Capsule Privacy Policy

1. What does this Privacy Policy cover?

This Privacy Policy covers how we treat your “personal information”, which is identifiable information about you. This includes information referred to as “personally identifiable information”, “personal data”, or “personal information” under data privacy laws, rules, and regulations that protect you and that apply to Capsule.

When we say, “you” we mean users of Capsule's Services.

This Privacy Policy doesn't cover the practices of third parties that we don't own, control, or manage including any third-party websites or services. While we try to only work with third parties that share our respect for your privacy, we don't take responsibility for their policies, so we encourage you to carefully review the privacy policies of the third-party websites or services that you access.

2. What categories of personal information do we collect?

We may collect the following categories of personal information from you when you visit our website before becoming a customer of Capsule by submitting information regarding a prescription or if you only purchase non-prescription products from Capsule:

• Identifiers (such as name, personal email address, personal zip code, and driver's license, or other forms of identification);
• Commercial information (such as transaction history);
• Internet or other network or device activity (such as IP address or usage data);
• The general location of the device that you are using to access the Services;
• Legally protected classifications (such as gender);
• Voice recordings made during calls with our pharmacy experience team; and
• Other information that identifies or can be reasonably associated with you that you have voluntarily provided to us.

3. How, when, and why do we collect personal information about you?

We may collect personal information from you from the following sources:

From or on behalf of You. We collect personal information about you when you visit our website, communicate with us, or otherwise make use of or interact with any of the Services. If a family member or another authorized representative is using the Services on your behalf, we may also collect information about you through them.

From Your Use of the Services or Interaction with Capsule. When you visit our website, we may gather personal information about your device's general location, either from your IP address or from your use of the Services, or from location-based personal information that you elect to provide through your use of a mobile or other Internet-enabled device. We may also receive personal information through Cookies (as defined below).

From Our Vendors and Business Partners. We may receive personal information about you from our vendors or business partners who assist us with, for example, marketing or promotional services, advertisements, communications, or other personal information gathering. We may use analytics providers to collect and analyze personal information about how you interact and engage with the Services.

4. How do we process your personal information?

We may use, store, summarize, disclose, or otherwise handle your personal information we collect about you in the following ways:

To provide you with the Services you've requested and to personalize your experience including:

• To process your orders for non-prescription products including any applicable discounts (note that prescription medication orders are covered by the HIPAA Notice);
• To respond to your service requests;
• To respond to communications that we receive from you, to contact you when necessary or requested, and to send you personal information about Capsule or the Services; and
• To provide you with information that we believe will be of value to you in protecting and managing your health, which may be customized based on orders you've filled at Capsule or other information that you've provided us.

For any legitimate business purpose including:

• To improve the Services, including, for example, testing, internal analytics, and product development;
• To market our Services;
• To create aggregated and de-identified data; and
• To provide any legitimate business service or product.

For legal matters including:

• To fulfill our legal obligations under applicable law, regulation, court order or other legal process;
• To protect the rights, property, security or safety of you, Capsule, users of the Services, or the public, including detecting and protecting against error, fraud and other unauthorized or illegal activities; and
• To resolve any disputes and enforce our Terms and any other agreements or matters with you or others.

To consider, prepare for or carry out a corporate transaction including:

• An acquisition of Capsule, or one or more of our business units or of some or all of our assets; and
• In the context of some other business acquisition transaction or other transaction in which a third party combines or collaborates with us or one or more of our business units.

5. Why and how do we disclose your personal information we collect to third parties?

We disclose your personal information if you've given us permission to do so or as listed in this Privacy Policy.

We do not sell your personal information to any third party for monetary or other valuable compensation.

We may disclose your personal information to the following categories of third parties for the following reasons:

• To our vendors and business partners who have been engaged to enable us to provide the Services that you've requested, to personalize your experience, or perform business functions on our behalf, including our advertising partners who help us market our services and provide you with other offers that may be of interest to you;
• To a law enforcement agency or other government agency, a court or other tribunal, attorney, or a third party for the legal matters and corporate transactions described in Section 4 above;
• To a third party if such disclosure is required in order for us to fulfill our legal obligations under applicable law, regulation, court order, or other legal process;
• To establish or exercise our legal rights or to defend against claims; and
• To protect the rights, property, security, or safety of you, Capsule, our customers, or the public.

6. How do you correct and update your personal information?

You can correct or update your personal information by updating your account through the Services or by contacting us at privacy@capsule.com or (888) 910-1808. It may take us up to thirty days to process your request.

7. How do we safeguard your information?

Capsule follows generally accepted industry practices for protecting your personal information, including encryption of sensitive data at rest and in transit, anti-malware detection and prevention mechanisms, and real-time monitoring and response for potential security threats to protect personal information. Although we work to protect the security of your account and information, please be aware that no method of personal information transfer over the Internet, through a system, or electronic data storage is completely secure and therefore we can't guarantee absolute security.

