CAREVEST MORTGAGE GROUP PRIVACY POLICY

Effective: August 2024

Definitions

“Acts” means the Personal Information Protection Act (Alberta), Personal Information Protection Act (British Columbia) and the Personal Information Protection and Electronic Documents Act (Canada) as such may apply to CareVest from time to time;

“CareVest associates” means any employee, contractor, supplier, officer or director of the Corporation;

“CareVest”, “our”, “we”, or the “Corporation” means the CareVest Mortgage group of companies and includes reference to 2565491 Alberta Ltd., CareVest Capital Inc., CareVest Operations Corp., CVC Market Point Inc., and Carecana Management Corp. and those entities associated or affiliated with the listed companies or which have business, management or ownership in common with them.

“Personal Information” means information about an identifiable individual and typically includes name, residential address, telephone number, personal e-mail address, identification numbers, employment and financial history and certain physical characteristics. Personal Information does not include business or employment information typically found on a business card. Data we collect with personal identifiers removed, so that it is impossible to determine the identity of the person to whom the information relates, is not considered Personal Information.

“Privacy Officer” means the individual designated by CareVest to ensure compliance with the Acts and make information about CareVest’s management of personal information available on request. The Privacy Officer shall be the General Counsel or such person designated by the General Counsel.

“Trusted Contact Person”, or “TCP” means someone CareVest can reach out to if a CareVest employee is concerned you are being financially exploited or are making poor decisions based on diminished mental capacity. The TCP is an individual identified by you to CareVest and is whom CareVest may contact in accordance with your written consent.

Privacy

Your privacy is important to CareVest. We are committed to respecting your privacy through the protection of your Personal Information given to us when you invest with us, apply for a loan from us or enter into another commercial transaction or business relationship with us.

The following outlines our commitment to you:

Collection, Use and Disclosure – before collecting your Personal Information, or at the time of collection, we will explain to you the purpose for collecting it and obtain your consent
Responsible Use of Information – our collection of Personal Information is limited to what is reasonable under the circumstances and your information will be used only for the purpose for which it is collected
Security, Retention and Disposal – your Personal Information is kept confidential and secure and is not disclosed to anyone outside of the CareVest group of companies without your consent, unless required by law, and your Personal Information will be appropriately disposed of when it is no longer needed
Access to and Correction – you have the right to access your own Personal Information, and to correct any inaccuracies

10 Privacy Principles

CareVest has always been, and will continue to be, committed to maintaining the accuracy, confidentiality and security of your Personal Information. As part of this commitment, we have adopted the 10 Principles for the protection of privacy pursuant to the Acts which govern CareVest and which establish rules for the collection, use and disclosure of Personal Information by the private sector.

Accountability: All CareVest associates are responsible for maintaining and protecting all Personal Information under their control. CareVest has designated an individual as Privacy Officer to oversee compliance with the Acts and our 10 Privacy Principles.
Identifying Purposes: We will identify the purposes for which Personal Information is collected, either before or at the time of collection.
Consent: We will only collect, use and disclose your Personal Information with your knowledge and consent, except where otherwise required or permitted by law.
Limiting Collection: We will limit the collection of your Personal Information to only those details that are necessary for the purposes identified.
Limiting Use, Disclosure and Retention: Your Personal Information will only be used or disclosed for the purposes for which it was collected, unless you have otherwise consented, or when it is required or permitted by law. We will only retain your Personal Information for the period of time required to fulfill the purposes for which it was collected.
Accuracy: We will keep Personal Information we collect as accurate, complete and up-to-date as necessary to fulfill the purposes for which it was collected.
Safeguards: We will protect the Personal Information we collect with security safeguards appropriate to the sensitivity of the information.
Openness: Information about our policies and practices relating to the management of Personal Information will be made readily available to you.
Access: At your request, we will inform you of the existence, use and disclosure of your Personal Information, as well as give you access to the information. You have the right to challenge the accuracy and completeness of your information, and to amend it as necessary. (See Access to, and Changing your Personal Information).
Challenging Compliance: You may contact us with any questions, complaints or suggestions about this policy.

What Personal Information Does CareVest Collect?

At CareVest, we collect Personal Information from individuals who are investors in CareVest, borrowers or guarantors of loans by CareVest, parties to commercial transactions or individuals in business relationships with CareVest and employee information.

With your consent, as an investor we usually collect and maintain your name, residential address, telephone number, e-mail address, social insurance number, identity verification information (such as driver’s license number or credit agency report) and banking information.

With your consent, as a borrower or guarantor, in addition to the information listed above for investors, we usually collect and maintain your financial status and history, employment history and credit information.

