WellRx^TM Program Privacy Policy (USA)

Effective Date: August 22, 2024

This Privacy Policy ("Policy") describes Medical Security Card Company, LLC’s and its affiliates’ (collectively, "Company," "we," "us," or "our") practices with respect to the collection, use and disclosure of Personal Information (defined below) collected via our mobile applications (“Application(s)” and websites (“Site(s)” that are marketed using any version of the WellRxTM brand name or WellRxTM logo and through our other interactions with you and your participation in our WellRxTM branded program(s). Collectively, the WellRxTM branded Application(s), the WellRxTM branded Site(s) and WellRx Program(s) may be referred to as the “Services”.

PRIVACY LAWS AND GUIDELINES ARE PART OF A CONSTANTLY CHANGING ENVIRONMENT. WE RESERVE THE RIGHT IN OUR DISCRETION TO CHANGE THIS POLICY AT ANY TIME. ALL CHANGES WILL BE EFFECTIVE IMMEDIATELY UPON POSTING TO THE SITE AND APPLICATION. MATERIAL CHANGES WILL BE CONSPICUOUSLY POSTED ON THE SITE AND the APPLICATION OR OTHERWISE COMMUNICATED TO YOU. PLEASE READ THIS POLICY CAREFULLY.

IF YOU ARE A RESIDENT OF CALIFORNIA, COLORADO, VIRGINIA, CONNECTICUT, OR UTAH PLEASE SEE THE STATE-SPECIFIC SUPPLEMENTAL PRIVACY NOTICE SECTION LOCATED BELOW FOR ADDITIONAL INFORMATION THAT MAY BE APPLICABLE TO YOU.

This Privacy Policy does not apply data collected from our employees, from job applicants or to any program or service offering that we provide or manage on behalf of a third party for which we are not a data controller.  For programs we provide or manage on behalf of a third party, please contact the third party for information on their data privacy practices.

1.  Categories of Personal Information We Collect

For purposes of this Policy, “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular person. We may collect the following categories of Personal Information:

1.1. IDENTIFIERS.

Information such as: first name, middle initial, last name, name extension (e.g., Jr. Sr., I, II, etc.), date of birth, email address, zip code, postal address (including street address, city, and state), phone number, store number, individual prescription number, password, National Provider Information, alias, unique personal identifier, online identifier, internet protocol address ("IP Address"), account name, or other similar identifiers.

1.2. CUSTOMER RECORDS.

Information such as: telephone number, program effective date, program termination date, customer status, medical information, including prescription and medication information, insurance information such as group number, cardholder ID and member number, and individual prescription number and other similar records.

1.3. PROTECTED CLASSIFICATIONS.

Information such as: gender and age.

1.4. COMMERCIAL INFORMATION.

Commercial information, including records of products or services, including prescriptions, purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

1.5. INTERNET ACTIVITY.

Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a person’s interaction with the Site, the Application, or an advertisement.

1.6. GEOLOCATION DATA.

Data which may be determined by GPS, IP address, and other data from sensors on or around your device, depending in part on your device and account settings, which may include precise location data.

1.7. INFERENCES.

Inferences drawn from any of the information described in this section to create a profile, set personal preferences, or make recommendations, such as recommend foods and associated ratings.

1.8. SENSITIVE PERSONAL INFORMATION.

We may collect information concerning a person’s health, precise geolocation, and if you create an account, your log in and password.

This Policy does not apply to any data that is publicly available, data that we have aggregated and anonymized such that you are not identifiable or reasonably identifiable, or data that we receive in our role as a data processor to a third-party data controller.

2.  Sources of Personal Information

We may collect Personal Information from the following categories of sources:

2.1. INFORMATION YOU PROVIDE DIRECTLY TO US.

We collect Personal Information that you provide directly to us.   Personal Information is required to use certain features of the Site, to download the Application, and to use Services via either the Site or Application. 

2.1.1. Accounts.

We collect any Personal Information you provide when you create an account with us.  Further, we collect any additional information that you decide to populate in your health profile or the Medicine Chest feature within your account, such as your prescription information and general information about your health conditions (e.g., allergens, heart health, diabetes, etc.), and dietary preferences.  This Personal Information is used to create your account profile.

2.1.2. Contacting Us; Customer Service.

If you contact us, such as via email, our webform, or phone, or to report a problem with our Services, you will be required to provide certain Personal Information. We may retain your message’s content and our response.

