Nebraska Resident Privacy Notice

NEBRASKA RESIDENT PRIVACY NOTICE

Effective Date: May 9, 2025

This Nebraska Resident Privacy Notice (“Nebraska Notice”) provided by Thirty Madison, Inc., d/b/a Cove, Keeps, and Nurx, and its subsidiaries and affiliates ("Company" or "we"), supplements the information contained in the Thirty Madison Online Privacy Policy (“Privacy Policy” or “Policy”) and applies solely to individual residents of the State of Nebraska ("consumers" or "you").

The Privacy Policy describes how Thirty Madison collects, uses, and shares information about you through the Services where the Privacy Policy is posted, including details about the categories of Personal Data processed, the purposes for processing, the categories of third parties with whom Personal Data may be shared and the categories of Personal Data shared, and the process by which we will notify you of material changes. This Nebraska Notice supplements the Privacy Policy by explaining the additional rights provided to Nebraska residents under the Nebraska Data Privacy Act (“NDPA”) and how to exercise those rights, subject to NDPA exceptions. Any terms defined in the NDPA have the same meaning when used in this Nebraska Notice.

If you are a Nebraska resident, the NDPA provides you with certain rights with respect to your Personal Data, as described in this Notice. Personal Data includes any information that is linked or reasonably linkable to you. Personal Data does not include information that has been “deidentified” or is publicly available.

Your privacy rights under the NDPA do not apply to all information that we might collect, use, or disclose. For example, the NDPA does not apply to protected health information (PHI) that we handle as HIPAA-covered entities. Your PHI is instead governed by HIPAA and covered by KMG’s HIPAA Notice of Privacy Practices.

YOUR NDPA RIGHTS THE RIGHT OF ACCESS. Upon verifying your identity, you have the right to confirm whether we are processing Personal Data and to access or obtain a copy of your Personal Data. This right does not require us to disclose any trade secrets.

THE RIGHT TO DATA PORTABILITY. When exercising the Right of Access, you have the right to obtain your Personal Data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance.

THE RIGHT OF CORRECTION. You have the right to request that we correct inaccuracies in the Personal Data we collected and maintain about you, taking into account the nature of the data and the purposes for which it is processed. We may require documentation to verify the accuracy of requested corrections and may deny requests under the NDPA or other laws. If denied, we will provide the reasons in our response.

THE RIGHT TO REQUEST DELETION. You have the right to request that we delete the Personal Data we have concerning you. Upon verifying your identity, we will delete (and direct our service providers to delete) your Personal Data, unless an exception applies. We may also have a reason under the NDPA or other laws to deny your deletion request, either in whole or in part. If so, we will explain the reason in our response.

THE RIGHT TO OPT-OUT. To the extent applicable, you have the right to opt-out of our processing of your Personal Data for the purposes of: (i) targeted advertising; (ii) the sale of your Personal Data; or (iii) profiling in furtherance of decisions that produce legal effects or similarly significant effects concerning consumers. __Please note, however, that we do not process Personal Data for purposes of profiling as defined by the NDPA. __

THE RIGHT NOT TO RECEIVE DISCRIMINATORY TREATMENT. We will not discriminate against you, in violation of the NDPA, for exercising any of your NDPA rights.

HOW TO EXERCISE YOUR RIGHTS.

To exercise your rights, you or your authorized agent may contact us at:

• Cove: Phone (877) 456-2683; Email care@withcove.com
• Keeps: Phone (833) 745-3377; Email help@keeps.com
• Nurx: Phone (800) 321-NURX; Email nurx-support@thirtymadison.com

RESPONSE TIMING AND FORMAT If we can verify your identity, we will try our best to respond to your request within forty-five (45) days of receipt. If we require more time (up to forty-five (45) additional days), we will inform you of the reason and extension period in writing. We will provide information to you free of charge twice during any twelve (12)-month period. However, we reserve the right to charge a reasonable fee to process or respond to a third or subsequent identical request within the same twelve (12)-month period or if we determine that such request is excessive, repetitive, or manifestly unfounded. If we determine that your request warrants a fee, we will inform you of the reason for that decision and provide you with a cost estimate before completing your request.

RIGHT TO APPEAL If we are unable to comply with all or a portion of your request, we will explain the reasons we cannot comply. We will inform you of any action taken or not taken in response to the request and explain the reasons for our decision within forty-five (45) days of receiving the request. You may appeal our decision by resubmitting your request and we will respond no later than sixty (60) days from receiving your appeal and inform you of any action taken or not taken in response to the appeal. If your appeal is denied, you may lodge a complaint with the Nebraska Attorney General, available at: https://www.nebraska.gov/apps-ago-complaints/.

RIGHT TO OPT-OUT OF SELLING PERSONAL DATA AND TARGETED ADVERTISING We do not monetize your Personal Data. However, we may disclose certain types of Personal Data for non-monetary consideration, as set forth in the Thirty Madison Privacy Policy, which is treated as a “sale” of Personal Data under the NDPA. When you visit our websites, we provide you with a cookie banner and you have the right to opt-out of any “sale” of Personal Data. You also have the right to opt-out of the processing of your Personal Data for targeted advertising.

You may opt-out of the “sale” of your Personal Data and/or targeted advertising through:

• The Manage Preferences banner;
• Clicking Your Privacy Choices on the bottom of the Thirty Madison homepage, and then adjusting cookie settings under Storage Preferences by clicking the toggle next to Do Not Sell or Share My Personal Data (so the toggle is on) or Targeted Advertising (so the toggle is off); or
• A Universal Opt-Out Mechanism. We recognize and honor universal opt-out mechanisms (UOOMs) to opt-out of the sale of Personal Data and targeted advertising.

QUESTIONS AND HOW TO CONTACT US

If you have any questions, concerns, or complaints regarding this New Jersey Policy, please contact us at:

• Cove: Phone (877) 456-2683; Email care@withcove.com
• Keeps: Phone (833) 745-3377; Email help@keeps.com
• Nurx: Phone (800) 321-NURX; Email nurx-support@thirtymadison.com

Or write to us at: Thirty Madison, Inc. 82 Nassau St #61392 New York, NY 10038