MEDICURE INC.

Privacy Policy

Effective Date: Septembrer 14, 2026
Last Updated: September 14, 2026

1. About this Policy

Medicure Inc. ("Medicure", "we", "us", "our") is a pharmaceutical company headquartered in Winnipeg, Manitoba, Canada, listed on the TSX Venture Exchange under the symbol MPH and quoted in the United States on the OTC market under the symbol MCUJF.

This Policy describes how we handle personal information collected through medicure.com and any other website we operate that links to this Policy, which we refer to together as the "Site". It also covers personal information you send us by email or telephone using the contact details published on the Site.

Our products are sold only in the United States. Information about them on the Site is intended for a United States audience, and nothing on the Site is an offer to supply a product anywhere else. Our investors, by contrast, are located in Canada, the United States and potentially elsewhere, and the investor sections of the Site are intended for all of them.

1.1 Companies covered by this Policy

This Policy applies to Medicure Inc. and to the following subsidiaries, in respect of personal information collected through the Site:

Medicure International Inc. (Barbados), which holds the United States rights to AGGRASTAT (tirofiban hydrochloride) injection and ZYPITAMAG (pitavastatin) tablets
Medicure Pharma Inc., which distributes our products in the United States

1.2 Companies with their own privacy policies

Our pharmacy businesses each maintain their own privacy documents, because they hold health information governed by rules that do not apply to this Site:

Marley Drug, Inc., a mail-order and retail pharmacy serving all fifty states, Washington D.C. and Puerto Rico
Gateway Medical Pharmacy, Portland, Oregon
West Olympia Pharmacy, Olympia, Washington

If you are a patient of one of those pharmacies, the privacy policy and notice of privacy practices published by that pharmacy govern your information, not this Policy.

The Site links to websites we operate for individual products, and to third-party websites we do not control. Following a link takes you to a separate site with its own privacy policy, which you should read before providing information there.

2. Information we collect

2.1 Information you give us

Where it comes from	What we collect
Contact and enquiry forms, email and telephone	Your name, email address, city, province or state, and telephone number, together with whatever you choose to tell us in your message.
Investor newsletter sign-up	Your email address, and your name where you give it.
Health care professionals	Your specialty, place of work, and National Provider Identifier, which we use to confirm your professional status before giving you access to information intended for health care professionals.
Medical information enquiries	Your contact details and the content of your enquiry about one of our products.
Adverse event and product complaint reports	Whatever you tell us when you report an adverse event or a product complaint, which may include information about a patient's health. See Section 5.
Product enquiries	Your contact details and the content of your enquiry about one of our products. See Section 6.
Job applications	Your CV and anything else you send to our human resources address, including your work history, education and contact details.
Telephone calls and voicemail	Your telephone number, a recording of the call or voicemail, and any transcript of it. See Section 2.4.

Sometimes people send us information about another person - for example, a health care professional reporting an adverse event experienced by a patient. If you give us information about someone else, you confirm that you are entitled to do so.

2.2 Information collected automatically

When you visit the Site, we and the providers described in Section 4 collect your IP address, browser and device type, operating system, the pages you view, the pages you arrived from and moved on to, and the dates and times of your visit. We derive an approximate location from your IP address, generally no more precise than city or region. Where you have accepted performance cookies, we also record how you interact with a page - clicks, scrolling and mouse movement - as described in Section 4.3.

2.3 Information from other sources

We may combine what we hold with information from public databases and other third parties, for example to verify the licensure of a health care professional.

2.4 Telephone calls

Our telephone lines are operated through a third-party communications provider. Calls are recorded for quality assurance, and voicemail messages are recorded, transcribed and delivered to the member of staff they were left for. This means that when you call us we collect your telephone number, what you said, and a written transcript of it.

You will be told at the start of the call that it may be recorded. If you would prefer not to be recorded, you can write to us instead using the contact details in Section 15.

We do not collect government identification numbers, financial account numbers, precise geolocation, biometric or genetic information through the Site.