8. Will this Privacy Policy change?

We may change this Privacy Policy at any time. However, we'll give you prior notice of any major changes by placing a notice on the Services, by sending you an email, or by some other manner, and we'll let you know when the modified Privacy Policy will become effective. Your continued use of the Services after the new effective date will be considered assent to the new Privacy Policy.

9. What else do you need to know?

Internet and Other Electronic Network Activity Tracking. Capsule and our third-party service providers use tracking technologies (collectively, “Cookies”) and browser local storage technology to manage your identity, store your preferences, track how you interact with the Services, and make your experience more consistent. You can control how local storage works on your browser settings; however, disabling the local storage functionality on your browser may prevent you from being able to access and use our website.

Website tracking technologies are small pieces of data placed on your computer, tablet, phone or similar device when you use that device to access the Services. Cookies help us in many ways to make your use of the Services more enjoyable and meaningful. We may use these types of Cookies to enable our servers to recognize your web browser, tell us how and when you visit and use the Services, analyze trends, learn about our customer base, and operate and improve the Services (local storage may also perform these functions).

We may use certain types of Cookies like pixels, which are embedded on unauthenticated pages of our website (which are pages for which you have not provided login credentials) in order to track and provide advertising. We may also use Cookies in our relationships with our vendors and business partners to assist us in better understanding customers of our Services through our customers' interactions with the Services.

Most browsers have an option for turning off the Cookie feature, which will prevent your browser from accepting new Cookies, as well as (depending on the sophistication of your browser software) allow you to decide on acceptance of each new Cookie in a variety of ways, however some Cookies such as those enabling site functionality may not be disabled. You can also delete all Cookies that are already on your device. If you do this, however, you may have to manually adjust some preferences every time you visit our website and other Services and it may impact the overall functionality of some features of the Services. Please note that the Services don't support “Do Not Track” requests sent from a browser at this time.

Children's Privacy. The Services are not directed to or intended for use by minors and Capsule doesn't knowingly collect personal information directly from children. If you're under the age of eighteen, please don't use or access the Services unless you are emancipated or you have the right under your state's law to make decisions about your healthcare, but no one under the age of thirteen is permitted to use the Services. However, parents or guardians are permitted to use the Services on behalf of a child under their care and these parents or guardians may provide us with their child's personal information. Consistent with the requirements of the US Children's Online Privacy Protection Act, if we learn that we have received personal information directly from a child under age thirteen without his or her parent's or legal guardian's verified consent, we will use that personal information only to respond directly to that child (or his or her parent or legal guardian) to inform the child that he or she cannot use the Services. If you believe that a child under thirteen years of age may have directly provided their personal information to us, please contact us at privacy@capsule.com and we will investigate the report. We will make commercially reasonable efforts to delete personal information of a child under age thirteen without parental or guardian permission.

Information Retention. We retain personal information about you for as long as necessary to provide you with our Services and to perform our processing activities. When establishing a retention period for specific categories of personal information, we consider who we collected the personal information from, our need for the personal information, and why we collected the personal information. In some cases, we retain personal information for a long period if doing so is necessary to comply with our legal obligations, resolve disputes or collect fees owed, or is otherwise permitted or required by applicable law, rule or regulation. We may further retain information as necessary to carry out our ongoing obligations or activities, including for example in legal matters, and in an anonymous or aggregated form where that information would not reasonably identify you personally.

10. For California Residents

If you're a California resident, California law requires us to provide you with additional information about how we collect, use, share, and otherwise process your personal information. If there are any conflicts between this section and any other provision of this Privacy Policy and you're a California resident, the portion that is more protective of your personal information shall control to the extent of such conflict. This section provides you with our privacy practices in addition to those above, but only applies to your personal information included in the CCPA's scope; it does not apply to PHI, which is covered by the HIPAA Notice.

For California personnel of Capsule, please see Capsule's human resources information system for the privacy policy notice applicable to California personnel and for California candidates for positions at Capsule, please refer to the privacy policy notice in the job posting.

Personal Information We Collect. In addition to the information we collect listed above, we also collect the following personal information from the following categories of data subjects:

If you are a health care provider, including a physician, nurse practitioner, or other health care professional using our Services (collectively, “Health Care Providers”), we may also collect the following categories of personal information when you use our Services:

• Health Care Provider contact data and other professional information (such as your name, your clinic or hospital name, phone email, and office address) and provider identifiers (such as NPI number and DEA number);
• Practice information (such as type of practice, specialty, names of office staff or other contacts at the practice); and
• Your prescription orders and related communications.

We may also collect your personal information from publicly available sources, third parties, such as other health care providers who recommend you as someone who may be interested in Capsule, and third party data collectors who license health care provider information to us.

If you are an individual only making non-prescription purchases, we may also collect the following categories of personal information:

• Your products ordered and delivered and related communications; and
• Your delivery address, phone number, email address, and other contact information.

