MEDICURE PHARMA INC.

Consumer Health Data Privacy Notice

Effective Date: Septembrer 29, 2026
Last Updated: September 29, 2026

About this Notice

Medicure Pharma Inc. ("Medicure Pharma," "we," "us," or "our") provides this Consumer Health Data Privacy Notice to describe how we collect, use, share, and protect consumer health data on patient.zypitamag.com, and the rights you have in that data under the Washington My Health My Data Act and Nevada SB 370.

In this Notice, "consumer health data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status.

This Notice covers only consumer health data. Our ZYPITAMAG Privacy Policy describes how we handle personal information generally.

We may amend this Notice. If we make a material change, we will notify you as required by applicable law, including by notifying you at the time we collect consumer health data.

1. Consumer health data we collect

This website is about ZYPITAMAG, a medicine for high cholesterol, and about cholesterol generally. Because of that, using it can indicate something about your health interests even if you never tell us anything about yourself.

We may collect the following categories of consumer health data:

• Health-related browsing activity - the pages you view on this website, including pages about cholesterol, about statins and their side effects, and about ZYPITAMAG itself.
• Health-related information you give us - what you tell us when you ask about coverage, cost, or how to obtain ZYPITAMAG, whether by web form, email, or telephone.
• Identifiers linked to the activity above. An identifier is consumer health data only where we can associate it with the health-related activity described above. We collect your IP address, and the identifiers in strictly necessary cookies, automatically - these are a necessary part of delivering the pages you request and keeping the website secure. We collect cookie and device identifiers set by analytics and advertising technologies only after you accept the corresponding category in Cookie Preferences. We collect your name, email address, or telephone number only when you provide them to us.
• Inferences - conclusions about your possible health interests drawn from the categories above and used for advertising measurement. We create these only where you have accepted advertising cookies.

2. Sources of consumer health data

We collect consumer health data from the following sources:

• From you, when you complete a form on this website, or contact us by email or telephone about ZYPITAMAG.
• Automatically, as a necessary part of operating this website. When your browser requests a page, our servers record technical information such as your IP address, the page requested, and the date and time. We create these records to deliver the pages you ask for and to keep the website secure.
• Through cookies, pixels, and tags, where you have consented. These technologies record which pages you view and how you move through them. They do not operate until you accept the corresponding category through Cookie Preferences, and you can change your choice at any time.
• From our advertising and analytics partners, who provide us with aggregate and campaign-level information about how visitors reach and interact with this website.

3. How we use consumer health data

• To answer your questions about ZYPITAMAG, including questions about coverage, cost, and how to obtain it.
• To operate, secure, measure, and improve this website, including by recording sessions so that we can see where a page is confusing or broken.
• To advertise ZYPITAMAG, including measuring how our advertising performs and, where you have consented, showing you advertising for ZYPITAMAG on other websites and applications.
• To meet our obligations under drug safety regulation where you report a side effect or a product complaint.
• To protect the rights, property, and safety of Medicure Pharma and others, and to prevent fraud and abuse.
• To comply with applicable law and respond to lawful requests from government authorities.

4. How we process consumer health data

We collect consumer health data in two ways. Some you provide to us directly, by completing a form, sending an email, or telephoning us. Some is collected automatically as you use this website. Automatic collection through cookies, pixels, and advertising or analytics tags does not begin until you have accepted the corresponding category through our cookie banner. Basic server records, described in Section 2, are created whenever your browser requests a page, because they are necessary to deliver the page to you and to keep the website secure.

We store consumer health data on servers located in the United States, under access controls that limit staff access to what their role requires. Some of the people who build this website and answer enquiries sent through it work outside the United States, including in Canada, and may access consumer health data there while providing those services. We analyze it in combination with data from other visitors to understand aggregate patterns, and we disclose it to the parties identified in Section 5. We do not use consumer health data to make automated decisions that produce legal or similarly significant effects about you.

We maintain administrative, technical, and physical safeguards designed to protect consumer health data against unauthorized access, use, modification, and disclosure.

5. How we share consumer health data

What we share

We share your health-related browsing activity, the identifiers linked to that activity, and inferences drawn from it. Specifically, this includes the pages you view on this website, cookie and device identifiers, advertising identifiers, and inferences derived from those categories.

We do not share what you write in a form, or what you tell us by email or telephone.

Why we share it

To measure how our advertising performs; to show you advertising for ZYPITAMAG on other websites and applications; to understand how this website is used and improve it; to operate and secure it; and to comply with law.

Who we share it with

• Consent management, which presents our cookie banner, records your choices, and signals them to the technologies below.

