California Consumer Privacy Act

Last updated: June 10, 2024

Privacy Statement-California
This PRIVACY NOTICE IS APPLICABLE TO CALIFORNIA RESIDENTS (“consumers” or “you”) ONLY and supplements the information in Advanta Rx, Inc.’s general Privacy Statement. We adopt this notice to comply with the California Consumer Privacy Act of 2018 (“CCPA”), the California Privacy Rights Act ("CPRA"), and other California privacy laws. Any terms defined in the CCPA or CRPA have the same meaning when used in this notice.

Information We CollectWe collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (“Personal Information”).

‍Right to Know.
You have the right to know and see what data we have collected about you over the past 12 months, including:

• The categories of personal information we have collected about you;
• The categories of sources from which the personal information is collected;
• The business or commercial purpose for collecting your personal information;
• The categories of third parties with whom we have shared your personal information; and
• The specific pieces of personal information we have collected about you.

Right to Delete.

You have the right to request that we delete the personal information we have collected from you. There are a number of exceptions, however, that include, but are not limited to, when the information is necessary for us or a third party to do any of the following: Complete your transaction;

• Provide you a good or service;
• Perform a contract between us and you;
• Protect your security and prosecute those responsible for breaching it;
• Fix our system in the case of a bug;
• Protect the free speech rights of you or other users;
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et seq.);
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interests that adheres to all other applicable ethics and privacy laws;
• Comply with a legal obligation; or
• Make other internal and lawful uses of the information that are compatible with the context in which you provided it.

Do Not Sell My Personal Information.

You have the right to request that we do not sell your personal information. Please click here so that we can process your request in an efficient manner. Please note that we do not knowingly sell the personal information of minors under 16 years of age without legally-required affirmative authorization.

Authorized Agent.
You have the right to appoint another person or entity registered with the Secretary of State ("Authorized Agent") to make a request for you. If you appoint an Authorized Agent you must provide us with legal authorization indicating your consent to have an Authorized Agent act on your behalf. Examples of acceptable forms of legal authorization include, but are not limited to, a fully executed Power of Attorney or a notarized affidavit.

Other Rights.
You can request certain information about our disclosure of personal information to third parties for their own direct marketing purposes during the preceding calendar year. This request is free and may be made once a year. You also have the right not to be discriminated against for exercising any of the rights listed above.

Exercising Your California Privacy Rights.
To request access to or deletion of your personal information, or to exercise any other data rights under California law, please contact us or direct your authorized agent to contact us using the following methods:

• Email: You may write to us to exercise rights. Please include your full name, residential address, e-mail address, and phone number, along with why you are writing, so that we can verify and process your request in an efficient manner. Please email us at support@advantarx.com.
• Webform: You may fill out a Webform to exercise rights. Please include your full name, e-mail address, and phone number, along with why you are writing, so that we can verify and process your request in an efficient manner.
• Toll-Free Telephone Number: You may call us at 1-800-628-6337 to exercise rights. Please specify your full name, residential address, e-mail address, and phone number, along with why you are calling, so that we can verify and process your request in an efficient manner.

How We Verify Your Request.
When submitting a request via one of the approved methods you will be prompted to provide some information, including your full name, address, email address and phone number. This information is used to validate your request. Upon collection of your information, you will receive an email asking you to validate ownership of that email address by means of a one-time link or code. Without confirmation of ownership of your email address your request may not be processed. The link in the verification email is set to expire after a few days to protect your information should someone gain unauthorized access to your email account at a later stage.To protect your data from unauthorized access, we use the other data points you provide and match it with the information we may have previously obtained from you. If there is a mismatch in the data provided, we shall inform you of this and deny your request, at which point you may start a new claim with corrected information. If the information matches, we will proceed with the processing of your request. The level of data verification may vary depending on the type of request as allowed by the law.

Response Timing.
After submitting your request for access or deletion, you will receive a confirmation receipt within 10 business days that includes additional information. We aim to respond to a consumer request for access or deletion within 45 days of receiving that request. If we require more time, we will inform you of the reason and extension period in writing.

NOTE: We may revise this privacy notice from time to time as implementing regulations further develop and come into effect.

Categories of personal information we collect
We may collect the following categories of personal information from you or from third parties that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly with a particular consumer (i.e., you) or household ("personal information"). Specifically, we may have collected the following categories of personal information within the last twelve (12) months since this policy was last updated:

 

 

Please note personal information does not include:

• Publicly available information from government records.
• De-identified or aggregated consumer information.
• Information excluded from the CCPA's scope, like:
• health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
• personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.

Sharing personal information
We may disclose your personal information to a third party for a business purpose. When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.

In the preceding twelve (12) months, we may have disclosed the following categories of personal information for a business purpose:

 

 

We disclose your personal information for a business purpose to the following categories of third parties:

• Our affiliates.
• Service providers.
• Third parties to whom you or your agents authorize us to disclose your personal information in connection with products or services we provide to you.

