Our Policy

Last update: February 15, 2008

Kanayo Software Inc. ("Kanayo") realizes that our website, www.HealthGraphCommunity.com (the "Site"), can only work if we build trust with our patient communities. This policy outlines the type of information Kanayo collects from our members and how it is shared with other parties. We reserve the right to modify this policy at any time, and without prior notice, by posting amended terms on our website. We will update our website promptly when changes are made to draw your attention to the new policy. However, it is your obligation to keep yourself informed as to the current wording.

WHAT KIND OF DATA WE COLLECT AND WHY

Consent

Kanayo is committed to ensuring that you are aware of why your personal information is being collected, how your personal information is being used, and for what reason your personal information may be disclosed. To this end, we will use all reasonable efforts to provide information to you on how your personal information will be used by us as well as to obtain your consent when you provide us with personal information.

As well, we may periodically request confirmation from you to ensure that the personal information collected and maintained by us is up-to-date and accurate and that we have your continuing consent for the use or attention of your personal information.

Kanayo may collect, use or disclose your personal information, without notice to you, only if required to do so by law or in the good faith belief that such action is necessary to:

a. conform to obligations imposed by law or statutes;

b. meet an emergency need; and/or

c. If the purposes for collecting, using and disclosing your personal information differ from those purposes listed below, we will advise you, either by amending this Privacy Statement and notifying you of the amendment, or by seeking your further consent.

Personal information collected and used by Kanayo

The Site enables patients to track and share their disease history online so that the collective knowledge of thousands of patients can be shared with others affected by the disease. We know our success in achieving this goal depends on our members' sharing this philosophy.

The type of data members may add to their profiles ("Profile Data") may include:

• Condition/disease information, including diagnosis date, first symptom information, and family history
• Treatment regimens, including treatment start dates, stop dates, effectiveness, and dosages
• Symptoms experienced, including severity and duration
• Biographical information, including photo, bio, gender, age, location (city, state & country), and general notes

Members may voluntarily enter information that identifies them ("Personal Information") into their Profile Data or elsewhere on the Site. You may enter as much or as little of such information as you like. In the course of registering to use the Site, Kanayo may also ask you to provide certain information about yourself not in your Profile Data, such as your name, address, email, and birth date.

We may also periodically ask you to complete short surveys. You are free to respond or not. Your participation in these surveys is not required, and your refusal to do so will not impact your experience on the site. To create the best possible tools, research, and functionality for patients, we may also review your Personal Information internally as needed.

Cookies are required to use the Site. A cookie is a small data file, which often includes an anonymous unique identifier that is sent to your browser from a web site's computers and stored on your computer's hard drive. The Site uses two types of cookies: Session Cookies, and Persistent Cookies. Session Cookies are temporary cookies that remain in the cookie file of your browser until you leave the Website. Session cookies do no store any Personal Information, only a unique visitor ID number that we can use to customize the Site functionality for you. Persistent Cookies remain in the cookie file of your browser for much longer, even after you leave the Site. Persistent cookies do no store any Personal Information, only preferences that should persist from visit to visit, like "Remember Me".

In summary, we collect Profile Data and Personal Information to expand the knowledge base in relation to diseases. The knowledge we gain will help us and care givers in providing better quality services in a more timely manner to you and others.

HOW YOUR PERSONALLY IDENTIFIABLE DATA IS USED

So others can learn from your experience, your Profile Data will be aggregated and made available to other members. For example, we may report the number of patients trying a particular treatment or the number of patients experiencing a particular symptom. Additionally, other members will be able to view your Profile Data.

In addition to serving the individual needs of our members, Kanayo sponsors on-going research studies. By filling out your Profile Data you are adding your health information to our database which may be used in research. For example, we may look at scientific questions such as, "Do certain treatments work better for some types of people versus others?" At Kanayo and in conjunction with external researchers, we're interested in better understanding the experience of living with chronic conditions and improving treatment options and health outcomes for everyone.

Kanayo will never rent, sell or share Personal Information for marketing purposes. To be clear, Kanayo may, from time-to-time, sell aggregate data to a third party. Kanayo identifies "aggregate data" as being information relating to 3 or more Site members, excluding business information and excluding names and residential addresses (geographical area may be provided).

In the future, we may provide an opt-in service to allow our partners (including but not limited to pharmaceutical companies, medical devices companies, non-profits, and research institutions) to directly and anonymously communicate with you through our system. Furthermore, we may provide our partners with anonymized data (which may or may not be aggregated) for research and commercial purposes.

