Privacy Policy

OneroRx
POL-PRIV-0002 Website Privacy Policy
Public-Facing Privacy Disclosure
Last Updated: TBD

OneroRx and its affiliated entities operate pharmacies and home medical equipment (HME) services across multiple states. We are committed to protecting the privacy of our patients, customers, website visitors, and all others whose information we hold. This Privacy Policy describes how we collect, use, share, and protect personal information through our website at www.onerorx.com and any other websites or digital services we operate.

As a HIPAA Covered Entity, OneroRx is subject to specific federal requirements governing the use and disclosure of Protected Health Information (PHI). Those requirements are described in our Notice of Privacy Practices (NPP), which is incorporated into this Policy by reference and is available at all of our locations and on our website. Where this Policy and our NPP address the same subject, the NPP governs with respect to PHI.

This Policy covers personal information collected through our website and digital services. It applies to website visitors, prospective patients, job applicants, and others who interact with us online. Patients receiving care from our pharmacies or HME services should also refer to our NPP for information specific to their health records.

1. Who This Policy Applies To
This Policy applies to individuals who:
• Visit our website at www.onerorx.com or any other website we operate
• Contact us by phone, email, or through online forms
• Apply for employment with OneroRx through our website
• Are patients or customers of OneroRx pharmacies or HME services
• Interact with us through social media platforms

If you use our website or services on behalf of an organization, references to you include both the organization and the individuals within it whose information we may collect.

2. Information We Collect
2.1 Information You Provide
When you interact with us, you may provide:
• Name, date of birth, address, and contact information
• Health insurance information and prescription benefit details
• Prescription information, medical history, and diagnosis information as needed to provide pharmacy or HME services
• Payment information including credit card or bank account details for billing purposes
• Government-issued identifiers where required by law or for identity verification
• Messages, feedback, or inquiries submitted through contact forms or email
• Employment application information including work history, education, and references

2.2 Information Collected Automatically
When you visit our website, we and our service providers may automatically collect:
• IP address and general geographic location
• Browser type, device type, and operating system
• Pages visited, links clicked, and time spent on each page
• Referring website or search terms used to find our site
• Date and time of your visit
• Device identifiers and mobile carrier information where applicable

We use cookies and similar technologies to collect this information. See Section 9 of this Policy for details on our cookie practices and your choices.

2.3 Information from Third Parties
We may receive information about you from third-party sources including prescribers, other healthcare providers, insurance companies, pharmacy benefit managers, background check providers for employment purposes, and public databases. We may also receive information from social media platforms if you interact with our content or connect your social media account to our services.

2.4 Protected Health Information
If you are a patient, we collect and maintain PHI in connection with providing pharmacy and HME services. PHI is governed by HIPAA and our Notice of Privacy Practices rather than by this Policy. See our NPP for a full description of how we use and protect your PHI.

3. How We Use Your Information
3.1 To Provide and Manage Services
• Fill and manage your prescriptions and home medical equipment services
• Coordinate with your prescriber, insurer, or other members of your care team
• Process billing and insurance claims
• Respond to your inquiries and provide customer service
• Process employment applications
• Operate and improve our website and digital services

3.2 Legal and Regulatory Compliance
• Comply with applicable law including HIPAA, DEA controlled substance reporting, and state pharmacy board requirements
• Respond to lawful court orders, subpoenas, or government investigations
• Comply with public health reporting requirements
• Detect and prevent fraud, security incidents, and other harmful activity

3.3 Marketing and Communications
We may contact you about services, refill reminders, and health programs relevant to you. We may also use your information for our own marketing purposes including notifying you of promotions, offers, and events. You may opt out of marketing communications at any time as described in Section 7 of this Policy. Opting out of marketing will not affect communications necessary for your care.

3.4 Analytics and Improvement
We use automatically collected information and analytics tools to understand how visitors use our website, improve our services, measure the performance of our digital communications, and serve relevant content. This may involve sharing data with third-party analytics providers such as Google Analytics. See Section 9 for more information.

3.5 Other Purposes
We may also use your information for other purposes disclosed at the time of collection, for purposes compatible with the context in which it was collected, or for purposes for which we have obtained your consent.

4. How We Share Your Information
OneroRx does not sell your personal information. We share your information only in the following circumstances:

4.1 Healthcare Operations
• With your healthcare providers and care team for treatment purposes
• With your health insurer or pharmacy benefit manager to process claims and prior authorizations
• With other covered entities involved in your care as permitted by HIPAA

4.2 Service Providers
We share information with third-party vendors and service providers who perform functions on our behalf, including technology vendors, billing services, shipping providers, analytics providers, and employment background check providers. These providers are contractually required to protect your information and use it only for the purposes for which it was provided. Vendors who handle PHI are required to execute a Business Associate Agreement with OneroRx.

