Consumer Health Data Privacy Notice

Last Updated and Effective: April 2, 2024

This Consumer Health Data Privacy Notice supplements the information contained in Fullscript’s Privacy Statement and Fullscript’s US State Privacy Notice, and applies to personal information defined as “consumer health data” under US consumer health data laws. Any terms defined in our Privacy Statement or Terms of Service have the same meaning when used in this Privacy Notice.

As discussed in our Privacy Statement and US State Privacy Notice, we do not “sell” any personal information, including consumer health data, as defined under US state privacy law.

Collection of Consumer Health Data

As described in the Collection of Personal Information section of the Privacy Statement and the Collection of Personal Information section of the US State Privacy Notice, the data we collect depends on the context of your interactions with us and the choices you make (including your privacy settings), the products, services, and features you use, and applicable law. Because consumer health data is defined very broadly, some of the categories of data we collect could also be considered consumer health data. Consumer health data does not include information pertaining to individuals with whom we have a business or employment relationship.

Consumer health data we collect may include:

• Information about your health-related conditions, symptoms, status, diagnoses, testing, or treatments, including surgeries, procedures, supplements, medications, or other interventions as well as information about your reproductive or sexual health. 
• Biographical and demographic information to the extent related to physical or mental health status, diagnosis, disease, or treatment.
• Measurements of bodily functions, vital signs, or characteristics, including photographs, which may also be considered biometric information under consumer health data laws.
• Information that could identify your attempt to seek health care services or information, including services that allow you to assess, measure, improve, or learn about your or another person’s health.
• Other information, including information we may collect via automated means, that may be used to infer or derive data related to the above or other health information.

We only collect these categories of consumer health data with your consent or as reasonably necessary to provide the Services you have requested or authorized.

We limit third party collection of consumer health data by ensuring that entities whose cookies, web beacons, pixels, and other online trackers we use on our websites and Services are our vendors or service providers under applicable US privacy laws, including consumer health data privacy laws. These third parties may collect consumer health data from you depending on your browser, browser add-ons, and associated permissions you set on your device, so it is important that you review their privacy notices to learn how they process consumer health data and the methods they provide to allow you to opt out of such processing. Please see the Use of Cookies and Other Web Technologies section of the Privacy Statement for more information regarding our use of cookies.

Sources of Consumer Health Data

We collect and use consumer health data for the purposes described in the Use of Personal Information section of the Privacy Statement and the Use of Personal Information section of the US State Privacy Notice. We primarily collect and use consumer health data as reasonably necessary to provide you with the Services you have requested or authorized. This may include delivering and operating the Services, personalizing certain product or service features, sending promotional and other communications related our business, ensuring the secure and reliable operation of the Services and the systems that support them, troubleshooting and improving the Services, and other essential business operations that support the provision of the Services, such as analyzing our performance, meeting our legal obligations, developing our workforce, and conducting research and development.

Sharing of Consumer Health Data

We may share each of the categories of consumer health data listed above for the purposes described in the Sharing of Personal Information section of the Privacy Statement and the Sharing of Personal Information section of the US State Privacy Notice. In particular, we may share consumer health data with your consent or as reasonably necessary to provide the Services you have requested or authorized, as described above.

For example, if you make a purchase, we will share information about the transaction as necessary to process the payment, including conducting fraud protection checks. We may also disclose data when we believe that doing so is necessary to comply with applicable law or respond to a valid legal process.

As necessary for the purposes described above, we may share consumer health data with the following categories of third parties:

• • Practitioners. We may share your data, including consumer health data, with your Practitioner for the purpose of providing our Services and fulfilling your requests.
  • Service providers. Vendors or agents working on our behalf may access and use consumer health data for the purposes described above. For example, companies we hire to provide customer service support or assist in protecting and securing our systems may need access to data to provide those functions. 
  • Financial institutions and payment processors. When you make a purchase or enter into a financial transaction, we will disclose payment and transactional data to banks and other entities as necessary for payment processing, fraud prevention, credit risk reduction, analytics, or other related payment processing services. 
  • Parties to a corporate transaction. We may disclose consumer health data as part of a corporate transaction or proceeding such as a merger, financing, acquisition, bankruptcy, dissolution, or a transfer, divestiture, or sale of all or a portion of our business or assets. 
  • Affiliates. We enable access to data across our subsidiaries, affiliates, and related companies, including Healthy Web Inc., Natural Partners, Inc., Emerson Ecologics LLC, and FSLV Holdings LLC. For example, where we share common data systems or where access helps us to provide our Services and operate our business. 
  • Government agencies. As described in our privacy statement, we disclose data to law enforcement or other government agencies when we believe doing so is necessary to comply with applicable law or respond to valid legal process.
  • Other third parties. In certain circumstances, it may be necessary to provide data to other third parties, for example, to comply with the law or to protect our rights or those of our customers. 

Your Rights and Choices

Applicable law provides certain rights with respect to consumer health data, including rights to access, delete, or withdraw consent relating to such data, subject to certain exceptions. You can request to exercise such rights using mechanisms described in the How to Submit Requests section of the US State Privacy Notice.

If your request to exercise a right in connection with consumer health data is denied, you may appeal that decision by contacting our privacy team at privacy@fullscript.com. If your appeal is unsuccessful, you can file a complaint with the relevant government body in your state, including:

• Connecticut State Attorney General at https://portal.ct.gov/AG/Common/Complaint-Form-Landing-page.
• Washington State Attorney General at www.atg.wa.gov/file-complaint.
• Nevada State Attorney General at https://ag.nv.gov/Complaints/File_Complaint/.

Please contact us directly with any questions or concerns you may have about your consumer health data privacy or this Consumer Health Data Privacy Notice. You can also call us at 1-866-807-3828 or email us at privacy@fullscript.com.

Changes to Our Privacy Notice

We reserve the right to amend this Privacy Notice from time to time. If we amend this Privacy Notice, we will post the updated Privacy Notice on the website and update the Privacy Notice’s effective date. By continuing to use our Services after such revisions are in effect, you are acknowledging that you have read and understand the revisions.