Effective Date of this Privacy Policy: March 8, 2023

TLC respects your concerns about privacy. This Privacy Policy (“Policy”) describes the personal information we may obtain about you, including when you visit our retail stores, use the TLC website, the TLC Online Store, our Text Messaging Program, and other related online and offline services and communications with us (collectively, the “Sites”). We also describe how we may use and disclose that information, and explain the choices available to you regarding our use of the information, the measures we take to protect the security of the information, and how you can contact us if you have any questions about our privacy practices. SMS recipients: We will not share, rent or sell your Personal Information to other companies or individuals, unless we have your consent.

Please note that the personal information we may obtain in some circumstances can include “protected health information” (“PHI”), which is subject to specific privacy and security protections under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). Please see our HIPAA Notice of Privacy Practices to learn how we handle PHI and specific rights you have in regard to your PHI. That PHI-specific notice takes precedence and supersedes this Policy in the event of any conflict.

This Policy and your use of any of our Sites is subject to our Terms & Conditions (“Terms”), and by registering for or otherwise using our Sites, you agree to be bound by our Terms and this Policy. If you have questions about this Policy, please contact us as directed below.

1. Information We Obtain

Some of the information we collect is personal information, which generally means information that identifies you as an individual, or other information we associate with it. We may obtain personal information in various ways, such as when you visit our Sites, including at stores, our website, or when creating a TLC account.

(A) Information We Collect From You

The types of personal information we may obtain directly from you include:

· contact information, such as name, phone number, postal address and email address;

· demographic information, such as date of birth and gender;

· transactional information, such as payment card information (e.g., card number, expiration date, and security code), bank account number, and purchase history;

· information associated with a TLC account, including login credentials (e.g., username and password), profile information and subscription preferences;

· information related to prescription management (such as medical information and prescription numbers);

· comments, product reviews and other content provided through or in connection with our Sites;

· geolocation data associated with your use of the Sites;

· for individuals who apply for a career opportunity with TLC: contact information, data submitted on a résumé or in a job application, and other information we obtain to administer the careers process; and

· for individuals who provide services to TLC: contact information and other details we may obtain in managing our relationship with such service providers.

We maintain equipment in our retail stores which may capture information about shoppers, including cameras used for security and operational purposes, in-store networking equipment, and supporting your participation in our loyalty program and use of coupons or promotions we are offering.

We also may obtain other information about you in ways we describe at the time we collect the information or otherwise with your consent.

If you provide us with personal information about any other individual (such as a family member), you represent that you have any necessary consents to give us their information for use in accordance with this Policy.

(B) Information We Collect Automatically

When you interact with our Sites, we can obtain certain information by automated means (collectively, “Online User Activity”) through cookies, web server logs, web beacons and other similar technologies implemented on our website and mobile app. A “cookie” is a text file that websites send to a visitor’s computer or other Internet-connected device to uniquely identify the visitor’s browser or to store information or settings in the browser. A “web beacon,” also known as an Internet tag, pixel tag or clear GIF, links web pages to web servers and their cookies and may be used to transmit information collected through cookies back to a web server.

We may use these automated technologies to collect information about your device (e.g., computer, mobile phone), browsing actions, and usage patterns. The information we obtain in this manner may include your device IP address, identifiers associated with your devices, types of devices connected to our services, web browser characteristics, device characteristics, language preferences, referring/exit pages, clickstream data, and dates and times of website visits. These technologies help us (1) remember your information so you will not have to re-enter it; (2) track and understand how you use and interact with our products and services; (3) tailor our Sites around your preferences; (4) measure the usability of our Sites and the effectiveness of our communications; (5) provide customer support; and (6) otherwise manage and enhance our Sites and marketing activities.

Your browser may be configured to alert you when receiving certain types of cookies or enable you to restrict or disable certain types of cookies. You can find out how to do this for your particular browser by clicking “help” on your browser’s menu or visiting www.allaboutcookies.org. For mobile devices, you can manage how your device and browser share certain device data by adjusting the privacy and security settings on your device. Our Sites are not designed to respond to “do not track” signals received from browsers. Please note that without cookies you may not be able to use or benefit from all of the functionality or features on our Sites.

