Supplemental U.S. Privacy Notices

Annex A – Supplemental U.S. Consumer Health Data Privacy Statement

This Supplemental Consumer Health Data Privacy Statement (“Consumer Health Data Privacy Statement”) supplements Phil’s Privacy Notice and applies only to personal information we process that is defined to be “consumer health data” subject to the Washington My Health My Data Act (“MHMDA”), Nevada Consumer Health Data Privacy Law (“NVCHDPL”), Connecticut Data Privacy Act (“CTDPA”), or other applicable state consumer health data privacy law.

Terms used in this Supplemental Consumer Health Data Privacy Statement defined in MHMDA or NVCHDPL will have the meaning set forth in those laws to the extent such laws are applicable.

Consumer Health Data We Collect

Under the MHMDA, “consumer health data” is defined as “personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status.”

Under NVCHDPL, “consumer health data” is defined as “personally identifiable information that is linked or reasonably capable of being linked to a consumer and that a regulated entity uses to identify the past, present or future health status of the consumer.”

Under the CTDPA, the definition of “sensitive data” includes data “revealing . . . mental or physical health condition or diagnosis.” As amended the definition of “sensitive data” was expanded to include “consumer health data” defined as any personal data “used to identify a consumer’s physical or mental health condition or diagnosis, including gender-affirming health data and reproductive sexual health data.”

Because consumer health data is defined very broadly, many of the categories of personal information we collect under our Privacy Notice may also be considered consumer health data.

Examples of consumer health data you may provide to us, or that we may otherwise collect, may include:

• Information that could identify your attempt to seek health care services or information, including services that allow you to assess, measure, improve, or learn about your or another person's health. For example, we collect your search queries on the Services, which may include queries or other information concerning medical conditions or other health-related topics.
• Information about your health-related conditions, symptoms, status, diagnoses, disease, testing, or treatments.
• Information about social, psychological, behavioral, and medical interventions.
• Information about use or purchase of prescribed medication(s).
• Information about measurements of bodily functions, vital signs, symptoms, or characteristics including photographs.
• Information about diagnoses or diagnostic testing, treatment, or medication.
• Information about surgeries or other health-related procedures.
• Reproductive or sexual health information.
• Information about gender-affirming care.
• Biometric information.
• Genetic data.
• Information about your access to healthcare, including precise location information that could reasonably indicate an attempt to acquire or receive health services or supplies.
• Information processed to associate or identify an individual with the data listed above derived or extrapolated from non-health information.
• Information related to the precise (geo)location information of a consumer used to indicate an attempt by a consumer to receive health care services or products.
• Other information that may be used to infer or derive data related to the above or other consumer health data.

Sources of Consumer Health Data

We collect consumer health data that you provide to us, consumer health data we collect automatically when you use the Services, and consumer health data from third-party sources, as described in our Privacy Notice and below.

Why We Collect and Use Consumer Health Data

We collect and use consumer health data for the purposes and in the manner described in the “How We Use Personal Information” section of our Privacy Notice.

Primarily, we collect and use consumer health data as reasonably necessary to provide you with the products or Services you have requested or authorized. This may include delivering and operating the products or Services and their features, personalization of certain product or Services features, ensuring the secure and reliable operation of the products or Services and the systems that support them, troubleshooting and improving the products and Services, and other essential business operations that support the provision of the products and Services (such as analyzing our performance and meeting our legal obligations).

We may also use consumer health data for other purposes for which we give you choices and/or obtain your consent as required by law.

Sharing of Consumer Health Data

We may share each of the categories of consumer health data described above for the purposes described above and in the “How We Use Personal Information” section of our Privacy Notice.

In particular, we may share consumer health data, with your consent or as reasonably necessary to complete any transaction or provide any product or Service you have requested or authorized, as described above.

We only share or disclose your consumer health data as needed to provide you with the products or services that you request, or with your explicit consent or authorization. We may share or disclose any or all the above categories of consumer health data to the following entities that may use the data only as permitted for the purposes set forth above, and within the bounds of our contracts with them:

• Business Collaborators (including pharmaceutical manufacturers, biotechnology companies, specialty pharmacies, and other healthcare industry partners with whom Phil collaborates to provide patient access, pharmacy, or therapy support services)
• Product co-promotion partners
• Product co-development partners
• Marketing and Advertising Agencies
• Social Media Companies and Platforms
• Service Providers (including those hosting or analyzing data on our behalf, those assisting with fraud prevention, those assisting in program administration, those assisting in incident management and reporting, those administering our call center and websites, and those who assist with our information technology and security programs)
• Emergency Personnel
• Authorized/legal representatives, family members, and caregivers
• Third parties (including those with whom Phil has joint marketing and similar arrangements, those who provide marketing and data analytics services, those who provide program enrollment or product fulfillment, payment, and authorization, other third parties as necessary to complete transactions, provide products/services, protect our rights or the rights of others, or where required by law)
• Parties to a corporate transaction
• Phil lawyers, auditors, and consultants
• Legal and regulatory bodies

