Privacy Policy

Effective Date: September 1, 2026

Last Updated: September 1, 2026

Applies to: marleydrug.com and any other website, mobile application, or online service operated by Marley Drug, Inc. that links to this Policy (the "Site").

1. How This Policy Fits With Our Other Privacy Documents

Marley Drug is a licensed pharmacy. Because of that, different sets of privacy laws apply to different categories of information we handle, and we maintain separate documents for each. Reading the right one matters, so we have set them out here.

If there is any conflict between this Policy and our HIPAA Notice of Privacy Practices with respect to PHI, the HIPAA Notice of Privacy Practices controls.

2. Who We Are and What This Policy Covers

Marley Drug, Inc. ("Marley Drug," "we," "us," or "our") operates a licensed retail and mail-order pharmacy located at 5008 Peters Creek Parkway, Winston-Salem, North Carolina 27127. Marley Drug is a subsidiary of Medicure Inc.

This Policy describes how we collect, use, disclose, and protect personal information through the Site, and the choices and rights you have. It applies to visitors to the Site, registered account holders, and individuals who contact us, subscribe to our communications, or participate in our surveys and promotions.

This Policy does not apply to PHI that we create or maintain in our capacity as your pharmacy. That information is governed by our HIPAA Notice of Privacy Practices.

The Site is intended for individuals located in the United States and for use by adults 18 years of age or older.

3. Information We Collect

We collect the categories of personal information described below. The categories used here are those defined by the California Consumer Privacy Act, as amended, because they are the most detailed statutory categories in use; the same disclosures serve our obligations under other state privacy laws.

3.1 Categories collected in the preceding twelve months

3.2 Information we do not collect through the Site

We do not knowingly collect precise geolocation, biometric information, genetic data, neural data, or the contents of your private communications through the Site. We do not collect personal information from children as described in Section 11.

4. How We Treat Health Information

This section is the most important part of this Policy, and we have written it in plain terms rather than legal shorthand.

4.1 Your pharmacy records

Your prescriptions, patient profile, dispensing history, allergies, insurance and billing records, and communications with our pharmacists are protected health information. We do not disclose PHI to advertising platforms, analytics providers, data brokers, or any other third party for advertising, marketing measurement, or audience-building purposes. We do not sell PHI. Uses and disclosures of PHI are described in our HIPAA Notice of Privacy Practices and, where required, will be made only with your written authorization.

4.2 Browsing activity on our public pages

Separately from your pharmacy records, our public product and education pages describe specific medications and health conditions. If you visit a page about a particular medication, that visit can indicate something about your health interests even though you are not yet a patient and we hold no prescription for you.

We treat that browsing activity as sensitive. Our practices are as follows:

• Advertising and analytics tags on our public pages do not run until you have consented through our cookie banner, other than tags that are strictly necessary for the Site to function and to keep it secure.

• We do not transmit your name, email address, telephone number, prescription information, or dispensing records to advertising or analytics vendors.

• We do not use your pharmacy records to build advertising audiences, to target advertising to you, or to inform which advertisements you see.

• We configure our analytics and advertising tags so that they do not receive medication names or condition identifiers in association with information that identifies you.

• We do not upload customer lists to advertising platforms, and we do not use customer-match or similar features to target advertising based on the medications dispensed to you. We may contact you directly with educational information about a medication you are currently taking, to help you use it as prescribed. Those communications come from us as your pharmacy and are governed by our HIPAA Notice of Privacy Practices.

4.3 Tracking on pages where you are signed in

We use analytics on the pages where you are signed in, so we can see whether the Site is working and where people run into difficulty. What we record is that an action happened — that an item was added to a cart, or that a step in a checkout or a request was completed. We do not record what you added, which medications you take, or any part of your prescription or dispensing records, and we do not send any of that to advertising or analytics providers.

5. How We Use Personal Information

We use the personal information described in Section 3 for the following purposes:

• Providing the Site and our services, including creating and maintaining your account, authenticating you, processing and fulfilling orders, arranging shipping, and enabling order tracking.

• Communicating with you about your orders, your account, and administrative matters such as changes to our terms or policies.

• Providing customer service and responding to your questions, requests, and complaints.

• Sending marketing communications by email or text message where you have chosen to receive them, and measuring how those communications perform.

• Advertising, including measuring the performance of our advertising and, where you consent, showing you advertisements for Marley Drug on other websites and applications.

• Analytics and improvement, including understanding how the Site is used, diagnosing problems, and improving our content, pricing presentation, and user experience.

• Security, fraud prevention, and integrity, including detecting and preventing fraudulent transactions, unauthorized access, and abuse of the Site.

• Legal and regulatory compliance, including compliance with pharmacy law, recordkeeping obligations, tax obligations, and responses to lawful requests from government authorities.

