Your Privacy Rights

YOUR STATE PRIVACY RIGHTS

State consumer privacy laws may provide their residents with additional rights regarding our use of their personal information.

1. PRIVACY NOTICE FOR CALIFORNIA RESIDENTS

Last Reviewed on: July 1, 2024

This Privacy Notice for California Residents supplements the information contained in the Privacy Policy and applies solely to all visitors, users, and others who reside in the State of California ('consumers' or 'you'). We adopt this notice to comply with the California Consumer Privacy Act of 2018 (CCPA) and any terms defined in the CCPA have the same meaning when used in this Notice.

Information We Collect

Our Website collects information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household, or device ("personal information"). Personal information does not include:

• Publicly available information from government records
• Deidentified or aggregated consumer information
• Information excluded from the CCPA's scope, like health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data
• Personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994

In particular, our Website has collected the following categories of personal information from users within the last twelve (12) months:

• Identifiers such as name, email address, and IP address
• Personal information such as name
• Commercial information such as prescriptions and pharmacies searched
• Internet activity such as search history, pages visited, and coupons generated
• Geolocation data such as ZIP codes entered to see pharmacies nearby, as well as actual location when visitors grant access

We obtain the categories of personal information listed above from the following categories of sources:

• Directly from you. For example, via forms you complete as part of drug coupon generation
• Indirectly from you. For example, from observing your actions on our Website

Use of Personal Information

• To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses
• To personalize your Website experience and to deliver content and product and service offerings relevant to your interests via email or text message (with your consent, where required by law)
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations
• As described to you when collecting your personal information or as otherwise set forth in the CCPA
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our Website users is among the assets transferred

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice. We will not retain your personal or sensitive personal information longer than reasonably necessary for each disclosed collection purpose.

Sharing Personal Information

We may disclose your personal information to a third party for a business purpose. When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.

We share your personal information for a business purpose with the following categories of third parties:

• Service providers
• Parent or subsidiary organizations
• Partners
• Internet cookie data recipients like Google Analytics

Disclosures of Personal Information for a Business Purpose
In the preceding twelve (12) months, Company has disclosed the following categories of personal information for a business purpose:

Category A: Identifiers
Category B: California Customer Records personal information categories
Category D: Commercial information
Category F: Internet or other similar network activity
Category G: Geolocation data

Sales of Personal Information
In the preceding twelve (12) months, Company has not sold personal information.

Your Rights and Choices

The CCPA provides consumers (California residents) with specific rights regarding their personal information. This section describes your CCPA rights and explains how to exercise those rights.

Access to Specific Information and Data Portability Rights
You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you:

• The categories of personal information we collected about you
• The categories of sources for the personal information we collected about you
• Our business or commercial purpose for collecting that personal information
• The categories of third parties with whom we share that personal information
• If we disclosed your personal information for a business purpose, a list identifying the personal information categories that each category of recipient obtained

Deletion Request Rights
You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

1. Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you
2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities
3. Debug products to identify and repair errors that impair existing intended functionality
4. Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law
5. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq)
6. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent
7. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us
8. Comply with a legal obligation
9. Make other internal and lawful uses of that information that are compatible with the context in which you provided it

Right to Correct

You have the right to request that we correct any of your personal information that is inaccurate. Once we receive and confirm your verifiable consumer request, we shall use commercially reasonable efforts to correct the inaccurate personal information as directed by you.

Right to Opt-out of Sale and Sharing

You have the right to opt-out of the sale or sharing of your personal information. Once we receive and confirm your verifiable consumer request, your personal information will not be sold or shared unless you subsequently provide consent.

Right to Limit Sensitive Personal Information Use

Our use of your Sensitive Personal Information is generally limited to performing services or providing goods you requested. You have the right to request that we limit our use and disclosure of your Sensitive Personal Information for purposes not subject to an exception pursuant to law.

Exercising Your Rights
To exercise the rights described above, please submit a verifiable consumer request to us by either:

• Call our customer service center at 1-800-928-4301
• Email us at contact@paramountrx.com. Please include the following fields in your email:
  • Full name
  • Email address
  • Date of birth
  • Full address
  • Phone number (optional)

Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. To designate yourself as an authorized agent, please attach a verifiable notarized document granting you permission to submit any such request on the minor’s behalf.