In addition, we may share or disclose consumer health data as permitted or required by law, such as (i) to an acquiring organization if we are involved in a sale or a transfer of all or a part of our business, (ii) as needed to prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, (iii) in situations that may involve violations of our terms of use or other rules, (iv) to protect our rights and the rights and safety of others, (v) as needed to support external auditing, compliance and corporate governance functions, (vi) as needed to preserve the integrity or security of our systems, or (vii) to investigate, report, or prosecute those responsible for any action that is illegal under applicable state or Federal law.

How to Exercise Your Rights

State consumer health data privacy laws provide consumers with certain rights with respect to consumer health data. For example, under MHMDA, consumers have the right to: (i) confirm whether Phil is collecting, sharing, or selling consumer health data and to access such data; (ii) withdraw consent from Phil’s collection and sharing of consumer health data; and (iii) request Phil delete consumer health data. Under NVCHDPL, consumers have the right to: (i) confirm whether Phil is collecting, sharing or selling consumer health data; (ii) have Phil provide the consumer with a list of all third parties with whom Phil has shared consumer health data relating to the consumer or to whom Phil has sold such consumer health data; (iii) request that Phil cease collecting, sharing, or selling consumer health data relating to the consumer; and (iv) request that Phil delete consumer health data.

The rights afforded to consumers under applicable state consumer health data privacy laws are subject to certain exceptions.

Depending on the Services offered, you can access and make choices about your consumer health data through our product controls within the Phil website. You may also exercise your rights by following the instructions found under the “Your Privacy Choices and Rights” section of our Privacy Notice.

Phil will not discriminate against you for exercising any of your rights. We will make reasonable efforts to respond promptly to your requests in accordance with applicable laws. Please allow 45 days for a response. We may, after receiving your request, require additional information from you to authenticate your request and verify your identity. Please be aware that we may be unable to afford these rights to you under certain circumstances, such as if we are legally prevented from doing so.

If your request to exercise a right under a consumer health data law is denied, you may appeal that decision by contacting us at: privacy@usephil.com.

If your appeal is unsuccessful and your consumer health data is subject to MHMDA, you may raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.

Disclosure Regarding Third Party Collection of Consumer Health Data Under NVCHDPL

This Supplement applies to Nevada consumers for purposes of providing additional disclosures required by NVCHDPL. We collect, use, process, and share consumer health data for the purposes and manners described above in our Consumer Health Data Privacy Notice.

Third Party Collection of Consumer Health Data on Phil Websites.

We limit third party collection of consumer health data over time and across different Internet websites or online services when Nevada consumers use our websites or online services. We do this by disabling certain cookies or by ensuring that entities whose cookies, web beacons, pixels, and other online trackers we use on our websites and online services are our service providers or processors under applicable U.S. state privacy or consumer health data privacy laws. Nonetheless, please note that other third parties may still be able to process consumer health data from you over time and across different websites depending on your browser, browser settings and add-ons, and associated permissions you have set on your device. This collection of consumer health data by those third parties is unrelated to Phil processing of consumer health data from you, and we encourage you to review your browser settings and review those third parties’ privacy notices for more information about their consumer health data practices.

Review and Revision of Consumer Health Data.

If you would like to review and/or revise your consumer health data, you may submit a request to us via any of the methods listed in this Notice.

Updates to This Supplemental Consumer Health Data Privacy Statement

We may update this Supplemental Consumer Health Data Privacy Statement from time to time in our sole discretion. If we do, we’ll let you know by posting the updated Supplemental Consumer Health Data Privacy Statement on our website, and/or we may also send other communications.

Annex B – Consumer Health Data Authorization

We and our partners use and share cookies and other tracking technologies (“cookies”) to improve your experience, measure website performance, and personalize marketing to you.

Under certain state privacy laws, cookies are considered to include personal information and our sharing of cookies may be considered a “sale” or “sharing” for behavioral or “targeted” advertising. To opt out, click here.