(C) Third-Party Web Analytics Services

We use third-party web analytics services on our Sites, such as Google Analytics and Adobe Analytics. The service providers that administer these services use automated technologies to collect data (such as IP addresses, cookies, and other device identifiers) to evaluate use of our Sites. To learn more about Google Analytics and how to opt out of their tool entirely, please visit www.google.com/analytics/learn/privacy.html. 

(D) Online Tracking and Interest-Based Advertising

We may use certain cookies known as “Third Party Targeting Cookies” as well as other advertising techniques to share limited identifying information including Online User Activity with advertising partners to provide you with advertising about products and services tailored to your interests. You may see our ads on other websites or mobile apps through this technique, since it enables us to target our messaging to users considering demographic data, users’ inferred interests and browsing context. In similar fashion, ad technology companies track users’ online activities over time by collecting information through automated means, including through the use of cookies, web server logs, web beacons and other similar technologies. This information is used to show ads that may be tailored to individuals’ interests, to track users’ browsers or devices across multiple websites, and to build a profile of users’ online browsing activities. The information collected may include data about users’ visits to websites that participate in the online ad ecosystem, such as the pages or ads viewed and the actions taken on the websites. This data collection takes place both on our Sites and on third-party websites that participate in the online ad ecosystem. This process also helps us track the effectiveness of our marketing efforts. To learn how to opt out of interest-based advertising, please

visit www.aboutads.info/choices and http://www.networkadvertising.org/choices/.

(E) Information we Receive from Third Parties

We may receive information you provide on behalf of third parties, or third parties provide on your behalf, including but not limited to healthcare providers and gift card purchasers/recipients. We may receive information from or about you if you follow or engage with us through social media platforms that we use. We may also receive information from sources assisting us with (i) enhancing or correcting our customer records; (ii) performing marketing and research services; or (iii) detecting fraud or theft. In the event we acquire a business, we may receive information from the seller of such business.

2. How We Use the Information We Obtain

We may use the personal information we obtain to:

· provide our products and services, such as to create and manage TLC accounts and loyalty programs, facilitate purchases at our Sites, process and fulfill orders, keep you informed about the status of your orders (including messaging with TLC pharmacists, who may provide you with health care information), and provide related customer and technical support;

· personalize your experience on our Sites, and communicate with you about products and services that may be of interest to you, including promotional materials about TLC and third-party products and services;

· provide and administer your participation in surveys, events, contests and programs (including discount or coupon-related offers);

· provide you with location-based information (such as finding a TLC store near you);

· operate, evaluate, develop, manage and improve our business (including operating, administering, analyzing, and improving our Sites; developing new products and services; managing and evaluating the effectiveness of our communications; conducting market research, aggregating and anonymizing data, and performing data analytics; facilitating the provision of services to TLC; and performing accounting, auditing, and other internal functions);

· protect against, identify and respond to suspected fraud, criminal activity, violations of law or our Terms and other policies, or any harm to our staff or any other individual; and

· comply with and enforce applicable legal requirements, relevant industry standards, contractual obligations and our policies, including this Privacy Policy, our HIPAA Notice of Privacy Practices, and our Terms and Conditions.

We also may use the personal information we obtain in other ways for which we may provide specific notice at the time of collection or otherwise with your consent.

3. How We May Share Information

We may share information about you with the following categories of third parties, where consistent with this Policy and applicable laws:

· Our service providers (e.g., IT services, maintenance and hosting of our Sites, payment processors, marketing and analytics, customer communications, order fulfillment and shipping), but we only provide information to these providers to perform their required functions on our behalf; and

We also may disclose information about you in certain unusual circumstances, including (1) if we are required to do so by law or legal process; (2) in response to requests by government agencies, such as law enforcement authorities; (3) to establish, exercise, or defend our legal rights; (4) when we believe disclosure is necessary or appropriate to prevent physical or other harm or financial loss; (5) in connection with an investigation of suspected or actual fraud or other illegal activity; or (6) in the event we sell or transfer (or contemplate the sale or transfer of) all or a relevant portion of our business or assets (including in the event of a merger, acquisition, joint venture, reorganization, divestiture, dissolution, or liquidation).