• Corporate transactions, including evaluating or completing a merger, acquisition, financing, reorganization, or sale of assets, in which case personal information may be among the assets transferred.

We will not use personal information we have collected for materially different, unrelated, or incompatible purposes without first providing notice to you and, where required, obtaining your consent.

6. Cookies and Other Tracking Technologies

6.1 What these technologies are

Cookies are small data files placed on your device when you visit a website. We also use related technologies including pixels, web beacons, tags, software development kits, and server logs. We refer to all of these collectively as "cookies" in this section.

First-party cookies are set by Marley Drug. Third-party cookies are set by vendors we engage, and those vendors may be able to recognize your device across other websites you visit. Their handling of that information is governed by their own privacy policies as well as by our contracts with them.

6.2 Categories of cookies we use

6.3 Vendors whose technologies operate on the Site

We group the third parties whose technologies operate on the Site into the categories below. A current list of the individual cookies in use is published at www.marleydrug.com/cookie-list .

6.4 How we obtain and honor your consent

When you first visit the Site, we present a consent banner. Cookies in the functional, analytics, and advertising categories do not operate until you accept them. You may accept all categories, reject all non-essential categories, or select categories individually, and rejecting is as easy as accepting. Closing the banner without making a selection is not treated as consent.

You can change your choices at any time through the Cookie Settings link in the footer of every page. Changing your choices applies to the browser and device you are using; if you use more than one browser or device, you will need to set your preferences on each.

We also transmit your consent choices to Google through Google Consent Mode, so that Google tags adjust their behavior according to what you have chosen.

6.5 Browser-based opt-out signals

We recognize and honor the Global Privacy Control signal. If your browser or extension transmits that signal, we treat it as a request to opt out of the sale and sharing of personal information and of targeted advertising, and we apply it to the browser transmitting it. Where we can associate the signal with a known account, we apply it to that account as well.

Some browsers transmit a "Do Not Track" signal. Where your browser sends that signal, we treat it as a request to opt out of the sale and sharing of personal information and of targeted advertising.

6.6 Browser and device controls

Most browsers and mobile operating systems let you block or delete cookies, receive a warning before a cookie is set, or reset your advertising identifier. These controls are found in your browser or device privacy settings and vary by product. Blocking cookies may prevent parts of the Site from working properly. You can still place orders by telephone if you prefer not to use the Site.

You can also opt out of interest-based advertising from participating companies through the Digital Advertising Alliance or through the AppChoices application. These industry tools are operated by third parties and are not a substitute for the controls we provide.

6.7 Email tracking

Our marketing emails contain pixels that tell us whether the message was opened and which links were clicked. We use this to understand which communications are useful and to stop sending messages that are not. Every marketing email contains an unsubscribe link. You may also unsubscribe by contacting us using the details in Section 15. If you unsubscribe from marketing messages, we will still send you transactional messages about your orders and your account, which you cannot opt out of while you have an active account or order.

6.8 Third-party sign-in and social media features

The Site may let you register or sign in using a third-party authentication provider such as Google. If you use that option, the provider may set its own cookies and will share limited information with us, such as your name and email address, according to your settings with that provider.

The Site may also include social media features such as sharing buttons or embedded content. When you interact with those features, your browser connects directly to the social media platform, which may collect information about your device and your interaction and may associate it with your account on that platform if you are signed in. We do not control that collection. Please review the privacy policies of the relevant platforms.

7. Disclosure, Sale, and Sharing of Personal Information

7.1 Who we disclose personal information to

We disclose personal information to the following categories of recipients:

• Service providers and contractors who perform functions on our behalf, including payment processing, shipping and logistics, hosting and infrastructure, email delivery, customer service tooling, and analytics. These parties are bound by contract to use the information only to perform services for us.

• Advertising and analytics partners, where you have consented to advertising or analytics cookies, as described in Section 6.

• Professional advisors, including lawyers, auditors, and insurers.

• Government authorities and other parties, where we believe disclosure is required by law, court order, subpoena, or other legal process, or is necessary to protect the rights, property, or safety of Marley Drug, our customers, or others.

• Acquirers and their advisors, in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of assets.

7.2 Sale and sharing

Several state privacy laws define "sale" and "sharing" broadly. Under those definitions, making personal information available to advertising vendors in exchange for advertising services can be a "sale," and disclosing it for cross-context behavioral advertising is a "share," even though no money changes hands and even though we do not sell customer lists.

We want to be direct about this rather than rely on qualifiers. When advertising cookies operate on the Site with your consent, that activity may constitute a sale or sharing of the categories of personal information listed below.

