Privacy Policy

Lettuce Inc. and our corporate affiliates (“Lettuce” or “we”, “us” or “our”) respect your privacy. This privacy policy (this “Privacy Policy”) describes the manner in which we collect, use, disclose, and protect your personal information. It applies to our website and mobile application (together, the “Platform”), and related service offerings. We will only use your personal information in accordance with this Privacy Policy except where otherwise permitted or required by law. By using the Platform, you consent to the practices described in this Privacy Policy.

Lettuce is not affiliated with, and is not responsible for, the privacy practices of the medical practitioner, or other service provider providing the services for which you seek financing from Lettuce.

1. What is Personal Information?

Personal information means information about an identifiable individual, including information that can be used on its own or with other information to identify, contact, or locate a single person. Generally, personal information does not include business contact information used to contact you in your business capacity, including your name, title, business phone number or business email address.

2. What Personal Information Does Lettuce Collect?

We may collect several types of personal information, including:

• Contact and identification information. For example, your name, birth date, residence address, telephone number, email address, SIN number, copies of identification documents, and a photographic image of you.

• Employment information. For example, your employment status, employer, professional title, and income.

• Loan administration information. For example, your loan repayment history and other information collected in the course of administering your loan.

• Credit information. For example, credit reports, and other credit information (collectively, “Credit Information”).

• Financial account information. For example, your bank account information, account balances, transaction history, information with respect to mortgage payments and other expenses, and loan administration information (collectively, “Financial Account Information”).

• Information with respect to the services being financed. For example, information relating to the type and cost of services being financed (but not clinical or diagnostic information), and the service provider.

• Your personal preferences. For example, your consent to receive marketing communications, and your preferences based on your settings and past use of the Platform.

• Technical information. For example, IP address, browser type and version, operating systems, length of visit on the Platform, page views and website navigation paths.

• Other information you provide us. For example, information contained in or relating to any communication that you send to us, such as in connection with a job application.

3. How Does Lettuce Collect Personal Information?

We typically collect personal information from you directly, for example, when you send us an email or fill out a form. However, sometimes we may collect personal information about you in other ways, including:

• Publicly available information. We may collect your personal information from publicly available sources.

• Consumer reporting agencies. We may collect your Credit Information from consumer reporting agencies in accordance with our Terms of Service.

• Financial institutions. We may collect your Financial Account Information from your bank or other financial institution in accordance with our Terms of Service.

• Cookies. Please see “6. Our Platform” below for information about our use of automatic data collection tools on our Platform.

If you provide us with personal information about a third party, we rely on you to obtain all necessary consents to permit us to collect, use and disclose the personal information for the purposes for which the information was collected and as set out in this Privacy Policy.

4. For What Purposes Does Lettuce Use Personal Information?

We may use your personal information to provide and improve our services, including in connection with:

• Account management. We use your personal information to verify your identity and manage your account.

• Make financing decisions. We use your personal information to assess your creditworthiness, including to make lending decisions using our proprietary automated model.

• The provision of services. We use your personal information to provide to administer your loan.

• Marketing and recommendations. We use your personal information to send you marketing communications, recommend features, products, and services that might be of interest to you, identify your preferences and personalize your experience with the Platform. You may withdraw your consent to receive marketing communications at any time. See “11. Contact Us” for contact details.

• Improve Lettuce. We use your personal information to operate, evaluate and improve our business, including to provide functionality, analyze performance, fix errors, develop our proprietary automated models, and improve the usability and effectiveness of the Platform.

• Employment. Lettuce may use your personal information to administer and process your application for employment.

• Other. We may use your personal information as required or permitted by applicable laws, to prevent fraud or criminal activity, to protect or enforce the rights of Lettuce and to safeguard the security of our clients, Lettuce and others.

In particular, we use your Credit Information and Financial Account Information for the following purposes: (i) to verify your identity and authenticate your financing application; (ii) to assess your creditworthiness and make credit decisions; (iii) to develop and use internal proprietary models, analytics, and risk scores (including assigning you a proprietary risk score); (iv) the ongoing administration, servicing, and collection of your loan or account; and (v) compliance with legal and regulatory requirements, including fraud prevention.