4. Links to Other Online Services

Our Sites may provide advertisements for or links to other online services for your convenience and information, and may include third-party features such as apps, tools, payment services, widgets and plug-ins (e.g., PayPal, Facebook, Twitter, Instagram, LinkedIn and YouTube). These third-party online services and features may operate independently from us. The privacy practices of the relevant third parties, including details on the information they may collect about you, is subject to the privacy statements of these parties, which we strongly suggest you review. To the extent any linked third-party online service or feature is not owned or controlled by us, TLC is not responsible for these third parties’ information practices.

You may see us promoted by other businesses on various websites, social media and other platforms. Please note that we do not always have complete information about where our brand may be displayed or promoted, and if you believe that we are featured in venues that are inappropriate or offensive, please contact us as directed below.

5. Your Choices

(A) Choices Available to All Individuals

We offer you certain choices in connection with the personal information we obtain about you.

· Accessing and Correcting Your Information: Keeping your account information up-to-date is very important. You can generally review or update your personal information, preferences and communication settings by logging in to the Sites online or by contacting us as directed below.

· Marketing Emails: From time to time, we or the brand/services partners we engage with as described above may contact you via email for the purpose of providing announcements, promotional offers, alerts, confirmations, surveys, and/or other general communications. In addition to changing communication preferences in your account (as noted above), you may unsubscribe from such marketing communications at any time by selecting the unsubscribe option within the body of the e-mail. Even if you opt out of receiving such communications, we will continue sending you non-marketing email communications, such as administrative or transaction alerts.

· Cookies: As described above, web browsers may offer users the ability to disable receiving certain types of cookies; however, if cookies are disabled, some features or functionality of our Services may not function correctly.

· Targeted Advertising: We may work with advertising partners who collect information about your online activities and provide you with choices regarding the use of your browsing behavior for purposes of targeted advertising. Popular advertising services you may opt out of targeted advertising from include Google, Facebook, the Network Advertising Initiative and Digital Advertising Alliance.

(B) Notice Regarding Text Messages

We offer service-related and/or promotional messages. If you affirmatively consent to receive these text messages from us and enroll in any text message program, you will receive updates via text unless you opt-out of the text message program. Message frequency may vary. If at any time you would like to stop receiving text message notifications, please text “STOP” in reply to our message, we will send you a reply message to confirm that you have been unsubscribed and you will no longer receive messages from us. If you want to join again, just sign up as you did the first time and we will start sending messages to you again. If at any time you forget what keywords are supported, just text “HELP” back to us and we will respond with instructions on how to use our service as well as how to unsubscribe.

Participating carriers are not liable for delayed or undelivered messages. As always, message and data rates may apply for any messages sent to you from us and to us from you. If you have any questions about your text plan or data plan, it is best to contact your wireless provider. For any questions about our text program, you can contact us as provided below.

(C) State-Specific Privacy Rights

The residents of certain states are entitled to additional privacy disclosures and privacy rights. Please see the end of this Policy regarding such disclosures and to learn more about exercising those rights.

6. How We Protect and Retain Personal Information

We maintain administrative, technical, and physical safeguards designed to protect personal information against accidental, unlawful, or unauthorized destruction, loss, alteration, access, disclosure, or use. No data transmission or storage is 100% secure, and we cannot guarantee that information you send to us online or via email, or information that we maintain about you, will not be accessed, disclosed, altered, or destroyed. We will make any legally required disclosures of any breach of the security, confidentiality, or integrity of your personal information. To the extent the law of your jurisdiction allows for notification of a security or privacy incident via e-mail or the Services, you agree to accept notice in that form.

We retain personal information based on a number of factors, including (i) for business purposes such as for as long as your account is active, as long as is reasonably necessary to provide you with our products and services, and for the other purposes we use your information as described above, and (ii) as reasonably necessary to comply with our legal obligations, resolve disputes and enforce our agreements. We may also retain cached or archived copies of your information for a reasonable period of time. 

7. Children’s Personal Information

Our Sites are designed for a general audience and are not directed to children under the age of 13. We do not knowingly collect or solicit personal information from children under the age of 13 through our Sites, and endeavor to promptly delete such information if we become aware of it. If you believe that a child under the age of 13 may have provided us with personal information online without parental consent, please contact us as directed below.

