Vitamins that stick with your schedule. Literally.
Menu PatchAid
Vitamins that stick with your schedule. Literally.

Privacy policy

Last Updated: August 22, 2026

SMS/Text Messaging. For how we collect, use, and protect information in connection with our SMS/text message program, please also review our Messaging Terms and Messaging Privacy Policy, which are incorporated into and form part of this Privacy Policy.

Your Privacy Choices. To opt out of the sale or sharing of your personal information, or of its use for targeted advertising, visit Your Privacy Choices.

Consumer Health Data. For disclosures and rights concerning consumer health data, see our separate Consumer Health Data Privacy Policy.

PatchAid ("PatchAid," "we," "us," or "our") respects the privacy of our customers and has developed this Privacy Policy to demonstrate our commitment to protecting your privacy. This Privacy Policy describes, for you as an individual who uses the PatchAid website, places orders by phone, uses our other services, or who otherwise provides us with information by phone, mobile application, chat, text message, fax, mail, at a retail location, or by other means (collectively, the "Services"), the information we collect, how that information may be used, with whom it may be shared, and your choices about such uses and disclosures.

We encourage you to read this Privacy Policy carefully when using our Services or transacting business with us. By using our Services or otherwise doing business with us, you accept the practices described in this Privacy Policy. If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing, and disclosure of your personal information.

If you have any questions about our privacy practices, please refer to the "How to Contact Us" section at the end of this Privacy Policy.

TABLE OF CONTENTS

QUICK SUMMARY

This summary is provided for convenience and does not replace the full Privacy Policy below.

  • We collect information you give us (such as your name, contact details, and payment information), information collected automatically (such as device and usage data through cookies and similar technologies), and information from other sources.
  • We use information to fulfill orders, operate and improve our Services, communicate with you, personalize and deliver advertising, and meet legal obligations.
  • We share information with service providers and, for advertising purposes, with certain third parties. These advertising-related disclosures may be considered a "sale" or "sharing" of personal information under some state laws.
  • Some information we handle may be treated as "consumer health data" or "sensitive information" under certain state laws. We describe how we handle it, and how you can withdraw consent, in the sections below.
  • Depending on where you live, you may have rights to access, delete, correct, and obtain a copy of your personal information, and to opt out of targeted advertising and the sale or sharing of your personal information.
  • We honor the Global Privacy Control (GPC) browser signal as a request to opt out of sale or sharing and targeted advertising where required by law.
  • You can reach us at hello@patchaid.com, at (866) 230-3615, by mail, or through our online request form.

INFORMATION WE COLLECT

As described more fully in this section, we may collect information that can identify you ("personal information"), such as your name, phone number, mailing address, and e-mail address, (i) when you or other users provide it to us when using our Services, or (ii) from our affiliated businesses, our business partners, or other third parties. We may combine the personal information that we receive from different sources. When you provide personal information through our Services, the information may be sent to servers located in the United States.

Information You Provide

We may collect and store any personal information you enter on our Services, provide to us by phone, furnish to our customer service team, or give to us in some other manner. This includes identifying information such as your name, address, e-mail address, and telephone number, and, if you transact business with us, limited transaction and payment details. Payment card information is processed by our payment providers. We generally receive only the information needed to complete and support the transaction, such as payment status and limited card details. We also may request information about your interests and activities, your gender and age, your opinions about products and services that we offer, and other demographic information. If you choose to share it, for example in a product review, survey, or message to our customer service team, we may also receive information about your wellness preferences or product usage. Interactions with our Services may be monitored, recorded, and retained, and we may use third-party service providers to collect, store, and analyze information you provide when you use or interact with our Services.

Information From Other Sources

We may periodically obtain both personal and non-personal information about you from affiliated businesses, business partners, contractors, and other third parties, and add it to our account or other records. Examples include updated delivery and address information, purchase history, credit information, and additional demographic information. The categories of third-party sources include advertising networks, internet service providers, data analytics providers, government entities, operating systems and platforms, social networks, and data brokers.

