NOTICE OF CLASS ACTION CERTIFICATION, SETTLEMENT APPROVAL, AND COUNSEL FEE APPROVAL

PLEASE READ THIS NOTICE CAREFULLY. IT MAY AFFECT YOUR RIGHTS.

SUMMARY

A class action was brought against CarePartners related to the cyber-security breach which was announced by CarePartners on June 18, 2018 (the "Cyber-Breach"). The Court has now allowed the case to be prosecuted as a class action, and it has also approved a settlement of the class action. The class action is called Redublo et al. v. 8262900 Canada Inc. o/aCarePartners (the "Class Action").

Anyone who fits this definition is included in the Class:

All persons who are or were patients, non-unionized employees or contractors of CarePartners from January 1, 2010, to June 11, 2018, excluding CarePartners' officers and directors.

You are receiving this Notice because you have been identified as an Affected Class Member. Affected Class Members are those Class Members whose personal information has been confirmed to have been included in the Cyber-Breach.

As an Affected Class Member, you now must decide whether to stay in the Class Action or to exclude yourself from the Class Action (this is called opting out).

• If you stay in the Class Action, then you will be bound by the settlement, and you are entitled to share in the compensation from the settlement. You need to submit a claim form by January 11, 2023 if you stay in the Class Action and want to receive a share of the settlement funds.
• If you opt out, then you will not be part of the Class Action, you will not be bound by the settlement, and you will not be able to receive a share of the settlement. If you opt out, you may be able to commence your own claim against CarePartners, but you should be aware that there are time limits within which you can start a claim. You should consult a lawyer before deciding to opt out to start your own claim. If you decide to opt out, you need to submit an Opt-Out notice to the Claims Administrator by December 12, 2022. Details about how to opt out are set out below at #6.

Under the Settlement, CarePartners will pay $3,440,000.00 (the "Settlement Fund"), in exchange for a full and final release from the Class of all the claims made against it in the Class Action. If more than a specified number of people decide to opt out, CarePartners has the option to void the Settlement, in which case the Class Action will continue.

Once legal fees, disbursements, honorarium payments to the Plaintiffs, and the costs of administering the settlement are deducted, the net Settlement Fund will be distributed equally among all Affected Class Members who submit valid Claim Forms by the claims deadline.

The settlement is a compromise of disputed claims in order to achieve an early full and final resolution of the Class Action and without any admission or findings of liability or wrongdoing against CarePartners. CarePartners denies any liability and denies the truth of the allegations made against it. If the Settlement Agreement had not been approved, it would have defended the Class Action and opposed certification of the action as a class proceeding.

This Notice provides a summary of the Settlement Agreement. The full Settlement Agreement may be viewed at: https://CarePartnersPrivacyBreach.ca.

BASIC INFORMATION

1. Why is there a Notice?

The Ontario Superior Court of Justice has now certified this lawsuit as a Class Action, on consent, for the purposes of facilitating the settlement. Arthur Redublo and Donna Moher (the "Plaintiffs") were appointed as the representative plaintiffs for the Class. The Plaintiffs are two individuals whose information was taken by the hackers during the Cyber-Breach. The Plaintiffs brought this Class Action seeking damages on behalf of all individuals who may have been similarly affected by the Cyber-Breach.

The Court has approved the Settlement Agreement and has found that it is fair, reasonable, and in the best interests of the Class. The Court's Reasons may be viewed at: https://waddellphillips.ca/class-actions/carepartners-class-action.

Affected Class Members (as defined in the Settlement Agreement - see discussion below) may now make a claim to receive a portion of the net Settlement Fund. A Claim Form is available on the Claims Administrator's website, which can be accessed at: https://portal.CarePartnersPrivacyBreach.ca.

2. What is this lawsuit about?

On June 18, 2018, CarePartners announced that it had been hacked. Personal information, including personal health information, belonging to an unspecified number of CarePartners patients and employees/contractors was extracted by the hackers who wanted CarePartners to pay them a ransom. To pressure CarePartners into paying the ransom, the hackers produced a sample of the stolen information to CarePartners to prove that they had the data. When CarePartners did not pay the ransom, the hackers produced a large data set to the CBC. The CBC reviewed the data, but did not share the data more broadly.

The Plaintiffs alleged that CarePartners was negligent in how it was storing the Class Members' personal information, which led to the Cyber-Breach.

CarePartners disputes the Plaintiffs' allegations and has not admitted liability.

3. What are the settlement terms?

All of those individuals whose personal information was produced to CarePartners or to the CBC by the hackers are the "Affected Class Members." An independent review company was hired to review the CBC data set to identify Affected Class Members. Affected Class Members are entitled to claim compensation under the terms of the Settlement.

