expression
• City/Town
• Province
• Age range
• Health data
• Data about your use of SilverCloud
• Feedback data

Contact details

Email address will tie to your account and be used to send you notifications etc.

Optional personal information

Interests, likes/dislikes, profile image, etc.

Health data

SilverCloud collects information related to; answers to psychological questionnaires and calculated results; entries to interactive tools such as a list of problems, recording mood over time, or journal entries; messages between clients and coaches. This data is used to report on outcomes, utilization, and engagement in aggregate.

Data about your use of SilverCloud

Your employer code when you first signed up, pages and sections viewed, other actions you take on SilverCloud, emails sent to you, server errors that affect you, etc.

When you log in and log out, your IP address, browser type and version, time zone and language, notification preferences.

Your login details (username, encrypted password).

Feedback data

Your feedback in the “progress points” at the end of each module; User experience questionnaires; Other questionnaires where it is indicated that the recipient is SilverCloud.

Data we do not collect

SilverCloud is intended for use by people aged 16 years or over and we do not knowingly collect personal data from people under 16 years of age.

SilverCloud processes your data for specific purposes and where there is a legal basis.

• Provide SilverCloud platform and programs
• Technical support
• Understanding usage and improving service

Provide SilverCloud platform and programs

SilverCloud collects and processes your data under a contract with Shoppers Drug Mart Inc., to provide you with secure access to the SilverCloud platform and programs.

SilverCloud uses your data to display program pages, record your activity on interactive tools, store your preferences, send notifications by email, or push notification, etc.

When applicable, SilverCloud shares your personal information with your behavioural health coach, who is a third-party service provider. Your coach only has access to personal information that is necessary to perform their functions, and is contractually obligated to maintain the confidentiality and security of your personal information. Authorized Shoppers Drug Mart Inc. program administrators have access to personal information for the sole purpose of managing and delivering the SilverCloud platform to end users.

Technical support

SilverCloud provides technical support to end users, and so we will review your personal data if required when you contact us by telephone, email, or through the SilverCloud platform.

Understanding usage and improving service

SilverCloud analyzes personal data to understand usage and to help us improve the platform and programs.

We only share non-identifiable data that is in aggregate about users of SilverCloud with Shoppers Drug Mart Inc. so that it can understand how many individuals use SilverCloud and what engagement is like in general. No personal information is shared with Shoppers Drug Mart Inc.SilverCloud processes data for this purpose on behalf of your service and also on our own behalf.

Most analysis uses anonymous aggregate data (for example, average length of time spent on the platform). Some analysis uses individual data, with additional safeguards in place such as anonymisation, use of pseudonyms (pseudonymisation), and limiting the set of individual data (data minimization). This analysis may include profiling, machine learning, or other techniques.

Where SilverCloud is processing your data for these purposes on its own behalf it is necessary for our legitimate interests or those of a third party (such as our partners) to:

• understand efficiency and effectiveness of SilverCloud’s services
• identify opportunities for improving services, components, or tools
• provide customers with an understanding of how their use of the service might be improved
• provide statistical and market data to guide business development
• identify and understand trends in interactions with the SilverCloud platform
• understand the needs and specific contexts of different groups, by using information on medical and psychological factors (e.g. existing conditions, previous treatment)

We also believe that this processing does not undermine your fundamental rights and freedoms.

Where we process your data for this purpose, the processing is necessary for scientific research purposes or statistical purposes and we ensure appropriate safeguards, mentioned above, are in place.

You have rights regarding your personal data. If you have any questions please contact SilverCloud.

Right to information about processing of your personal details

The aim of this privacy notice is to give you this information.

Right to access your personal data

You have the right to know if your personal data is being held, what categories of data are held, and to receive a copy of all data about you.

Right to change or remove your details

You have the right to correct any inaccurate data, or remove data if it is not necessary for us to hold it.

Right to object to processing

You can object to processing if it could affect your rights, freedoms or interests.

Right to data portability

We will provide your data in a portable format.

Right to lodge a complaint

You also have the right to lodge a complaint with a supervisory authority.

Contact details for the Office of the Privacy Commissioner of Canada can be found at www.priv.gc.ca/en/.

We use third party sub-processors to host the SilverCloud platform and communicate with you.

Amazon Web Services

We use Amazon Web Services to host the SilverCloud platform and database, store encrypted backups and send email notifications.

Location of processing: AWS Canada (Central), Montréal, Quebec

AWS Privacy Policy

Zendesk

Zendesk International Limited, One Grand Parade, Dublin 6, D06 R9X8, Ireland

We use Zendesk to handle technical assistance communication.

Location of processing: US and EU

Zendesk Privacy Policy

Links to other websites

You should also be aware that where you link to another website from SilverCloud, that SilverCloud has no control over that other website. Accordingly, SilverCloud cannot guarantee that the controller of that website will respect your privacy in the same manner as SilverCloud.

We are committed to ensuring that your information is secure. In order to prevent unauthorized access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online.

All SilverCloud employees are contractually and ethically bound to respect the confidentiality of any personal data held by SilverCloud.

SilverCloud maintains ISO 27001:2013 certification.

SilverCloud will retain your personal data only in accordance with its Personal Data Retention Policy.

We will revise this privacy notice when necessary and we encourage you to check back in future for changes.

24 Febuary 2023

Update to SMS service provider