4.3 Legal Requirements
• With government agencies and regulators as required by law
• In response to valid court orders, subpoenas, or legal process
• To protect the rights, property, health, or safety of OneroRx, our patients, or the public
• In connection with fraud prevention or security investigations

4.4 Business Transactions
If OneroRx is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any material change in ownership or use of your personal information and will provide you with choices as required by applicable law.

4.5 With Your Authorization
We will share your information for any other purpose with your written authorization. You may revoke that authorization at any time.

4.6 Aggregated and De-Identified Information
We may share aggregated or de-identified information that cannot reasonably be used to identify you with third parties for research, analytics, or other purposes.

5. Your Rights
5.1 HIPAA Patient Rights
If you are a patient, you have the following rights under HIPAA with respect to your Protected Health Information. See our Notice of Privacy Practices for full details on how to exercise these rights:
• Right to access and receive a copy of your health records
• Right to request corrections to inaccurate or incomplete records
• Right to request restrictions on how we use or share your information
• Right to request confidential communications
• Right to an accounting of certain disclosures we have made of your information
• Right to receive a copy of our Notice of Privacy Practices
• Right to be notified of a breach of your unsecured PHI

5.2 Consumer Privacy Rights
Depending on the state where you reside, you may have additional rights regarding your personal information collected through our website and digital services. These rights are separate from your HIPAA patient rights and apply to personal information that is not PHI, as well as to website visitors who are not patients. Rights available in certain states include:

• The right to know what personal information we have collected about you, the categories of sources, our purposes for collecting it, and the categories of third parties with whom we share it
• The right to access and receive a copy of the specific personal information we have collected about you
• The right to request deletion of your personal information, subject to certain legal exceptions
• The right to correct inaccurate personal information we maintain about you
• The right to opt out of the sale of your personal information (we do not sell personal information)
• The right to opt out of sharing your personal information for cross-context behavioral advertising
• The right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects
• The right to data portability, meaning the right to receive your personal information in a portable format
• The right to limit the use of sensitive personal information beyond what is necessary to provide services
• The right to non-discrimination for exercising your privacy rights

The specific rights available to you and the scope of each right depend on your state of residence. See Section 11 of this Policy for state-specific information. To submit a request to exercise your rights, use the contact information in Section 10.

5.3 How to Submit a Request
To exercise any of your rights, contact our Privacy Officer using the information in Section 10. We will take steps to verify your identity before processing your request and will respond within the timeframe required by applicable law. We may require you to provide your name, date of birth, and contact information to verify your identity. You may designate an authorized agent to submit a request on your behalf by providing written authorization for the agent to act on your behalf.

5.4 Non-Discrimination
We will not discriminate against you for exercising your privacy rights. We will not deny you goods or services, charge you different prices, provide a different level of service, or suggest that you will receive a different level of service because you exercised a privacy right.

6. How We Protect Your Information
• Encryption of electronic health information and sensitive personal data in storage and in transit
• Access controls limiting information access to employees and service providers with a legitimate need
• Employee training on privacy and security requirements
• Physical security at all locations
• Regular security assessments and risk management
• Vendor management and contractual data protection requirements

No method of electronic transmission or storage is completely secure. If you have reason to believe your information has been compromised, please contact us immediately using the information in Section 10.

7. Your Choices and Opt-Out Options
7.1 Marketing Communications
You may opt out of marketing communications at any time by following the unsubscribe instructions in any marketing email we send, by contacting us at privacy@onerorx.com, or by calling us at [Phone Number]. We will process your opt-out promptly. Opting out of marketing will not affect transactional or care-related communications such as prescription refill reminders or equipment service notices, which are necessary for your care.

7.2 Cookies and Tracking Technologies
You may manage cookie preferences through your browser settings. Most browsers allow you to refuse cookies, delete existing cookies, or be notified when cookies are set. Disabling cookies may affect the functionality of our website. See Section 9 for more details on our cookie practices.

7.3 Opt-Out Preference Signals
Some browsers and browser extensions support opt-out preference signals such as the Global Privacy Control (GPC), which can indicate your preference to opt out of certain types of data processing including data sharing for cross-context behavioral advertising. Where required by applicable law, we will make reasonable efforts to honor these signals.

7.4 Do Not Track
Some browsers offer a Do Not Track feature that sends a signal to websites requesting that your browsing not be tracked. Because no uniform technical standard for Do Not Track has been established, our website does not currently respond to Do Not Track signals. We will update this Policy if our approach changes.