Children's privacy
Our website is for adults, and we do not knowingly collect personal information from children under the age of 18.

Visiting our websites from outside The United States
This Privacy Policy is intended to cover collection of information on our website from residents of the United States. If you are visiting our website from outside the United States, please be aware that your information may be transferred to, stored and processed in the United States where our servers are located and our central database is operated. The data protection and other laws of the United States and other countries might not be as comprehensive as those in your country. Please be assured that we seek to take reasonable steps to ensure that your privacy is protected. By using our services, you understand that your information may be transferred to our facilities and those third parties with whom we share it as described in this privacy policy. By using our website and the services available on the site, which are provided exclusively from the United States, you hereby consent to the transfer of your information to the United States and its collection, storage, sharing and use as described in this Privacy Policy. You further agree that all transactions relating to the site and our services shall be deemed to have occurred in the United States.

General data protection REGULATION
For residents of the European Union, Advanta Rx, Inc. makes all efforts to comply with the General Data Protection Regulation, which took effect on May 25, 2018. EU residents have certain rights under data protection laws. They don't apply in all circumstances. If you wish to use any of them, we'll explain at that time if they are engaged or not. The right of data portability is only relevant from May 2018.

• The right to be informed about the processing of your personal information
• The right to have your personal information corrected if it is inaccurate and to have incomplete personal information completed
• The right to object to processing of your personal information
• The right to restrict processing of your personal information
• The right to have your personal information erased (the "right to be forgotten")
• The right to request access to your personal information and to obtain information about how we process it
• The right to move, copy or transfer your personal information ("data portability")
• Rights in relation to automated decision making which has a legal effect or otherwise significantly affects you

You have the right to complain to the Information Commissioner's Office which enforces data protection laws: https://ico.org.uk/. You can contact us using the details below.

Your right to object
You have the right to object to certain purposes for processing, in particular to data processed for direct marketing purposes and to data processed for certain reasons based on our legitimate interests. You can contact us by going to the How to Contact Us section located below.

Legal basis for processing your personal information
Advanta Rx, Inc. relies on the following legal bases to use your personal data:

Where it is needed to provide you with our products or services, such as:

a) Assessing an application for a product or service you hold with us, including consider whether or not to offer you the product, the price, the payment methods available and the conditions to attach

b) Managing products and services you hold with us, or an application for one

c) Updating your records, tracing your whereabouts to contact you about your account and doing this for recovering debt (where appropriate)

d) Sharing your personal information with business partners and services providers when you apply for a product to help manage your product

e) All stages and activities relevant to managing the product or service including inquiry, application, administration and management of accounts

f) For some of our profiling and other automated decision making to decide whether to offer you a product and/or service, particular payment method and the price or terms of this

Where it is in our legitimate interests to do so, such as:

a) Managing your products and services relating to that, updating your records, tracing your whereabouts to contact you about your account and doing this for recovering debt (where appropriate)

b) To perform and/or test the performance of, our products, services and internal processes

c) To follow guidance and recommended best practice of government and regulatory bodies

d) For management and audit of our business operations including accounting

e) To carry out monitoring and to keep records of our communications with you and our staff (see below)

f) To administer our good governance requirements and those of other members of our Group, such as internal reporting and compliance obligations or administration required for AGM processes

g) For market research and analysis and developing statistics

h) For direct marketing communications and related profiling to help us to offer you relevant products and services, including deciding whether or not to offer you certain products and service

i) Subject to the appropriate controls, to provide insight and analysis of our customers to business partners either as part of providing products or services, helping us improve products or services, or to assess or to improve the operating of our businesses

j) For some of our profiling and other automated decision making

k) Where we need to share your personal information with people or organizations in order to run our business or comply with any legal and/or regulatory obligations

To comply with our legal obligations

With your consent or explicit consent:

a) For some direct marketing communications

b) For some of our profiling and other automated decision making

c) For some of our processing of special categories of personal data such as about your health, if you are a vulnerable customer or some criminal records information

This Privacy Policy does not create rights enforceable by third parties or require disclosure of any personal information relating to users of our website.

Changes to this privacy policy
We will occasionally update this Privacy Policy to reflect changes in our practices and services. When we post changes to this Privacy Policy, we will revise the "last updated" date at the top of this Privacy Policy. Accordingly, you should periodically check the "last updated" date at the top of our Privacy Policy so that you can familiarize yourself with any changes.

No rights of third parties

How to contact us
If you have any questions about this Privacy Policy or our information-handling practices, or if you would like to request information about our disclosure of personal information to third parties for their direct marketing purposes, please contact us at support@advantarx.com

Advanta Rx, Inc.
30 N Gould St. Ste R
Sheridan, WY 82801
privacy@advantarx.com
1-800-628-6337