CONSUMER HEALTH DATA PRIVACY POLICY

Effective Date: August 24, 2026 | Last Updated: August 24, 2026

This Consumer Health Data Privacy Policy ("CHD Policy") supplements the Lucky Rx Privacy and Security Policy (the "Privacy Policy") and applies to personal data defined as "Consumer Health Data" ("CHD") under applicable consumer health privacy laws, including the Washington My Health My Data Act ("MHMDA"), Nevada's Consumer Health Data Privacy Law ("Nevada CHD Law"), the Connecticut Data Privacy Act ("CTDPA"), and other similar laws as they may be amended from time to time. Capitalized terms not otherwise defined in this CHD Policy have the meanings assigned in the Privacy Policy. In the event of a conflict between this CHD Policy and the Privacy Policy, this CHD Policy will govern solely with respect to Consumer Health Data.

Lucky Rx operates a technology and administrative platform that facilitates interactions among users, independent healthcare providers and affiliated healthcare entities, pharmacies, service providers, and other parties involved in supporting the Services. Lucky Rx provides technology and administrative services and does not independently provide medical care, exercise clinical judgment, or maintain healthcare records used for diagnosis, treatment, or prescribing decisions.

HIPAA AND CONSUMER HEALTH DATA

"Consumer health data" means personal information that is linked or reasonably linkable to a particular individual and that identifies that individual's past, present, or future physical or mental health status. The following categories of information are not consumer health data and are not covered by this CHD Policy:

Protected Health Information ("PHI"), as defined by the Health Insurance Portability and Accountability Act ("HIPAA");
Health care information collected, used, or disclosed in accordance with Washington Revised Code § 70.02;
Publicly available information;
De-identified data; or
Information otherwise excluded from the scope of applicable consumer health data privacy laws.

Independent healthcare providers, pharmacies, and affiliated healthcare entities maintain their own privacy practices and compliance obligations; please review their privacy notices where available.

To the extent required by applicable consumer health privacy laws, Lucky Rx obtains your affirmative consent prior to the collection of Consumer Health Data and, separately, prior to the sharing of Consumer Health Data with third parties or affiliates, except where such collection or sharing is necessary to provide a product or service you have requested from Lucky Rx or is otherwise permitted or required by applicable law.

Where consent is required, the request for consent will clearly and conspicuously disclose: (i) the categories of Consumer Health Data to be collected or shared; (ii) the purpose of the collection or sharing, including the specific ways in which it will be used; (iii) the categories of entities with whom the Consumer Health Data may be shared; and (iv) how you may withdraw your consent from future collection or sharing of your Consumer Health Data.

Consent for the collection of Consumer Health Data and consent for the sharing of Consumer Health Data are obtained separately and distinctly from one another.

You may withdraw your consent at any time by contacting us at [email protected]. Withdrawal of consent will not affect the lawfulness of any processing conducted prior to withdrawal. Following withdrawal, Lucky Rx will cease the applicable collection or sharing activities within a reasonable time, subject to any applicable legal obligations.

CATEGORIES OF CHD COLLECTED

As described in the Privacy Policy, the data we collect depends on the context of your interactions with the Services, the choices you make, and applicable law. We may collect the following categories of consumer health data with your consent or to the extent necessary to provide a product or service that you requested. We only collect the categories of consumer health data described in this CHD Policy.

Individual health conditions, treatment, diseases, or diagnosis;
Social, psychological, behavioral, and medical interventions;
Health-related surgeries or procedures;
Reproductive or sexual health information;
Precise location information that could reasonably indicate an individual's attempt to acquire or receive health services or supplies;
Website usage, browsing activity, and interactions with health-related content or Services;
Use, purchase, treatment with a prescribed medication or diagnostic testing;
Bodily functions, vital signs, symptoms, or measurements of health data;
Data that identifies a consumer seeking health care services, including services that allow a consumer to assess, measure, improve, or learn about their health;
Identifiers, device information, analytics information, referral information, and advertising attribution information associated with healthcare-related Services; and
Any other information used to associate or identify an individual with any category of health data described above that is derived or extrapolated from non-health information (such as proxy, derivative, inferred, or emergent data by any means, including algorithms or machine learning).

