TEXAS RESIDENT PRIVACY NOTICE

Effective Date: July 1, 2024

This Texas Resident Privacy Notice (“Texas Policy”) provided by Thirty Madison, Inc., d/b/a Cove, Keeps, Facet, and Nurx (collectively “Thirty Madison”), and its subsidiaries and affiliates (“Thirty Madison”, “Company” or “We”) supplements the information contained in the Thirty Madison Online Privacy Policy (“Privacy Policy”). This Texas Policy applies only to individual residents of the State of Texas (“consumers” or “you”). The Privacy Policy, as supplemented by this Texas Policy, describes how Thirty Madison collects, uses, and shares information about you through our websites, social media, email exchanges, mobile apps, and other online services on which the Policy is posted (“Service”).

If you are a Texas resident, the Texas Data Privacy and Security Act and any future amendments (collectively “TDPSA”) provide you with certain rights with respect to your Personal Data. Your Personal Data includes any information that identifies you or is linked to you. Personal Data does not include information that has been “deidentified” or that is publicly available. This Texas Policy describes your rights with respect to your Personal Data and explains how to exercise those rights.

Your privacy rights under the TDPSA do not apply to all information that we might collect, use or disclose. For example, the TDPSA does not apply to protected health information that we handle as HIPAA-covered organizations. Your protected health information is instead governed by HIPAA and is covered by the Medical Group’s HIPAA Notice of Privacy Practices.

Any terms defined in the TDPSA have the same meaning when used in this Texas Policy.

THE RIGHT TO KNOW, ACCESS AND OBTAIN A COPY

Upon verification of your identity, you have the right to know whether we hold Personal Data about you, to access that Personal Data, and to obtain a copy of that Personal Data you previously provided us (if that Personal Data is in a digital format, and it is technically feasible to provide you a copy).

THE RIGHT TO CORRECT

You have the right to request that we correct inaccurate Personal Data that we hold about you.

THE RIGHT TO REQUEST DELETION

You have the right to request that we delete the Personal Data that we hold about you.

RIGHT TO OPT-OUT OF SELLING PERSONAL DATA AND TARGETED ADVERTISING We do not sell sensitive Personal Data. However, we may disclose other types of Personal Data for non-monetary consideration, as set forth in the Thirty Madison Online Privacy Policy, which is treated as a “sale” of Personal Data. You have the right to opt-out of any “sale” of Personal Data. You also have the right to opt-out of the processing of your Personal Data for targeted advertising.

You may opt-out of the selling of your Personal Data and targeted advertising through the Manage Preferences banner or by clicking Your Privacy Choices on the bottom of the Thirty Madison homepage; then changing cookie settings under Storage Preferences by clicking the toggle next to Do Not Sell or Share My Personal Data (so the toggle turns green) or Targeted Advertising (so the toggle turns gray). We may verify opt-out requests.

As of January 1, 2025, we will recognize and honor universal opt-out mechanisms (UOOMs) to opt-out of the sale of Personal Data and targeted advertising.

We do not process Personal Data for purposes of profiling in furtherance of a decision that produces a legal or similarly significant effect concerning a consumer, as those terms are defined by the TDPSA.
__ TO SUBMIT A REQUEST TO EXERCISE YOUR RIGHTS __

You may designate an authorized agent to exercise your rights on your behalf. To exercise the rights described above, you or your authorized agent may contact us at:

Cove: Phone (877) 456-2683; Email care@withcove.com

Keeps: Phone (833) 745-3377; Email help@keeps.com

Facet: Phone (855) 658-8855; Email help@facetcare.com

Nurx: Phone (800) 321-6879; Email support@nurx.co

We may ask you to provide additional Personal Data, such as your date of birth, address, or email address so that we can properly identify you in our data systems. We will only use Personal Data provided in a request to review to comply with your request. If you choose not to provide this information, we may only be able to process your request to the extent we are able to identify you in our data systems. In certain circumstances, we may decline a request to exercise the rights described above.

RESPONSE TIMING AND FORMAT

If we can verify your identify, we will try our best to respond to your request within forty-five (45) days of receipt. If we are unable to process your request in such time, we will inform you of the delay in writing.

If you have an account with us, we will deliver our written response through your account or through email. If you do not have an account with us, we will deliver our written response by mail or email. We will provide information to you free of charge, up to twice per year. However, we reserve the right to charge a fee to process or respond to your request if we determine that such request is unfounded, excessive or repetitive.

RIGHT TO APPEAL

If we are unable to comply with all or a portion of your request, we will explain the reasons we cannot comply. We will inform you of any action taken or not taken in response to the request and explain the reasons for our decision within sixty (60) days of receiving the request. You may appeal our decision by resubmitting a request.