APALY HEALTH INC.

Apaly Health Inc. ("Apaly Health," "we," "us," or "our") is committed to protecting the privacy of individuals who use the ApalyRx prescription benefit platform. This Privacy Policy explains what personal information we collect, how we use and share it, and the rights you have over your information. ApalyRx LLC, a Texas Class G centralized prescription processing pharmacy (NPI 1912873969) and wholly owned subsidiary of Apaly Health Inc., operates within the platform and handles personal information only as described in this Policy and in the HIPAA Authorization at apalyrx.com/legal.

1. Information We Collect

1.1 Information You Provide Directly. We collect personal information you provide when you enroll in the ApalyRx program, create an account, or contact us. This includes:

• Identity information: your full name, date of birth, and government-issued identification information where required
• Contact information: your home address, email address, telephone number, and mobile number
• Account credentials: your username, password, and account security information
• Payment information: your credit card or bank account information collected through our payment processor, Stripe, Inc. We do not store full payment card numbers on our systems
• Health plan information: your employer, health plan name, member ID, and benefit configuration details
• Prescription delivery preferences: your preferred delivery address and any special delivery instructions

1.2 Information We Collect Automatically. When you use the platform, we automatically collect:

• Device and browser information: your device type, operating system, browser type and version, and device identifiers
• Usage data: pages visited, features used, time spent on pages, links clicked, and navigation paths
• Log data: IP address, access timestamps, error logs, and referring URLs
• Cookie and tracking data: as described in Section 3 of this Policy

1.3 Information from Third Parties. We receive personal information about you from:

• Your employer and health plan: eligibility status, plan enrollment dates, benefit configuration, and member ID information provided by your employer or its third-party administrator
• Healthcare providers: electronic prescription data transmitted by your prescribing provider via NCPDP SCRIPT or other electronic prescription formats
• Dispensing Pharmacy partners: prescription fulfillment status, dispense records, and shipment information
• Program Suppliers: program eligibility confirmation and patient support service information where applicable under your HIPAA Authorization
• Identity and eligibility verification services: information used to verify your identity and eligibility for program participation

1.4 Protected Health Information. Information that constitutes Protected Health Information under HIPAA, including prescription data, medical record information, and health plan benefit details, is governed by the HIPAA Authorization at apalyrx.com/legal and applicable federal and state health privacy laws, not by this Privacy Policy. The collection, use, and disclosure of Protected Health Information is described in detail in your HIPAA Authorization.

2. How We Use Your Information

2.1 Program Administration. We use your personal information to administer the ApalyRx program on behalf of your employer health plan, including verifying your eligibility, routing your prescriptions, collecting cost share payments, coordinating with Dispensing Pharmacies, and providing program support.

2.2 Account Management. We use your information to create and maintain your account, authenticate your identity, communicate with you about your account, and respond to your support requests.

2.3 Payment Processing. We use your payment information to collect cost share amounts as required by your health plan's benefit design. Payment processing is performed through Stripe, Inc. under Stripe's privacy policy at https://stripe.com/privacy.

2.4 Communications. We use your contact information, including your mobile telephone number, to send you prescription status updates, cost share notifications, program change notices, and other communications related to your program participation, consistent with your TCPA Communications Consent at apalyrx.com/legal.

2.5 Analytics and Platform Improvement. We use automatically collected data and data from third-party analytics tools to understand how the platform is used, identify technical issues, improve platform functionality, and develop new features. This includes use of tools such as Visitor Intelligence, RB2B, and Apollo.io on our public-facing websites.

2.6 Legal Compliance. We use your information to comply with applicable laws and regulations, respond to legal process, satisfy regulatory obligations, and cooperate with government and law enforcement authorities as required by law.

2.7 Security and Fraud Prevention. We use your information to detect, investigate, and prevent fraudulent, unauthorized, or illegal activity, and to protect the security and integrity of the platform and program.

2.8 Business Operations. We use your information for internal business operations including auditing, recordkeeping, financial reporting, and program analytics. We may use de-identified information, which cannot reasonably identify you, for any lawful business purpose.

3. Cookies and Tracking Technologies

3.1 Cookies. The platform uses cookies and similar tracking technologies to operate and improve the platform. Cookies are small data files stored on your device. We use:

• Essential cookies: required for platform operation, authentication, and security. These cannot be disabled without affecting platform functionality.
• Functional cookies: used to remember your preferences and settings to improve your experience.
• Analytics cookies: used by third-party analytics tools to collect information about how you use the platform. These include tools such as Visitor Intelligence, RB2B, and Apollo.io on our public websites.
• Payment cookies: used by Stripe, Inc. in connection with payment processing.