8. Data Retention
We retain personal information for as long as necessary to fulfill the purposes for which it was collected, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. Specific retention periods vary by information type:

• Patient health records and PHI: retained in accordance with HIPAA requirements (minimum six years) and applicable state pharmacy board regulations, which may require longer retention
• DEA controlled substance records: minimum two years per DEA requirements, or longer as required by state law
• Employment records: seven years following separation from employment
• General business and transactional records: seven years
• Website analytics data: retained as configured in applicable analytics platforms, typically 26 months
• Marketing communication records: retained for the duration of the business relationship plus three years

When retention periods expire, information is securely destroyed in accordance with our Data Retention and Disposal Policy.

9. Cookies and Tracking Technologies
9.1 What We Use
Our website uses cookies and similar tracking technologies including web beacons, pixel tags, and scripts. These technologies help us operate our website, understand how visitors use it, and deliver relevant content and advertising. We may use the following categories of cookies:

Strictly Necessary Cookies
These cookies are required for the website to function and cannot be disabled. They enable core features such as page navigation and access to secure areas. No consent is required for these cookies.

Preference Cookies
These cookies remember your preferences and settings such as language, region, and accessibility options to improve your experience.

Analytics and Statistics Cookies
These cookies help us understand how visitors interact with our website by collecting and reporting information anonymously. We may use services such as Google Analytics. Information collected by these tools may be combined with information from other sources by the analytics provider. You can opt out of Google Analytics by installing the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout.

Marketing and Advertising Cookies
These cookies may be used to track visitors across websites and to serve relevant advertising. They may be set by us or by third-party advertising partners. We will obtain your consent before placing marketing cookies where required by applicable law.

9.2 Your Cookie Choices
You can manage cookie preferences through your browser settings. Most browsers allow you to view, delete, and block cookies. You can also use tools such as the Digital Advertising Alliance opt-out at optout.aboutads.info or the Network Advertising Initiative opt-out at optout.networkadvertising.org to limit interest-based advertising. Note that opting out of advertising cookies does not mean you will not see ads; it means the ads you see may be less relevant to you.

9.3 Third-Party Technologies
We may use third-party analytics and advertising services that place their own cookies or tracking technologies on our website. These third parties operate under their own privacy policies. We encourage you to review those policies. We are not responsible for the data practices of third parties.

10. Third-Party Links
Our website may contain links to third-party websites, social media platforms, or other online services. These links are provided for your convenience and do not represent an endorsement or affiliation. We do not control the privacy practices of third-party sites and are not responsible for their content, privacy policies, or data handling. We encourage you to review the privacy policies of any third-party site you visit before providing personal information.

11. Contact Us
If you have questions about this Policy, wish to exercise your rights, or need to report a privacy concern, please contact our Privacy Officer:

OneroRx
Attention: Privacy Officer and Compliance
[Mailing Address]
[City, State, ZIP]
Phone: [Phone Number]
Email: privacy@onerorx.com
Website: www.onerorx.com

You also have the right to file a complaint with the U.S. Department of Health and Human Services, Office for Civil Rights, regarding our handling of your PHI:
• Website: www.hhs.gov/ocr
• Phone: 1-800-368-1019
• TDD: 1-800-537-7697
• Address: 200 Independence Avenue S.W., Washington D.C. 20201

12. Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will post the updated Policy on our website with a revised effective date and, where required by law, provide additional notice. We encourage you to review this Policy periodically. Your continued use of our website or services after an update constitutes acceptance of the revised Policy.

13. State-Specific Privacy Rights
The following sections describe additional privacy rights available to residents of specific states. These rights apply to personal information we collect through our website and services and are separate from your HIPAA patient rights. To exercise any of these rights, use the contact information in Section 11.

13.1 California
If you are a California resident, the following provisions apply under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) and the California Confidentiality of Medical Information Act (CMIA).

Categories of Personal Information Collected
In the past 12 months we have collected the following categories of California personal information: identifiers such as name, address, email address, and IP address; personal information under California Civil Code Section 1798.80 such as name, address, and telephone number; health and medical information; commercial information including products and services purchased; internet or network activity information including browsing history on our website; and geolocation data at the general level.

Your California Rights
• Right to know the categories and specific pieces of personal information we have collected about you
• Right to know the categories of sources, our business purposes, and the categories of third parties with whom we share information
• Right to request deletion of your personal information, subject to legal exceptions
• Right to correct inaccurate personal information
• Right to opt out of the sale or sharing of your personal information (we do not sell personal information)
• Right to limit use of sensitive personal information to what is necessary to provide services
• Right to non-discrimination for exercising these rights

Do Not Sell or Share
We do not sell personal information and have not done so in the past 12 months. We do not share personal information for cross-context behavioral advertising purposes as defined by CCPA.