2.1.3. Marketing Communications.

If we receive your contact information, we may use it to send you promotional and other electronic and hardcopy communications related to the Services. We may use third-party providers to deliver these communications to you. You may opt-out of marketing emails by using the unsubscribe link in the email or by contacting us at [email protected] with "Unsubscribe" in the subject line. To opt-out of other marketing communications (e.g., postal marketing and telemarketing), please contact us as set forth below. Opting out of marketing communications does not opt you out of other non-marketing communications such as communications about your account or transactions.

2.1.4. Feedback.

When you provide comments or feedback about our Services ("Feedback"), we will not treat that Feedback as confidential, and we may use that Feedback for any purpose in our sole discretion so long as it does not personally identify you. Feedback will be used without attribution or compensation to you.

2.2.  INFORMATION WE COLLECT AUTOMATICALLY.

We may use cookies, web beacons, pixel tags and other tracking technologies (collectively "Online Technologies") to collect certain information from you automatically when you access our Site or Application. 

2.2.1. Internet Activity and Device Information. 

We may collect information such as the websites you visit before or after you visit the Site or Application, pages you click-on on the Site or Application, IP address, location information, search requests, browser type, browser language, mobile carrier, operating system, date and time you visit the Site or Application, the amount of time spent on the Site or Application, unique device identifier (e.g., Google Advertising ID (GAID), Android ID, ID for Advertisers (IDFA), ID for Vendors (IDFV), MAC address, International Mobile Equipment Identity (IMEI), or other device IDs), requesting and referring URLs, and the device you use to access the Site or Application.

2.2.2. Account Activity.

If you choose to create an account, we may collect data about how you use (i) your online account, (ii) the Site when you are logged into your account, and (iii) the Application when you are logged into your account.

2.2.3. Online Technologies.

We use online technologies to:

• prevent fraud, protect your data from unauthorized parties, and comply with legal requirements;

• make our Site and Application function properly;

• provide personalized experiences;

• tailor our interactions with you;

• help with our marketing efforts;

• provide us with valuable data and statistics about the usage and effectiveness of our Services and to help us improve our Services.

You can choose to either accept or decline certain Online Technologies based on your browser settings. You can disable Online Technologies by changing your browser settings but disabling Online Technologies may impact your use and enjoyment of the Services. Not all features or functions of the Site or Application may work properly if you disable Online Technologies. You cannot disable all Online Technologies, such as cookies that are essential to the functioning of the Site or Application.

2.2.4. Google Analytics.

We use Google Analytics to collect and process information about your use of the Services. Google sets Online Technologies on your device that will automatically send data to Google. Google uses this data to provide us with reports that we use to improve the Site’s and Application’s structure and content and to learn more about our user base.

We may implement additional add-on services to Google Analytics, such as Demographics and Interest Reporting. Demographics and Interest Reporting uses Online Technologies to collect data about our Site traffic by tracking users across websites and across time to provide us with analytics on our user base. To learn more about how Google uses data, you may click on this text to visit Google’s Privacy Policy. You may click on this text to download the Google Analytics Opt-out Browser Add-on for each web browser you use, but this does not prevent the use of other analytics tools.

We have also enabled the following Google Analytics Advertising Features:, Remarketing with Google Analytics and Google Analytics Demographics and Interest Reporting. Remarketing with Google Analytics uses the Google Analytics Cookie to serve advertisements to you across the Internet based on your visit to our Site. Google Analytics Demographics and Interest Reporting uses a third-party Cookie to collect information about our website traffic by tracking users across websites and across time, which generates a report for us to better understand the users of the Services.

We use Google Ads to serve ads across various websites. Google uses Online Technologies to collect data about your use of the Services to generate targeted advertisements to you on other websites that you visit. To opt-out of this type of advertising by Google, to customize your ad preferences, or to limit Google’s collection or use of such data, you can click on this text to visit Google’s Safety Center or you can click on this text to visit Google’s Ad Settings and you can click on this text to follow Google’s personalized ad opt-out instructions. Opting out will not affect your use of the Services.

2.2.5. Ad Measurement, Conversion Tracking, and Online Behavioral Advertising.

We use third parties to provide targeted advertising, including but not limited to Facebook, Live Ramp, and Double Click. These services collect data about your interactions with the Site and Application and other websites to send you targeted advertisements for goods and services. The data collected may be associated with your Personal Information. These advertisements may appear on the Site, Application, and on other websites and may be sent to you via email. We also use third parties, including Google, to provide us with ad measurement and conversion tracking services. These services measure the effectiveness of our ad campaigns and provide us with better insights about our ads.