You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative, which may include fields listed above
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it
• We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you
• We will only use personal information provided in a verifiable consumer request to verify the requestor's identity or authority to make the request

Response Timing and Format
We will confirm receipt of your request within ten (10) business days. We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. We will deliver our written response by mail or electronically, at your option. For requests to opt-out of the sale or sharing or to opt-out of automated processing of your personal information or request to limit the use and disclosure of your sensitive personal information, we will comply within 15 business days after receipt of your request.

Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request's receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

• Deny you services
• Charge you different prices or rates for services, including through granting discounts or other benefits, or imposing penalties
• Provide you a different level or quality of services
• Suggest that you may receive a different price or rate for services or a different level or quality of services

2. PRIVACY NOTICE FOR COLORADO RESIDENTS

Under the Colorado Privacy Act (“CPA”), Colorado residents have the right to receive certain disclosures regarding a business’ processing of “personal data,” as defined under the CPA, as well as certain rights with respect to our processing of such personal data. In addition, certain information about you may be considered “Sensitive Data” under Colorado Law, and, unless the processing falls under a legal exception, we cannot process Sensitive Data without obtaining your consent. To the extent you are a resident of Colorado and we collect, use or disclose personal data subject to the CPA, the following applies.

What personal data we collect:

• Identifiers: such as name, telephone number, email address, username and password if you are a loyalty program member, IP address
• Commercial information: such as prescriptions and pharmacies searched and considered, loyalty program participation information
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information
• Geolocation information: such as ZIP codes entered to see pharmacies nearby, as well as actual location when visitors grant access

What sensitive data we collect:

We may collect the following categories of sensitive data (as enumerated in the CPA) about you.

• Physical health condition or diagnosis, which may include your interactions with our Website when searching for prescriptions or pharmacies
• Personal data revealing your sex life, such as your search for sexual health-related prescriptions

What personal data we share and who we share personal data with:

We do not sell your personal data to third parties in exchange for monetary consideration. We also do not use or disclose personal information for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer.

Your Privacy Rights

If you are a Colorado resident and we collect, use, or disclose personal data subject to CPA, you may have the following rights under the CPA with respect to your personal data.

• Right to access. You have the right to confirm whether or not we are processing your personal data and to access such personal data
• Right of portability. You may have the right to obtain a copy of the personal data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit your personal data to another controller or business where the processing is carried out by automated means
• Right to delete. You have the right to ask us to delete certain personal data we have collected about you
• Right to correction. You have the right to ask us to correct inaccuracies in the personal data we have collected
• Right to opt out of sale and profiling. Under the CPA, a “sale” includes exchanging personal data with a third party for monetary or other compensation. Colorado residents also have the right to opt out of the processing of your personal data for decisions that produce legal or similarly significant effects concerning you. We do not process personal data for such profiling
• Right to opt out of targeted advertising. You have the right to opt out of targeted advertising based on your personal data

How to Submit a Request

If you are a Colorado consumer and wish to exercise these rights, you or your authorized agent may submit a request by using one of the following specifically designated methods:

• Email us at contact@paramountrx.com
• Call our customer service center at 1-800-928-4301

Responding to Requests

 For requests for access, correction, deletion, or appeal, we will first acknowledge receipt of your request within 10 business days of receipt of your request. We provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know. For requests to opt out of the use of your CO Personal Data for purposes of targeted advertising, sale, and automated processing (“profiling”), we will comply within 15 business days after receipt of your request.

Requests By Authorized Agents 

You may designate an agent to submit requests on your behalf. The agent must be a natural person or a business entity that is registered with the Colorado Secretary of State. If you would like to designate an agent to act on your behalf, your agent must provide us your CO Personal Data and signed documentation demonstrating that you authorized the agent to submit a request on your behalf. For access and correction requests, the agent must also follow the verification process outlined below. Please note that this subsection does not apply when an agent is authorized to act on your behalf pursuant to a valid power of attorney. Any such requests will be processed in accordance with Colorado law pertaining to powers of attorney.