Information About Others

We may also collect and store personal information about other people that you provide to us. If you use our Services to send another person (a friend, relative, colleague, or similar) a product as a gift, information that may interest them, or messages such as invitations, we may store your personal information and the personal information of each such recipient.

Information Collected Automatically

We and our service providers automatically collect information from your browser and devices when you use our Services. This information may include your IP address, device identifiers, browser type and language, operating system, time zone, access times, the content of any cookies that your browser previously accepted from us, the pages and products you view, the items you add to or remove from a shopping cart, search terms you enter, and the referring website address.

Information We Create

We create some personal information when you use our Services or in the operation of our business. This includes records of your transactions and communications with us, analytics information, and inferences we draw from the categories of information described above, such as inferred product preferences.

Mobile Information

We may collect information from your mobile device if you have downloaded any of our mobile application(s) or interact with our Services on a mobile device. Examples include your approximate or precise geographic location, how you use the application(s), and information about the type of device you use. To opt out of sharing certain information such as location, review the settings on your mobile device or uninstall the application(s).

Public Postings

If you post information about yourself or others, or communicate with others using our Services, please note that we cannot control who reads your postings or what they do with the information you provide. We encourage you to use caution in posting personal information. See "User-Submitted Content" below.

CONSUMER HEALTH DATA AND SENSITIVE INFORMATION

Washington residents and other consumers covered by consumer health data laws can review our separate Consumer Health Data Privacy Policy. It explains the categories, sources, uses, disclosures, and rights that apply to consumer health data.

PatchAid sells consumer products. We are a retailer. We do not provide medical advice, we do not diagnose or treat any condition, and nothing we publish is a substitute for the advice of a qualified healthcare professional. We do not require you to give us any health information in order to buy from us.

Even so, some of the information we handle may be treated as "consumer health data" under laws such as the Washington My Health My Data Act and Nevada Senate Bill 370, or as "sensitive information" or "sensitive data" under other state privacy laws. These laws define consumer health data broadly, and can include information derived or inferred from information that is not itself health information, such as the products you buy or view.

We distinguish between two different things:

  • Self-reported preferences, goals, and symptoms. Information you volunteer about your dietary preferences, wellness goals, product tolerance, or how a product made you feel. You choose whether to share this, typically in a product review, a survey, or a message to our customer service team.
  • Diagnosed medical conditions and treatment information. We do not ask for this, we do not need it to fulfill your order, and we ask that you not send it to us. If you send it anyway, for example in a customer service message, we handle it under this section and we do not use it for advertising.

We collect and process information in this category to fulfill your orders, respond to your inquiries, operate and improve our Services, and meet legal obligations. We may share it with service providers and processors that perform functions on our behalf, such as order fulfillment, customer service, payment processing, technology, and analytics, under contracts that limit their use of the data. We do not sell consumer health data, and we do not share consumer health data for cross-context behavioral advertising or targeted advertising. Where these laws require consent, we will obtain your consent before collecting or sharing consumer health data, and we will not collect or share consumer health data beyond what is necessary to provide a product or service you have requested without separate authorization where required.

See "Consumer Health Data Rights (Washington, Nevada, and Similar Laws)" below for the specific rights available to you and how to exercise them.

HOW WE USE INFORMATION WE COLLECT

We may use information that we collect about you to:

  • Fulfill your requests for products and services and process and ship your orders;
  • Manage returns, exchanges, refunds, warranties, and subscriptions;
  • Offer products and services that may be of interest to you;
  • Customize the advertising and content that you see on our Services and on other sites and platforms;
  • Communicate with you by e-mail, postal mail, telephone, text message, and mobile devices about products, services, orders, and account matters;
  • Manage your account and preferences and provide customer support, including reviewing recorded calls or the content of other communications for quality and training purposes;
  • Perform research and analytics and improve our Services, products, and offerings;
  • Identify and protect against fraudulent transactions, security incidents, and other misuse of our Services;
  • Verify your eligibility for, and deliver prizes in connection with, contests, sweepstakes, and promotions;
  • Personalize your experience, including, if you sign up for our text messaging program, sending you reminders such as shopping cart reminders;
  • Process payments, evaluate creditworthiness and payment options, and administer financing or installment programs you elect to use;
  • Enforce our Terms of Service and other terms, conditions, and policies;
  • Operate, manage, and grow our business, including in connection with a merger, acquisition, financing, reorganization, sale of assets, or bankruptcy; and
  • Comply with legal obligations, respond to lawful requests, establish or defend legal claims, and perform other functions as described to you at the time of collection.