To change your preferences with respect to certain online ads and to obtain more information about third-party ad networks and online behavioral advertising, you can click on this text to visit the National Advertising Initiative Consumer opt-out page or the Digital Advertising Alliance’s WebChoices tool. You also can learn more about opting out of third parties’ use of Online Technologies used to tailor ads and other content by clicking on this text to visit http://www.networkadvertising.org/managing/opt_out.asp and http://www.aboutads.info/choices. Changing your settings with individual browsers or ad networks will not necessarily carry over to other browsers or ad networks. As a result, depending on the opt-outs you request, you may still see our ads.

2.2.6. ReCAPTCHA.

We may use and implement reCAPTCHA, a Google tool to help fight spam and misuse on our Site.  As a result, certain Personal Information may be disclosed to Google for this purpose pursuant to Google’s Privacy Policy.

2.2.7. Video Content.

The Site contains videos and embedded content provided by us and other parties, including visible content and/or feeds scripts embedded in the Site's code. Company and such other parties may collect data about how you interact with such content. For example, YouTube may collect usage data on videos embedded on the Site. Even if you do not watch videos, YouTube may still collect certain information about your interactions with our Site if you are signed into your YouTube account or Google account when accessing our Site.  YouTube, LLC is owned by Google. Please see Google's Privacy Policy for more information. 

2.2.8. Google Maps.

We use the Google Places API(s) for location searches and the Google Maps/Google Earth API(s) for the results. Pursuant to the Google Maps/Google Earth APIs Terms of Service, use of this location feature is also subject to the Google privacy policy, which can be found by clicking on this text to visit https://policies.google.com/privacy. We use Google Maps to enhance your user experience and increase the usefulness of the Site and Application.

With your consent, we may access your location. We will only access your location while you are using the Application or the Site and provided you have opted-in to activate this feature. You may choose to allow us to access your location by granting the Application or the Site, as applicable, access to your device's location when prompted or through your device's location services settings.

2.3.  INFORMATION FROM THIRD-PARTY SOURCES.

We obtain Personal Information about individuals from various third-party companies and public sources, and we may combine that with Personal Information or other data we collect. This enhances our existing data about our users, improves our ability to contact you, and enhances our marketing capabilities. Third party sources of information may include but are not limited to, the following:

2.3.1. Pharmacies.

We collect Personal Information about your prescription purchases as disclosed to us by the pharmacies who are part of our discount prescription networks that process your prescriptions. We may use such information about your prescription purchases sourced from pharmacies for purposes related to the administration of our programs, to better communicate with you, and to provide information to you in regard to your account or use of our programs as applicable.

2.3.2 Clients.

Our programs may be provided to you on behalf of an organization with which you are affiliated.  In order to enroll you in our programs, we receive Personal Information from those organizations.

2.3.3. Practitioners.

We may receive Personal Information from medical practitioners, providers, health plans, or provider groups to allow us to contact consumers for potential use of our programs and to assist with prescription compliance.

3.  Uses of Personal Information

In addition to the uses described elsewhere in this Policy, we may collect, use and disclose any of the Personal Information described in Section 1 above for the following purposes:

3.1. AS STATED OR AGREED TO AT THE POINT OF COLLECTION.

We may use Personal Information for the purposes stated or agreed-to (or as is obvious) at the point of collection. For example, we use Personal Information to respond to your questions, comments, or complaints. We may also use Personal Information as requested or consented to by you.

3.2. ADMINISTRATION.

We use Personal Information for administrative purposes, such as managing your accounts, providing customer support, facilitating transactions, to inform our business strategies, to understand the Site’s and Application’s demographics and user preferences, for evaluating applications, and managing profiles.

3.3. BILLING AND CLAIMS QUESTIONS.

We use Personal Information to collect payments via pharmacies for participation in our prescription drug discount program and to assist pharmacies with questions about adjudicated claims.

3.4. REBATE PROGRAM.

We use Personal Information to assist with financing the operation of the discount card program.

3.5. SITE AND APPLICATION MANAGEMENT.

We use Personal Information for Site and Application management, such as troubleshooting problems, improving the content and functionality of the Site and Application, statistical and other analyses of the Site and Application, and to customize the Site and Application for you and our other users.

3.6. COMMUNICATIONS AND ADVERTISING.

We may use Personal Information to send you promotions or to perform targeted advertising, to notify you of new services, products, or programs, to notify you of new features of our Services, to notify you of changes to our Terms or this Policy, and for other similar communications.

