Privacy Protection, Information Security & Breach Management Policy

TRUCOVER INSURANCE & INVESTMENTS INC.

5B Conestoga Dr., Brampton, Ontario L6Z 4N5

Privacy Officer contact: admin@trucover.ca

Document control

Adoption note: Management must designate the Privacy Officer, approve this policy, assign responsibility for each control, and confirm the procedures match TruCover’s actual systems and contractual obligations. This document does not certify legal or regulatory compliance.

Executive Policy Statement

TruCover Insurance & Investments Inc. (“TruCover”) is committed to respecting privacy, safeguarding personal information and promptly identifying, managing, documenting and, where required, reporting privacy incidents. We handle sensitive insurance, investment and financial-service information only for legitimate, identified purposes with appropriate consent or another lawful basis. Every director, employee, advisor and service provider acting for TruCover must protect information entrusted to the company.

Contents

1. Purpose, scope and governing framework
2. Privacy governance and responsibilities
3. Ten privacy principles
4. Personal information lifecycle and consent
5. Advisor and employee operating rules
6. Safeguards and cybersecurity
7. Third parties, transfers and digital channels
8. Individual requests and complaints
9. Incident response and breach notification
10. Records, retention and secure disposal
11. Training, oversight and enforcement
12. Appendices A–F: Working forms and control registers

1. Purpose, Scope and Governing Framework

This policy applies to all personal information in TruCover’s custody or control, whether held in paper, electronic, audio, cloud-based or other form, and to information handled on TruCover’s behalf. It binds directors, officers, employees, licensed insurance and investment representatives, temporary staff, contractors, and vendors with authorized access. Advisors must also comply with applicable insurer, managing general agency (MGA), dealer and product-provider rules.

TruCover will assess applicability of the Personal Information Protection and Electronic Documents Act (PIPEDA), relevant provincial requirements, Ontario insurance-sector rules, contractual obligations, and other laws that apply to specific products or activities. Anti-spam obligations, where applicable, are separately assessed under Canada’s Anti-Spam Legislation (CASL). If a legal or contractual requirement imposes a higher standard, that requirement prevails.

Definitions

2. Privacy Governance and Responsibilities

Management

• Formally appoint a Privacy Officer with sufficient authority and resources; approve this policy and material exceptions.
• Maintain oversight of material risks, audit findings, third-party arrangements, significant incidents and corrective actions.
• Ensure advisors and staff are trained and provide evidence of implementation when appropriately requested.

Privacy Officer

• Own the privacy program, register and retention rules; advise on collection, consent, disclosures and safeguards.
• Maintain a centralized incident log; lead or coordinate investigations, RROSH determinations, notifications and remedial action.
• Respond to access, correction, withdrawal and complaints; liaise with insurers, MGAs, regulators and counsel as required.
• Review controls and policy at least annually; retain evidence of training, access reviews and remediation.

All employees, advisors and contractors

• Use personal information solely for assigned, authorized business purposes and only to the extent necessary.
• Protect credentials and devices; never send client records to personal email, unapproved cloud storage or unapproved messaging platforms.
• Immediately report suspicious emails, wrong-recipient messages, lost devices, unauthorized access, misdirected documents or other suspected incidents.
• Cooperate with incident containment and investigations; do not conceal, independently delete evidence or communicate with regulators/media without authorization.

3. Ten Privacy Principles

1. Accountability: TruCover assigns responsibility for personal information under its control.
2. Identifying purposes: Explain why information is needed at or before collection.
3. Consent: Obtain meaningful consent where required, with lawful exceptions applied narrowly.
4. Limiting collection: Collect only information reasonably necessary for identified purposes.
5. Limiting use, disclosure and retention: Do not repurpose, share or retain information without authorization or a lawful basis.
6. Accuracy: Keep information sufficiently complete and up to date for its intended purpose.
7. Safeguards: Use measures proportionate to sensitivity and risk.
8. Openness: Provide understandable information about privacy practices.
9. Individual access: Facilitate access and correction subject to legal exceptions.
10. Challenging compliance: Route privacy complaints to the Privacy Officer for assessment and resolution.

4. Personal Information Lifecycle and Consent

4.1 Collection and purpose

Depending on services requested, TruCover may need contact and identity data; date of birth; family and beneficiary data; occupation; income, assets and liabilities; tax and SIN information where legally required or justified; investment objectives and risk tolerance; banking/payment details; medical and lifestyle data for underwriting; claims and policy details; travel or driving information; and relevant communications and advice records. Do not request medical or SIN information merely because it may be convenient.