3. How we use personal information

To respond to you - answering enquiries sent through the Site, by email or by telephone.
To keep investors informed - sending press releases, financial results, event notices and other corporate communications to people who have asked to receive them.
To meet our regulatory obligations - recording, investigating and reporting adverse events and product complaints as required by the United States Food and Drug Administration.
To verify professional status - confirming that a person requesting health care professional information is one.
To answer questions about our products, as described in Section 6.
To consider job applications.
To maintain the quality of our telephone service, through call recording and review.
To operate, secure and improve the Site - understanding which pages are used, diagnosing faults and preventing misuse.
To measure and deliver our communications and advertising, where you have consented to the technologies described in Section 4.
To comply with law, respond to lawful requests, and establish, exercise or defend legal claims.

We will not use personal information for a materially different purpose without telling you first and, where the law requires it, obtaining your consent.

4. Cookies and other tracking technologies

Cookies are small data files placed on your device when you visit a website. We also use pixels, tags, web beacons and server logs, and we refer to all of these as cookies in this section.

A current list of the individual cookies in use, showing the companies that set them and whether they are first or third party, is published at medicure.com/cookie-list.

4.1 Categories we use

Category	What it does	Consent
Strictly necessary	Records your cookie choices and keeps the Site working and secure.	Runs without consent and cannot be switched off.
Functional	Supports the forms and marketing platform we use to respond to enquiries and to manage subscriptions to our investor communications.	Runs only with your consent.
Performance	Measures how the Site is used - which pages are visited and how visitors move through them - so that we can improve it.	Runs only with your consent.
Performance	Measures how the Site is used - which pages are visited, how visitors move through them, and where they run into difficulty - so that we can improve it. See Section 4.3.	Runs only with your consent.
Targeting	Supports video embedded in our pages. See Section 4.2.	Runs only with your consent.

4.2 Embedded video

Some of our pages embed video hosted by a third-party video platform. When that content loads, the platform receives your IP address and the address of the page you are viewing, and may set its own advertising cookies. Under some United States state privacy laws this can be treated as "sharing" personal information for cross-context behavioural advertising, even though no money changes hands.

You can prevent it by declining the targeting category in Cookie Preferences, or by sending a Global Privacy Control signal as described in Section 4.5. Apart from embedded video, we do not use advertising or audience-targeting technologies on the Site, and we do not sell personal information.

4.3 Analytics and session recording

We use analytics tools to understand how the Site is used - which pages are visited, how visitors move between them, and where they encounter problems. One of these tools records anonymised sessions, capturing clicks, scrolling and mouse movement so that we can see where a page is confusing or broken.

These recordings are configured to hide the contents of form fields, so what you type into a form is not captured. They do not record audio, and they are not used to identify you or to target advertising to you. They run only if you accept the performance category in Cookie Preferences.

4.4 Your choices

When you first visit the Site we present a cookie banner. Non-essential cookies do not run until you accept them. You may accept all categories, reject all non-essential categories, or choose individually, and rejecting is as easy as accepting. You can change your choices at any time through the Cookie Preferences link in the footer of every page. Your choices apply to the browser and device you are using.

Most browsers also let you block or delete cookies through their own settings. Blocking cookies may stop parts of the Site working.

4.5 Browser signals

We recognise and honour the Global Privacy Control signal. If your browser or a browser extension sends that signal, we treat it as a request to opt out of the sale and sharing of personal information and of targeted advertising for that browser.

Some browsers also send a "Do Not Track" signal. There is no common industry standard for interpreting it and we do not respond to it. Please use Cookie Preferences or Global Privacy Control instead, which we do act on.

4.6 Email tracking

Our investor and marketing emails contain pixels that tell us whether a message was opened and which links were followed. We use this to understand which communications are useful. Every such email contains an unsubscribe link.

4.7 Embedded content and social media

Some pages contain video and other content hosted by third parties. When that content loads, the third party receives your IP address and information about your device, and may set its own cookies. The Site also links to our social media profiles. Following those links takes you to platforms we do not control, governed by their own policies.

5. Adverse events and medical information

If you report an adverse event or a product complaint, or ask our Medical Information Department a question about one of our products, we handle that information differently from everything else described in this Policy, because we are required to.

Reports are received by telephone on 1-800-509-0544 and by email at adverse.events@medicure.com. Medical information enquiries reach medical.information@medicure.com. We do not collect adverse event reports through a form on the Site. Calls to these lines are recorded, and voicemail messages are recorded and transcribed, as described in Section 2.4.