5. How Does Lettuce Share Personal Information?

Lettuce does not sell your personal information. However, we may share your personal information as follows:

• With our corporate affiliates. Lettuce may share personal information amongst our corporate affiliates that are also subject to this Policy.

• With our service providers. Lettuce may disclose your personal information to Lettuce’s service providers who perform services on our behalf such as consumer reporting agencies (to obtain credit reports) and other services providers that perform, without limitation, pre-authorized payment processing, identification verification, financial data collection, loan collections, data hosting, Platform analytics, advertising, and contract administration services. When we do use an outside company, we enter into a contract that requires it to use and protect your personal information in a manner that is consistent with this Privacy Policy.

• With your service providers. Lettuce may disclose your personal information to the medical practitioner, or other service provider providing the services for which you seek financing from Lettuce, in connection with your application for financing from Lettuce. This information may include, without limitation, your contact information, information regarding the services received and your available credit with us, even if you do not transact. Your service provider may use this information to contact you.

• With credit reporting agencies. Lettuce may disclose your accountrelated information, such as credit limits, balances, and payment history, to consumer reporting agencies, where permitted or required by applicable law, including for purposes of credit adjudication, account administration, and maintaining the accuracy of consumer credit files.

• With any successor to all or part of our business. Lettuce may disclose your personal information in connection with a proposed or actual business transaction, such as a corporate reorganization, merger or acquisition, or the sale of some or all of Lettuce’s business or assets, but Lettuce will require that the information recipient agrees to use and protect your personal information in a manner that is consistent with this Privacy Policy and applicable privacy laws.

• Other. Lettuce may disclose your information as permitted or required to comply with any court order, law, or legal process, including to respond to any government or regulatory request. We may also disclose your personal information to prevent fraud or criminal activity, to protect the rights and interests of Lettuce, and to safeguard the security of our customers, Lettuce and others.

We may transfer, process, and store your personal information in and to a foreign country, including, without limitation, the United States. Such countries have different privacy laws that may or may not be as comprehensive as Canadian law. In these circumstances, the governments, courts, law enforcement, or regulatory agencies of that country may be able to obtain access to your personal information through the laws of the foreign country. Whenever we engage a foreign service provider, we require that its privacy and security standards adhere to this policy and applicable Canadian privacy legislation. You are welcome to contact us to obtain further information about our policies regarding service providers outside of Canada, including (i) the countries where collection, use, and disclosure of personal information may occur; and (ii) the purposes for such collection, use, and disclosure. See “11. Contact Us” for contact details.

6. Our Platform

• Cookies. Our Platform uses cookies and similar technologies (such as clear GIFs, web beacons and pixel tags) to operate and improve our Platform. For the purposes of this Privacy Policy, we refer to all such technologies as “cookies”. Some cookies are necessary for the Platform to function properly, including to enable core functionality and security. We may also use optional cookies, such as analytics cookies, to understand how users interact with our Platform and to improve its performance and usability. Where required by applicable law, we will obtain your consent before placing nonessential cookies on your device. You may withdraw or modify your consent at any time through your browser settings or other available tools. Most web browsers also allow you to control cookies through their settings. However, if you refuse to accept cookies, certain parts of the Platform may not work properly.

• Interest-Based Ads. We may use cookies to collect information about your online activities over time and across third-party websites or other online services in order to deliver interestbased advertising. The information collected for this purpose may include details such as the pages you visit, the content you view, the links you click, your approximate location, and technical information about your browser or device. This information is generally used in aggregated or pseudonymous form to infer interests and deliver more relevant advertising. Where required by applicable privacy laws, we will obtain your consent before using cookies for interestbased advertising. You may withdraw your consent or opt out of interestbased advertising at any time. To learn more about interestbased advertising or to opt out, please visit the Digital Advertising Alliance of Canada’s optout tool at: https://youradchoices.ca. Please note that opting out does not stop advertisements from being displayed, but it may make the ads you see less relevant to your interests.

