CCPA Privacy Notice

Scope of Disclosures

This California Privacy Notice (the “CA Disclosures”) supplements the information contained in our Privacy Policy and applies solely to individual residents of the State of California (“consumers” or “you”).

These CA Disclosures describe how we collect, use, disclose, and otherwise process personal information of individual residents of the State of California, either online or offline, within the scope of the California Consumer Privacy Act of 2018 (CCPA).

Unless otherwise expressly stated, all terms in these CA Disclosures have the same meaning as defined in our Privacy Notice or as otherwise defined in the CCPA.

Personal Information Disclosures

When we use the term “personal information” in these CA Disclosures, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

For the purposes of these Disclosures, personal information does not include:

• Publicly available information from government records.
• Deidentified, aggregated or anonymized information that is maintained in a form that is not capable of being associated with or linked to you. This information is deidentified pursuant to the deidentification methodology described in Section 164.514(b)(2) of Title 45 of the Code of Federal Regulations, commonly known as the HIPAA safe harbor method, and may then be sold or disclosed as permitted by law.
• Information excluded from the CCPA’s scope, such as:
  • Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
  • Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.
• Information relating to employees, job applicants, contractors and other personnel of Duet Pharmacy, which is not governed by this Disclosure.

Any terms defined in the CCPA have the same meaning when used in these CA Disclosures.

Collection and Use of Personal Information

We collect various categories of Personal Information in connection with our Services. Please review the Collection of your Personal Information section of the Privacy Policy to learn more about the personal information we collect.

In the last 12 months, we have collected the following categories of personal information:

Purposes for Collecting Personal Information

We collect, use, sell or disclose personal information about you for one or more of the purposes:

• To fulfill or meet the reason you provided the information. For example, if you share your name and contact information to ask a question about our products or services, we will use that personal information to respond to your inquiry.
• To communicate with you, including via email, text message, push notification and/or telephone calls.
• To operate, maintain, and provide to you the features and functionality of the Service.
• To help maintain the safety, security, and integrity of our Service, technology assets, and business.
• For testing, research, analysis, and product development, including to develop and improve our Service.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• To evaluate, negotiate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Company’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by Company about consumers is among the assets transferred or is otherwise relevant to the evaluation, negotiation or conduct of the transaction.

Disclosure of Personal Information

In the last 12 months, we have disclosed for a business purpose and sold the following categories of personal information:

We do not sell personal information and will not sell personal information unless we provide proper notice to consumers and, in the case of personal information collected prior to that notice, we obtain explicit consent for the sale of personal information relating to those individuals we previously interacted with.

Recipients of Personal Information

As described in our Privacy Policy, we share personal information with third parties for business purposes.

We disclose your personal information to the following categories of third parties:

• Our service providers. We engage a number of third-party service providers that perform business or operational services for us or on our behalf, such as website hosting, infrastructure provisioning, IT services, customer service, email delivery services, marketing and advertising services, and other similar services, subject to contractual terms restricting the collection, use and disclosure of your personal information for any other commercial purpose.
• Third parties at your request. We share your personal information with third parties with your consent or at your direction.
• Businesses as needed to provide Services. We may share personal information with third parties you engage with through our Service, or as needed to fulfil your request or transaction, including, for example, order fulfilment, payment processing, or delivery or shipping services. This may also include sharing your information with business partners such as pharmaceutical companies or patient assistance programs in certain limited circumstances so that you may seek any needed financial assistance for your out-of-pocket costs for our Services.
• Our affiliate companies. We may share your personal information with other companies owned or controlled by Duet Pharmacy, and other companies owned by or under common ownership as Duet Pharmacy, which also includes our subsidiaries (i.e., any organization we own or control) or our ultimate holding company (i.e., any organization that owns or controls us) and any subsidiaries it owns;
• Law enforcement and third parties pursuant to legal request. From time to time, we may disclose personal information as reasonably necessary to respond to law enforcement requests and as required by applicable law, court order, or governmental regulations;
• Third parties in the context of a corporate transaction. We may disclose personal information as reasonably necessary to evaluate, negotiate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Company’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by Company about consumers is among the assets transferred or is otherwise relevant to the evaluation, negotiation or conduct of the transaction.

Your California Privacy Rights

As a California resident, you may be able to exercise the following rights in relation to the Personal Information about you that we have collected (subject to certain limitations at law):

How to Exercise Your California Consumer Rights

To Exercise Your Right to Know or Right to Deletion

To exercise your Right to Know and/or your Right to Deletion, please submit a request by:

• Emailing ccpa@duetrrx.com with the subject line “California Rights Request,” or
• Calling 800-780-3584 x103

We will need to verify your identity before processing your request, which may require us to request additional personal information from you. We will only use personal information provided in connection with a Consumer Rights Request to review and comply with the request.

In certain circumstances, we may decline a request to exercise the rights described above, particularly where we are unable to verify your identity. If we are unable to comply with all or a portion of your request, we will explain the reasons for declining to comply with the request.

To Exercise Your Right to Opt Out of Personal Information Sales

We do not sell your personal information to any third parties for their own commercial purposes. Should those plans change, if you are a California resident who has used our services, you may submit a request to opt out of any potential future sales under California law by emailing us at ccpa@duetrx.com. Please note we will take reasonable steps to verify your identity and the authenticity of the request. Once verified, we will maintain your request in the event our practices change.

Updates to These CA Disclosures

We will update these CA Disclosures from time to time. When we make changes to these CA Disclosures, we will change the “Last Updated” date at the beginning of these Disclosures. All changes shall be effective from the date of publication unless otherwise provided in the notification.

Contact Us

If you have any questions or requests in connection with this Notice or other privacy-related matters, please send an email to ccpa@duetrx.com. Alternatively, inquiries may be addressed to:

Duet Pharmacy
c/o Alphascript
420 Industrial Road
San Carlos, CA 94070
Attn: Director of Compliance

Effective date: 10/18/2021