• Advertising and marketing platforms, which measure how our advertising performs and deliver advertising for ZYPITAMAG to you on other websites and applications. Under our contracts with these companies, they may use consumer health data only to provide services to us and not for their own purposes.
• Analytics and website performance providers, which measure how this website is used, record sessions, and help us diagnose problems. Under our contracts with these companies, they may use consumer health data only to provide services to us.
• Form protection providers, which help us tell people from automated programs when you submit a form.
• Technology service providers, including website hosting, content delivery, and embedded video.
• Our affiliate, Medicure Inc., our parent company, whose staff help us answer enquiries sent through this website and operate the site. Under our arrangement with Medicure Inc., it may use consumer health data only to provide those services to us, and not for its own purposes.

Sale

We do not sell your consumer health data. We do not exchange it for money or for other valuable consideration, and we will not do so without first obtaining any authorization required by applicable law.

Other circumstances in which we may disclose consumer health data

We may also disclose consumer health data where permitted by law, specifically:

• with your consent;
• where necessary to protect your vital interests, such as a medical emergency or natural disaster;
• to an acquiring organization, if we are involved in a merger, acquisition, financing, reorganization, or sale of our business;
• as necessary to prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, or malicious or deceptive activity;
• as necessary to preserve the integrity or security of our systems; and
• to investigate, report, or prosecute those responsible for conduct that is illegal under state or federal law.

Adding recipients

We will not share consumer health data with any third party or affiliate not listed in this Notice without first telling you and obtaining your consent.

Tracking across our websites

We also operate zypitamag.com, a website for health care professionals. The two websites share a web address, so some of the parties listed above may recognize the same browser across both.

6. Your rights in your consumer health data

If you are a resident of Washington or Nevada, you have the following rights:

• Confirm and access. Confirm whether we collect, share, or sell your consumer health data, and obtain a copy of that data.
• Know who received it. Obtain a list of all third parties and affiliates with whom we have shared or sold your consumer health data, together with a way to contact each of them.
• Correct. If you are a Nevada resident, review your consumer health data and ask us to correct it where it is inaccurate.
• Withdraw consent. Withdraw your consent to our collection and sharing of your consumer health data at any time. Withdrawing is as easy as giving consent - use the Cookie Preferences link in the footer of any page.
• Stop collection, sharing, and sale. Direct us to stop collecting, sharing, or selling your consumer health data.
• Delete. Have your consumer health data deleted, as described in Section 7.
• Appeal. Appeal a decision by us not to act on your request, as described in Section 9.

If another state's law gives you rights in your consumer health data, we will honor those rights as that law requires.

We will not discriminate against you for exercising any of these rights.

These rights apply to consumer health data. If you have reported a side effect or a product complaint, drug safety regulation requires us to keep that record, and we will tell you when that applies to a request you have made.

7. Deletion

On receiving a verified deletion request, we will delete your consumer health data from our records and network within 30 days. Where the data is held on archived or backup systems, deletion may be delayed until those systems are restored, and in no case longer than six months.

Within the same 30 days, we will also notify every affiliate, processor, contractor, and third party with whom we have shared your consumer health data of your deletion request. Those parties are required to delete it from their own records and networks, including their archived and backup systems.

8. How to exercise these rights

You can submit a request using our online form, by emailing compliance@medicure.com, or by calling 1-800-509-0544.

To process your request we will ask for information to verify your identity, such as your name, email address, or telephone number, and match it against information we already hold. Where your request concerns data we hold only against a cookie or device identifier and cannot link to you, we will tell you so and explain how to clear those identifiers and withdraw your consent instead. We will not ask for more information than is necessary to verify you, and we will use it only for that purpose.

We will respond without undue delay and no later than 45 days after receiving your request. If your request is complex, we may extend that period by a further 45 days; we will tell you within the first 45 days if we do, and why.

You may make requests free of charge twice a year. If a request is manifestly unfounded, excessive, or repetitive, we may charge a reasonable fee to cover the administrative cost of responding, or decline to act. We will tell you which, and why, before proceeding.

9. Appeals

If we decline to act on your request, you may appeal within a reasonable period after receiving our decision. To submit an appeal, use this online form, call 1-800-509-0544, or email compliance@medicure.com. Please tell us that you are appealing a decision, so that we handle your request as an appeal.

Within 45 days of receiving your appeal we will inform you in writing of any action taken or not taken, together with a written explanation of our reasons. If we deny your appeal, we will provide you with an online mechanism, if available, or another method by which you may submit a complaint to the Washington Attorney General or the Nevada Attorney General.