RxMart Inc.

Privacy Policy

Replaces the version currently published at rxmart.com/privacy-policy

Version 2.0 — Effective [EFFECTIVE DATE] — Last revised [EFFECTIVE DATE]

I. Introduction

We are committed to protecting the privacy of our visitors and users and to providing detailed information about how their information is used and protected. This Privacy Policy describes how RxMart Inc. and its affiliates (collectively "RxMart," "we," "our," or "us") collect and process personal information through our websites and services (together, the "Services"). Capitalized terms not defined here have the meaning given in the Terms & Conditions.

By using the Services you consent to the practices described in this Privacy Policy. If you do not agree with it, do not access or use the Services.

RxMart operates a business-to-business marketplace for licensed pharmacies and distributors. The Services are not directed to consumers or to individuals acting in a personal capacity, and the Marketplace does not process protected health information.

II. Information We Collect

Information you provide

We receive information when you complete forms, register for an account, use or edit your account, or place an order. This may include your name, business address, email address, phone number, place of work, purchase history, product preferences, professional information, facility and personal licensing information, and payment or financial information.

Verification and screening information

Because participation in the Marketplace is limited to licensed entities, we collect and generate additional information for credentialing purposes, including: pharmacy, wholesale distributor, and individual professional license numbers and status; National Provider Identifier and NCPDP identifiers; DEA registration information where held; entity formation and good-standing records; beneficial ownership information for owners holding 25% or more, and officer and director information; government-issued identification for authorized signers; bank account details used to verify payout destinations; and the results of screening against exclusion, debarment, and sanctions databases maintained by the Office of Inspector General, the System for Award Management, and the Office of Foreign Assets Control.

This information is collected and used for verification, fraud prevention, and legal and regulatory compliance. It is not used for marketing. Full details of the credentialing process are set out in the Pharmacy Member Verification Policy.

Information collected automatically

We may automatically collect information resulting from your use of the Services, including your IP address, login details, and device location. We may use device identifiers, cookies, tokens, scripts, and similar technologies to collect information about your browsing actions and patterns and technical information about your device, internet connection, operating system, and browser.

Information from third-party sources

We may obtain information about you from third parties, including: state boards of pharmacy and other licensing authorities; the NPPES and NCPDP registries; secretaries of state and other public records; exclusion, debarment, and sanctions databases; analytics providers; financial institutions and payment processors for the purpose of verifying account ownership; and commercial business verification and fraud prevention providers.

Where we obtain a consumer report on an individual through a consumer reporting agency, we do so only after providing that individual with the disclosure and obtaining the written authorization required by the Fair Credit Reporting Act.

III. Information Collected by Third Parties

When you use the Services, certain third parties may use automatic information collection technologies to collect information about you or your device. This Privacy Policy does not address, and we are not responsible for, the privacy or data practices of third parties, including Sellers that use the Marketplace or Services.

IV. How We Use Information

We use information to provide, improve, and develop the Services. We, our partners, contractors, and agents may use personal information for purposes including:

• Operating the Marketplace and processing transactions between Buyers and Sellers.
• Verifying licensure, identity, ownership, and eligibility, and conducting ongoing monitoring and re-verification.
• Detecting, investigating, and preventing fraud, diversion, product diversion or counterfeiting, account takeover, and other prohibited activity.
• Managing your account and sending technical notices, updates, security alerts, and support and administrative messages.
• Responding to comments, questions, and requests, and providing customer service.
• Communicating with you about products, services, offers, and events, and providing news and information relevant to your use of the Marketplace.
• Conducting internal research and development and making business decisions about current and future offerings.
• Monitoring and analyzing trends, usage, and activity, including producing aggregated and de-identified market analytics in which no individual member is identifiable.
• Complying with any court order, law, or legal process, and responding to any government or regulatory request, including requests from boards of pharmacy, FDA, and law enforcement.
• Enforcing or applying our Terms & Conditions and the Marketplace Participation Agreement.

We do not sell personal information, and we do not use verification or screening information for advertising or marketing purposes.

V. How We Share Information

We may share information with affiliates, partners, service providers, and other third parties in order to:

• Assist with the maintenance and operation of the Services, including hosting, payment processing, verification, and fraud prevention providers acting on our behalf.
• Complete a transaction. Information necessary to complete an order is shared between the transacting Buyer and Seller, including entity name, facility address, licensure status, and order details.
• Comply with any court order, law, or legal process, including responding to any government or regulatory request, and to enforce or apply our Terms & Conditions and the Marketplace Participation Agreement.
• Protect our rights, property, or safety, or those of our members or others, including notifying manufacturers, regulators, and counterparties in connection with suspect or illegitimate product, recalls, or suspected criminal conduct.
• Disclose to a buyer or successor entity in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, including as part of a bankruptcy or similar proceeding.

Financial information may be shared with third-party payment processors and related entities to process payments. We do not disclose payment or financial information, or information prohibited from disclosure under federal or state law, for commercial purposes.