3.2 Managing Cookies. Most browsers allow you to control cookies through browser settings. Disabling certain cookies may affect platform functionality. Instructions for managing cookies are available in your browser's help documentation.

3.3 Do Not Track. Some browsers transmit Do Not Track signals to websites. The platform does not currently respond to Do Not Track signals. We will update this Policy if our practices change.

3.4 Third-Party Tracking. Our public websites at apalyrx.com use third-party tools including Visitor Intelligence, RB2B, and Apollo.io that may collect information about visitors for business identification and outreach purposes. These tools operate under their respective privacy policies. If you are a member accessing the platform at apalyrx.net, third-party tracking tools are limited to those necessary for platform operation and payment processing.

4. How We Share Your Information

4.1 Dispensing Pharmacy Partners. We share your personal information and Protected Health Information with Dispensing Pharmacy partners as necessary to route and fulfill your prescriptions. Dispensing Pharmacy partners use your information to process, verify, dispense, and ship your medications. Data sharing with Dispensing Pharmacy partners is governed by your HIPAA Authorization and applicable law.

4.2 Program Suppliers. We share your personal information and Protected Health Information with Program Suppliers whose products are covered under your health plan's program, as described in your HIPAA Authorization at apalyrx.com/legal. Program Suppliers use your information to administer their programs, verify eligibility, and provide patient support services.

4.3 Your Employer Health Plan. We share your personal information with your employer health plan and its designated third-party administrator for purposes of benefit administration, eligibility verification, claims processing, and program reporting.

4.4 Service Providers. We share your personal information with third-party service providers who perform services on our behalf, including payment processing (Stripe, Inc.), technology infrastructure, data analytics, customer support, and communications services. These service providers are contractually required to use your information only to perform services for us and to protect your information consistent with this Policy.

4.5 Business Associates. We engage authorized technology vendors and service providers as Business Associates under HIPAA to support platform operations including eligibility verification, electronic medical record connectivity, and prescription data exchange. These Business Associates handle Protected Health Information under Business Associate Agreements consistent with HIPAA.

4.6 Legal Requirements. We may disclose your personal information to courts, government agencies, regulators, law enforcement, and other third parties when required by law, legal process, or regulatory obligation, or to protect the rights, property, or safety of Apaly Health, our users, or others.

4.7 Business Transfers. If Apaly Health is involved in a merger, acquisition, asset sale, or similar transaction, your personal information may be transferred as part of that transaction. We will notify you of any such transfer and any resulting changes to this Policy.

4.8 With Your Consent. We may share your personal information for other purposes with your explicit consent.

4.9 We Do Not Sell Your Personal Information. Apaly Health does not sell your personal information to third parties for monetary or other valuable consideration. We do not share your personal information with third parties for their own direct marketing purposes without your consent.

5. Data Retention

5.1 Retention Period. We retain your personal information for the duration of your enrollment in the ApalyRx program and for seven (7) years following the termination of your enrollment, unless a longer retention period is required by applicable law. Protected Health Information may be subject to longer retention requirements under applicable health privacy laws.

5.2 Prescription Records. Prescription records and related transaction data are retained consistent with applicable state and federal pharmacy laws, which may require retention for periods ranging from two to ten years depending on the jurisdiction and type of record.

5.3 Payment Records. Payment records are retained for seven (7) years following the relevant transaction to satisfy tax, accounting, and audit obligations.

5.4 De-identified Information. De-identified information that cannot reasonably be used to identify you may be retained indefinitely for analytics, research, and business improvement purposes.

5.5 Deletion. Upon expiration of the applicable retention period, we will delete or de-identify your personal information consistent with our data retention policies and applicable law. Deletion of certain records may be delayed where required by ongoing legal proceedings, regulatory investigations, or other legal obligations.

6. Data Security

6.1 Security Measures. Apaly Health maintains reasonable and appropriate administrative, physical, and technical safeguards to protect your personal information against unauthorized access, disclosure, alteration, or destruction. These measures include encryption of data in transit and at rest, access controls, authentication requirements, and regular security assessments.

6.2 HIPAA Security Rule. Protected Health Information is protected under safeguards consistent with the HIPAA Security Rule, 45 C.F.R. Parts 160 and 164, Subparts A and C, including administrative, physical, and technical safeguard requirements applicable to electronic Protected Health Information.