Verification of Requests

Before we fulfill a request, we must verify your identity and ability to exercise these rights. There are also some exclusions and exceptions that may apply. So that we can verify your identity, you will be asked to give us certain personal data, as described below.

For Access, Correction, Deletion & Appeal Requests

We may require you to provide any of the following information: Full legal name, date of birth, email address, and/or phone number. If you ask us to provide you with specific pieces of personal data, we may require you to sign a declaration under penalty of perjury that you are the consumer whose personal data is the subject of the request.

For Opt-Out Requests

Requests to opt-out of targeted advertising, sale, or profiling of your CO Personal Data do not require verification or email confirmation.

Process to Appeal a Decision Related to Your Rights

If we refused to fulfill your request to exercise your privacy rights above, you may appeal this decision by contacting us at contact@paramountrx.com.We will respond to your request within 45 days of receipt of your appeal with an explanation about our decision to fulfill or refuse your request. You may contact the Colorado Attorney General to file a complaint related to the denial of your request by phone at 1-720-508-6000.

3. PRIVACY NOTICE FOR CONNECTICUT RESIDENTS

Under the Connecticut Data Privacy Act (“CTDPA”), Connecticut residents have the right to receive certain disclosures regarding a business’ processing of “personal data,” as defined under the CTDPA, as well as certain rights with respect to our processing of such personal data. In addition, certain information about you may be considered “Sensitive Data” under Connecticut Law, and, unless the processing falls under a legal exception, we cannot process Sensitive Data without obtaining your consent. To the extent you are a resident of Connecticut and we collect, use or disclose personal data subject to the CTDPA, the following applies.

What personal data we collect:

• Identifiers: such as name, telephone number, email address, IP address
• Commercial information: such as prescriptions and pharmacies searched and considered, loyalty program participation information
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information
• Geolocation information: such as ZIP codes entered to see pharmacies nearby, as well as actual location when visitors grant access

Purpose for collecting personal data:

We collect CT Personal Data to respond to your inquiries, fulfill your requests and improve your experience; for reporting and analytics; to improve the effectiveness of our services, conduct research and analysis, or for other internal operations purposes.

What personal data we share and who we share personal data with:

We do not sell your personal data to third parties in exchange for monetary consideration. We also do not use or disclose personal information for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer.

Your Privacy Rights

If you are a Connecticut resident, you have the following rights under the CTDPA with respect to your personal data.

• Right to access. You have the right to confirm whether or not we are processing your personal data and to access such personal data
• Right of portability. You may have the right to obtain a copy of the personal data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit your personal data to another controller or business where the processing is carried out by automated means
• Right to delete. You have the right to ask us to delete certain personal data we have collected about you
• Right to correction. You have the right to ask us to correct inaccuracies in the personal data we have collected
• Right to opt out of sale and profiling. Under the CPA, a “sale” includes exchanging personal data with a third party for monetary or other compensation. Colorado residents also have the right to opt out of the processing of your personal data for decisions that produce legal or similarly significant effects concerning you. We do not process personal data for such profiling
• Right to opt out of targeted advertising. You have the right to opt out of targeted advertising based on your personal data

How to Submit a Request

If you are a Connecticut consumer and wish to exercise these rights, you or your authorized agent may submit a request by using one of the following specifically designated methods:

• Email us at contact@paramountrx.com
• Call our customer service center at 1-800-928-4301

Responding to Requests

For requests for access, correction, deletion, or appeal, we will first acknowledge receipt of your request within 10 business days of receipt of your request. We provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know. For requests to opt out of the use of your CT Personal Data for purposes of targeted advertising, sale, and automated processing (“profiling”), we will comply within 15 business days after receipt of your request.

Requests By Authorized Agents

You may designate an agent to submit requests on your behalf. The agent must be a natural person or a business entity that is registered with the Connecticut Secretary of State. If you would like to designate an agent to act on your behalf, your agent must provide us your CT Personal Data and signed documentation demonstrating that you authorized the agent to submit a request on your behalf. For access and correction requests, the agent must also follow the verification process outlined below. Please note that this subsection does not apply when an agent is authorized to act on your behalf pursuant to a valid power of attorney. Any such requests will be processed in accordance with Connecticut law pertaining to powers of attorney.