Sold or shared in the preceding twelve months:

• Identifiers, including IP address and cookie and advertising identifiers

• Internet or other electronic network activity information

• Commercial information, limited to products viewed or purchased on the Site

• Inferences drawn from the above

Disclosed for a business purpose in the preceding twelve months:

• Identifiers

• Customer records and financial information

• Commercial information

• Internet or other electronic network activity information

• Geolocation data (approximate)

• Audio information (customer service call recordings)

• Inferences

• Sensitive personal information, limited to authentication credentials

We do not sell or share protected health information. We do not sell or share sensitive personal information for the purpose of inferring characteristics about you. We do not sell or share the personal information of consumers we know to be under 16 years of age.

8. Your Privacy Rights and Choices

8.1 Rights available to you

Residents of Washington and Nevada have rights in their consumer health data under the statutes described in Section 12.3. Residents of California and of a number of other states have rights under their state privacy laws. We extend the rights below to all residents of the United States, and we will honor a request from anyone who makes one.

Rights concerning your PHI — including the right to inspect and copy your pharmacy records, request amendments, request restrictions, request confidential communications, and receive an accounting of disclosures — are described in our HIPAA Notice of Privacy Practices and are exercised through our Pharmacy Privacy Officer.

8.2 How to exercise your rights

You may submit a request in any of the following ways:

• Online Form

• Telephone: 800-286-6781

• Email: compliance@marleydrug.com

• Mail: Privacy Officer, Marley Drug, Inc., 5008 Peters Creek Parkway, Winston-Salem, NC 27127

To opt out of the sale or sharing of personal information, you may also use the "Do Not Sell or Share My Personal Information" link in the footer of every page, adjust your choices through Cookie Preferences, or transmit a Global Privacy Control signal. To limit our use of sensitive personal information, use the "Limit the Use of My Sensitive Personal Information" link in the footer of every page. You do not need an account or to verify your identity to use either link.

8.3 Verification

For requests other than opt-out requests, we must verify your identity before we act. We will ask you for information such as your name, email address, postal address, and telephone number, and match it against information we already hold. For requests involving sensitive information, we may require additional verification. We will not use information you provide for verification for any other purpose.

8.4 Authorized agents

You may designate an authorized agent to submit a request on your behalf. We will require written permission signed by you, and we may require you to verify your own identity directly with us. An agent acting under a valid power of attorney does not need to provide separate written permission.

8.5 Exceptions to deletion

As a licensed pharmacy, we are legally required to retain certain records, and we cannot delete them at your request. In particular:

• Prescription and dispensing records must be retained for the periods required by federal law and by the pharmacy laws of the state in which the prescription was dispensed.

• Financial and tax records must be retained for the periods required by applicable law.

• Records necessary to complete a transaction, detect security incidents, prosecute those responsible for fraudulent or illegal activity, comply with a legal obligation, or exercise or defend legal claims may be retained.

Where we cannot delete information for one of these reasons, we will tell you which exception applies. A deletion request that we cannot fulfill in whole will still be fulfilled in part where the remaining information is not subject to an exception — for example, we can delete marketing profiles and advertising identifiers even where we must retain dispensing records.

8.6 Response times and appeals

We will confirm receipt of your request within 10 business days and respond within 45 calendar days. If we need more time, we will tell you within the initial 45-day period and may extend by an additional 45 days.

If we decline to act on your request, we will explain why. You may appeal that decision within a reasonable period using our online request form, by calling 800-286-6781, or by emailing compliance@marleydrug.com. Please tell us that you are appealing a decision, so that we handle your request as an appeal. We will respond to your appeal in writing within 45 days. If we deny your appeal, we will provide you with a method to submit a complaint to your state attorney general.

We will not charge a fee for responding to your request unless it is manifestly unfounded, excessive, or repetitive, in which case we will tell you the reason and the amount before proceeding.

9. How Long We Keep Personal Information

We keep personal information for as long as necessary to fulfill the purposes described in this Policy, and then for as long as we are required to keep it by law. Because retention periods differ substantially by category, we set out our criteria rather than a single period:

10. How We Protect Personal Information

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, and destruction. These include encryption of data in transit, access controls limiting employee access to what is needed for their role, vendor due diligence and contractual security commitments, employee confidentiality agreements and training, network monitoring, and a documented incident response process.

No system is completely secure, and we cannot guarantee the security of information transmitted to us. You are responsible for keeping your account credentials confidential and for activity that occurs under your account. If you believe your account has been compromised, contact us immediately at compliance@marleydrug.com or 800-286-6781.

If a security incident affects your personal information, we will notify you as required by applicable law.

11. Children

The Site is intended for adults. You must be at least 18 years old to create an account or place an order on the Site. The Site is not directed to children.

We do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, contact us using the details in Section 15 and we will delete it.