If you are our business contact or potential business contact, we may also collect the following categories of personal information to seek business or conduct business with you or the party you work for:

• The company(ies) or groups you are affiliated with and your role(s);
• Your business contact information; and
• Information related to your business needs, interests in our products or services, and communication with our team.

Personal Information Disclosed for a Business Purpose. We have disclosed the following categories of personal information to following categories of third parties in the preceding twelve months. Capsule does not “sell” or “share” personal information as those words are defined by CCPA.

Your Privacy Rights. You have the following rights under the CCPA with respect to your personal information.

Right to Know. You have the right to request details of the personal information about you that we've collected and used subject to our receipt and confirmation of your verifiable consumer request. Specifically, we'll disclose to you:

• The categories of personal information we collected about you;
• The categories of sources for personal information we collected about you;
• Our business or commercial purpose for collecting your personal information;
• The categories of third parties with whom we shared your personal information;
• The specific pieces of your personal information that we have collected about you; and
• If we disclosed your personal information for a business purpose or “shared” (as such terms are defined under the CCPA) your personal information over the past twelve months, a list identifying the personal information categories that each category of third-party recipient obtained or that was sold to each category of third-party recipient.

Right to Delete. You have the right to request the deletion of your personal information that is collected by us subject to our receipt and confirmation of your verifiable consumer request. Under the CCPA, this right is subject to certain exceptions. For example, we may need to retain your personal information to provide you with the Services or complete a transaction or other action you've requested, or if deletion of your personal information involves disproportionate effort. If your deletion request is subject to an exception, we may deny your deletion request.

Right to Correction. You have the right to request that we correct any inaccurate personal information we maintain about you. Under the CCPA, this right is subject to certain exceptions. For example, if we decided, based on the totality of the circumstances related to your personal information, that such data is correct, we're not required to act on the request. If your correction request is subject to an exception, we may deny your request.

Right to Opt Out of Processing of Sensitive Personal Information. While California consumers have certain rights over the processing of their sensitive information, Capsule does not collect your “sensitive personal information” as that term is defined by CCPA.

Right to Opt Out of and Opt Into Selling and Sharing. Under the CCPA, California residents have certain rights when a business “sells” or “shares” personal information with third parties for purposes of cross-contextual behavioral advertising. Capsule does not “sell” personal information, as that term is defined by CCPA. If Capsule does sell or share, Capsule may only share or sell personal information collected about you from unauthenticated webpages, including the landing page, for advertising purposes, and will not share or sell personal information collected after you've logged into the Services for such purposes.

In the last twelve months, we may have shared Internet and Other Electronic Network Activity Tracking for the business or commercial purposes stated in the Internet and Other Electronic Network Activity Tracking section.

You have the right to opt-out of the sale or sharing of your personal information. You can opt-out using the following methods:

• Email us at privacy@capsule.com.
• By implementing the Global Privacy Control or similar control that is legally recognized by a government agency or industry standard and that complies with the CCPA. The signal issued by the control must be initiated by your browser and applies to the specific device and browser you use at the time you cast the signal. Please note this does not include Do Not Track signals.

Once you have submitted an opt-out request, we will not ask you to reauthorize the sale or sharing of your personal information for at least twelve months.

We do not knowingly sell or share any personal information of minors under sixteen years of age.

Right to Non-Discrimination. We may not discriminate against you because you've exercised any of the privacy rights described above.

Exercising Your Rights Under the CCPA. Except as otherwise provided, to exercise the rights above, you, or your authorized agent must send us a request that provides sufficient information to allow us to verify that you're the person about whom we've collected personal information and describes your request in sufficient detail to allow us to understand, evaluate and respond to it. If you identify yourself as an authorized agent of a data subject, you will be asked to provide us with the data subject's signed permission demonstrating that you have been authorized by the data subject to act on their behalf or other valid legal documentation confirming your status. Satisfaction of these criteria means your request is a “verifiable consumer request”; we're not required to respond to requests that don't meet these criteria. We'll only use the personal information provided in a request to verify your identity and complete your request. You don't need an account to submit a request.

We'll work to respond to your request within the time period required by CCPA. We'll not charge you a fee for making a request unless your request(s) is excessive, repetitive, or manifestly unfounded. If we determine that your request warrants a fee, we'll notify you of the fee and explain that decision before completing your request.

You may submit a request using the following methods:

• Email us at privacy@capsule.com;
• Call us toll-free at (888) 910-1808; or
• In writing to Capsule's Privacy Officer at 122 W 146th Street, New York, NY 10039 (Attention: Privacy Officer and Legal Department).

11. Other State Law Privacy Rights

Capsule intends to provide you with all privacy rights to which you are entitled by law. If you believe you are entitled to exercise privacy rights under any other applicable law, please email us at privacy@capsule.com or write to Capsule's Privacy Officer at 122 W 146th Street, New York, NY 10039 (Attention: Privacy Officer and Legal Department).

12. Questions or Concerns

If you've any questions or concerns regarding privacy using the Services, please contact us at privacy@capsule.com or (888) 910-1808.