5.1 What we do with a report

We record what you tell us, investigate it, and report it to the United States Food and Drug Administration where we are required to. A report may include information about a patient's health, their age and sex, the medicine involved, and the outcome. Where you report on behalf of someone else, that information concerns them rather than you.

5.2 Why we cannot delete these records

Pharmacovigilance records are subject to mandatory retention periods under drug safety regulations. This means that if you ask us to delete your personal information, we will delete what we can but we must keep adverse event and product complaint records for the period the law requires. We will tell you when that applies to a request you have made.

You may also report an adverse event directly to the FDA through MedWatch at fda.gov/medwatch or by telephone on 1-800-FDA-1088.

6. Product enquiries and patient support

We answer questions about our products by telephone and email rather than through the Site - for ZYPITAMAG on 1-833-ZYP-4YOU and at zypitamag@medicure.com. We use your contact details and the content of your enquiry to respond to you, and we keep a record of the exchange. Calls to these lines are recorded as described in Section 2.4.

We do not currently operate a copay assistance program.

7. How we share personal information

Within our group - with the Medicure companies listed in Section 1.1, for the purposes described in this Policy.
With service providers - website hosting and development, email and marketing platforms, analytics providers, our telephone and voicemail provider, and consent management. These providers may use personal information only to provide services to us.
With advertising and audience measurement providers - where you have consented to targeting cookies, as described in Section 4.
With our transfer agent and registrar - for shareholders, as described in Section 8.
With professional advisers - lawyers, auditors and insurers.
With regulators and other authorities - including drug safety regulators, securities regulators, courts and law enforcement, where the law requires it or where we need to protect the rights, property or safety of Medicure, our patients, our shareholders or others.
In a corporate transaction - if we sell or transfer a business unit or asset, including in a bankruptcy or similar proceeding, personal information may be among the assets transferred. We would require the recipient to protect it consistently with this Policy.
In aggregated or de-identified form - information that does not identify you may be used and shared for any purpose.

We do not sell personal information for money. Whether the advertising technologies described in Section 4.2 amount to a "sale" or "sharing" under some United States state laws is addressed there, and you can opt out.

8. Investors and shareholders

Most people who visit this Site are investors, so this section sets out what that involves.

8.1 If you subscribe to investor communications

We use your email address to send press releases, financial results, event notices and similar corporate communications. You can unsubscribe at any time using the link in any of those emails, or by contacting us using the details in Section 15. These are sent through a third-party email platform, which processes your address on our behalf.

8.2 If you hold our shares

Shareholder registers are maintained by our transfer agent rather than through this Site. Information about registered shareholders reaches us through the transfer agent and through regulatory filings. As a reporting issuer we are required to collect, retain and in some cases publicly disclose certain information - for example, the holdings of directors, officers and significant shareholders. Those obligations arise under securities law and are not affected by the rights described in Section 9.

8.3 If you contact investor relations

We use your contact details and the content of your message to respond, and we keep a record of the exchange.

9. Your rights

9.1 Everyone

Whoever you are and wherever you live, you may ask us to give you access to the personal information we hold about you, correct it if it is wrong, delete it, or stop using it for a particular purpose. You may also withdraw consent you have given. We respond to every request.

Some information we are required to keep, and a deletion request cannot override that. Where an exception applies we will delete everything else and tell you what we have kept and why. The main exceptions are:

Records of adverse events and product complaints, which drug safety regulation requires us to retain - see Section 5.
Shareholder, director and officer records, which securities law requires us to keep and in some cases to disclose publicly - see Section 8.2.
Anything we need in order to comply with a legal obligation, or to establish, exercise or defend a legal claim.

We will not treat you differently for exercising these rights.

9.2 Canada

Medicure is a Canadian organisation, headquartered in Winnipeg and listed on a Canadian exchange, and it handles personal information in the course of commercial activity. The Personal Information Protection and Electronic Documents Act therefore applies to how we handle personal information, including that of our investors, regardless of the fact that our products are sold only in the United States. You have the right to know what personal information we hold about you, why we collected it and to whom it has been disclosed; to ask us to correct it; to withdraw consent, subject to legal and contractual restrictions; and to challenge our handling of it. Our Privacy Officer is responsible for our compliance and is your first point of contact. If you are not satisfied with our response you may complain to the Office of the Privacy Commissioner of Canada.