6.3 No Absolute Security. No security measures are completely effective against all threats. We cannot guarantee that your information will never be accessed, disclosed, altered, or destroyed in a security incident. If you believe your account has been compromised, contact us immediately at privacy@apalyrx.com.

6.4 Breach Notification. In the event of a data breach affecting your personal information or Protected Health Information, we will notify you as required by applicable law, including HIPAA's breach notification requirements and applicable state data breach notification laws.

7. Children's Privacy

7.1 Platform Age Requirement. The ApalyRx platform is intended for use by persons aged 18 and older. We do not knowingly collect personal information from children under the age of 13.

7.2 COPPA Compliance. Apaly Health does not knowingly collect, use, or disclose personal information from children under 13 in violation of the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. Section 6501 et seq. If we learn that we have collected personal information from a child under 13 without parental consent, we will promptly delete that information.

7.3 If You Believe a Child Has Provided Information. If you believe a child under 13 has provided personal information to us, please contact us at privacy@apalyrx.com and we will promptly investigate and delete the information if confirmed.

8. Your Privacy Rights

8.1 General Rights. Depending on your state of residence, you may have the following rights with respect to your personal information:

• Right to know: the right to know what personal information we collect, use, disclose, and sell about you
• Right to access: the right to request a copy of your personal information
• Right to correction: the right to request correction of inaccurate personal information
• Right to deletion: the right to request deletion of your personal information, subject to exceptions required by applicable law
• Right to opt out of sharing: the right to opt out of the sharing of your personal information with third parties for certain purposes
• Right to non-discrimination: the right not to receive discriminatory treatment for exercising your privacy rights

8.2 How to Exercise Your Rights. To exercise any of the rights described in this Section, contact us at:

• Email: privacy@apalyrx.com
• Mail: Apaly Health Inc., Privacy Officer, 802 E. Whiting, Tampa, Florida 33602
• Account settings: apalyrx.net

We will respond to verified requests within the timeframe required by applicable law. We may need to verify your identity before processing your request. We will not discriminate against you for exercising your privacy rights.

8.3 Protected Health Information Rights. Your rights with respect to Protected Health Information, including your right to access, amend, and receive an accounting of disclosures of your health information, are governed by HIPAA and described in our Notice of Privacy Practices, available by contacting privacy@apalyrx.com. Those rights are separate from and in addition to the rights described in this Section.

9. California Privacy Rights

9.1 Categories of Personal Information Collected. In the preceding twelve months, we have collected the following categories of personal information as defined under the CCPA/CPRA:

• Identifiers: name, address, email address, telephone number, IP address, account identifiers, and device identifiers
• Personal information under California Civil Code Section 1798.80: name, address, telephone number, credit card information, and medical information
• Internet or other electronic network activity: browsing history on the platform, search history, and information about your interaction with the platform
• Geolocation data: general location information derived from IP address
• Professional or employment-related information: employer name and health plan information
• Medical information and health insurance information: as described in Section 1.4 and governed by the HIPAA Authorization

9.2 Purposes for Collection. We collect the categories of personal information described above for the business and commercial purposes described in Section 2 of this Policy.

9.3 Categories of Third Parties with Whom We Share Personal Information. We share personal information with the categories of third parties described in Section 4 of this Policy, including Dispensing Pharmacy partners, Program Suppliers, your employer health plan, service providers, and Business Associates.

9.4 We Do Not Sell or Share for Cross-Context Behavioral Advertising. Apaly Health does not sell your personal information and does not share your personal information for cross-context behavioral advertising as defined under the CCPA/CPRA. Because we do not engage in these activities, we do not offer an opt-out mechanism for the sale or sharing of personal information for behavioral advertising. If our practices change, we will update this Policy and provide the required opt-out mechanisms.

9.5 Sensitive Personal Information. We collect sensitive personal information as defined under the CCPA/CPRA, including health information, financial information, and precise geolocation in some cases. We use sensitive personal information only to perform the services described in this Policy and do not use it for purposes that would require us to offer a right to limit its use under California law.