VI. Security

We design our systems with security and privacy in mind and maintain administrative, technical, and physical safeguards to protect personal information from unauthorized access, use, or disclosure. These safeguards vary with the sensitivity of the information collected. Controls include access restriction on a business-need basis, logging of access to verification records, multi-factor authentication requirements for account holders, and out-of-band verification and holds on changes to payout destinations.

The security of your information also depends on you. Where you have been given or have chosen a password, you are responsible for keeping it confidential and must not share it.

Transmission of information over the internet is not completely secure. Although we work to protect your personal information, we cannot guarantee the security of information transmitted through our website. Any transmission is at your own risk, and we are not responsible for circumvention of privacy settings or security measures.

VII. Changes to This Policy

We may change this Privacy Policy from time to time. The date last revised appears at the top of this policy. Continued use of the Services indicates consent to the policy as posted. If we make material changes to how we treat personal information, we will notify you by email or through a notice on our website. You are responsible for ensuring we have a current, deliverable email address for you and for periodically reviewing this policy.

VIII. Accessing, Correcting, and Deleting Information

You may update, correct, or request deletion of your personal information by contacting us using the details in Section XII. We may be unable to delete information without also closing your account, and we may decline a request to change or delete information where doing so would violate a law or legal requirement, cause the information to be inaccurate, or interfere with a record we are required to retain.

Verification, licensure, transaction, and product tracing records are subject to mandatory retention periods and generally cannot be deleted on request during those periods.

IX. Retention

We keep information no longer than necessary for the purposes for which it is processed, except where a longer period is required by law or by our regulatory obligations. In particular:

Category	Retention
Transaction, tracing, and product records	Not less than six (6) years
Verification files, licensure evidence, and screening results	Term of membership plus six (6) years
Agreement acceptance records and superseded versions	Not less than six (6) years after end of membership
Investigations, enforcement actions, and regulatory notifications	Not less than six (6) years
System and access logs, including payout-destination changes	Not less than two (2) years
Marketing and communication preferences	Until you withdraw consent or close your account

X. California Residents

Consumers residing in California have certain additional rights with respect to their personal information under the California Consumer Privacy Act, as amended. Where the CCPA applies to us, we will fulfill requests to the extent required and permitted by law. We collect and retain personal information only to the extent reasonably necessary and proportionate for a disclosed purpose, and we maintain reasonable security measures to protect it.

We will not discriminate against any consumer for exercising rights under the CCPA. We will not deny goods or services, charge different prices or rates, provide a different level of service or quality, or suggest that a different price or quality may apply.

You may make a request by calling [PRIVACY PHONE], emailing [PRIVACY OFFICER EMAIL], or using the contact form at [PRIVACY REQUEST FORM URL].

XI. Your State Privacy Rights

Residents of certain states have additional rights regarding their personal information. Subject to the applicable state law and to verification of your identity, you may have the right to:

• Opt out of the processing of your personal data for targeted advertising, for the sale of personal data, or for profiling that produces legal or similarly significant effects.
• Opt out of the processing of sensitive data, including precise geolocation data.
• Opt out of the collection of personal data through voice recognition or facial recognition features.
• Confirm whether we have collected, held, or processed your data, and access that data.
• Obtain a list of the third parties to which we have disclosed your personal data.
• Delete personal data we have collected and hold about you, subject to the retention obligations described in Section IX.
• Correct inaccuracies in your personal data.
• Receive your requested data in a usable, portable, and transferable form.
• Be free from discrimination or retaliation for exercising any of these rights.

Responding to requests

• We respond without undue delay and within 45 days of receipt. Where the type or complexity of a request requires more time, and where we notify you within the original 45 days, we may extend once for an additional 15 days.
• If we decline to act on a request, we will notify you within 45 days and provide information about our appeal process, together with our justification.
• You may request information free of charge twice in a 12-month period. Depending on your state of residence, we reserve the right to charge a reasonable fee for a third or subsequent request within a 12-month period.

How to exercise your rights

• Submit a request through our website, call us at [PRIVACY PHONE], or email us at [PRIVACY OFFICER EMAIL].
• To exercise opt-out rights, use the "Opt-Out Rights" link on our website, or contact us using the details above. [CONFIRM this link exists on the site before publishing.]
• To designate an agent to act on your behalf, or if you are a guardian or conservator acting for another individual, contact us using the details above.
• If a request is declined you may appeal by email to [PRIVACY OFFICER EMAIL] or by following the process on our website.
• If you contact us directly, you will need to provide enough information to identify you, proof of your identity and address, and a description of the right you wish to exercise and the information to which the request relates.
• We are not obligated to make a data access or portability disclosure where we cannot verify that the requester is the person about whom we collected information, or someone authorized to act on their behalf. Personal data collected to verify identity in connection with a request is used solely for verification.

XII. Contact

Questions about this Privacy Policy may be directed to:

RxMart Inc.

[RXMART LEGAL NOTICE ADDRESS]

[PRIVACY OFFICER EMAIL]

[PRIVACY PHONE]

Effective date: [EFFECTIVE DATE]

Last revised: [EFFECTIVE DATE]

Version: 2.0