9.3 Quebec

If you live in Quebec, you also have the right to receive the personal information you gave us in a structured, commonly used technological format, and to be informed where a decision about you is based exclusively on automated processing. We do not make decisions of that kind through the Site.

9.4 California and other United States states

If you live in California, you may request the categories and specific pieces of personal information we have collected about you, the sources, the purposes and the categories of third parties we disclose to; correction; deletion; and to opt out of the sale or sharing of personal information. Residents of other states with comprehensive privacy laws have comparable rights. To opt out of sale or sharing, use Cookie Preferences or send a Global Privacy Control signal; you do not need an account and we will not ask you to verify your identity to opt out.

California Civil Code section 1798.83 allows California residents to ask about disclosures of personal information to third parties for those third parties' own direct marketing purposes. We do not make such disclosures.

9.5 How to make a request

Submit a request using the Your Privacy Choices link in the footer of every page, which opens our online request form. You may also email compliance@medicure.com or call 1-800-509-0544. You may also write to the Privacy Officer at the address in Section 15. We may ask for information to confirm your identity, which we will use only for that purpose. We will respond within the time the applicable law allows, and we will tell you if we need longer.

If we decline to act on your request we will explain why, and you may ask us to reconsider by replying to our response.

10. Where your information is held

Medicure is headquartered in Canada and has subsidiaries in the United States and Barbados. Personal information you give us may be stored in, transferred to, and accessed from any of those countries, and by our service providers in other countries.

Where information is held outside your own country it may be accessible to the courts, law enforcement and national security authorities of that country. Wherever it is held, we handle it in accordance with this Policy and require our service providers to protect it.

11. How long we keep personal information

Category	Retention
Adverse event and product complaint records	Retained for the period required by drug safety regulation. This obligation overrides deletion requests.
Medical information enquiries	Retained for the period needed to answer the enquiry and to meet regulatory recordkeeping obligations.
Investor and shareholder records	Retained for the period required by Canadian and United States securities law and by our corporate records obligations.
Investor communication subscriptions	Retained while you are subscribed. Unsubscribe records are kept indefinitely, because we need them in order to honour your choice.
Enquiries and correspondence	Retained for as long as needed to deal with the matter and for the period during which a related claim could be brought.
Job applications	Retained for 12 months after the role is filled, unless you ask us to keep your details on file.
Call recordings, voicemail and transcripts	Retained for 12 months for quality assurance, except where a call concerns an adverse event or product complaint, in which case the drug safety retention period above applies.
Records of a closed patient support programme	Retained only where a legal or audit obligation requires it.
Cookies and device identifiers	Session cookies are deleted when you close your browser. Persistent cookies remain until they expire or you delete them, for the period set by the party that placed them.

12. Security

We maintain administrative, technical and physical safeguards designed to protect personal information against unauthorised access, use, alteration and loss. These include access controls limiting employee access to what their role requires, encryption of information in transit, due diligence and contractual commitments from our service providers, employee confidentiality obligations and training, and a documented process for responding to incidents.

No system is completely secure and we cannot guarantee the security of information transmitted to us over the internet. If you believe your information has been compromised, contact us at compliance@medicure.com.

If a security incident affects your personal information, we will notify you and the relevant authorities as required by applicable law.

13. Children

The Site is intended for adults. It is not directed to children and we do not knowingly collect personal information from them. If you believe a child has given us personal information through the Site, contact us using the details in Section 15 and we will delete it.

Adverse event reports may concern a child, because a child may have taken one of our medicines. That information is handled as described in Section 5 and is retained as drug safety regulation requires.

14. Changes to this Policy

We may update this Policy. When we do, we will change the Last Updated date at the top and post the revised Policy on the Site. If the changes are material we will give additional notice before they take effect. Information we collected before a change will be handled in accordance with the Policy in force when it was collected, unless we notify you otherwise or you consent. We review this Policy at least once every twelve months.

15. Contact us

The company responsible for the collection, use and disclosure of personal information under this Policy is Medicure Inc.

Medicure Inc.
Attention: Privacy Officer
2-1250 Waverley Street
Winnipeg, Manitoba, Canada R3T 6C6
Telephone: 204-487-7412
Email: compliance@medicure.com

United States enquiries may also be addressed to Medicure Pharma Inc., 116 Village Blvd, Suite 200, Princeton, New Jersey 08540.