The Personal Information we collect in relation to a commercial transaction or business relationship will vary depending on the nature of the transaction or relationship and may include additional information for investors and borrowers or guarantors.

Personal Information may also include your transaction history with CareVest, customer service inquiries, information requested or provided to you or responses to surveys.

We may also collect and summarize Personal Information in a format that does not identify you as an individual for statistical and marketing purposes.

We may record phone calls to or from our offices for the purposes of quality assurance control, customer service training and to record consent and instructions related to business transactions with CareVest. If you have any questions or concerns with the taping of your phone calls, you may contact us in writing or through our website or the Privacy Officer.

It is always your choice whether or not you provide us with your Personal Information. However, a decision to withhold Personal Information may restrict or prevent us from allowing you to invest with us or providing you with a loan or entering into a commercial transaction or business relationship with you.

How Do We Gather Your Personal Information?

Depending on how you do business with us, we may gather Personal Information from the following sources:

from you, on applications, contracts or forms filled out through telephone, e-mail, online or face-to-face interviews
from intermediaries contracted by us with whom you have a relationship
from your interactions with us; for example as an existing investor or past borrower or guarantor
from government and other entities, such as CRA
from consumer reporting agencies, such as a credit reporting agency
from previous employers

How Do We Use Your Personal Information?

With your consent, we will use your Personal Information for one or more of the following purposes:

to determine your eligibility and suitability for our products and services
to verify your identity for investment purposes
to purchase an investment with us
to pay you a return on your investment
to comply with tax requirements
to service your existing CareVest investments
to contact and correspond with you and to respond to your inquiries
to email or otherwise send you communications regarding goods or services we believe will interest you
to compile statistics, conduct market research to measure and improve the effectiveness of our marketing initiatives
to report to regulatory or industry agencies
in the case of borrowers or guarantors, to assess the viability of a loan and to market our products and services
to tailor our products to your preferences
to administer and service your business relationship with us
in the event a member of the CareVest group of companies proceeds with a business transaction such as the purchase, sale, lease transfer, merger or amalgamation or any other type of acquisition, or disposal of, or taking of a security interest in respect of, an organization, your Personal Information may be shared with such prospective party to complete the business transaction

To Whom Do We Disclose Your Personal Information?

With your consent or as permitted or required by law or other regulatory bodies which govern us and our business, we may disclose your information as follows:

to those associates within the CareVest group of companies that require your Personal Information for the uses set out above or for a legitimate business purpose
to the securities dealer, individual dealing representative or finder through whom you purchased our securities and any subsequent dealer or individual representative that assumes custody of, management of, or reporting responsibilities to you regarding, your CareVest investment holdings
to our legal counsel
to our auditors
to a government institution, self-regulating organization, or other person or entity that has asserted its lawful authority to obtain the information
where we have concerns about that you are being financially exploited or may be suffering from diminished capacity, we may contact your TCP
where we have reasonable grounds to believe the information could be useful in the investigation of unlawful activity
to comply with a subpoena or warrant or an order made by a court, person or entity with jurisdiction to compel the production of information
to comply with court rules regarding the production of records and information
to contracted third party service providers (see below)

We will only use and disclose your Personal Information to fulfill the purposes for which it was collected. Any exception will be with your prior consent, or as may be required by law or other regulatory bodies which govern our business. Also, we will keep your information only for as long as it is needed to fulfill the purposes for which it was collected.

Service Providers

CareVest may share your Personal Information with certain service providers in order to conduct our businesses, provide our products and services to you, to verify and validate information and your identity, and to address investor, borrower and business service matters. Examples of service providers include our bank, legal counsel, accountants and other business advisors, transfer agents, administration service providers, credit reporting agencies (with respect to investors, borrowers and guarantors) and delivery services. To reduce the risk of fraud or misuse of Personal Information, we will only provide such information as is necessary for the service provider to carry out the service we have contracted with them to provide.

We will use reasonable efforts to ensure that your Personal Information is used in a manner that is consistent with this policy. If you do not wish us to provide your Personal Information to our service providers, we may be unable to provide you with our products or services or properly service your account or carry out a transaction or enter into a business relationship with you.

We will not sell your Personal Information to any organization, for any purpose.

Links to Other Web Sites

As part of our service, our web site may contain links to other web sites or Internet resources. When you click on one of those links you are contacting another web site or internet resource. CareVest is not responsible for the practices or the content of such websites, and recommends that you check the security and privacy policy of any website before providing your personal information. NO OTHER WEBSITE IS COVERED BY OUR PRIVACY POLICY.