3.7. TO PROTECT OUR RIGHTS.

We may use Personal Information to protect our legal rights or interests, or those of third parties, including to bring a legal action against you or anyone who may be causing harm to us, our Site, the Application, or to other users of the Site or the Application. We may also use Personal Information to seek business, financial or legal advice, and to respond to other legal requests.

3.8. TO RECEIVE FEEDBACK AND IMPROVE USER EXPERIENCE.

We may collect Feedback from you through surveys. We may use all of the survey information that we collect to improve user experience, and our products and services. We may also aggregate and anonymize any survey information and license and distribute the same.

4.  Disclosure of Personal Information

In addition to any disclosures described elsewhere in this Policy, we may disclose any of the Personal Information described in Section 1 above to the following categories of third parties:

4.1. EMPLOYEES AND AFFILIATES.

We may disclose or allow access to Personal Information to our employees and affiliates who have a need to know the information for our business purposes.

4.2. PHARMACIES.

We may disclose Personal Information to pharmacies for billing purposes and to assist consumers and pharmacies with questions about adjudicated claims.

4.3. THIRD-PARTY PHARMACEUTICAL MANUFACTURERS.

We may disclose Personal Information to third-party pharmaceutical manufacturers or their intermediaries to assist with financing the operation of the discount card program.

4.4. VENDORS.

We may disclose Personal Information to our vendors, consultants, agents, partners, and representatives that provide services to us. These vendors may include but are not limited to our marketing and ad agencies, information technology vendors, and customer service call vendors. Our vendors may also aggregate the information they receive for their own internal analysis and purposes and for inclusion in general databases regarding consumer behavior and trends.

4.5. GOVERNMENT OFFICIALS / LAW ENFORCEMENT.

We may cooperate with law enforcement and other governmental agencies, and may disclose Personal Information: (i) if we believe in good faith we are legally required to disclose that Personal Information, or (ii) if we are advised to disclose Personal Information by our legal counsel.

4.6. PROFESSIONAL ADVISORS.

We may disclose Personal Information to certain professional advisors, such as our attorneys, accountants, financial advisors, and business advisors, in their capacity as advisors to us.

4.7. LEGAL PROCEEDINGS AND PROTECTION OF RIGHTS. 

We may use Personal Information and disclose it to third parties if we believe doing so is necessary to provide you the contemplated services or to protect our rights or the rights of others, including disclosing information necessary to identify, contact, or bring legal action in the event of a violation of our contracts, terms, or policies.

4.8. CHANGE IN OWNERSHIP.

In the event Company is the subject of a change of control or in the event the Site, or Application or Services change ownership, in whole or in part, or in the event of a bankruptcy, receivership or a similar transaction, and with respect to due diligence related to the foregoing, we may provide Personal Information to the subsequent (or prospective) owner(s).

4.9. OTHER.

We may disclose Personal Information to third parties when explicitly requested by or consented to by you, or for the purposes for which you disclosed the Personal Information to us as indicated at the time and point of the disclosure (or as was obvious at the time and point of disclosure).

5.  Use and Disclosure of De-Identified or Aggregated Information

De-identified information is information that cannot reasonably be associated with or linked to an individual and therefore is not Personal Information.  We may collect, use, disclose, share, create, transfer, and otherwise process de-identified and aggregated information that we receive or create for any purposes in our sole discretion, in compliance with applicable laws. We may use aggregated data to understand users’ needs, to determine user demographics and user patterns, to determine what kinds of products and services we can provide, and to improve and enrich our products and services, including the Site and Application. We are the sole and exclusive owner of such de-identified and aggregated information.

We may disclose de-identified and aggregated information to (i) our clients in order to provide overviews of claims information, (e.g., "specific drug associated with 35–47-year-olds and mostly female,") and (ii) third-party advertisers and content distributors for our own marketing purposes (e.g., the number of users and basic -de-identified demographic data).

6.  Children

The Services are not directed at children under 18 years of age. We do not knowingly collect Personal Information from children under 18. If a parent or legal guardian learns that their child provided us with Personal Information without his or her consent, please contact us and we will make commercially reasonable attempts to delete such Personal Information from our records.

7.  Social Media

We are active on social media, including but not limited to Facebook, YouTube, X (formerly Twitter), Instagram, Reddit, Pinterest, and LinkedIn ("Social Media"). Anything you post on Social Media is public information and will not be treated confidentially. We may post (or re-post) any comments or content that you post on our Social Media pages. YOU AGREE TO HOLD US AND OUR AFFILIATES HARMLESS AND WITHOUT LIABILITY FOR THE RESULTS OF ANY AND ALL CONTENT YOU POST ON OUR SOCIAL MEDIA PAGES.