Process to Appeal a Decision Related to Your Rights

If we refused to fulfill your request to exercise your privacy rights above, you may appeal this decision by contacting us at contact@paramountrx.com. We will respond to your request within 45 days of receipt of your appeal with an explanation about our decision to fulfill or refuse your request. You may contact the Connecticut Attorney General to file a complaint related to the denial of your request by phone at 1-860-808-5318.

4. 
   PRIVACY NOTICE FOR NEVADA RESIDENTS

If you are a Nevada resident, we are required to provide additional information to you about how we collect, use and disclose your information that may be considered "Personal Data" under Nevada Law ("NV Personal Data"), and you may have additional rights with regard to how we use and disclose your NV Personal Data. In addition, certain information about you may be considered “Consumer Health Data” under Nevada Law, and, unless the processing falls under a legal exception, we cannot process Sensitive Data without obtaining your consent. We have included this Nevada-specific information below.

Processing

We process certain categories and specific pieces of NV Personal Data about individuals who reside in Nevada. In the 12 months prior to the date of this Privacy Policy, we collected the following types of categories of NV Personal Data, which we will continue to collect:

• Identifiers: such as name, telephone number, email address, IP address
• Commercial information: such as prescriptions and pharmacies searched and considered
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information
• Geolocation information: such as ZIP codes entered to see pharmacies nearby, as well as actual location when visitors grant access

Deidentified Information

We may also maintain and use information that does not identify an individual and cannot reasonably be used to identify an individual which is derived from NV Personal Data. We will not attempt to reidentify deidentified NV Personal Data unless permitted by law.

Purposes

We collect NV Personal Data to respond to your inquiries, fulfill your requests and improve your experience; for reporting and analytics; to improve the effectiveness of our services, conduct research and analysis, or for other internal operations purposes.

Nevada Consumer Rights

As a Nevada resident, you have the right to ask us for and access, including in a portable, readily usable format, any or all of following types of information regarding the NV Personal Data we have collected about you:

• Specific pieces of NV Personal Data we have collected about you
• Categories of NV Personal Data we have collected about you
• Categories of sources from which such NV Personal Data was collected
• Categories of NV Personal Data we sold or disclosed for a business purpose about you; and
• The business or commercial purpose for collecting or selling your NV Personal Data

You also have the right to request deletion of your NV Personal Data and to opt out of the use of your NV Personal Data for purposes of targeted advertising and sale.

Nevada also provides its residents with a limited right to opt-out of certain personal information sales. However, please know we do not currently sell data triggering that statute's opt-out requirements.

Exercising Nevada Consumer Rights

You or your authorized agent may submit a request to exercise your Utah Consumer Rights by using one of the following specifically designated methods:

• Email us at contact@paramountrx.com
• Call our customer service center at 1-800-928-4301

Responding to Requests

For requests for access or deletion, we will first acknowledge receipt of your request within 10 business days of receipt of your request. We provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know. For requests to opt out of the use of your NV Personal Data for purposes of targeted advertising and sale, we will comply within 15 business days after receipt of your request.

5. PRIVACY NOTICE FOR OREGON RESIDENTS

If you are an Oregon resident, we are required to provide additional information to you about how we collect, use and disclose your information that may be considered "Personal Data" under Oregon Law ("OR Personal Data"), and you may have additional rights with regard to how we use and disclose your OR Personal Data. In addition, certain information about you may be considered “Sensitive Data” under Oregon Law, and, unless the processing falls under a legal exception, we cannot process Sensitive Data without obtaining your consent. We have included this Oregon-specific information below.