Please also review "Your Choices About Marketing Communications" below.

TEXT MESSAGING (SMS/MMS) PROGRAM

If you opt in to our text messaging program, you consent to receive recurring automated marketing and transactional text messages (such as order updates, shopping cart reminders, and promotional offers) from or on behalf of PatchAid at the mobile number you provide. You may opt in by submitting your mobile number through a sign-up form on our Services, by texting a keyword to our text messaging number, or by giving your express written consent at checkout or in another program enrollment flow.

  • Consent is not a condition of purchase. Consent to receive text messages is not a condition of buying any goods or services from us, and you do not need to agree to receive texts in order to place an order.
  • Message frequency. Message frequency varies and depends on your activity and the programs you join.
  • Carrier rates. Message and data rates may apply. Your mobile carrier is not liable for delayed or undelivered messages.
  • Opt out. You can cancel at any time by replying STOP to any message you receive from us. After you send STOP, we will send one message to confirm that you have been unsubscribed, and you will receive no further messages from that program unless you re-enroll.
  • Help. For help, reply HELP to any message you receive from us, e-mail hello@patchaid.com, or call (866) 230-3615.
  • Processor. Our text messaging program is operated on our behalf by our SMS platform provider, Postscript, acting as our service provider and processor. Postscript processes your mobile number and message activity only to operate the program for us.
  • No sharing of opt-in data. We will not share your mobile opt-in information or your consent with third parties for their own marketing purposes.

By enrolling in or using our text messaging program, you also agree to our Messaging Terms and Messaging Privacy Policy, which govern your participation in the program and the handling of information collected through it.

HOW WE SHARE INFORMATION WE COLLECT

We will not share your personal information with others except as described below, or except when we inform you in advance and give you the opportunity to opt out where required. We may share personal information with:

  • Authorized Service Providers: Companies that perform services on our behalf, such as fulfilling orders, processing payments, delivering packages, providing customer service and marketing assistance, performing analytics, supporting our Services' functionality, and supporting contests, sweepstakes, and surveys. These service providers and contractors may have access to personal information needed to perform their functions but are not permitted to use it for their own purposes.
  • Our E-Commerce Platform: Our online store is hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide the Services to us and to you. Information you submit through our Services will be transmitted to and shared with Shopify and, in some cases, with third parties located in countries other than where you reside. You can review the Shopify Consumer Privacy Policy at privacy.shopify.com.
  • Affiliates: Our affiliated companies, which will handle personal information consistent with applicable privacy and security laws and this Privacy Policy. At a minimum, in any commercial e-mail an affiliate sends you, it will give you the opportunity to choose not to receive such messages in the future.
  • Advertising and Analytics Partners: Companies that help us deliver, measure, and personalize advertising across websites, devices, and platforms. As described below, certain of these disclosures may be considered a "sale" or "sharing" of personal information or "targeted advertising" under state law, and you may opt out.
  • Business Partners: Businesses with which we partner to offer products, services, promotions, contests, or sweepstakes. When you elect to engage in a particular merchant's offer or program, you authorize us to provide your information to that merchant.
  • Direct Mail Partners: From time to time, we may share our postal mailing list with selected providers of goods and services that may be of interest to you. You may opt out of this as described in "Your Choices About Marketing Communications" below.
  • Legal and Safety: In response to a subpoena or similar investigative demand, a court order, a search warrant, or a request for cooperation from law enforcement or another government agency; to establish, exercise, or defend legal rights; to comply with legal requirements; to investigate or prevent fraud, security incidents, or illegal activity; or to protect the rights, property, or safety of PatchAid, our customers, our employees, or others. In such cases, we may raise or waive any legal objection or right available to us.
  • Corporate Transactions: In connection with a merger, acquisition, financing, reorganization, divestiture, sale of assets, or bankruptcy, in which personal information may be transferred as a business asset.