SOURCES OF CHD

As described in the Privacy Policy, we collect consumer health data from the following sources:

Directly from you, through account creation, purchases, subscriptions, customer support interactions, communications, and use of the Services;
Automatically through your interactions with the Website or Services, including through cookies, pixels, analytics technologies, advertising attribution technologies, device information, and similar technologies;
From business partners, advertising networks, affiliate programs, referral sources, analytics providers, and marketing platforms; and
From independent healthcare providers, pharmacies, and service providers in connection with Services you have requested.

PURPOSES FOR COLLECTION OF CHD

We collect and use consumer health data only for the purposes described in this CHD Policy. Primarily, we collect and use consumer health data as reasonably necessary to provide you with the Services you have requested or authorized. We may also collect and use consumer health data for the following purposes:

Providing, operating, maintaining, and supporting the Services, including facilitating account administration, purchases, subscriptions, fulfillment coordination, customer support, and payment processing;
Facilitating communications and operational workflows involving users, independent healthcare providers, pharmacies, and service providers involved in supporting the Services;
Analyzing, troubleshooting, improving, personalizing, and enhancing the Website, Services, and user experience;
Measuring advertising performance, campaign attribution, marketing effectiveness, and user engagement;
Providing advertising, promotional content, and marketing communications relating to Lucky Rx products or Services, subject to applicable law and your preferences;
Detecting, investigating, and preventing fraud, abuse, unauthorized activity, or violations of applicable terms or policies;
Complying with legal obligations, governmental requests, regulatory requirements, or legal process;
Any other purpose disclosed at the time of collection or with your consent.

To the extent that advertising measurement or attribution technologies are used in connection with the Services, Lucky Rx implements reasonable technical measures designed to limit the transmission of health-indicative information to third-party advertising platforms and does not authorize such platforms to use consumer health data for behavioral targeting purposes.

HOW AND WHY WE SHARE CHD

We may share consumer health data with your consent or as reasonably necessary to provide a product or service that you have requested. For purposes of the Washington MHMDA, "share" means to release, disclose, disseminate, divulge, make available, provide access to, license, or otherwise communicate consumer health data to a third party or affiliate. "Sharing" does not include (i) disclosure of consumer health data to provide goods or services in a manner consistent with the purpose for which the data was collected; (ii) disclosure to a third party with whom you have a direct relationship when the disclosure is for the purpose of providing a product or service you requested, provided that Lucky Rx maintains control and ownership of the data and the third party uses the data only at Lucky Rx's direction and consistent with your consent and the purpose for which the data was collected; or (iii) disclosure or transfer of consumer health data to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in compliance with applicable law.

Lucky Rx may share consumer health data for the purposes described in the "Purposes For Collection of CHD" section above, and additionally in connection with a merger, acquisition, financing transaction, restructuring, sale of assets, bankruptcy proceeding, or other corporate transaction involving Lucky Rx.

Lucky Rx does not sell Consumer Health Data. Under the Washington MHMDA, "sale" means the exchange of consumer health data for monetary or other valuable consideration, excluding (i) exchange to a third party as part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of Lucky Rx's assets in compliance with applicable law, or (ii) exchange by Lucky Rx to a processor when consistent with the purpose for which the data was collected and disclosed to you. Lucky Rx will not sell or offer to sell Consumer Health Data without first obtaining your valid written authorization as required by applicable law.

Lucky Rx does not share Consumer Health Data for cross-context behavioral advertising or targeted advertising using Consumer Health Data prohibited by applicable consumer health privacy laws.

Lucky Rx does not implement geofencing technologies within 1,750 feet of any healthcare facility, mental health facility, reproductive or sexual health facility, or any other entity that provides in-person healthcare services or products, for purposes of identifying, tracking, collecting Consumer Health Data from, or sending healthcare-related advertising, notifications, or messages to consumers regarding their Consumer Health Data.