The Services allows you to connect and share data with Social Media. These features may require us to use Online Technologies (such as cookies, plug-ins, and APIs) provided by such Social Media platforms to facilitate those communications and features. The Services may use advertising networks and services offered by Social Media platforms to deliver advertising content. Use of these services requires Social Media platforms to implement Online Technologies to deliver ads to you while you access the Services.

Your use of Social Media is governed by the privacy policies and terms of the third parties that own and operate those Social Media platforms/websites.  We encourage you to review those policies and terms. Your use of Social Media is not controlled by us or governed by this Policy.

8.  Data Security

The privacy and the security of your Personal Information is very important to us. We use commercially reasonable administrative, technical, and organizational measures to help secure Personal Information against loss, misuse, and alteration appropriate to the type of Personal Information processed. Unfortunately, no measures can be guaranteed to provide complete security. Accordingly, we do not guarantee the security of Personal Information, and you are providing your Personal Information at your own risk. If a breach of your Personal Information occurs, we will notify you of the breach as required under applicable law.

9.  Access from Outside the United States

If you access the Site or the Application from outside the United States, please be aware that Personal Information may be transferred to, stored in, and processed in the United States. Certain governmental authorities may not consider the level of protection of Personal Information in the United States to be equivalent to that required in other jurisdictions. Our online privacy practices are governed by the laws of the United States, which may differ from privacy laws in your home country. By using our Services, you understand that Personal Information will be transferred, processed, used, disclosed, and stored in the United States and other jurisdictions as set forth in this Policy.

10.  Data Retention

We will retain your Personal Information in accordance with our record retention requirements and our internal policies, which reflect our business and legal considerations. Your Personal Information may be retained longer if required or permitted by applicable law.

11.  Third-Party Websites

The Site may link to, or be linked to, websites not owned or controlled by us. We are not responsible for third parties’ privacy policies or practices. This Policy does not apply to any third-party websites or to any data that you provide to third parties. We recommend that you read the privacy policy for each website that you visit.

****************************************

12.  State Specific Supplemental Privacy Notice

If you are a resident of California, Colorado, Connecticut, Virginia or Utah, please review the relevant section below for additional information on disclosures and additional rights that may apply to you.

12.1. CALIFORNIA PRIVACY RIGHTS NOTICE.

THIS SECTION PROVIDES ADDITIONAL PROVISIONS APPLICABLE ONLY TO CONSUMERS WHO ARE RESIDENTS OF CALIFORNIA. If any information in this section conflicts with the main body of this Policy above, the information in this section controls for California residents.  Capitalized terms used in this state-specific section but that are not defined in this Policy have the meanings set forth in the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 and its implementing regulations (collectively, the "CCPA").

12.1.1. Collection, Sources, Purpose, Sharing and Retention of Your Personal Information.

Categories of Personal Information we collect.  The categories of Personal Information we have collected in the last twelve (12) months are described in Section 1. 

Categories of sources from which Personal Information is collected. The categories of sources from which Personal Information is collected is described in Section 2.

Purposes for collecting Personal Information. The purposes for collecting Personal Information are described in Section 3.

Categories of Personal Information Sold or Shared. While we do not disclose Personal Information to third parties in exchange for monetary compensation, we may “Sell” or “Share” Personal Information as defined by the CCPA. In the past 12 months, we have Sold or Shared the following categories of Personal Information to any of the third parties listed in Section 4 for those purposes described in Section 3.

• Identifiers,

• Customer Records,

• Commercial Information, and

• Inferences.

As stated above, we do not knowingly collect information of any minor under the age of 18.  As a result, we do not have actual knowledge of Selling or Sharing as defined by the CCPA Personal Information of minors under the age of 16.

Categories of Personal Information Disclosed for a Business Purpose.  In the last 12 months we disclosed all of the categories of Personal Information described in Section 1 for our or one of our service provider’s operational purposes.

Sensitive Personal Information. We have not used or disclosed Sensitive Personal Information for any reason other than the reasons for which it was provided to us.  We do not use Sensitive Personal Information to infer characteristics about individuals.

Data Retention. We determine how long to retain Personal Information, which applies to all categories of Personal Information set forth in Section 1, based on our legal obligations, how long we need to retain your Personal Information for the purposes we collected it, and our internal data retention policies.

12.1.2. California Consumer Rights.

California consumers have the following rights under CCPA:

Right to Request Access. You have the right to request access to, and receive a copy of, the specific pieces of Personal Information that we have collected in the last 12 months, and to have this delivered, either (a) by mail or (b) electronically in a portable format and, to the extent technically feasible, in a readily useable format.