Sensitive Personal Information
We collect certain sensitive personal information including health information, government identifiers, and financial account information in connection with providing our services. We use this information only as necessary to provide services and as otherwise permitted by law.

Authorized Agents
California residents may designate an authorized agent to submit requests on their behalf. We will require written proof of the agent's authorization and may require you to verify your identity directly with us before processing the request.

Financial Incentives
We do not offer financial incentives in exchange for the retention or sale of personal information.

Medical information protected under HIPAA and the California Confidentiality of Medical Information Act (CMIA) is subject to those laws rather than CCPA. See our Notice of Privacy Practices for details on your rights regarding PHI.

13.2 Colorado
If you are a Colorado resident, you have rights under the Colorado Privacy Act (CPA). You have the right to access your personal data, correct inaccurate personal data, request deletion of personal data, obtain a portable copy of personal data, and opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. To exercise these rights, contact us using the information in Section 11.

13.3 Connecticut
If you are a Connecticut resident, you have rights under the Connecticut Data Privacy Act (CTDPA). You have the right to access, correct, and delete your personal data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. To exercise these rights, contact us using the information in Section 11.

13.4 Florida
If you are a Florida resident, you have certain rights under the Florida Digital Bill of Rights for personal data collected through our website and services that are not covered by HIPAA. You have the right to access, correct, and delete your personal data, obtain a portable copy, and opt out of targeted advertising and the sale of personal data. To exercise these rights, contact us using the information in Section 11.

13.5 Illinois
If you are an Illinois resident, your mental health records, substance use disorder records, HIV-related information, and genetic information are subject to heightened protections under Illinois state law as described in our Notice of Privacy Practices. For personal information collected through our website that is not covered by HIPAA, you may contact us to request access, correction, or deletion of your personal data.

13.6 Indiana
If you are an Indiana resident, you have rights under the Indiana Consumer Data Protection Act (INCDPA). You have the right to access, correct, and delete your personal data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. To exercise these rights, contact us using the information in Section 11.

13.7 Iowa
If you are an Iowa resident, you have rights under the Iowa Consumer Data Protection Act (ICDPA). You have the right to access and delete your personal data, obtain a portable copy, and opt out of the sale of personal data and targeted advertising. To exercise these rights, contact us using the information in Section 11.

13.8 Michigan
If you are a Michigan resident, your mental health records, substance use disorder records, and HIV-related information are subject to heightened protections under Michigan state law as described in our Notice of Privacy Practices. For personal information collected through our website that is not covered by HIPAA, you may contact us to request access, correction, or deletion of your personal data.

13.9 Minnesota
If you are a Minnesota resident, you have rights under the Minnesota Consumer Data Privacy Act (MCDPA) and the Minnesota Health Records Act (MHRA). Your health records, mental health records, and other health information are subject to the strong protections of the MHRA as described in our Notice of Privacy Practices. For personal information collected through our website that is not covered by HIPAA or the MHRA, you have the right to access, correct, and delete your personal data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling. To exercise these rights, contact us using the information in Section 11.

13.10 Missouri
If you are a Missouri resident, your mental health records and HIV-related information are subject to heightened protections under Missouri state law as described in our Notice of Privacy Practices. For personal information collected through our website that is not covered by HIPAA, you may contact us to request access, correction, or deletion of your personal data.

13.11 Montana
If you are a Montana resident, you have rights under the Montana Consumer Data Privacy Act (MTCDPA). You have the right to access, correct, and delete your personal data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling. To exercise these rights, contact us using the information in Section 11.

13.12 Nebraska
If you are a Nebraska resident, you have rights under the Nebraska Data Privacy Act (NDPA). You have the right to access, correct, and delete your personal data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling. To exercise these rights, contact us using the information in Section 11.

13.13 Nevada
If you are a Nevada resident, you have rights under the Nevada Privacy of Information Collected on the Internet from Consumers Act and the Nevada Consumer Health Data Privacy Law. We do not sell personal information as defined under Nevada law. For consumer health data rights under Nevada law, you have the right to access, correct, and delete your consumer health data. To exercise these rights, contact us at privacy@onerorx.com.

13.14 New Hampshire
If you are a New Hampshire resident, you have rights under the New Hampshire Privacy Act (NHPA). You have the right to access, correct, and delete your personal data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling. To exercise these rights, contact us using the information in Section 11.

13.15 New Jersey
If you are a New Jersey resident, you have rights under the New Jersey Data Privacy Act (NJDPA). You have the right to access, correct, and delete your personal data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling. To exercise these rights, contact us using the information in Section 11.