Any third parties to whom we disclose personal information may have their own privacy policies governing their use of that information. Those policies will govern the use, handling, and disclosure of your personal information once we have shared it as described in this Privacy Policy. We encourage you to review those policies. These entities or their servers may be located inside or outside the United States.

Aggregated and Non-Personal Information

We may share aggregated, de-identified, and non-personal information, which does not identify you, with advertisers, partners, affiliates, advisors, investors, and others for analytics, advertising, and general business purposes. For example, we may tell our advertisers the number of visitors to our Services and the most popular features or products. Where we maintain de-identified information, we will maintain and use it in de-identified form and will not attempt to re-identify it except as permitted by law.

SELLING, SHARING, AND TARGETED ADVERTISING

We use cookies, pixels, and similar technologies to deliver targeted advertising and to measure its effectiveness, and we disclose certain personal information (such as online identifiers, device information, and browsing and purchase activity) to advertising and analytics partners. Under several state privacy laws, these activities may be considered a "sale" or "sharing" of personal information, or "targeted advertising," even though we do not exchange your information for money.

You have the right to opt out of the sale or sharing of your personal information and of targeted advertising. You can exercise this right by:

  • Using our "Do Not Sell or Share My Personal Information" / "Your Privacy Choices" link at patchaid.com/pages/data-sharing-opt-out, by submitting a request through our contact page, by e-mailing legal@patchaid.com, or by calling (866) 230-3615; and
  • Enabling the Global Privacy Control (GPC) signal in a supported browser or extension, which we will treat as a request to opt out of sale or sharing and targeted advertising for that browser or device where required by law.

We do not sell or share sensitive personal information or consumer health data. We do not knowingly sell or share the personal information of consumers under 16 years of age, and we do not knowingly process the personal information of consumers we know to be under 18 for targeted advertising.

COOKIES, PIXELS, AND ADVERTISING TECHNOLOGY

We and our service providers use a variety of tracking technologies that collect usage information whenever you interact with our Services.

Cookies

Cookies are small pieces of text that a website stores on your device and that can be read by the website when you return. We use two types of cookies: session cookies, which terminate shortly after you end your internet session, and persistent cookies, which are stored on your device until they expire or are deleted. Both types help provide an enhanced experience by recalling your use of our Services, your shopping preferences, shopping cart information, and your sign-in details. We use functional, performance, advertising, and analytics cookies. Most of the persistent cookies we use expire between thirty minutes and two years from the date they are placed on your device.

Cookies necessary for the functioning of the store support access to your account, navigation through the storefront, shopping cart operation, checkout, and customer login. Reporting and analytics cookies record tracking preferences, landing pages, referrers, and general store analytics.

Pixels, Web Beacons, and Similar Technologies

We also use standard internet technologies such as web beacons (also known as clear gifs, pixel tags, or web bugs), tags, software development kits, and similar technologies to track your use of our Services, to customize our Services and advertisements, and to measure the effectiveness of our advertising, content, and programming. Web beacons are embedded invisibly on web pages or in e-mail and may be used to deliver or communicate with cookies, to count users who have visited certain pages, and to understand usage patterns. We may include these technologies in promotional or other e-mail messages or newsletters to determine whether messages have been opened and acted upon.

Advertising Technology and Your Opt-Out Choices

We may allow third parties, including advertising companies and ad networks, to collect information through tracking technologies when you view or interact with advertisements or use our Services. These companies may collect information about where you, or others using your device, saw or clicked on the advertisements they deliver, and may associate this information with your subsequent visits to advertised websites. The collection and use of that information is subject to the third party's own privacy policy.