By clicking "Accept” or otherwise opting into personalized marketing, you authorize Phil to “sell” or “share” your "consumer health data” in accordance with our Consumer Health Data Authorization:

This Consumer Health Data Privacy Authorization (“Authorization”) supplements Phil’s Privacy Notice and Supplemental Consumer Health Data Privacy Notice, and applies only to “consumer health data” subject to the Washington My Health My Data Act (“MHMDA”), Nevada Consumer Health Data Privacy Law (“NVCHDPL”), Connecticut Data Privacy Act (“CTDPA”), or other applicable state consumer health data privacy law (as applicable).

Terms used in this Authorization defined in MHMDA, NVCHDPL, CTDPA, or other applicable state consumer health data privacy law will have the meaning set forth in those laws to the extent such laws are applicable.

If you opt-in to “personalized marketing” through the www.phil.us cookie banner, you allow Phil to “sell” your consumer health data as described below:

• Specific consumer health data intended for “sale”: Consumer health data collected via cookies and similar technologies including but not limited to browsing activity on www.phil.us; however, consumer health data does not include PHI of current or potential Phil users.
• Purpose of the “sale” of consumer health data: To tailor and deliver personalized advertisements to you.
• How consumer health data purchasers gather and use the data: Consumer health data purchasers will gather the data via cookies and other tracking technologies when you visit the Phil website. These purchasers may use the data to assist us to deliver personalized advertisements to you and in accordance with their privacy policies linked below.
• Consumer health data purchasers’ contact information:
  • Google. For more information about Google’s use of your personal information, please visit Google’s Data Policy. To opt out of Google’s use of your information, please click here.
• Contact information for Phil: privacy@usephil.com

Please note:

• The provision of goods or services may not be conditioned upon you accepting the terms of this authorization.
• Purchasers may redisclose the consumer health data sold under this authorization and such data may no longer be protected by the MHMDA, NVCHDPL, CTDPA, or other applicable state consumer health data privacy law.
• You may revoke this authorization at any time through the Phil cookie banner. To do so, please be sure the box next to “Personalize Marketing” is unchecked and click “Save my preferences.” You may also click “Reject Optional Cookies” to decline our use of all cookies not required to operate our website.
• A revocation will not impact previously sold consumer health data. In addition, if you use different browsers or devices, you must indicate your choices on each browser/device used to access www.phil.us.

If you have any questions about how to revoke your authorization, please contact us at privacy@usephil.com.

This authorization will expire one (1) year after accepting it.

To learn more about how we use and share personal information including cookies, please review our Privacy Notice.

Annex C – Supplemental U.S. Privacy Notice

This Supplemental U.S. Privacy Notice supplements our Privacy Notice and only applies to our processing of Personal Information from U.S. consumers residing in a state with a comprehensive privacy law.

Notice at Collection

At or before the time of collection, U.S. consumers residing in a state with a comprehensive privacy law have a right to receive notice of our privacy practices. Such consumers can find this information below.

• Personal Information Collected. See the section of this Supplemental U.S. Privacy Notice titled “Overview of Personal Information Collected, Disclosed, Sold and/or Shared” for a list of personal information which may be collected. If we have previously collected personal information in the past 12 months, we may collect that personal information from you.
• Uses of Personal Information. See the section of this Supplemental U.S. Privacy Notice titled “Uses of Personal Information” for a list of the purposes for which we use personal information.
• Is Personal Information “Sold” or “Shared” for “Cross-Context Behavioral Advertising”? Yes. See the section of this Supplemental U.S. Privacy Notice titled “Overview of Personal Information Collected, Disclosed, Sold and/or Shared” for more details. If we have previously “sold” personal information or “shared” personal information for “cross-context behavioral advertising” in the past 12 months, we may “sell” or “share” that personal information if collected from you. See the section of this Supplemental U.S. Privacy Notice titled “Right to Opt Out of ‘Sales’ of Personal Information and/or ‘Sharing’ for ‘Cross-Context Behavioral Advertising’” for instructions on how to opt-out of these activities.
• Personal Information Retention. To determine the appropriate retention period for personal information, we may consider applicable legal requirements, the amount, nature, and sensitivity of the personal information, certain risk factors, the purposes for which we process your personal information, and whether we can achieve those purposes through other means.
• Additional Information. For more information on our privacy practices, please review this Supplemental U.S. Privacy Notice and our Privacy Notice. Importantly, the section of our Privacy Notice titled “Your Privacy Choices and Rights” includes important details about how you can exercise some of the rights which you have under U.S. privacy laws.

Categories of Sources From Which Personal Information Is Collected

We collect personal information that you provide to us, personal information we collect automatically when you use the Sites, and personal information from third-party sources.