We do not sell or share the personal information of anyone under 16 years of age.

We may hold protected health information about a minor where a parent or legal guardian obtains prescriptions on their behalf. That information is governed by our HIPAA Notice of Privacy Practices and by applicable state law, not by this Policy.

12. Additional State-Specific Disclosures

12.1 Information governed by HIPAA

Most state consumer privacy laws exclude protected health information, and several exclude HIPAA covered entities altogether. Where a state law excludes information or entities of that kind, this Policy describes our practices as a matter of transparency rather than because the law requires it, and nothing in this Policy waives any exemption available to us.

12.2 California

California residents have the rights described in Section 8. In addition:

• Do Not Sell or Share My Personal Information. We provide a link with this title in the footer of every page – Your Privacy Rights. You may use it to opt out of the sale and sharing of your personal information, and you do not need an account or to verify your identity to do so.

• Limit the Use of My Sensitive Personal Information. We provide a link with this title in the footer of every page. You may use it to direct us to limit our use and disclosure of sensitive personal information to the purposes necessary to provide the services you have requested.

• Metrics reporting. We do not buy, receive, sell, or share the personal information of 10,000,000 or more California consumers in a calendar year, so we do not publish privacy request metrics.

• Shine the Light. California Civil Code section 1798.83 permits California residents to request information about disclosures of personal information to third parties for their own direct marketing purposes. We do not make such disclosures.

• Notice at collection. A description of the categories of personal information we collect and the purposes for which we use it is provided at or before the point of collection, including through the link to this Policy in our footer and at account registration.

• Automated decision-making. We do not use automated decision-making technology to make decisions producing legal or similarly significant effects concerning you.

12.3 Washington and Nevada

Residents of Washington and Nevada should also read our Consumer Health Data Privacy Notice which describes our handling of consumer health data under the Washington My Health My Data Act and Nevada SB 370 and the rights those laws provide.

12.4 Oregon

Oregon treats information about a consumer's physical or mental health condition or diagnosis, and information about reproductive or sexual health, as sensitive data under the Oregon Consumer Privacy Act. We process sensitive data only where you have given us your consent, and you may withdraw that consent at any time through Cookie Preferences or by contacting us. Oregon residents may also request access to, correction of, and deletion of personal information, and may opt out of targeted advertising and of the sale of personal information, using the methods in Section 8.

12.5 Texas

We do not sell sensitive personal data, including data revealing health information, without your consent.

12.6 Nevada opt-out of sale

Nevada residents may direct us not to make any sale of covered information as defined by Nevada Revised Statutes Chapter 603A. Submit your request using any of the methods in Section 8.2 — our online request form, by calling 800-286-6781, by emailing compliance@marleydrug.com, or by mail.

12.7 Financial incentives

Some of our promotions give you a discount or credit in return for providing personal information. These currently include our refer-a-friend credit, the credit we offer for completing a customer feedback survey, and promotions that ask you to share content on social media. You take part by using a referral link, completing a survey we send you, or entering a promotion when we announce one. The information involved is the record that a referral came from you, your survey responses, and the content and account name you submit to a social media promotion.

Participation in any of these is entirely optional. You choose whether to take part, you may withdraw at any time by contacting us at compliance@marleydrug.com, and withdrawing does not affect a benefit you have already received. We do not deny you goods or services, charge you a different price, or give you a different level of service because you decline to take part or because you exercise any privacy right described in this Policy.

When we offer a discount or credit in exchange for information, for example, $10 for a referral or $5 for completing a customer feedback survey, we estimate the value of that information as no more than the value of the discount itself. We use this method because the discount is what the information costs us. We do not sell this information or place any separate market value on it.

13. Third-Party Websites

The Site may link to websites we do not operate. We are not responsible for the privacy practices of those websites. We encourage you to read their privacy policies before providing them with personal information.

14. Changes to This Policy

We may update this Policy. When we do, we will change the "Last Updated" date at the top and post the revised Policy on the Site. If the changes are material, we will provide additional notice, which may include emailing you at the address associated with your account or displaying a notice on the Site before the changes take effect. We review this Policy at least once every twelve months.

Your continued use of the Site after a change takes effect means you are aware of the updated Policy. It does not constitute consent where consent is required, and we will obtain consent separately where the law requires it.

15. Contact Us

If you have questions about this Policy or how we handle personal information, contact us:

Marley Drug, Inc.
Attn: Privacy Officer
5008 Peters Creek Parkway
Winston-Salem, North Carolina 27127
Telephone: 800-286-6781
Email: compliance@marleydrug.com 

For questions about your pharmacy records or your rights under HIPAA, contact our Pharmacy Privacy Officer at the address above. You also have the right to file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, without fear of retaliation.