Cookies

A cookie is a small file saved on your computer to help store preferences and other information that is used on webpages that you visit. When cookies have been saved on your computer, they may save your settings on certain websites and can sometimes be used to track how you get to and interact with the websites. Any information generated by the cookie about your use of the websites, including your IP address, will be transmitted to and stored by Google on servers in the United States. Google uses this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information for Google. Google will not associate your IP address with any other data held by Google.

Google uses cookies in several ways, including remarketing and google analytics, which both use cookies to run CareVest advertisements and to track the success of those advertisements. In addition, to help track sales and other conversions arising from CareVest advertisements, a conversion tracking feature may be used which adds a cookie to your computer when you click on an advertisement. The cookies may allow third party vendors to show you our advertisements based on your past internet usage and visits. Please be aware that you can opt-out of online advertising if you wish by visiting the following external link: http://www.networkadvertising.org/choices/.

You may also refuse the use of cookies by selecting the appropriate settings on your browser or within the application, however, please note that if you do this you may not be able to use the full functionality of the CareVest website you are visiting. Through your browser settings, you can accept or decline cookies or set your browser to prompt you before accepting a cookie from the websites you visit. You can delete cookies that have been installed in the cookie folder of your browser. The various browsers provide different procedures to manage your settings. Click on any of the browser links below for instructions:

Microsoft Windows Explorer: https://support.microsoft.com/en-us/help/17442/windows-internet-explorer-delete-manage-cookies
Google Chrome: https://support.google.com/chrome/answer/95647?hl=en&p=cpn_cookies
Mozilla Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences?redirectlocale=en-US&redirectslug=Enabling+and+disabling+cookies

If you are not using the listed browsers, you should go to the “Help” function for information on where to find your cookie folder.

By using our websites, you consent to the processing of data about you by Google in the manner and for the purposes set out in this Privacy Policy.

Giving Consent

The cornerstone to protecting your privacy is consent. We will only collect, use, and disclose your Personal Information with your consent, except where otherwise permitted or required by law, and will only collect, use, and disclose Personal Information that we reasonably believe is necessary to complete the transaction or provide the service.

We work hard to ensure we have and maintain your confidence and consent to collect, use and disclosure your Personal Information for the purposes identified in this Policy and at the time that you provide your Personal Information to CareVest. However, you do have a choice and can refuse or withdraw your consent at any time as follows:

You may choose not to provide us with any of your Personal Information. However, if you make this choice we may not be able to do business with you or provide you with the product, service or information that you requested or that could be offered to you.

You may have your Personal Information removed from marketing lists which we use to inform you of new or relevant product offerings.

You may also ask us about your Personal Information and notify us of any corrections that may be necessary.

We need your consent to collect, use and disclosure your Personal Information. If you have already provided us with Personal Information, we would like to continue to use and disclose it for the purposes for which it was collected. If you do not contact us, we will assume that we may continue to do this in accordance with the standards described in this Policy. If you have any questions about our privacy practices or wish to withdraw your consent to the use and disclosure of your Personal Information, please contact us at the phone numbers provided below or email us at privacy@carevest.com.

Types of Consent

Consent can be express or it may be implied in appropriate circumstances.

Implied Consent

In some cases, your consent is implied if we ask you to provide Personal Information with a stated purpose and you comply with our request. Implied consent may be used by us as a basis for extending new product offers to you or delivering documentation, reports and servicing your investment. We will not use your implied consent for the use or disclosure of your sensitive Personal Information such as financial data, other than as required by law, such as reporting your investment or involvement in an investment with us to securities regulatory authorities and the Canada Revenue Agency.

Express Consent

In cases where the information being collected, used or disclosed is of a financial nature or is otherwise sensitive, we will seek your express consent to the use of your Personal Information. By completing and signing a subscription agreement or other transaction agreement and related documentation to purchase our securities or enter into a transaction with us, you are giving us your express consent for us to use the Personal Information provided by you in the ways outlined above or in the documentation provided to you at the time or as required or permitted by law or other rules and regulations governing us and our business.

If you are a borrower or guarantor, by completing an application for a loan, including a personal financial statement, you are giving your express consent for us to use the Personal Information provided by you during the loan approval process in the ways outlined above or in the documentation provided to you at the time or as required or permitted by law or other rules and regulations governing us and our business.

Withdrawing Consent

You may withdraw your consent at any time, subject to legal or contractual restrictions and reasonable notice. If you withdraw your consent, we will inform you of the consequences of such withdrawal. To withdraw your consent, simply contact us and advise us of what Personal Information you no longer wish us to use. Withdrawal of your consent may result in us being unable to continue to do business with you or to offer you our products or services.