• Analytics. Our Platform may use web analytics services, such as Google Analytics, to help us understand how visitors interact with the Platform and to improve its performance and usability. These services use cookies to collect and analyze information about website usage. For example, Google Analytics uses cookies to generate information about your use of our website (which may include your IP address). This information is transmitted to and stored on servers operated by Google and is used on our behalf to evaluate Platform usage and to compile reports on Platform activity, such as mostvisited pages, time spent on the site, search terms, and other aggregated engagement metrics. You can prevent the collection and processing of data relating to your use of our Platform by Google by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en. You can also obtain additional information on Google Analytics’ data privacy and security practices at the following links:

https://policies.google.com/technologies/partner-sites
https://support.google.com/analytics/topic/2919631

• Third-party links. Our Platform may contain links to third-party Platforms which are provided solely for your convenience and information. As will be evident, when you click on one of those links, you will be leaving Lettuce’s Platform and going to the third party’s Platform. Any information provided to such third parties is governed by their privacy policies, which you may read on the applicable sites. Lettuce has no responsibility or liability for, or control over, the collection, use, and disclosure of your personal information by the owners of those third-party Platforms.

7. Retention and Protection of Personal Information

Lettuce retains your personal information for as long as necessary to fulfill the purposes identified in this Privacy Policy, including to comply with applicable legal, regulatory, tax, accounting and reporting requirements applicable to financial institutions and lenders. Under some circumstances, we may anonymize your personal information so that there is no serious possibility that you could be identified, whether through the information alone or in combination with other available information. Anonymized information is not subject to applicable privacy laws. We may use anonymized information for legitimate business purposes, such as analytics, research, service improvement, and business planning.

Lettuce employs safeguards, including organizational, technical, and physical measures, appropriate to the sensitivity of the personal information in its possession or under its control to protect that information from unauthorized access, collection, use, disclosure, disposal or similar risks. While Lettuce uses reasonable efforts to protect your personal information, no method of transmission over the internet or method of electronic storage is 100% secure, and therefore, Lettuce does not guarantee the security of your personal information.

8. Accuracy, Access to Personal Information and Withdrawing Consent

You have the right to request access to and to correct the personal information that we hold about you. You may exercise these rights by contacting us using the information provided below under “9. Contact Us”. We may request specific information from you to help us confirm your identity and your right to access and provide you with the personal information that we hold about you or make your requested changes. Applicable law may allow or require us to refuse to provide you with access to some or all of the personal information that we hold about you, or we may have destroyed, erased, or made your personal information anonymous in accordance with our record retention obligations and practices. If we cannot provide you with access to your personal information, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

Where you have provided your consent to the collection, use, and transfer of your personal information, you may have the legal right to withdraw your consent under certain circumstances. To withdraw your consent, contact us using the information provided below under “9. Contact Us”. Please note that if you withdraw your consent we may not be able to provide you with a particular product or service.

You also have the right to file a complaint with the Office of the Privacy Commissioner of Canada or applicable provincial regulator if you believe your privacy rights have been violated.

9. Minors

We do not willingly collect personal information concerning minors under the age of majority in their jurisdiction (typically 18 or 19 years old) unless we have obtained the prior valid consent of a person having parental authority or a tutor. If you have grounds to believe that we keep any such personal information unwillingly, please contact us using the information provided below under “10. Contact Us” so that we can make verifications and take the appropriate actions, if applicable.

10. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes to our privacy practices. We include the date that this Privacy Policy was last revised at the top of the page. We recommend that you review this Privacy Policy from time to time to ensure you are familiar with the current version. Your continued use of the Platform after we make changes to this Privacy Policy indicates that you accept and consent to those changes.

11. Contact Us

Lettuce has designated a Privacy Officer responsible for compliance by Lettuce with applicable privacy laws. If you have any questions regarding this Privacy Policy or wish to submit a request to exercise your privacy rights, please contact us at:

Lettuce Inc.

info@lettucecare.com