Processing

We process certain categories and specific pieces of OR Personal Data about individuals who reside in Oregon. In the 12 months prior to the date of this Privacy Policy, we collected the following types of categories of OR Personal Data, which we will continue to collect:

• Identifiers: such as name, telephone number, email address, IP address
• Commercial information: such as prescriptions and pharmacies searched and considered, loyalty program participation information
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information
• Geolocation information: such as ZIP codes entered to see pharmacies nearby, as well as actual location when visitors grant access

Deidentified Information

We may also maintain and use information that does not identify an individual and cannot reasonably be used to identify an individual which is derived from OR Personal Data. We will not attempt to reidentify deidentified OR Personal Data unless permitted by law.

Purposes

We collect OR Personal Data to respond to your inquiries, fulfill your requests and improve your experience; for reporting and analytics; to improve the effectiveness of our services, conduct research and analysis, or for other internal operations purposes.

Oregon Consumer Rights

As a Oregon resident, you have the right to ask us for and access, including in a portable, readily usable format, any or all of following types of information regarding the OR Personal Data we have collected about you:

• Specific pieces of OR Personal Data we have collected about you;
• Categories of OR Personal Data we have collected about you; and
• A list of specific third parties with whom we disclose OR Personal Data.

You also have the right to request correction or deletion of your OR Personal Data and to opt out of the use of your OR Personal Data for purposes of targeted advertising, sale, and automated processing ("profiling"). In addition, you have the right to appeal our refusal to act on your request.

Exercising Oregon Consumer Rights

You or your authorized agent may submit a request to exercise your Oregon Consumer Rights by using one of the following specifically designated methods:

• Email us at contact@paramountrx.com
• Call our customer service center at 1-800-928-4301

Responding to Requests

For requests for access, correction, deletion, or appeal, we will first acknowledge receipt of your request within 10 business days of receipt of your request. We provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know. For requests to opt out of the use of your OR Personal Data for purposes of targeted advertising, sale, and automated processing ("profiling"), we will comply within 15 business days after receipt of your request.

Process to Appeal a Decision Related to Your Rights

If we refused to fulfill your request to exercise your privacy rights above, you may appeal this decision by contacting us at contact@paramountrx.com. We will respond to your request within 45 days of receipt of your appeal with an explanation about our decision to fulfill or refuse your request. You may also contact the Oregon Attorney General to file a complaint related to the denial of your request by phone at 1-503-378-4400.

6. PRIVACY NOTICE FOR TEXAS RESIDENTS

If you are a Texas resident, we are required to provide additional information to you about how we collect, use and disclose your information that may be considered "Personal Data" under Texas Law ("TX Personal Data"), and you may have additional rights with regard to how we use and disclose your TX Personal Data. In addition, certain information about you may be considered “Sensitive Data” under Texas Law, and, unless the processing falls under a legal exception, we cannot process Sensitive Data without obtaining your consent. We have included this Texas-specific information below.

Processing

We process certain categories and specific pieces of TX Personal Data about individuals who reside in Texas. In the 12 months prior to the date of this Privacy Policy, we collected the following types of categories of TX Personal Data, which we will continue to collect:

• Identifiers: such as name, telephone number, email address, IP address
• Commercial information: such as prescriptions and pharmacies searched and considered, loyalty program participation information
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information
• Geolocation information: such as ZIP codes entered to see pharmacies nearby, as well as actual location when visitors grant access

Deidentified Information

We may also maintain and use information that does not identify an individual and cannot reasonably be used to identify an individual which is derived from TX Personal Data. We will not attempt to reidentify deidentified TX Personal Data unless permitted by law.

Purposes

We collect TX Personal Data to respond to your inquiries, fulfill your requests and improve your experience; for reporting and analytics; to improve the effectiveness of our services, conduct research and analysis, or for other internal operations purposes; to detect, prevent or investigate potential security breaches, fraudulent transactions and monitor against theft.

Texas Consumer Rights

As a Texas resident, you have the right to ask us for and access, including in a portable, readily usable format, any or all of following types of information regarding the TX Personal Data we have collected about you:

• Specific pieces of TX Personal Data we have collected about you
• Categories of TX Personal Data we have collected about you
• Categories of sources from which such TX Personal Data was collected
• Categories of TX Personal Data we sold or disclosed for a business purpose about you; and
• The business or commercial purpose for collecting or selling your TX Personal Data

You also have the right to request correction or deletion of your TX Personal Data and to opt out of the use of your TX Personal Data for purposes of targeted advertising, sale, and automated processing ("profiling"). In addition, you have the right to appeal our refusal to act on your request.