9.6 Your CCPA/CPRA Rights. As a California resident, you have the right to:

• Know the categories and specific pieces of personal information we have collected about you
• Know the categories of sources from which we collected your personal information
• Know the business or commercial purposes for collecting your personal information
• Know the categories of third parties with whom we shared your personal information
• Request deletion of your personal information, subject to exceptions
• Request correction of inaccurate personal information
• Opt out of the sale or sharing of your personal information (we do not sell or share for behavioral advertising)
• Not be discriminated against for exercising your CCPA/CPRA rights

9.7 How to Submit a CCPA/CPRA Request. To submit a request under the CCPA/CPRA, contact us at privacy@apalyrx.com or by mail at Apaly Health Inc., Privacy Officer, 802 E. Whiting, Tampa, Florida 33602. We will verify your identity before processing your request and will respond within 45 days, with a possible extension of an additional 45 days where reasonably necessary.

9.8 Authorized Agent. You may designate an authorized agent to submit a CCPA/CPRA request on your behalf. We will require written proof of the agent's authorization and may require you to verify your identity directly with us before processing the request.

10. Other State Privacy Rights

10.1 Applicability. Residents of Colorado, Connecticut, Virginia, and Texas, and other states that have enacted comprehensive consumer privacy laws, may have rights similar to those described in Section 9, including rights to access, correct, delete, and opt out of certain processing of personal information. The specific rights available to you depend on your state of residence and the law applicable in your state.

10.2 Opt Out of Targeted Advertising and Profiling. Apaly Health does not engage in targeted advertising using your personal information or in profiling that produces legal or similarly significant effects. Accordingly, opt-out rights related to targeted advertising and profiling do not apply to our current practices.

10.3 Opt Out of Sale. Apaly Health does not sell personal information. Opt-out rights related to the sale of personal information do not apply to our current practices.

10.4 Data Sharing for Program Administration. We share your personal information with Program Suppliers and Dispensing Pharmacy partners for program administration purposes as described in Section 4 of this Policy and in your HIPAA Authorization at apalyrx.com/legal. This sharing is necessary to perform the services you have enrolled in and is not sharing for targeted advertising or other commercial purposes beyond program administration.

10.5 How to Exercise State Privacy Rights. To exercise any available state privacy rights, contact us at privacy@apalyrx.com or by mail at Apaly Health Inc., Privacy Officer, 802 E. Whiting, Tampa, Florida 33602. We will respond within the timeframe required by applicable law.

10.6 Right to Appeal. If we decline to take action on your privacy rights request, you may have the right to appeal our decision. To submit an appeal, contact us at privacy@apalyrx.com within 30 days of receiving our response, explaining the basis for your appeal. We will respond to your appeal within the timeframe required by applicable law.

11. Third-Party Websites and Services

11.1 Third-Party Links. The platform may contain links to third-party websites and services, including your Dispensing Pharmacy's patient portal, your employer's benefits portal, and other resources. This Privacy Policy does not apply to third-party websites or services. We encourage you to review the privacy policies of any third-party sites you visit.

11.2 Payment Processor. Payment processing is provided by Stripe, Inc. Your payment information is collected and processed by Stripe under Stripe's Privacy Policy at https://stripe.com/privacy. We do not store your full payment card numbers on our systems.

11.3 Analytics Providers. Our public websites use analytics and visitor identification tools including Visitor Intelligence, RB2B, and Apollo.io. These tools collect information about website visitors, including IP address, company information, and browsing behavior, for business development purposes. These tools operate under their respective privacy policies. If you wish to limit collection by these tools, you may use browser privacy settings or opt-out mechanisms provided by those tools.

12. Changes to This Privacy Policy

12.1 Updates. Apaly Health may update this Privacy Policy from time to time to reflect changes in our practices, the platform, or applicable law. When we make material changes, we will update the date at the top of this Policy and, where required by law, notify you by email or through the platform.

12.2 Continued Use. Your continued use of the platform following any update to this Policy constitutes your acceptance of the updated Policy. If you do not agree to the updated Policy, you must stop using the platform and contact us to request deletion of your personal information.

13. Contact Us

13.1 Privacy Officer. For questions, concerns, or requests related to this Privacy Policy or your personal information, contact our Privacy Officer:

• Email: privacy@apalyrx.com
• Mail: Apaly Health Inc., Privacy Officer, 802 E. Whiting, Tampa, Florida 33602
• Account settings: apalyrx.net

13.2 HIPAA Concerns. For questions or concerns related to the privacy of your Protected Health Information or to request a copy of our Notice of Privacy Practices, contact us at privacy@apalyrx.com.

13.3 State Regulatory Authorities. If you believe we have violated your privacy rights, you may file a complaint with your state attorney general or applicable state privacy regulatory authority. In California, complaints may be filed with the California Privacy Protection Agency at https://cppa.ca.gov. Filing a complaint will not result in retaliation against you.