Right to Request to Know. You have a right to request information about the Personal Information we have collected about you, including any of the following that occurred in the last 12 months:

• the categories of Personal Information we collected from you (including Sensitive Personal Information if applicable),

• the categories of sources from which the Personal Information was collected,

• the business or commercial purpose for collecting, Selling or Sharing your Personal Information,

• the categories of third parties with whom we disclosed, Sold or Shared your Personal Information,

• the specific pieces of Personal Information we collected from you, and

• a list of categories of Personal Information we Sold, Shared or disclosed for a Business Purpose.

Right to Request Deletion. You have the right to request that we delete Personal Information we collected from you. We will comply with such requests, and direct our service providers to do the same, subject to certain exceptions permitted by applicable law.

Right to Opt-Out of the Sale or Sharing of Your Personal Information. You have the right to request that we do not Sell or Share any Personal Information. You may submit your opt-out request by following this link: DO NOT SELL OR SHARE MY PERSONAL INFORMATION

Right to Request Correction of Inaccurate Personal Information. You have the right to request that we correct inaccurate Personal Information that we maintain about you. We will make commercially reasonable efforts to make any such corrections as required by applicable law.

Right to Limit Use and Disclosure of Sensitive Personal Information. You have the right to limit our use and disclosure of your Sensitive Personal Information to only uses that are necessary to perform the Services MSC provides to you. We do not use or disclose Sensitive Personal Information for any purpose other than the purpose for which it was collected.

Right to Non-Discrimination. You have a right to not receive discriminatory treatment for exercising any of your rights under the CCPA.

Submission Process. The process for submitting a request to exercise the above rights is set forth below in Section 13.

12.1.3. Notice of Financial Incentives.

Use of our Services may provide financial benefits, such as prescription discounts, to those who choose to participate.  Given the nature of our Services and the resulting discounts, our Services may be interpreted to be a “financial incentive” as defined by the CCPA.  As a result, we have elected to provide this disclosure. Participation in our Services requires you to provide Personal Information in the form of Identifiers or Commercial Information as defined by the CCPA.  Based on our reasonable and good faith estimate, we receive value from participation in our Services via increased use of our Services, though any value will vary by participant depending on frequency of use, which offers a participant takes advantage of, and many other factors. To the extent that our Services are considered a financial incentive under the CCPA, you have the right to withdraw from participation or use in our Services at any time by not accessing our Services or by deleting your account, if applicable.

12.1.4. CALIFORNIA’S "DO-NOT-TRACK" REQUIREMENT. WE CURRENTLY DO NOT HONOR "DO NOT TRACK" REQUESTS.

12.2. VIRGINIA PRIVACY RIGHTS NOTICE.

THIS SECTION PROVIDES ADDITIONAL PROVISIONS APPLICABLE ONLY TO CONSUMERS WHO ARE RESIDENTS OF VIRGINIA.  If any information in this section conflicts with the main body of this Policy above, the information in this section shall control if you are a Virginia resident. Capitalized terms used in this state-specific section but not defined in this Policy have the meanings set forth in the Virginia Consumer Data Protection Act (“VCDPA”).

12.2.1. Your Personal Data.

Categories of Personal Data we collect. The categories of Personal Data we collect are described in Section 1.

Purposes for collecting Personal Data. The purposes for collecting Personal Data are described in Section 3.

Categories of Personal Data Disclosed. We disclose Personal Data as described in Section 1 of this Policy to the categories of third parties set forth in Section 4 of this Policy.

We process Personal Data for the purposes of providing targeted advertising as set forth above in Section 2.

12.2.2. Virginia Consumer Rights.

Virginia consumers have the following rights under VCDPA:

Right to Request Access. You have the right to confirm whether or not we are processing your Personal Data and to access such Personal Data.

Right to Request Data Portability. You have the right to obtain a copy of your Personal Data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the information to another business without hindrance, where the processing is carried out by automated means.

Right to Request Correction. You have the right to request to correct inaccuracies in your Personal Data, considering the nature of the Personal Data and the purposes of the processing of such Personal Data.

Right to Request Deletion. You have the right to request deletion of Personal Data provided by or obtained about you.

Right to Opt-Out of Targeted Advertising. You have the right to opt-out of the processing of your Personal Data for purposes of Targeted Advertising.

Submission Process. The process for submitting a request to exercise the above rights is set forth below in Section 13.