Exercising Texas Consumer Rights

You or your authorized agent may submit a request to exercise your Texas Consumer Rights by using one of the following specifically designated methods:

• Email us at contact@paramountrx.com
• Call our customer service center at 1-800-928-4301

Responding to Requests

For requests for access, correction, deletion, or appeal, we will first acknowledge receipt of your request within 10 business days of receipt of your request. We provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know. For requests to opt out of the use of your TX Personal Data for purposes of targeted advertising, sale, and automated processing ("profiling"), we will comply within 15 business days after receipt of your request.

Process to Appeal a Decision Related to Your Rights

If we refused to fulfill your request to exercise your privacy rights above, you may appeal this decision by contacting us at contact@paramountrx.com. We will respond to your request within 60 days of receipt of your appeal with an explanation about our decision to fulfill or refuse your request. You may contact the Texas Attorney General to file a complaint related to the denial of your request by phone at 1-512-463-2100.

7. 
   PRIVACY NOTICE FOR UTAH RESIDENTS

If you are a Utah resident, we are required to provide additional information to you about how we collect, use and disclose your information that may be considered "Personal Data" under Utah Law ("UT Personal Data"), and you may have additional rights with regard to how we use and disclose your UT Personal Data. In addition, certain information about you may be considered “Sensitive Data” under Utah Law, and, unless the processing falls under a legal exception, we cannot process Sensitive Data without obtaining your consent. We have included this Utah-specific information below.

Processing

We process certain categories and specific pieces of UT Personal Data about individuals who reside in Utah. In the 12 months prior to the date of this Privacy Policy, we collected the following types of categories of UT Personal Data, which we will continue to collect:

• Identifiers: such as name, telephone number, email address, IP address
• Commercial information: such as prescriptions and pharmacies searched and considered, loyalty program participation information
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information
• Geolocation information: such as ZIP codes entered to see pharmacies nearby, as well as actual location when visitors grant access

Deidentified Information

We may also maintain and use information that does not identify an individual and cannot reasonably be used to identify an individual which is derived from UT Personal Data. We will not attempt to reidentify deidentified UT Personal Data unless permitted by law.

Purposes

We collect UT Personal Data to respond to your inquiries, fulfill your requests and improve your experience; for marketing, advertising and promotional purposes; for reporting and analytics; to improve the effectiveness of our services, conduct research and analysis, or for other internal operations purposes.

Utah Consumer Rights

As a Utah resident, you have the right to ask us for and access, including in a portable, readily usable format, any or all of following types of information regarding the UT Personal Data we have collected about you:

• Specific pieces of UT Personal Data we have collected about you;
• Categories of UT Personal Data we have collected about you;
• Categories of sources from which such UT Personal Data was collected;
• Categories of UT Personal Data we sold or disclosed for a business purpose about you; and
• The business or commercial purpose for collecting or selling your UT Personal Data.

You also have the right to request deletion of your UT Personal Data and to opt out of the use of your UT Personal Data for purposes of targeted advertising and sale. In addition, you have the right to opt-out of the processing of your Sensitive Data.

Exercising Utah Consumer Rights

You or your authorized agent may submit a request to exercise your Utah Consumer Rights by using one of the following specifically designated methods:

• Email us at contact@paramountrx.com
• Call our customer service center at 1-800-928-4301

Responding to Requests

For requests for access or deletion, we will first acknowledge receipt of your request within 10 business days of receipt of your request. We provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know. For requests to opt out of the use of your UT Personal Data for purposes of targeted advertising and sale or for requests to opt-out of the processing of your Sensitive Data, we will comply within 15 business days after receipt of your request.

8. PRIVACY NOTICE FOR VIRGINIA RESIDENTS

If you are a Virginia resident, we are required to provide additional information to you about how we collect, use and disclose your information that may be considered "Personal Data " under Virginia Law ("VA Personal Data"), and you may have additional rights with regard to how we use and disclose your VA Personal Data. In addition, certain information about you may be considered "Sensitive Data" under Virginia Law, and, unless the processing falls under a legal exception, we cannot process Sensitive Data without obtaining your consent. We have included this Virginia-specific information below.

