Effective Date: July 15, 2026

Last Updated: July 15, 2026

Maintained by: Cannara Privacy Officer

 

Cannara Biotech (Québec) Inc. uses certain third-party service providers to support the operation of its medical cannabis program, websites and related services. This Sub-Processor List identifies the principal service providers that may process personal information on Cannara’s behalf, the services they perform, the categories of personal information they may handle and the jurisdictions in which that processing may occur. This list should be read together with Cannara’s Privacy Policy and may be updated from time to time as Cannara’s service providers and processing arrangements change. Material changes to this list, including the introduction of a new sub-processor category, a change in cross-border jurisdiction for an existing sub-processor, or a change in the role a sub-processor performs, shall be communicated to registered patients via email and via prominent notice on medical.cannara.ca. Non-material changes (e.g., entity-name updates that do not affect the substance of the relationship) are published here without separate notification.

 

 

Sub-Processor	Role	Jurisdiction (processing location)	Data categories handled
iTristan Group Inc. (Sellstack)	E-commerce platform patient registration interface, order management, claim submission workflow, integration with internal systems	Toronto, Ontario, Canada	Identification & contact info; medical document & registration info; order & transaction info; website usage info; communication records.
Purolator Inc.	Order delivery to registered patients (pick-up, transport, last-mile delivery, signature confirmation)	Mississauga, Ontario, Canada	Identification & contact info (recipient name + delivery address only); order references.
Authorize.net LLC	Credit-card and electronic payment processing; tokenization; fraud screening	United States and other jurisdictions in which Authorize.net, its affiliates and payment-processing partners operate	Payment card details (submitted directly; not stored by Cannara); transaction amounts; payment confirmation references
Microsoft Corporation / Microsoft Canada Inc Microsoft Dynamics 365 Business Center	Enterprise resource planning, including order processing, inventory management, invoicing, financial records and integration with the SellStack platform	Canada, where the Business Central environment is provisioned in the Canadian geography; limited processing or access may occur in other jurisdictions through Microsoft affiliates and sub-processors	Identification and contact information; patient or customer account identifiers; order and transaction information; product and shipment information; invoices, payment-status information and related accounting records.
Microsoft Corporation / Microsoft Canada Inc Microsoft 365 Exchange Online	Business email hosting and delivery, including patient-service communications, account notices, order-related messages and regulatory communication	Canada; the United States and other jurisdictions where Microsoft and its sub-processors operate	Email addresses; recipient and sender names; email content and attachments; message metadata; contact information; communication records.