You have several ways to limit interest-based advertising:

Please note that these opt-outs are cookie-based or device-based. If you clear cookies, use a different browser, or use a different device, you will need to opt out again. Blocking cookies may prevent parts of our Services from working properly, and may not by itself stop all sharing of information with advertising partners.

GLOBAL PRIVACY CONTROL AND DO-NOT-TRACK

Some browsers and browser extensions support the Global Privacy Control (GPC) or similar universal opt-out preference signals. Where required by applicable law, we treat a GPC signal as a valid request to opt out of the sale or sharing of personal information and of targeted advertising for the browser or device from which the signal is sent. You can learn more about GPC at globalprivacycontrol.org.

Because such signals are browser-specific and device-specific, you will need to enable the signal on each browser and device you use. If you are signed in to an account when we receive the signal, we will, where we are able to do so, apply the choice to your account as well. A GPC signal opts you out of online sale or sharing. To submit a request to opt out of any offline sale or sharing, please use the methods described in "How to Exercise Your Rights" below.

Apart from GPC where required by law, our Services do not currently respond to other "Do Not Track" signals, because there is no consistent industry standard for how to respond to them. If we develop this capability in the future, we will describe it in this Privacy Policy. Please note that third parties may collect personal information about your online activities over time and across different websites when you use our Services or browse other websites. To learn more about Do Not Track, visit allaboutdnt.com.

YOUR CHOICES ABOUT MARKETING COMMUNICATIONS

You can control how we communicate with you:

  • Withholding information. You can choose not to provide us with certain information, but that may result in your being unable to use certain features of our Services, because such information may be required in order to register as a member, purchase products or services, participate in a contest, promotion, survey, or sweepstakes, ask a question, or initiate other transactions.
  • E-mail. To stop receiving promotional e-mails or newsletters, update your subscription settings in My Account, click "unsubscribe" in any promotional e-mail, or contact Customer Service using the details below. We may still send you transactional and relationship messages, such as order confirmations, service announcements, administrative notices, and surveys, without offering you the opportunity to opt out of them.
  • Postal mail. If you do not wish to receive postal mailings, or do not want us to share your name and mailing address with selected companies for their own direct marketing, contact us by phone, e-mail, or mail.
  • Telephone. Under our Do-Not-Call policy, you may instruct us not to call you for marketing purposes by contacting Customer Service. We will implement your instructions within thirty days. We may still need to call you for servicing or other non-marketing purposes.
  • Text messages. Reply STOP to any message you receive from us, as described in "Text Messaging (SMS/MMS) Program" above.
  • Cookies and advertising. Use the controls described in "Cookies, Pixels, and Advertising Technology" above.

Changing your preferences will only affect future activities or communications from us. If we have already provided your information to a third party before you changed your preferences, you may need to change your preferences directly with that third party.

AUTOMATED DECISION-MAKING AND PROFILING

We do not engage in fully automated decision-making that produces legal or similarly significant effects concerning you. Our e-commerce platform and payment providers use limited automated processing to prevent fraud, such as short-lived denylists of IP addresses associated with repeated failed transactions and of payment cards associated with those addresses. These measures are not intended to, and in our assessment do not, produce legal or similarly significant effects.

Where a state or non-U.S. privacy law gives you the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, or the right to object to solely automated decision-making, you may exercise that right as described in "How to Exercise Your Rights" below. If we begin such processing in the future, we will update this Privacy Policy and provide any notice or choice required by law.

DATA RETENTION

We retain personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. The criteria we use to determine retention periods include the length of our relationship with you, the nature and sensitivity of the information, our legal, tax, accounting, and regulatory obligations, the existence of any legal claims or disputes, and our legitimate business needs such as fraud prevention, recordkeeping, and enforcing our agreements. When personal information is no longer needed, we take reasonable steps to delete, de-identify, or anonymize it.

