CONSUMER HEALTH DATA PRIVACY POLICY

Last Updated: September 2, 2026

1. Scope

This Consumer Health Data Privacy Policy supplements the MDRxLabs Privacy Policy and applies to consumer health data regulated by applicable state consumer health data laws, including the Washington My Health My Data Act and Nevada consumer health data law, to the extent those laws apply to MDRx Labs LLC and the information at issue.

This Policy generally applies to health-related personal information that is not exempt from the applicable consumer health data law, including where information is already governed by HIPAA or another statutory exemption.

2. Categories of Consumer Health Data We May Collect

Depending on your interaction with MDRxLabs, consumer health data may include height, weight, body mass index, health conditions, symptoms, treatment goals, medication history, prescription or treatment interests, eligibility information, healthcare consultation information, treatment recommendations, communications about health services, and other information that identifies or can reasonably be linked to your past, present, or future physical or mental health status.

We may also infer health-related information from information you provide, such as when an eligibility questionnaire indicates that you may be seeking a particular category of healthcare service.

3. Sources of Consumer Health Data

We may collect consumer health data directly from you; from a healthcare professional or pharmacy when necessary to administer services you request and permitted by law; from technology, support, communications, security, payment, and fulfillment providers that process information on our behalf; and from information generated through your interaction with MDRxLabs-operated intake, account, or support functionality.

4. Purposes for Collection and Use

We collect and use consumer health data to provide or facilitate a product or service you request; support eligibility and intake; connect you with appropriate clinical services; administer your account; coordinate customer support, payment status, and fulfillment; communicate about requested services; comply with legal obligations; maintain security; prevent fraud; and perform other uses disclosed to you at the time of collection with any consent required by law.

MDRxLabs does not use consumer health data for cross-context behavioral advertising and does not sell consumer health data.

When necessary to provide services you request or when otherwise permitted with any required consent, we may share the categories of consumer health data described above to the extent relevant to the requested service. Recipient categories may include licensed healthcare professionals and professional medical entities; licensed pharmacies; information-technology, hosting, security, and patient-support providers; communications providers; payment and fraud-prevention providers where information is necessary for the transaction; fulfillment providers; professional advisers; and government authorities when required or permitted by law.

MDRx Labs LLC does not currently identify a corporate affiliate that receives consumer health data for its own independent purposes. If that changes, this Policy will be updated as required by law.

Where applicable law requires consent for sharing, the request for sharing consent will be separate from consent to collect the data and will identify the categories of data, purposes, and categories of recipients.

6. How Consumer Health Data Is Processed

Consumer health data may be processed electronically through intake, account, customer-support, payment-status, care-coordination, and fulfillment systems. Access is limited based on role and business or clinical need, and service providers that process consumer health data on behalf of MDRxLabs are expected to process it only for authorized purposes and under applicable contractual and legal requirements.

7. Third-Party Collection Across Websites

MDRxLabs does not permit third parties to collect consumer health data over time across unrelated websites or online services for targeted or cross-context behavioral advertising. Non-health browsing information on public-facing pages may be collected through analytics or advertising technologies as described in the general Privacy Policy, but those technologies are not intended to receive consumer health data.

8. Your Consumer Health Data Rights

Depending on applicable law, you may have the right to confirm whether MDRxLabs collects, shares, or sells consumer health data; access consumer health data; obtain a copy; correct inaccurate data; delete consumer health data; withdraw consent to future collection or sharing; obtain information about third parties or affiliates with whom data was shared; and appeal a denial of a request.

To exercise a right, email support@mdrxlabs.com with the subject line "Consumer Health Data Request" or use the Privacy Choices page. We may take reasonable steps to authenticate your request and will respond within the time required by applicable law.

9. Deletion

When applicable law requires deletion, MDRxLabs will delete consumer health data from systems under its control and will take the steps required by law to notify processors, service providers, or other recipients to delete the data, subject to lawful exceptions.

10. Withdrawal of Consent and Appeals

You may withdraw consent to future collection or sharing where consent is the basis for processing by using the same contact methods described above. If MDRxLabs denies a request and applicable law provides a right to appeal, email support@mdrxlabs.com with the subject line "Consumer Health Data Appeal" and explain why you believe the decision should be reconsidered.

11. Sale of Consumer Health Data

MDRxLabs does not sell consumer health data. If MDRxLabs ever proposes an activity that constitutes a sale of consumer health data under applicable law, separate authorization will be obtained before doing so where required.

12. Geofencing

MDRxLabs does not use geofencing around healthcare facilities to identify or track consumers seeking healthcare, collect consumer health data, or send health-related messages in a manner prohibited by applicable law.

13. Security and Retention

MDRxLabs uses safeguards designed to protect consumer health data and restricts access based on role and purpose. Consumer health data is retained only for as long as reasonably necessary for the disclosed purposes, legal obligations, dispute resolution, security, and recordkeeping.

14. Material Changes

Material changes to this Policy will be posted and additional consent will be obtained where required before collecting, using, or sharing new categories of consumer health data or using the data for materially different purposes.

15. Contact

MDRx Labs LLC
16411 N 90th Street Suite 101, Scottsdale, AZ 85260
Email: support@mdrxlabs.com