Under the terms of the Settlement, CarePartners has paid $3,440,000.00 in full and final settlement of all of the claims made against it in the Class Action. CarePartners will receive a release from the Class, and the Class Action has been dismissed. However, if more than a specified number of Affected Class Members opt out of the Class Action, CarePartners has the option to void the Settlement Agreement, and the litigation will continue, and the settlement fund will be returned to CarePartners.

The total Settlement Fund includes legal fees, interest, disbursements, honoraria for the Plaintiffs (in the amount of $5,000 each, in recognition of their contributions to make the Class Action possible), as well as the costs of administering the settlement (including the costs to review the CBC data set). The legal fees and disbursements have been approved by the Court in the total amount of $816,302.25, inclusive of taxes. After these amounts are deducted from the Settlement Fund, the net amount will be distributed equally amongst all Affected Class Members who submit a valid Claim Form by January 11, 2023.

If any amount remains in the Settlement Fund after the claims administration process is complete, it will be transferred to the Public Interest Advocacy Center, a non-profit organization that provides legal and research services on behalf of consumer interests, including privacy rights.

4. Who is a member of the Class?

If you meet the Class definition, and you do not opt out of the Class Action before the opt-out deadline of December 12, 2022, then you are automatically included as a Class Member.

The Class definition is:

all persons who are or were patients, non-unionized employees or contractors of CarePartners from January 1, 2010, to June 11, 2018, excluding CarePartners' officers and directors.

WHAT TO DO NOW

5. How do I make a claim?

Only Affected Class Members are entitled to receive a payment from the Settlement Fund. Affected Class Members must submit a completed Claim Form to the Claims Administrator, Trilogy Class Action Services, no later than January 11, 2023 (the "Claim Deadline"). Compensation for approved claims will be paid by cheque.

Claimants must complete and submit their Claim Form electronically in the online claims administration portal at: https://portal.carepartnersprivacybreach.ca.

Questions about the Claim Form should be made to the Claims Administrator at:

Trilogy Class Action Services
117 Queen Street, P.O. Box 1000,
Niagara-on-the-Lake, Ontario L0S 1J0
Email:
Tel: 1‑877‑400‑1211

All Claim Forms must be submitted by January 11, 2023. No Claim Forms will be accepted after that date, under any circumstances.

6.  How do I opt out?

If you meet the Class definition, and you do not want to be involved in this Class Action, you must tell the Claims Administrator that you want to opt out before the opt-out deadline of December 12, 2022. Your Opt-Out notice must be in writing and include a clear statement that you wish to exclude yourself/opt out from this Class Action, as well as your full name and address, and it must be signed by you, or include your electronic signature.

Opt-Out notices must be sent to the Claims Administrator by mail, fax or email to:

Trilogy Class Action Services
117 Queen Street, P.O. Box 1000,
Niagara-on-the-Lake, Ontario L0S 1J0
Email:
Tel: 1‑877‑400‑1211
Fax: 416-342-1761

All Opt-Out notices must be submitted by December 12, 2022. No Opt-Out notices will be accepted after that date, under any circumstances.

If you opt out, that means that you are no longer a Class Member. You cannot make a claim for compensation from the Settlement Fund if you opt out of the Class Action. You will not be entitled to share in the Settlement Fund, and you will not be bound by the Court's order approving the Settlement Agreement and granting the release to CarePartners. You will keep any existing right that you had to bring a claim against CarePartners on your own about the Cyber-Breach.

THE LAWYERS REPRESENTING YOU

7. How are Class Counsel paid?

You will not have to pay any of the fees and expenses of Class Counsel. The Court granted Class Counsel's fee request, and Class Counsel's fees and expenses will be deducted from the Settlement Fund, in the total amount of $816,302.25.

The Court also granted honoraria of $5,000 each to the Plaintiffs for their contributions in commencing the Class Action and seeing it through to a successful resolution.

GETTING MORE INFORMATION

8. How do I get more information?

You can obtain more information about this settlement or the Class Action by contacting the Claims Administrator or Class Counsel using the contact details listed below.

Claims Administrator:
Trilogy Class Action Services
117 Queen Street, P.O. Box 1000,
Niagara-on-the-Lake, Ontario L0S 1J0
Email:
Tel: 1‑877‑400‑1211

Class Counsel:
Howie, Sacks & Henry LLP
20 Queen Street West, Suite 3500
Toronto, ON M5H 3R3
Email:
Tel: 416‑3646‑3901
Fax: 416-361-0083
Attn: CarePartners Privacy Breach Class Action

Class Counsel:
Waddell Phillips PC
36 Toronto Street, Suite 1120,
Toronto, ON M5C 2C5
Email:
Tel: 1‑888‑684‑5545
Fax: 416-477-1657
Attn: CarePartners Privacy Breach Class Action

Class Counsel:
Schneider Law Firm
1120 Finch Avenue West, Suite 700
Toronto, ON M3J 3H7
Email:
Tel: 416‑849‑6633
Fax: 416-514-0695
Attn: CarePartners Privacy Breach Class Action