Marley Drug

Consumer Health Data Privacy Notice

Effective Date: September 1, 2026

About This Notice

Marley Drug, Inc. ("Marley Drug," "we," "us," or "our") provides this Consumer Health Data Privacy Notice to describe how we collect, use, share, and protect consumer health data, and the rights you have in that data under the Washington My Health My Data Act and Nevada SB 370.

In this Notice, "consumer health data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status.

This Notice covers only consumer health data. Our Privacy Policy describes how we handle personal information generally. Protected health information that we hold as your pharmacy — including your prescriptions, dispensing history, patient profile, communications with our pharmacists, and responses you give to surveys about products supplied with your pharmacy order — is governed by our HIPAA Notice of Privacy Practices and is not covered by this Notice.

We may amend this Notice. If we make a material change, we will notify you as required by applicable law, including by notifying you at the time we collect consumer health data.

1. Consumer Health Data We Collect

We collect, use, and disclose consumer health data only as needed to provide the products or services you request, or with your consent.

We may collect the following categories of consumer health data:

Health-related browsing activity — the medication, condition, and health-education pages you view on our website, on-site searches you run, and products you place in your cart or purchase. This includes pages relating to sexual and reproductive health.
Health-related inquiries you make to us — questions you ask about a medication or condition by web form, email, or telephone before you become a patient of the pharmacy.
Survey and promotional responses — health-related information you volunteer in a survey or promotion that is not part of your pharmacy record. Where you respond to a survey about a product supplied with your pharmacy order, your response forms part of your pharmacy record, is protected health information, and is governed by our HIPAA Notice of Privacy Practices rather than by this Notice.
Identifiers linked to the activity above. An identifier is consumer health data only where we can associate it with the health-related activity described above. We collect your IP address, and the identifiers in strictly necessary cookies, automatically — these are a necessary part of delivering the pages you request and keeping your session secure. We collect cookie and device identifiers set by analytics and advertising technologies only after you accept the corresponding category in Cookie Preferences. We collect your name, email address, or telephone number only when you provide them to us.
Inferences — conclusions about your possible health interests drawn from the categories above and used for advertising measurement. We create these only where you have accepted advertising cookies.

2. Sources of Consumer Health Data

We collect consumer health data from the following sources:

From you, when you contact us about a medication or condition, place an order, or respond to a survey or promotion.
Automatically, as a necessary part of operating our website. When your browser requests a page, our servers record technical information such as your IP address, the page requested, and the date and time. We create these records to deliver the pages you ask for and to keep the site secure.
Through cookies, pixels, and tags, where you have consented. These technologies record which medication and health-education pages you view. They do not operate until you accept the corresponding category through our Cookie Preferences, and you can change your choice at any time.
From our advertising and analytics partners, who provide us with aggregate and campaign-level information about how visitors reach and interact with our content.

3. How We Use Consumer Health Data

To provide the products, services, and information you request, including responding to your questions about a medication.
To send you emails or text messages you have asked to receive, and to measure whether those messages are opened and acted on.
To operate, secure, measure, and improve our website.
To advertise our products and services, including measuring how our advertising performs and, where you have consented, showing you advertising for Marley Drug on other websites and applications.
To conduct research, analysis, and product development.
To protect the rights, property, and safety of Marley Drug, our patients, and others, and to prevent fraud and abuse.
To comply with applicable law and respond to lawful requests from government authorities.

4. How We Process Consumer Health Data

We collect consumer health data in two ways. Some you provide to us directly, by typing it into a form, telling it to a member of our staff, or answering a survey. Some is collected automatically as you use our website. Automatic collection through cookies, pixels, and advertising or analytics tags does not begin until you have accepted the corresponding category through our cookie banner. Basic server records, described in Section 2, are created whenever your browser requests a page, because they are necessary to deliver the page to you and to keep the site secure.

We store consumer health data on servers located in the United States, and we limit access to personnel who need it for their work. Some of those personnel work outside the United States, including in Canada, and may access consumer health data there while providing services to us. We analyze it in combination with data from other visitors to understand aggregate patterns, and we disclose it to the parties identified in Section 5. We do not use consumer health data to make automated decisions that produce legal or similarly significant effects about you.

We maintain administrative, technical, and physical safeguards designed to protect consumer health data against unauthorized access, use, modification, and disclosure.

5. How We Share Consumer Health Data

What we share

We share your health-related browsing activity, the identifiers linked to that activity, and inferences drawn from it. Specifically, this includes the medication and condition pages you view, including pages relating to sexual and reproductive health, searches you run on our website, cookie and device identifiers, advertising identifiers, and inferences derived from those categories.

We do not share the health-related questions you ask our staff by telephone, email, or web form. We do not share survey or promotional responses in a form that identifies you.

Why we share it

To measure how our advertising performs; to show you advertising for Marley Drug on other websites and applications; to understand how our website is used and improve it; to operate and secure our website; and to comply with law.