4.2 Consent and notice

• Identify the purposes and categories of recipients before collection, including insurer, MGA, dealer, administrator, reinsurer, underwriting/medical service providers and other applicable service providers.
• Use express, appropriately documented consent for sensitive information where warranted; ensure individuals understand material implications of the intended processing.
• Record the consent wording, date, method, product/purpose, any restrictions and withdrawal. Obtain fresh consent when materially new purposes require it.
• Explain consequences of declining or withdrawing consent (for example, inability to assess an application) without implying withdrawal erases mandatory records.
• Do not use client information for unrelated marketing without lawful consent or another valid legal basis; honour applicable unsubscribe requests.

4.3 Use, disclosure and accuracy

Use the minimum necessary information and restrict disclosure to an authorized recipient with a business need, a valid consent or other legal authority. Verify the recipient’s identity, destination and permissions before sending sensitive records. Maintain accuracy through client confirmations, review of critical underwriting facts and documented corrections. Do not modify records to misrepresent client instructions or historical disclosures.

4.4 Client communications

Explain the risks of unencrypted email or other channels when material, and offer appropriate secure alternatives. Authenticate clients before sharing sensitive details by phone or electronically. Marketing text/email communications must comply with CASL where applicable, including consent, sender identification and unsubscribe requirements.

5. Advisor and Employee Operating Rules

11. At onboarding, verify identity using approved processes; provide the applicable privacy notice and obtain consent required by the product/provider.
12. Use approved insurer/MGA/dealer portals and TruCover-approved storage; never retain unnecessary copies on personal phones or computers.
13. Before sending an application, verify attachments, email address, destination, client authorization and recipient entitlement.
14. Keep meeting notes, signed illustrations, consent forms, needs analyses, disclosure records and communications consistent with applicable recordkeeping obligations.
15. Do not discuss client health, claims or financial matters in public spaces or with unauthorized relatives or colleagues.
16. For remote work, use secured networks, company-approved devices, screen locks and secure workspaces; never leave records in vehicles or unattended public spaces.
17. On departure or role change, promptly revoke access, recover assets, transfer business records appropriately and document confirmation.

6. Safeguards and Cybersecurity

Administrative safeguards

• Role-based, least-privilege access; documented account provisioning, periodic access review and prompt deactivation.
• Confidentiality undertakings for staff and relevant vendors; privacy training at onboarding and at least annually.
• Approved data inventory, retention schedule, secure disposal process, and supplier due diligence.
• Change management and escalation for new software, AI tools, data-sharing channels or high-risk processing.

Technical safeguards

• Unique strong passwords and multifactor authentication for systems holding sensitive information where supported; no credential sharing.
• Encryption in transit and at rest appropriate to sensitivity and technical environment.
• Endpoint security, timely security patches, firewalls, backups and restoration testing.
• Monitoring/logging proportionate to risk, phishing protections, and secure access to cloud systems.
• No client information in public generative-AI tools or unapproved applications without documented privacy/security approval and a valid legal basis.

Physical safeguards

• Locked offices/cabinets; clean desks; visitor supervision; secure printed records and controlled keys.
• Cross-cut shredding or approved secure destruction; documented disposal of electronic media.
• Secure transport of papers; avoid printing and local downloads unless strictly necessary.

7. Third Parties, Transfers and Digital Channels

Before enabling a service provider to process personal information, assess access requirements, security posture, subcontracting, breach cooperation, data location, lawful transfers, retention and deletion obligations. Use contracts appropriate to risk that address permitted purposes, confidentiality, safeguards, incident reporting, audit/cooperation and return/destruction. TruCover remains accountable for information under its control even where processed by others.

Where information is processed or accessible outside Canada, evaluate jurisdictional risks and provide meaningful transparency consistent with applicable law. Do not promise that all information stays in Canada unless verified. Website forms, analytics, tracking technologies and marketing lists require separate assessment and an accurate public-facing website notice that describes actual practices.

8. Individual Requests and Complaints

Access, correction and consent withdrawal

Direct requests to admin@trucover.ca or the office address. Authenticate the requestor appropriately and log the receipt date, requested records, deadline, decision and response. Where PIPEDA applies, respond within the statutory 30-day period subject to lawful extensions; communicate any extension and reasons as required. Provide access and correction except where law permits or requires refusal, and explain available recourse. Record disagreements about disputed data when warranted.

Withdrawal of consent is subject to legal and contractual restrictions and reasonable notice. Confirm which future uses can cease and which information must remain for legitimate regulatory, legal or dispute-management purposes. Process marketing opt-outs according to applicable requirements.

Complaints

Acknowledge complaints promptly, investigate impartially, document findings and corrections, and provide a reasoned response with details of applicable external complaint channels, including the Office of the Privacy Commissioner of Canada when relevant. Escalate insurer/MGA-related matters to the responsible organization through approved channels.

9. Incident Response and Breach Notification

9.1 Immediate escalation and containment

All suspected or confirmed incidents must be reported immediately to the Privacy Officer or management. Staff should preserve the original message/file and incident details, take safe steps to limit exposure, and follow containment directions. Reporting must not await proof of harm or a completed incident form.