We may share consumer health data with the following categories of third parties:

Independent healthcare providers, pharmacies, and affiliated healthcare entities involved in supporting Services you have requested. A current list of specific affiliates may be obtained by contacting [email protected];
Service providers and processors supporting the Website or Services, including hosting, communications, payment processing, fraud prevention, analytics, customer support, and fulfillment, subject to written contracts governing their processing of Consumer Health Data;
Advertising networks, affiliate program partners, analytics providers, and advertising attribution platforms, subject to applicable law and contractual restrictions on the use of Consumer Health Data for behavioral targeting;
Professional advisors, including attorneys, auditors, accountants, and insurers;
Lucky Rx requires employees and contractors with access to Consumer Health Data to maintain the confidentiality of such data through appropriate contractual or statutory obligations.
Government agencies, regulatory authorities, and law enforcement, where required by applicable law, legal process, or regulatory obligations; and
Parties to corporate transactions, including mergers, acquisitions, financings, or asset sales involving Lucky Rx.

Lucky Rx may create aggregated or de-identified information from Consumer Health Data where permitted by law. Lucky Rx will not attempt to re-identify de-identified information except as permitted by applicable law and will require recipients to maintain such information in de-identified form where required.

HOW TO EXERCISE YOUR CONSUMER HEALTH PRIVACY RIGHTS

Subject to applicable law and certain exceptions, consumer health privacy laws, including the Washington My Health My Data Act ("MHMDA"), Nevada consumer health privacy laws, and Connecticut privacy laws, may provide consumers with rights relating to Consumer Health Data ("CHD").

Depending on your jurisdiction and applicable law, such rights may include the ability to:

Confirm whether Lucky Rx collects, uses, discloses, or processes CHD;
Request access to CHD associated with you;
Request deletion of CHD;
Request a list of all third parties and specific affiliates with whom Lucky Rx has shared Consumer Health Data concerning you;
Withdraw consent relating to certain collection or sharing activities where consent is required by law; and
Request correction of inaccurate information where applicable.

You may submit requests through the following email:

Email: [email protected]

Depending on the nature of your request, Lucky Rx may request additional information reasonably necessary to verify your identity and process your request. Lucky Rx will not request passwords, payment card information, or other sensitive financial credentials for identity verification purposes.

Lucky Rx will respond to verified consumer requests without undue delay and no later than forty-five (45) days after authenticating the request. If reasonably necessary due to the complexity or volume of requests, Lucky Rx may extend the response period by an additional forty-five (45) days, provided that Lucky Rx notifies you of the extension and the reason for it within the initial forty-five (45) day period. There is no fee to submit a consumer health data rights request.

Lucky Rx will not unlawfully discriminate against you for exercising any rights under applicable consumer health privacy laws. Lucky Rx will not deny, charge different prices for, or provide a different level or quality of products or services to you because you exercised your consumer health data privacy rights, except where a difference in price, rate, level, quality, or selection of goods or services is reasonably related to the value provided to Lucky Rx by your Consumer Health Data.

Appeals

If Lucky Rx denies your request in whole or in part, you may appeal the decision by submitting an appeal through the same request mechanism listed above.

Residents of certain jurisdictions may also have the right to contact their state Attorney General or regulatory authority:

Washington State Attorney General: https://www.atg.wa.gov/file-complaint
Nevada Attorney General: https://ag.nv.gov/Complaints/File_Complaint/
Connecticut Attorney General: https://www.dir.ct.gov/ag/complaint/e-complaint.aspx

Service Impact

Certain requests may affect Lucky Rx's ability to provide or support aspects of the Services. For example, if information necessary to maintain accounts, process transactions, support fulfillment activities, administer subscriptions, or provide operational services is deleted or restricted, certain features or functionality may become unavailable.

UPDATES TO THIS CHD POLICY

Lucky Rx may update this CHD Policy from time to time. Any updated version will be posted on the Website with a revised "Last Updated" date. Where required by law, Lucky Rx will obtain additional consent or authorization before applying material changes to Consumer Health Data practices. Your continued use of the Services following an update constitutes acknowledgment of the revised CHD Policy to the extent permitted by applicable law.

CONTACT US

If you have questions regarding this Consumer Health Data Privacy Policy ("CHD Policy"), Consumer Health Data practices, or Lucky Rx privacy practices, please contact us at:

Lucky Rx LLC

1311 Seven Hills Dr., Henderson, NV 89052

Email: [email protected]

Website: www.luckyrx.com