Our Website has collected the following categories of personal information from Virginia users within the last twelve (12) months:

• Identifiers such as name, email address, and IP address
• Commercial information such as prescriptions and pharmacies searched
• Internet activity such as search history, pages visited, and coupons generated
• Geolocation data such as ZIP codes entered to see pharmacies nearby, as well as actual location when visitors grant access
• Sensitive Personal Information such as precise geolocation

Deidentified Information

We may also maintain and use information that does not identify an individual and cannot reasonably be used to identify an individual which is derived from VA Personal Data. We will not attempt to reidentify deidentified VA Personal Data unless permitted by law.

We obtain the categories of personal information listed above from the following categories of sources:

• Directly from you. For example, via forms you complete as part of drug coupon generation
• Indirectly from you. For example, from observing your actions on our Website

Use of Personal Information

• To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses
• To personalize your Website experience and to deliver content and product and service offerings relevant to your interests via email or text message (with your consent, where required by law)
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations
• As described to you when collecting your personal information or as otherwise set forth in the VCDPA
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our Website users is among the assets transferred

Sharing Personal Information

We may disclose your personal information to a third party for a business purpose. When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.

We share your personal information for a business purpose with the following categories of third parties:

• Service providers
• Parent or subsidiary organizations
• Partners
• Internet cookie data recipients like Google Analytics

Disclosures of Personal Information for a Business Purpose
In the preceding twelve (12) months, Company has disclosed the following categories of personal information for a business purpose:

Category A: Identifiers
Category C: Commercial information
Category E: Internet or other similar network activity
Category F: Geolocation data

Category K: Sensitive Personal Information

Sales of Personal Information
In the preceding twelve (12) months, Company has not sold personal information.

Virginia Consumer Rights

As a Virginia resident, you have the right to ask us to access or for a portable copy of any or all of the following types of information regarding the VA Personal Data we have collected about you:

• Specific pieces of VA Personal Data we have collected about you
• Categories of VA Personal Data we have collected about you
• Categories of sources from which such VA Personal Data was collected
• Categories of VA Personal Data we sold or disclosed for a business purpose about you; and
• The business or commercial purpose for collecting or selling your VA Personal Data

You also have the right to request correction or deletion of your VA Personal Data and to opt out of the use of your VA Personal Data for purposes of targeted advertising, sale, and automated processing ("profiling").

In addition, you have the right to appeal our refusal to act on your request.

Exercising Virginia Consumer Rights

To exercise the rights described above, please submit an authenticated consumer request to us by either:

• Call our customer service center at 1-800-928-4301
• Email us at contact@paramountrx.com. Please include the following fields in your email:
  • Full name
  • Email address
  • Date of birth
  • Full address
  • Phone number (optional)

Only you, or someone legally authorized to act on your behalf, may make an authenticated consumer request related to your personal information. You may also make an authenticated consumer request on behalf of your minor child. To designate yourself as an authorized agent, please attach an authenticated notarized document granting you permission to submit any such request on the minor’s behalf.

Responding to Requests

For requests for access, correction, deletion, or appeal, we will first acknowledge receipt of your request within 10 business days of receipt of your request. We provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know.

For requests to opt out of the use of your VA Personal Data for purposes of targeted advertising, sale, and automated processing ("profiling"), we will comply within 15 business days after receipt of your request. In some cases, the law may allow us to refuse to act on certain requests. When this is the case, we will endeavor to provide you with an explanation as to why. We do not charge a fee to process or respond to your authenticated consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Process to Appeal a Decision Related to Your Rights

If we refused to fulfill your request to exercise your privacy rights above, you may appeal this decision by contacting us at contact@paramountrx.com

. We will respond to your request within 60 days of receipt of your appeal with an explanation about our decision to fulfill or refuse your request. You may contact the Virginia Attorney General to file a complaint related to the denial of your request by contacting mailoag@oag.state.va.us.