PRIVACY SETTINGS

HealthGraphCommunity offers three privacy levels you may choose for your Profile Data. Regardless of your privacy level, the following is always true: All HealthGraphCommunity registered members can see your username, and can contact you through HealthGraphCommunity. The privacy levels are:

• Everyone can see my profile: All HealthGraphCommunity registered members can see my Profile Data.
• Only my friends can see my profile: Only HealthGraphCommunity members who I have added to my HealthGraphCommunity Friends List can see my Profile Data.
• Only I can see my profile: Only I can see my Profile Data.

You may change your privacy level at any time.

Because the value of the Site is in sharing your experiences to help others, we hope that you feel comfortable enough to make your profile as visible as possible.

OTHER SECURITY ISSUES

Kanayo cannot guarantee the identity of any other members with whom you may interact in the course of using the Site or who may have access (based on the privacy level you have selected) to information you have posted in the Member Area. Additionally, we cannot guarantee the authenticity of any data that members may provide about themselves.

Kanayo takes commercially reasonable technical precautions to help keep your data secure.

RISKS AND BENEFITS

While our goal is to help patients improve health outcomes, there are no certain benefits to using this website. However, keeping track of personal well-being, treatments and symptoms has been shown to be helpful in improving overall health.

There are also no known risks to using this website, but there is a possibility that users may feel uncomfortable sharing information online. You are free to stop using this service at any time. You are also free to skip any questions or data fields that make you feel uncomfortable. If you decide to stop using this service for whatever reason, we are obliged to cease using your Profile Data and Personal Information if that is your request. We take our obligations under the Personal Information Protection and Electronic Documents Act very seriously.

WITHDRAWAL OF CONSENT

You may elect to withdraw consent of use of your personal information at any time. The procedure for withdrawal is as follows:

1. Please send a written request to the Privacy Officer, marked "Confidential" to the address listed at the end of this Privacy Statement.

2. Written notice must indicate why you are making such a request.

3. Please provide proof of identity as indicated above. Such withdrawal of consent may have one or all of the following implications:

1. An individual's access to the Site may be denied

2. The individual's Personal Information will be deleted from Kanayo's records and the individual may have to provide new information.

Retention and Destruction of Personal Information

Kanayo retains all information relative to consumers who have submitted their information, including historical data such as resumes. Kanayo may from time to time choose to destroy such data. When data is destroyed it is done so in a permanent, secure and private manner. Kanayo will not notify an individual of the destruction of his or her personal information.

QUESTIONS ABOUT THE PRIVACY POLICY

Our Privacy Officer

We have designated an individual at Kanayo to be responsible for the day-to-day care of personal information that may come to be in our control and our compliance with this Privacy Statement (the "Privacy Officer"). You may contact the Privacy Officer at Kanayo, in writing, at any time if you require further clarification on this Privacy Statement or to make a request for access to your personal information.

How to Contact the Privacy Officer:

Email: privacy@kanayo.com

Mail: Send your letter marked "Attention: Mark McManus" to:

Kanayo Software, Inc.
1668 Barrington Street, Suite 402
Halifax, NS B3J 2A2

Please mark your envelope as "Confidential".

Fax: 902-450-1580

How We Process Personal Information Access Requests:

Step 1: Requests for personal information must be made in writing to the email, mailing address or fax number above.

Step 2: Kanayo will respond to your inquiry within 30 days of receipt of the letter or email. Kanayo may furnish you with the requested information or provide a notice of extension. Kanayo reserves the right to sever information from personal information provided to you if, for example, such information may interfere with or harm Kanayo or its employees, directors, officers, partners or associated businesses or in some way or reveal confidential commercial information.

Some information requested may have an associated cost for retrieval and provision. If there is a cost for the information you have requested, you will be advised within the first 30 days of such costs. Costs must be paid in full before personal information is released to you.

Step 3: Prior to releasing personal information to you, Kanayo reserves the right to confirm your identity. Identification may be confirmed with either of the following;

a. photo identification - 1 piece of photo identification; or

b. a signed document - A signed document or item with the individual's signature must be provided with a photograph.

In addition to the above, proof of residence must be provided. This may include a driver's license or similar document. Emailed digital photographs of identification will not be accepted, but Kanayo will accept clear photocopies or scans of the above documents as proof of identity.

Kanayo will only use the above identity documents for the purpose of confirming your identity. By complying with the above procedures, you consent to this process.