Security and Disclosure of Your Personal Information

We know you are concerned about the security of the information you provide to us. To address this concern, we have developed processes and procedures to keep your Personal Information safe and secure.

We have appropriate safeguards in place depending on the sensitivity of the information, including:

Physical – secured storage facilities and premises
Technological – password-protected computers/files, firewalls and a secured server, additionally, we require all CareVest associates to use multifactor authentication in order access CareVest servers at all times
Organizational – CareVest associates trained in the importance of safeguarding your Personal Information from loss and unauthorized access and access limited within the CareVest organizations to those associates that require your Personal Information or part of it to carry out the uses outlined above or otherwise communicated to you or for a legitimate business purpose
Third Parties – in the event we transfer your Personal Information to a third party, we assess their privacy procedures or take steps to require them to protect your Personal Information in a manner consistent with our own internal measures, or as required by law
The Cloud Platform – more and more, companies are seeing the technological, economical and organizational benefits of cloud computing. CareVest may use cloud computing services for data processing, storage and backup, to facilitate productivity, for accounting services, for communications, or for customer service and support. CareVest will take reasonable steps to contract with Canadian cloud computing service providers, but this may not always be possible.

Although we cannot guarantee against theft, misuse, unauthorized disclosure, loss, alteration or destruction of your Personal Information by a third party, we take reasonable precautions to prevent such unfortunate occurrences. We will strive to keep your Personal Information as accurate and as up-to-date as is necessary for the purposes for which it is collected.

Personal information collected by us may be used, processed or stored outside of Canada and may be subject to disclosure in accordance with the laws of such foreign jurisdictions, which may be different than the laws in effect in the jurisdiction in which you reside.

Access to, And Changing Your Personal Information

Accessing your Personal Information

You may access and verify your Personal Information and find out to whom we have disclosed it. At the time of your request, we will need specific information from you to verify your identity before we can provide you with the Personal Information we hold.

There may be instances when we will not be able to provide you with the Personal Information that you request. Examples are if the Personal Information:

contains references to other persons
has already been destroyed due to legal requirements or because we no longer needed it for our purposes
is subject to solicitor-client or litigation privilege
contains trade secrets or confidential business information of CareVest and its affiliates or others
cannot be disclosed for legal reasons or we are not legally required to disclose it

Changing your Personal Information

We are committed to maintaining the accuracy of your Personal Information for as long as it is being used for the purposes we have identified. To help us keep your Personal Information up-to-date, we encourage you to notify us of inaccuracies or corrections as often as you wish. Notification of changes such as your address or telephone number will help us provide you with the best possible service.

If you identify any incorrect or outdated information requiring amendment, please contact our Investor Relations team, your dealing representative, CareVest business contact or mortgage broker, as applicable, the Privacy Officer, or the contact provided by us from time to time for such purpose. We may ask you to put your request for a correction in writing. We will make the proper changes and, upon your request, provide you with a copy of the corrected information.

Trusted Contact Person

In the event that CareVest becomes concerned that you are being financially exploited or that you may have diminished mental capacity, your TCP may be contacted. Your TCP is not the same as a power of attorney. A power of attorney has authority to make financial decisions on your behalf under certain circumstances, such as if you become incapacitated. Your TCP should have no interest in or involvement in making financial decisions for you. In fact, the TCP is someone we can reach out to if we feel your power of attorney is not acting appropriately.

We may contact your TCP to confirm or make inquiries about the name and contact information of your legal representative, including a legal guardian or an executor of an estate or a trustee of a trust under which you are a beneficiary. Your TCP does not have the ability to transact on your investment or to make any other decision on your behalf by virtue of being a TCP.

We will only use and disclose your TCP’s Personal Information to fulfill the purposes for which it was collected.

How long is my Information Retained?

We keep your information only as long as we need it for the products and services you’re receiving and for a reasonable time thereafter or to meet any legal requirements. We have retention standards that meet these requirements. We destroy your information appropriately when it is no longer needed, or we remove your personally identifiable information from our records.

Subject to legal, audit or regulatory requirements for continued retention of your information, you can also request that we remove your information from our records.

Contact Us

If you have questions, concerns, or complaints about your privacy or Personal Information, you may contact us at the address listed below. We will inform you of our complaint procedures and will assist you in resolving the situation. If a complaint is found to be justified, appropriate measures will be taken including, if necessary, amending our practices and procedures.

Suite 1450

555 4^th Avenue, SW

Calgary, Alberta

T2P 3E7

Attention: Privacy Officer

Telephone: (403) 509-0115

Facsimile: (403) 262-9520

E-mail: privacy@carevest.com

We will respond to your request or investigate your concern as quickly as we can.