13.16 New York
If you are a New York resident, your mental health records and HIV-related information are subject to heightened protections under New York Mental Hygiene Law and New York Public Health Law as described in our Notice of Privacy Practices. For personal information collected through our website that is not covered by HIPAA, you may contact us to request access, correction, or deletion of your personal data. New York's comprehensive privacy legislation continues to develop and this section will be updated as applicable laws take effect.

13.17 Oregon
If you are an Oregon resident, you have rights under the Oregon Consumer Privacy Act (OCPA). You have the right to access, correct, and delete your personal data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling. To exercise these rights, contact us using the information in Section 11.

13.18 Rhode Island
If you are a Rhode Island resident, you have rights under the Rhode Island Data Transparency and Privacy Protection Act. You have the right to access, correct, and delete your personal data, obtain a portable copy, and opt out of targeted advertising and the sale of personal data. To exercise these rights, contact us using the information in Section 11.

13.19 Texas
If you are a Texas resident, you have rights under the Texas Data Privacy and Security Act (TDPSA). You have the right to access, correct, and delete your personal data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling. Your mental health records and HIV-related information are subject to heightened protections under Texas state law as described in our Notice of Privacy Practices. To exercise these rights, contact us using the information in Section 11.

13.20 Vermont
If you are a Vermont resident, you have rights under Vermont privacy statutes. You may contact us to request access, correction, or deletion of your personal data collected through our website. To exercise these rights, contact us using the information in Section 11.

13.21 Virginia
If you are a Virginia resident, you have rights under the Virginia Consumer Data Protection Act (VCDPA). You have the right to access, correct, and delete your personal data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling. To exercise these rights, contact us using the information in Section 11.

13.22 Washington
If you are a Washington resident, you have rights under the Washington My Health My Data Act (MHMDA) and the Washington Consumer Protection Act. The MHMDA provides broad protections for consumer health data and applies to health data we collect through our website and services. You have the right to access your consumer health data, withdraw consent to collection or sharing, and request deletion of your consumer health data. Your mental health records, HIV-related information, substance use disorder records, and genetic information are also subject to heightened protections under Washington state law as described in our Notice of Privacy Practices. To exercise these rights, contact us using the information in Section 11.

13.23 Wisconsin
If you are a Wisconsin resident, your mental health records, substance use disorder records, HIV-related information, and genetic information are subject to the strong protections of Wisconsin Statutes Chapter 51 and Section 252.15 as described in our Notice of Privacy Practices. For personal information collected through our website that is not covered by HIPAA or Wisconsin health privacy statutes, you may contact us to request access, correction, or deletion of your personal data. To exercise these rights, contact us using the information in Section 11.

14. European Union and International Visitors
Our website and services are primarily directed to residents of the United States. If you are located in the European Union, European Economic Area, or United Kingdom and interact with our website or receive services from us, the following additional information applies.

14.1 Legal Basis for Processing
Where GDPR applies, we process personal data on the following legal bases: performance of a contract to which you are a party; compliance with a legal obligation; protection of vital interests; pursuit of our legitimate business interests where not overridden by your rights; and with your consent where specifically required.

14.2 Your GDPR Rights
• Right of access to your personal data
• Right to rectification of inaccurate personal data
• Right to erasure in certain circumstances
• Right to restriction of processing
• Right to data portability
• Right to object to processing based on legitimate interests or for direct marketing
• Right to withdraw consent at any time where processing is based on consent
• Right to lodge a complaint with a supervisory authority

To exercise these rights, contact us using the information in Section 11. You may also contact the data protection authority in your member state. More information is available at ec.europa.eu/justice/data-protection.

14.3 International Transfers
OneroRx is headquartered in the United States. If you are located outside the United States, your personal information may be transferred to and processed in the United States, where data protection laws may differ from those in your country. Where required, we implement appropriate safeguards for international transfers including standard contractual clauses approved by the European Commission. A copy of applicable transfer mechanisms is available upon request.

15. Children's Privacy
OneroRx provides pharmacy and HME services to patients of all ages including minors. Health information for minors is handled in accordance with HIPAA and applicable state laws governing minor consent and parental access rights, which vary by state and by the type of service.

Our website is not directed to children under 13 and we do not knowingly collect personal information from children under 13 through our website outside of a healthcare context. If you believe a child under 13 has submitted personal information through our website without appropriate consent, please contact us at privacy@onerorx.com and we will take appropriate steps to remove that information.

This Policy is effective as of TBD. Questions about this Policy should be directed to our Privacy Officer at privacy@onerorx.com.