8. Updates to This Privacy Policy

We may update this Policy from time to time and without prior notice to you, such as to reflect changes in our personal information practices with respect to our Sites, or to comply with new privacy laws or best practices. We will indicate at the top of the Policy when it was most recently updated. By continuing to use any Sites after such a change, you agree to the updated Policy.

9. How to Contact Us

Please contact us if you have any questions or requests in regard to this Policy or our handling of your information, such as to update or correct your information or preferences, or to submit a request.

You can contact us by phone at: (956.424.6268)

You also may write to us at: Attn: Privacy Officer, TLC Pharmacy, 909 Business Park Drive, Suite # 2 Mission, TX 78572.

10. State-Specific Notices

(A) California Residents: Retail Customers

This Section is provided specifically for California residents. In addition to the disclosures and rights provided above in this Policy, if you are a California resident you may be entitled to additional information about our practices as well as the right to exercise certain requests regarding your personal information.

1. Additional Notice of Collection and Use of Personal Information

This Section elaborates on the disclosures at the top of this Policy in regard to the categories of personal information we may about you:

· Identifiers: identifiers such as a real name, alias, postal address, unique personal identifier (such as a device identifier; cookies, beacons, pixel tags, mobile ad identifiers and similar technology; customer number, unique pseudonym, or user alias; telephone number and other forms of persistent or probabilistic identifiers), online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, and other similar identifiers;

· Additional Data Subject to (Cal. Civ. Code § 1798.80): signature, physical characteristics or description, state identification card number, bank account number, credit card number, debit card number, and other financial information;

· Protected Classifications: characteristics of some protected classifications under California or federal law, such as race, age, gender, disability status, and veteran status;

· Commercial Information: commercial information, including records of products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies;

· Biometric Information:  imagery of the face;

· Online Activity: Internet and other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding your interaction with websites, applications or advertisements;

· Geolocation Data;

· Sensory Information: audio and visual information;

· Employment Information: professional or employment-related information that is typically found on a résumé;

· Inferences: inferences drawn from any of the information identified above reflecting your preferences, characteristics, and purchasing behavior.

Opt-Out Rights

You have the right at any time to opt out of (i) any selling or sharing of your personal information to a third party (excluding service providers or other exceptions permitted by law); (ii) any third-party targeted advertising (i.e., cross-context behavioral advertising); and (iii) any use of sensitive personal information (such as precise geo-location or financial information) except for the purposes it was collected and as otherwise permitted by law. As described above, certain identifying information with Online User Activity may be shared with brands/services we partner with, advertising businesses and other third parties through Third Party Targeting Cookies or other means. You are entitled to opt-out of these and other activities (some of which are referred to as a “Do Not Sell” right):

· Any selling or sharing of your personal information to a third party (excluding service providers or other exceptions permitted by law);

· Any third-party targeted advertising (i.e., cross-context behavioral advertising); and

· Any use of sensitive personal information (such as precise geo-location information) except for the purposes it was collected and as otherwise permitted by law.

As described above, you can opt-out of Third Party Targeting Cookies by as described above or the used of an automated GPC signal from your browser. All other opt-opts can be exercised as provided below.

Privacy laws may provide you with other opt-out rights which are inapplicable to us. In particular, we do not engage in impactful profiling activities with respect to our customers.

To submit an Opt-Out Request: Call us at 956.424.6268.

Verifying and Processing Requests

To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal information or complying with your request. You will be required to provide some information, based on the nature of your request, including, but not limited to: name, email, home address, date of birth, phone number, look-up phone number and/or TLC account number. In addition, if you ask us to provide you with specific pieces of personal information, we will require you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request. If you designate an authorized agent to submit a request on your behalf (a) we may require you to provide the authorized agent written permission to do so, and (b) we may require you to verify your own identity directly with us as described above.

If we deny a privacy request, you may appeal the decision to us at the contact information provided below. To the extent possible, please describe the basis for your appeal and if there is any specific personal information that concern you. We will endeavor to provide a prompt response.

We may not, and will not, discriminate against any customer for exercising their privacy rights, including those provided by the applicable privacy laws. Please note that we may otherwise continue to share your personal information with our affiliates and service providers, and as otherwise directed by you, for the purposes described in our Policy.