Overview of Personal Information Collected, Disclosed, Sold, and/or Shared

U.S. consumers residing in a state with a comprehensive privacy law are provided with the right to know what categories of personal information Phil has collected about them, whether Phil disclosed that personal information for a business purpose (e.g., to a service provider), whether Phil “sold” that personal information, and whether Phil “shared” that personal information for “cross-context behavioral advertising” in the preceding twelve months. U.S. consumers residing in a state with a comprehensive privacy law can find this information below:

Uses of Personal Information

We may use and disclose the personal information that we collect for the following business and commercial purposes:

• Providing the Sites as further described in our Privacy Notice;
• Processing for administrative purposes as further described in our Privacy Notice;
• Processing to improve the Sites and develop new products and services, as further described in our Privacy Notice;
• Processing to operate our business, as further described in our Privacy Notice;
• Processing for marketing purposes as further described in our Privacy Notice;
• Processing with your consent or direction as further described in our Privacy Notice;
• Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards;
• Helping to ensure security and integrity to the extent the use of personal information is reasonably necessary and proportionate for these purposes;
• Debugging to identify and repair errors that impair existing intended functionality;
• Short-term, transient use, including, but not limited to, non-personalized advertising shown as part of your current interaction with Phil;
• Maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services;
• Providing advertising and marketing services;
• Undertaking internal research for technological development and demonstration;
• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by Phil, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by Phil.

Right to Opt Out of “Sales” of Personal Information and/or “Sharing” for “Cross-Context Behavioral Advertising”

We don’t “sell” personal information as most consumers typically define the term “sell” or “sold.” However, our Sites use advertising and analytics tools provided by third parties (such as HubSpot) that may constitute a “sale” or “sharing” of personal information under certain state laws. We “share” your personal information for “cross-contextual behavioral advertising” to provide you with “cross-context behavioral advertising” about Phil’s products and services.

U.S. consumers residing in a state with a comprehensive privacy law may have the right to opt out of the “sharing” of personal information for “cross-context behavioral advertising.” To exercise these rights, please click HERE and follow the instructions on that page or by emailing us at: privacy@usephil.com. We will process such requests in accordance with applicable laws.

Disclosure Regarding Individuals Under the Age of 18

Phil does not have actual knowledge of any “sale” of personal information of minors under 18 years of age. Phil does not have actual knowledge of any “sharing” of personal information of minors under 18 years of age for “cross-context behavioral advertising.”

Disclosure Regarding Sensitive Personal Information

Phil only uses and discloses sensitive personal information for the following purposes:

• To perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services.
• To prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, and or confidentiality of stored or transmitted personal information.
• To resist malicious, deceptive, fraudulent, or illegal actions directed at Phil and to prosecute those responsible for those actions.
• To ensure the physical safety of natural persons.
• For short-term, transient use.
• Maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services.
• To verify or maintain the quality or safety of a product, service, or device that is owned, manufactured, manufactured for, or controlled by Phil, and to improve, upgrade, or enhance the service or device that is owned, manufactured by, manufactured for, or controlled by Phil.
• For purposes that do not infer characteristics about individuals.

Non-Discrimination

California residents have the right not to receive discriminatory treatment by us for the exercise of their rights conferred by the CCPA.

Notice of Financial Incentive

This Notice of Financial Incentives aims to inform you about any programs, benefits, and other financial incentive offerings, including price or service differences (collectively, “Incentive Offerings”), that we may provide in connection with the collection of your personal information so that you may make an informed decision on whether to participate in our Incentive Offerings. Such Incentive Offerings may be deemed “financial incentives” under the CCPA.

The material aspects of any Incentive Offering, along with the personal information collected in connection with an Incentive Offering, will be described at the time you are presented with the Incentive Offering.

Examples of our Incentive Offerings may include:

• One-Time Discount. We may offer you a discount on your first order if you provide us your email address and agree to receive marketing emails in exchange for a one-time discount.
• Refer-a-Friend Program. We may offer a discount on your future purchase when you provide your personal information along with your friends' or colleagues' personal information, and they make a purchase. The referred party may also receive a reward in the form of a discount on the first order and/or a free service for making a purchase through your referral.

You can opt-in to an Incentive Offering by following the instructions that accompany the presentation of the Incentive Offering. If you subsequently wish to withdraw from the Incentive Offering, you may request such withdrawal by contacting us as set forth in “Contact Us” above.

Each Incentive Offering may be based upon our reasonable and good-faith determination of the estimated value of such offer to our business, taking into consideration the value of the offer itself and the anticipated revenue generation that may be realized.