PERSONAL INFORMATION GOVERNANCE POLICY (SUMMARY)

Last updated: March 31, 2026

Preliminary Note

The Réseau Première Ligne (“RPL”) is a group of family medicine groups (FMGs) aimed at fostering collaboration, knowledge sharing, and innovation to support healthcare professionals and provide patient-centred care.

RPL is an unincorporated association established at the initiative of Groupe Medway Inc., which contributes to its startup activities and development.

In this context, Groupe Medway Inc.’s personal information protection policies apply to RPL’s activities, with the necessary adaptations to reflect its structure, operations, and applicable legal requirements. Groupe Medway Inc. acts as the Privacy Officer for RPL activities carried out under its governance.

This summary of the Personal Information Governance Policy (the “Policy”) is intended to inform users (“you” or “your”) of the rules adopted by Groupe Medway Inc. and its related and/or affiliated companies (collectively “Medway” or “we” or “our”) governing the collection, use, retention, and destruction of personal information, as well as individuals’ rights and staff responsibilities.

Medway places great importance on the protection of personal information it holds. This Policy has been developed in accordance with applicable legal frameworks, including sections 35 to 40 of the Civil Code of Québec, the Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), and other applicable laws (the “Act”).

PROCESSING OF PERSONAL INFORMATION

The protection of your personal information is ensured by Medway throughout its lifecycle (collection, use, retention, destruction, or anonymization) in accordance with the following principles, subject to exceptions provided by law.

Collection

• Medway collects only the personal information necessary to fulfill its mission and activities.
• Individuals are informed of the purposes of collection and their rights.
• When consent is required by law, it must be clear, free, informed, and given for specific purposes.
• Upon request, individuals may also be informed of the categories of persons who have access to their personal information, the retention period, and the contact details of the Privacy Officer.

Use

• Personal information is used only for the purposes for which it was collected, unless consent is obtained.
• Secondary use without consent is permitted only in cases allowed by law.
• Access to personal information is limited to Medway personnel who need it to perform their duties.

Disclosure

• Personal information may only be disclosed to third parties with consent or where permitted or required by law.
• Any disclosure to service providers or subcontractors is governed by a written agreement, including strict obligations under the law.
• Where applicable, a Privacy Impact Assessment (PIA) is conducted before transferring personal information outside Quebec.

Retention and Security

• Personal information is retained only as long as necessary for the purposes for which it was collected or as required by law.
• Information is stored in secure environments based on its sensitivity.
• Appropriate security measures are implemented to protect personal information.
• Default privacy settings in technological tools are set to the highest level of protection.

Destruction or Anonymization

• Personal information is securely destroyed or anonymized once the purposes have been fulfilled, subject to legal retention requirements.

INDIVIDUAL RIGHTS

Subject to legal exceptions, individuals may:

• Request access to their personal information and obtain a copy;
• Request correction of inaccurate or incomplete information;
• Request deletion of outdated or unjustified information;
• Request portability of computerized data;
• Withdraw consent where applicable;
• Request de-indexing or cessation of dissemination in cases provided by law;
• Be informed when an automated decision is made and request a review.

Requests must be submitted in writing to the Privacy Officer. Medway responds within 30 days and provides assistance where needed. Reasonable fees may apply where permitted by law.

PRIVACY INCIDENTS

• Medway maintains a register of privacy incidents as required by law.
• When an incident is suspected, Medway takes reasonable steps to reduce harm and prevent recurrence.
• If an incident presents a serious risk of harm, Medway notifies the Commission d’accès à l’information and affected individuals.

PRIVACY IMPACT ASSESSMENTS (PIA)

Medway conducts PIAs notably when:

• Developing or modifying systems involving personal information;
• Transferring personal information outside Quebec;
• Using personal information for research, study, or statistical purposes without consent where permitted by law.

COMPLAINT HANDLING

Complaints regarding personal information protection must be submitted in writing to the Privacy Officer.

The Privacy Officer will:

• Acknowledge receipt;
• Review the complaint;
• Provide a written response within 30 days;
• Inform the individual of possible recourse with the Commission d’accès à l’information du Québec.

Complaints are handled confidentially and promptly.

RESPONSIBILITIES

Privacy Officer

Contact:
Me Jean-François Hébert
Email: responsableprp@med-way.ca
Phone: 418-496-6603

• Ensure compliance with applicable laws;
• Oversee access, correction, and portability requests;
• Manage privacy incidents and required notifications;
• Participate in PIAs;
• Maintain and update internal policies.

Vice President, Human Resources

• Ensure internal application of the policy;
• Support staff training and awareness;
• Apply disciplinary measures when necessary.

Staff

• Comply with the policy;
• Limit access to necessary information only;
• Protect confidentiality;
• Report incidents or breaches immediately.

SANCTIONS

Failure to comply with this Policy may result in appropriate disciplinary measures in accordance with Medway’s internal rules.

UPDATES

This policy may be updated to reflect legal or operational changes.