New Jersey Resident Privacy Notice

NEW JERSEY RESIDENT PRIVACY NOTICE

NEW JERSEY RESIDENT PRIVACY NOTICE

Effective Date: January 15, 2025

This New Jersey Resident Privacy Notice (“New Jersey Policy”) provided by Thirty Madison, Inc., d/b/a Cove, Keeps, Facet, and Nurx, and its subsidiaries and affiliates ("Company" or "we"), supplements the information contained in the Thirty Madison Online Privacy Policy (“Privacy Policy” or “Policy”) and applies solely to individual residents of the State of New Jersey ("consumers" or "you").

The Privacy Policy describes how Thirty Madison collects, uses, and shares information about you through the Services where the Privacy Policy is posted, including details about the categories of Personal Data processed, the purposes for processing, the categories of third parties with whom Personal Data may be shared and the categories of Personal Data shared, and the process by which we will notify you of material changes. This New Jersey Policy supplements the Privacy Policy by explaining the additional rights provided to New Jersey residents under the New Jersey Privacy Act (“NJPA”) and how to exercise those rights, subject to NJPA exceptions. Any terms defined in the NJPA have the same meaning when used in this New Jersey Policy.

If you are a New Jersey resident, the NJPA provides you with certain rights with respect to your Personal Data, as described in this Notice. Personal Data includes any information that is linked or reasonably linkable to you. Personal Data does not include information that has been “deidentified” or is publicly available.

Your privacy rights under the NJPA do not apply to all information that we might collect, use, or disclose. For example, the NJPA does not apply to protected health information (PHI) that we handle as HIPAA-covered entities. Your PHI is instead governed by HIPAA and covered by KMG’s HIPAA Notice of Privacy Practices.

YOUR NJPA RIGHTS

THE RIGHT TO KNOW. Upon verifying your identity, you have the right to know whether we hold Personal Data about you, as well as the categories of Personal Data that we have disclosed, and the categories of third parties to whom we disclosed it.

THE RIGHT TO ACCESS AND OBTAIN A COPY. You have the right to access or obtain a copy of your Personal Data in a portable and readily usable format that allows you to transmit it to another entity without hindrance. This right does not require us to disclose any trade secrets.

THE RIGHT TO CORRECT. You have the right to request that we correct inaccuracies in the Personal Data we collected and maintain about you, taking into account the nature of the data and the purposes for which it is processed. We may require documentation to verify the accuracy of requested corrections and may deny requests under the NJPA or other laws. If denied, we will provide the reasons in our response.

THE RIGHT TO REQUEST DELETION. You have the right to request that we delete the Personal Data we have concerning you. Upon verifying your identity, we will delete (and direct our service providers to delete) your Personal Data, unless an exception applies. We may also have a reason under the NJPA or other laws to deny your deletion request, either in whole or in part. If so, we will explain the reason in our response.

THE RIGHT TO OPT-OUT. To the extent applicable, you have the right to opt-out of our processing of your Personal Data for the purposes of: (i) targeted advertising; (ii) the sale of your Personal Data; or (iii) profiling in furtherance of decisions that produce legal effects or similarly significant effects concerning consumers. Please note, however, that we do not process Personal Data for purposes of profiling as defined by the NJPA.

THE RIGHT NOT TO RECEIVE DISCRIMINATORY TREATMENT. We will not discriminate against you, in violation of the NJPA, for exercising any of your NJPA rights.

HOW TO SUBMIT A REQUEST TO EXERCISE YOUR RIGHT TO KNOW, ACCESS, CORRECT, AND DELETE

To exercise your rights, you or your authorized agent may contact us at: Cove: Phone (877) 456-2683; Email care@withcove.com Keeps: Phone (833) 745-3377; Email help@keeps.com Facet: Phone (855) 658-8855; Email help@facetcare.com Nurx: Phone (800) 321-6879; Email nurx-support@thirtymadison.com

RESPONSE TIMING AND FORMAT If we can verify your identity, we will try our best to respond to your request within forty-five (45) days of receipt. If we require more time (up to forty-five (45) additional days), we will inform you of the reason and extension period in writing.

We will provide information to you free of charge once during any twelve (12)-month period. However, we reserve the right to charge a reasonable fee to process or respond to a second or subsequent identical request within the same twelve (12)-month period or if we determine that such request is excessive, repetitive, or manifestly unfounded. If we determine that your request warrants a fee, we will inform you of the reason for that decision and provide you with a cost estimate before completing your request.

RIGHT TO APPEAL If we are unable to comply with all or a portion of your request, we will explain the reasons we cannot comply. We will inform you of any action taken or not taken in response to the request and explain the reasons for our decision within forty-five (45) days of receiving the request. You may appeal our decision by resubmitting your request. If your appeal is denied, you may lodge a complaint with the New Jersey Division of Consumer Affairs in the Department of Law and Public Safety, available at: https://www.njconsumeraffairs.gov/.

RIGHT TO OPT-OUT OF SELLING PERSONAL DATA AND TARGETED ADVERTISING We do not monetize your Personal Data. However, we may disclose certain types of Personal Data for non-monetary consideration, as set forth in the Thirty Madison Privacy Policy, which is treated as a “sale” of Personal Data under the NJPA. When you visit our websites, we provide you with a cookie banner and you have the right to opt-out of any “sale” of Personal Data. You also have the right to opt-out of the processing of your Personal Data for targeted advertising.

You may opt-out of the “sale” of your Personal Data and/or targeted advertising through:

  • The Manage Preferences banner;
  • Clicking Your Privacy Choices on the bottom of the Thirty Madison homepage, and then adjusting cookie settings under Storage Preferences by clicking the toggle next to Do Not Sell or Share My Personal Data (so the toggle turns green) or Targeted Advertising (so the toggle turns gray). We may verify opt-out requests; or
  • A Universal Opt-Out Mechanism. As of July 15, 2025, we will recognize and honor universal opt-out mechanisms (UOOMs) to opt-out of the sale of Personal Data and targeted advertising.

QUESTIONS AND HOW TO CONTACT US

If you have any questions, concerns, or complaints regarding this New Jersey Policy, please contact us at:

Cove: Phone (877) 456-2683; Email care@withcove.com

Keeps: Phone (833) 745-3377; Email help@keeps.com

Facet: Phone (855) 658-8855; Email help@facetcare.com

Nurx: Phone (800) 321-NURX; Email nurx-support@thirtymadison.com

Or write to us at:

Thirty Madison, Inc.

82 Nassau St #61392 New York, NY 10038