If you close your account, we may still retain certain information associated with that account for analytical purposes, recordkeeping integrity, fraud prevention, collection of amounts owed, enforcement of our terms and conditions, and other purposes permitted by law. If certain information has already been provided to third parties as described in this Privacy Policy, retention of that information will be subject to those third parties' policies.

HOW WE PROTECT YOUR PERSONAL INFORMATION

We take reasonable administrative, technical, and physical security measures designed to help safeguard your personal information from unauthorized access, alteration, and disclosure. For example, we limit access to personal information to authorized personnel who need it for permitted business functions, we use encryption to transmit sensitive personal information between your system and ours, and we use firewalls and other controls to help prevent unauthorized access.

No system can be completely secure. Although we take steps to secure your information, we do not promise, and you should not expect, that your personal information, searches, or other communications will always remain secure, and any information you send to us may not be secure while in transit. You should take care with how you handle and disclose your personal information and should avoid sending sensitive information through insecure e-mail or other unsecured channels. If you register an account, you are responsible for keeping your credentials safe, and we recommend that you not share your username, password, or other access details with anyone. For information about protecting yourself against identity theft, visit the Federal Trade Commission's website at ftc.gov.

Security incidents. We maintain procedures for detecting, investigating, and responding to suspected security incidents. If we determine that a security incident has resulted in the unauthorized acquisition of, or access to, your personal information in a manner that triggers a notification obligation, we will notify you and the applicable regulators within the time and in the manner required by the applicable state breach notification statute or other applicable law. Where a service provider or processor suffers an incident affecting personal information it handles for us, our agreements require it to notify us without undue delay.

HOW YOU CAN ACCESS AND UPDATE YOUR INFORMATION

If you have an online account with us, you can review and update your personal information by logging into My Account or by contacting us by phone. You may close your account at any time by contacting PatchAid Customer Service. After you close your account, you will not be able to sign in to our Services or access your personal information through our Services, although you may open a new account at any time. If you close your account, we may retain certain information as described in "Data Retention" above and as otherwise permitted by law.

USER-SUBMITTED CONTENT

We may provide areas on our Services where you can post information about yourself or others, create a profile, communicate with others, post reviews of products, or upload content such as pictures, videos, or audio files. Such postings may also appear on other websites or in search results. Whenever you voluntarily disclose personal information in a publicly viewable area, that information will be publicly available and can be collected and used by others. For example, if you post your e-mail address, you may receive unsolicited messages. We cannot control who reads your postings or what others do with the information you post, so we encourage you to exercise discretion and caution with respect to your personal information, and in particular not to post information about your health. Once you have posted information, you may not be able to edit or delete it yourself; contact us if you need assistance.

THIRD-PARTY WEBSITES

Our Services may contain links to websites and online platforms operated by others that do not operate under this Privacy Policy. For example, if you click an advertisement or a link on our Services, you may be taken to a website that we do not control. These third-party websites may independently solicit and collect information, including personal information, from you, and in some instances may provide us with information about your activities on those websites. Some third-party websites may be co-branded with our trademarks and those of our business partners and may have the look and feel of our Services, but the URL in your browser window will indicate that you are visiting a different site. We recommend that you review the privacy statements of any third-party websites you visit. Our inclusion of a link does not by itself imply endorsement. Our Privacy Policy applies only to information collected by PatchAid.

CHILDREN'S PRIVACY

Our Services are intended for adults. Our Terms of Service require customers to be 18 years of age or older, and our Services are not directed to children. We do not knowingly collect, use, or disclose personal information from children under the age of 13 in violation of the Children's Online Privacy Protection Act ("COPPA"). We do not knowingly sell or share the personal information of consumers under 16 years of age, and we do not knowingly process the personal data of any consumer we know to be under 18 for purposes of targeted advertising.

If we learn that we have collected personal information from a child under 13 in a manner inconsistent with COPPA, we will delete it. If you are a parent or guardian and believe your child has provided us with personal information, please contact us using the details below and we will delete it.