Who we share it with

Consent management, which presents our cookie banner, records your choices, and signals them to the technologies below.
Advertising and marketing platforms, which measure how our advertising performs and deliver advertising for Marley Drug to you on other websites and applications. These companies may also use the information they receive for their own purposes, as described in their own privacy policies.
Advertising measurement and attribution providers, which record which advertising channel and click preceded a visit or an order. Under our contracts with these companies, they may use consumer health data only to provide services to us.
Analytics and website performance providers, which measure how our website is used and help us diagnose problems with it. Under our contracts with these companies, they may use consumer health data only to provide services to us.
Communications and survey providers, which deliver our emails and text messages, measure whether they are opened and acted on, and host forms and surveys you choose to complete. Under our contracts with these companies, they may use consumer health data only to provide services to us.
Technology service providers, including website hosting, content delivery, and embedded video.
Our affiliate Medicure Inc., which provides marketing, advertising, and data analysis services to us. Marley Drug, Inc. is a subsidiary of Medicure Inc., which also owns West Olympia Pharmacy and Gateway Medical Pharmacy. Under our agreement with Medicure Inc., it may use the consumer health data described in this Notice only to provide those services to us, and not for its own purposes. We do not share consumer health data with West Olympia Pharmacy or Gateway Medical Pharmacy.

Sale

We do not sell your consumer health data. We do not exchange it for money or for other valuable consideration, and we will not do so without first obtaining any authorization required by applicable law.

Other circumstances in which we may disclose consumer health data

We may also disclose consumer health data where permitted by law, specifically:
with your consent;
where necessary to protect your vital interests, such as a medical emergency or natural disaster;
to an acquiring organization, if we are involved in a merger, acquisition, financing, reorganization, or sale of our business;
as necessary to prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, or malicious or deceptive activity;
as necessary to preserve the integrity or security of our systems; and
to investigate, report, or prosecute those responsible for conduct that is illegal under state or federal law.

Adding recipients

We will not share consumer health data with any third party or affiliate not listed in this Notice without first telling you and obtaining your consent.

Tracking across our websites

The parties listed above do not collect consumer health data about you over time across different websites or applications that we own.

6. Your Rights in Your Consumer Health Data

If you are a resident of Washington or Nevada, you have the following rights:

Confirm and access. Confirm whether we collect, share, or sell your consumer health data, and obtain a copy of that data.
Know who received it. Obtain a list of all third parties and affiliates with whom we have shared or sold your consumer health data, together with a way to contact each of them.
Correct. If you are a Nevada resident, review your consumer health data and ask us to correct it where it is inaccurate.
Withdraw consent. Withdraw your consent to our collection and sharing of your consumer health data at any time. Withdrawing is as easy as giving consent — use the Cookie Preferences link in the footer of any page.
Stop collection, sharing, and sale. Direct us to stop collecting, sharing, or selling your consumer health data.
Delete. Have your consumer health data deleted, as described in Section 7.
Appeal. Appeal a decision by us not to act on your request, as described in Section 9.

If another state's law gives you rights in your consumer health data, we will honor those rights as that law requires.

We will not discriminate against you for exercising any of these rights.

These rights apply to consumer health data. They do not apply to protected health information we hold as your pharmacy, which is governed by our HIPAA Notice of Privacy Practices and by pharmacy recordkeeping laws that require us to retain those records.

7. Deletion

On receiving a verified deletion request, we will delete your consumer health data from our records and network within 30 days. Where the data is held on archived or backup systems, deletion may be delayed until those systems are restored, and in no case longer than six months.

Within the same 30 days, we will also notify every affiliate, processor, contractor, and third party with whom we have shared your consumer health data of your deletion request. Those parties are required to delete it from their own records and networks, including their archived and backup systems.

8. How to Exercise These Rights

Submit a request using our online form, by calling 800-286-6781, or by emailing compliance@marleydrug.com.

To process your request we will ask for information to verify your identity, such as your name, email address, postal address, or telephone number, and match it against information we already hold. Where your request concerns data we hold only against a cookie or device identifier and cannot link to you, we will tell you so and explain how to clear those identifiers and withdraw your consent instead. We will not ask for more information than is necessary to verify you, and we will use it only for that purpose.

We will respond without undue delay and no later than 45 days after receiving your request. If your request is complex, we may extend that period by a further 45 days; we will tell you within the first 45 days if we do, and why.

You may make requests free of charge twice a year. If a request is manifestly unfounded, excessive, or repetitive, we may charge a reasonable fee to cover the administrative cost of responding, or decline to act. We will tell you which, and why, before proceeding.

9. Appeals

If we decline to act on your request, you may appeal within a reasonable period after receiving our decision. To submit an appeal, use this form, call 800-286-6781, or email compliance@marleydrug.com. Please tell us that you are appealing a decision, so that we handle your request as an appeal.

Within 45 days of receiving your appeal we will inform you in writing of any action taken or not taken, together with a written explanation of our reasons. If we deny your appeal, we will provide you with an online mechanism, if available, or another method by which you may submit a complaint to the Washington Attorney General or the Nevada Attorney General.

10. Contact Us

If you have questions about this Notice or our handling of consumer health data, contact:

Marley Drug, Inc.
Attn: Privacy Officer
5008 Peters Creek Parkway
Winston-Salem, North Carolina 27127
Email: compliance@marleydrug.com
Telephone: 800-286-6781