18. Secure and contain: Stop unauthorized access, revoke credentials, recall messages where possible, isolate affected systems with IT support and preserve forensic evidence.
19. Open an incident record: Identify reporter, discovery time, event timeline, systems, information types, affected individuals and known recipients.
20. Assign an investigation owner and notify relevant insurer/MGA/dealer, vendor, IT/security, legal counsel or law enforcement as appropriate.
21. Assess scope and harm: Sensitivity, circumstances of exposure, encryption, likelihood of misuse, actual or potential impacts and corrective controls.
22. Make and document statutory reporting and notification decisions, including no-report decisions, with rationale.
23. Notify required parties as soon as feasible under applicable law; provide accessible practical advice and update information as investigation continues.
24. Close with root-cause review, assigned remediation, target dates, validation and management sign-off.

9.2 PIPEDA real risk of significant harm assessment

For a breach of security safeguards involving personal information under TruCover’s control, assess whether it is reasonable in the circumstances to believe the breach creates a real risk of significant harm to an individual. Relevant factors include sensitivity of the information and probability of actual or future misuse. Potential harms include identity theft, financial loss, humiliation, reputation or relationship damage, negative credit impacts, employment/business impacts and threats to safety.

If PIPEDA reporting requirements apply and RROSH exists, report to the Office of the Privacy Commissioner of Canada and notify affected individuals as soon as feasible after determining the breach occurred, in the required form and with required content. Consider notifying other organizations or government institutions capable of reducing or mitigating harm when legally required or permitted. Examine any separate provincial, sectoral or contractual reporting requirements rather than assuming PIPEDA is exhaustive.

9.3 Notification content and governance

Individual notifications should explain, as required by law, the circumstances and timing, the types of personal information affected, measures taken, steps recipients can take to reduce harm, the organization’s contact details and the ability to complain to the appropriate commissioner. The Privacy Officer approves notices and keeps a copy, recipient list, dates and delivery records. Law-enforcement coordination does not automatically suspend legal notice obligations.

9.4 Breach recordkeeping

Maintain records of every breach of security safeguards covered by PIPEDA, including breaches not meeting RROSH, for at least 24 months after the day TruCover determines the breach occurred; preserve longer when another retention requirement, legal hold or contractual obligation applies. Records must permit an assessment of whether reporting and notification decisions were reasonable.

10. Records, Retention and Secure Disposal

Retain records only as long as reasonably required for identified purposes and applicable insurance, investment, tax, anti-money-laundering, contractual and litigation obligations. Because requirements vary by record category and product, TruCover will maintain a separate approved retention schedule rather than applying a single arbitrary period to all client files. Suspend disposal when litigation, regulatory inquiry, complaint or investigation creates a legal hold. At expiry, securely delete, anonymize or destroy the information and document material destruction.

11. Training, Oversight and Enforcement

Before system access, personnel must acknowledge this policy and complete orientation. Refresher training will occur at least annually and after major incidents or procedural changes, with attendance and topic records retained. Management will review technology and privacy risks at least annually, including access, third parties, incidents, data handling and website practices. Violations may result in access restrictions, remedial training, discipline, termination of engagement and external reporting where appropriate.

Management approval and effective date are required before this manual is considered adopted. This manual should be reviewed by qualified Canadian privacy/compliance counsel and aligned with applicable insurer/MGA and dealer requirements before reliance in an audit.

Appendix A — Privacy Breach Incident Report

Appendix B — RROSH Decision Worksheet

Appendix C — Staff Training and Acknowledgment Register

Appendix D — Privacy Complaint and Access Request Log

Appendix E — Annual Safeguards Review Checklist

• Privacy Officer appointed and current contact published internally
• Advisor confidentiality and privacy acknowledgments completed
• Sensitive-data collection, consent and sharing practices reviewed
• Least-privilege access and offboarding records checked
• MFA, endpoint updates, backups and recovery testing reviewed
• Email, portals, storage, website forms and third-party services reviewed
• Incident register, RROSH records and notification decisions checked
• Retention schedule, disposal records and legal holds reviewed
• Client requests and complaints completed within applicable deadlines
• Remediation actions assigned, tracked and validated

Reviewer: ___________________ Review date: ______________ Follow-up due: ______________

Appendix F — Policy Revision and Approval Record

Legal and reference points for final management review

• PIPEDA and the Personal Information Protection and Electronic Documents Regulations (breach reporting, notification and records).
• Office of the Privacy Commissioner of Canada: guidance on breach reporting and privacy management programs.
• CASL requirements for commercial electronic messages, where applicable.
• Applicable Ontario insurance requirements, insurer/MGA/dealer agreements and federal/provincial recordkeeping rules.