Right to Appeal. If we reject or deny your request submitted pursuant to Section 13 of this Policy, you have the right to appeal our decision by submitting an appeal form. To submit an appeal form, visit the state form selector. Select your state and select the appropriate appeals form option. Appeal requests must be submitted within a reasonable time following our rejection of your original request.

12.2.3. De-identified Data Commitment.

We will not attempt to re-identify any de-identified data that we maintain and use.

12.3. COLORADO PRIVACY RIGHTS NOTICE.

THIS SECTION PROVIDES ADDITIONAL PROVISIONS APPLICABLE ONLY TO CONSUMERS WHO ARE RESIDENTS OF COLORADO. If any information in this section conflicts with the main body of this Policy above, the information in this section shall control, if you are a Colorado resident. Capitalized terms used in this state-specific section but not defined in this Policy have the meanings set forth in the Colorado Privacy Act (“CPA”).

12.3.1. Your Personal Information.

Categories of Personal Data we collect. The categories of Personal Data we collect are described in Section 1.

Purposes for collecting Personal Data. The purposes for collecting Personal Data are described in Section 3.

Categories of Personal Data Disclosed. We disclose Personal Data as described in Section 1 of this Policy to the categories of third parties set forth in Section 4 of this Policy.

We process Personal Data for the purposes of providing Targeted Advertising as set forth above in Section 2.

12.3.2. Additional Notices to Colorado Consumers.

Notice of Bona Fide Loyalty Program. Use of our Services may provide financial benefits, such as prescription discounts, to those who choose to participate.  Given the nature of our Services and the resulting discounts, our Services may be interpreted to be a “bona fide loyalty program” as defined by the CPA. As a result, we have elected to provide this disclosure. Participation in our Services requires you to provide Personal Data in the form of Identifiers or Commercial Information about your purchases, which we may use for Targeted Advertising. To the extent that our Services are considered a financial incentive under the CPA, you have the right to withdraw from participation or use in our Services at any time by not accessing our Services or by deleting your account, if applicable. However, because the Personal Data we collect is required to provide our Services, we would be unable to provide our Services if you elect not to provide us your Personal Data.

12.3.3. Colorado Consumer Rights.

Colorado consumers have the following rights under the CPA:

Right to Request Access. You have the right to request confirmation of whether or not we are processing your Personal Data and to access such Personal Data.

Right to Data Portability. You have the right to obtain a copy of your Personal Data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance, where the processing is carried out by automated means.

Right to Request Correction. You have the right to request correction of inaccuracies in your Personal Data.

Right to Request Deletion. You have a right to request deletion of Personal Data provided by or obtained about you.

Right to Opt-Out of Targeted Advertising. You have a right to opt-out of the processing of your Personal Data for purposes of Targeted Advertising. You may submit your opt-out request by following this link: DO NOT SELL OR SHARE MY PERSONAL INFORMATION.

Submission Process. The process for submitting a request to exercise the above rights is set forth below in Section 13.

Right to Appeal. If we reject or deny your request submitted pursuant to Section 13 of this Policy, you have the right to appeal our decision by submitting an appeal form. To submit an appeal form, visit the state form selector. Select your state and select the appropriate appeals form option. Appeal requests must be submitted within a reasonable time following our rejection of your original request.

12.4. CONNECTICUT PRIVACY RIGHTS NOTICE.

THIS SECTION PROVIDES ADDITIONAL PROVISIONS APPLICABLE ONLY TO CONSUMERS WHO ARE RESIDENTS OF CONNECTICUT. If any information in this section conflicts with the main body of this Policy above, the information in this section shall control. if you are a Connecticut resident. Capitalized terms used in this state-specific section but not defined in this Policy have the meanings set forth in the Connecticut Data Privacy Act (“CTDPA”).

12.4.1. Your Personal Data.

Categories of Personal Data we collect. The categories of Personal Data we collect are described in Section 1.

Purposes for collecting Personal Data. The purposes for collecting Personal Data are described in Section 3.

Categories of Personal Data Disclosed. We disclose Personal Data as described in Section 1 of this Policy with the categories of third parties set forth in Section 4 of this Policy.

We process Personal Data for the purposes of providing targeted advertising as set forth above in Section 2.

12.4.2. Connecticut Consumer Rights.

Connecticut consumers have the following rights under the CTDPA.

Right to Request Access. You have the right to request confirmation of whether or not we are processing your Personal Data and to access such Personal Data.

Right to Data Portability. You have the right to obtain a copy of your Personal Data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance, where the processing is carried out by automated means.

Right to Request Correction. You have the right to request correction of inaccuracies in your Personal Data.

Right to Request Deletion. You have a right to request deletion of Personal Data provided by or obtained about you.

Right to Opt-Out. You have a right to opt-out of the processing of your Personal Data for purposes of Targeted Advertising. You may submit your opt-out request by following this link: DO NOT SELL OR SHARE MY PERSONAL INFORMATION.

Submission Process. The process for submitting a request to exercise the above rights is set forth below in Section 13.

Right to Appeal. If we reject or deny your request submitted pursuant to Section 13 of this Policy, you have the right to appeal our decision by submitting an appeal form. To submit an appeal form, visit the state form selector. Select your state and select the appropriate appeals form option. Appeal requests must be submitted within a reasonable time following our rejection of your original request.

12.5. UTAH PRIVACY RIGHTS NOTICE.

THIS SECTION PROVIDES ADDITIONAL PROVISIONS APPLICABLE ONLY TO CONSUMERS WHO ARE RESIDENTS OF UTAH. If any information in this section conflicts with the main body of this Policy above, the information in this section shall control if you are a Utah resident. Capitalized terms used in this state-specific section but not defined in this Policy have the meanings set forth in the Utah Consumer Privacy Act (“UCPA”).

12.5.1. Your Personal Data.

Categories of Personal Data we collect. The categories of Personal Data we collect are described in Section 1.

Purposes for collecting Personal Data. The purposes for collecting Personal Data are described in Section 3.

Categories of Personal Data Disclosed. We disclose Personal Data as described in Section 1 of this Policy to the categories of third parties set forth in Section 4 of this Policy.

We process Personal Data for the purposes of providing targeted advertising as set forth above in Section 2.

12.5.2. Utah Consumer Rights.

Utah consumers have the following rights under the UCPA:

Right to Request Access. You have the right to confirm whether or not we are processing your Personal Data and to access such Personal Data.

Right to Request Data Portability. You have the right to obtain a copy of your Personal Data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the information to another business without hindrance, where the processing is carried out by automated means.

Right to Request Correction. You have the right to request to correct inaccuracies in your Personal Data, considering the nature of the Personal Data and the purposes of the processing of such Personal Data.

Right to Request Deletion. You have the right to request deletion of Personal Data provided by or obtained about you. 

Right to Opt-Out of Targeted Advertising. You have the right to opt-out of the processing of Personal Data for purposes of Targeted Advertising.

Submission Process. The process for submitting a request to exercise the above rights is set forth below in Section 13.

13. Submitting State Privacy Rights Requests

To submit any of the rights above, you may submit your request to us by contacting us

Via online web form

You must provide sufficient information to allow us to reasonably verify you are the data subject to whom the Personal Information relates, and you must describe your request with sufficient detail to allow us to properly understand, evaluate, and respond to your request.

When we receive your rights request (i) we will acknowledge receipt of your request; (ii) we will try to match the information you provide in making the request with information we already maintain about you; (iii) in order to verify your identity, we may ask you to provide additional information, which may include Personal Information; and (iv) we will consider various factors when determining how to verify your identity, such as the sensitivity and value of the data, the risk of harm, and the likelihood of fraud.

We will only use Personal Information we collect during the verification process for the purpose of verifying your identity.  If you maintain an account with us, we may use that account to respond to your request and/or verify your identity. 

If we are unable to verify your identity as required by applicable laws and regulations, we will decline to comply with your request, and let you know why.  In addition, we may decline to comply with your request as permitted by applicable law. 

We may charge a fee as permitted by applicable law, such as to process or respond to your request if it is excessive, repetitive, manifestly unfounded, or if we believe the request is fraudulent or submitted for purposed other than exercising applicable privacy rights.

If you are a resident of California, Colorado, or Connecticut, you may have a right to submit certain requests to exercise your rights using an authorized agent.  If we receive a request from an authorized agent, we will need to verify and authenticate your identity as the data subject, the agent’s identity, and the agent’s authority to act on your behalf.  We may deny a request from an authorized agent if we do not have proof that they are authorized by you to act on your behalf. 

Furthermore, a parent or legal guardian may make a request on behalf of their dependent or non-adult child.  We may deny a request if you are unable to prove that you are the custodial parent or legal guardian.

14. Contact Us

If you have any questions, you may contact us as set forth below:

Via Email at: [email protected]

By mail at:

Medical Security Card Company, LLC
350 S Williams Blvd
Tucson, AZ 85711

By phone at: 1-800-407-8156

Via webform at: https://www.medicalsecuritycard.com/contact/

For Security/Privacy related issues E-Mail: [email protected]