HOW TO EXERCISE YOUR RIGHTS

You may submit a privacy request through any of the following channels. Please tell us which right you are exercising and the state or country in which you reside.

Verification. To protect your information, we may ask you to provide two or three pieces of personal information that we will match against our records to verify your identity before fulfilling certain requests. For security reasons, we do not send sensitive information, such as payment card numbers, in response to a request to access your personal information. When we delete personal information, we may retain information necessary to comply with our legal obligations or our records retention practices.

Timing. We will acknowledge and respond to your request within the timeframe required by applicable law, and we will tell you if we need an extension permitted by that law.

Authorized agents. You may use an authorized agent to submit a request on your behalf. The agent must provide proof of authorization, such as a signed permission or a valid power of attorney, and we may require you to verify your identity directly with us and to confirm that you gave the agent permission.

Non-discrimination. We will not discriminate against you for exercising your privacy rights.

Right to appeal. If we decline to take action on your request and your jurisdiction provides a right to appeal, you may appeal by replying to our response or by e-mailing legal@patchaid.com with the subject line "Privacy Appeal." We will respond in writing, and explain the reasons for our decision, within the period required by your state's law. If your appeal is denied, you may contact your state Attorney General or, if you are outside the United States, your local data protection authority.

If your state is not listed. If you are not a resident of a state named below but would like to obtain information or take actions that residents of such states may take, please submit a request using the channels above. We will use reasonable efforts to honor your request.

YOUR U.S. STATE PRIVACY RIGHTS

A number of U.S. states have enacted comprehensive consumer privacy laws. Depending on your state of residence, and subject to the exceptions and limits in your state's law, you may have some or all of the following rights:

  • Right to Know / Access: To confirm whether we process your personal information and to access that information, including the categories of personal information collected, the sources, the purposes for collecting, selling, or sharing it, and the categories of third parties with whom it is shared.
  • Right to Delete: To request deletion of personal information we have collected from or about you, subject to legal exceptions.
  • Right to Correct: To request correction of inaccurate personal information, taking into account the nature of the information and the purposes of processing.
  • Right to a Copy / Data Portability: To obtain a copy of the personal information you previously provided, in a portable and, where feasible, readily usable format.
  • Right to Opt Out: To opt out of (i) the sale or sharing of your personal information, (ii) targeted advertising, and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects.
  • Right to Limit Sensitive Data: Where provided by law, to limit our use and disclosure of sensitive personal information, or to withhold or withdraw consent to its processing.
  • Right to Non-Discrimination: To not receive discriminatory treatment for exercising your privacy rights.
  • Right to Appeal: Where provided by law, to appeal our decision regarding your request.

To exercise any of these rights, see "How to Exercise Your Rights" above.

State-by-State Applicability

The table below lists the state privacy laws we track and the rights framework that applies. Rights are available only to residents of the listed state, only to the extent and in the manner that state's law provides, and only where that law applies to us. The state-specific sections that follow control where applicable. Where a state law takes effect after the "Last Updated" date above, we will honor rights under that law as of its effective date.

STATE

LAW

NOTES

California

California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA)

See "California Privacy Rights" below, plus Shine the Light

Colorado

Colorado Privacy Act (CPA)

Universal opt-out signal honored; appeal available

Connecticut

Connecticut Data Privacy Act (CTDPA)

Universal opt-out signal honored; appeal available

Delaware

Delaware Personal Data Privacy Act (DPDPA)

Appeal available

Indiana

Indiana Consumer Data Protection Act

Appeal available

Iowa

Iowa Consumer Data Protection Act

Narrower rights set than most states

Kentucky

Kentucky Consumer Data Protection Act

Appeal available

Maryland

Maryland Online Data Privacy Act (MODPA)

Heightened limits on sensitive data and minors; see note below

Minnesota

Minnesota Consumer Data Privacy Act

Includes a right to question profiling results

Montana

Montana Consumer Data Privacy Act

Universal opt-out signal honored; appeal available

Nebraska

Nebraska Data Privacy Act

Appeal available

Nevada

Nevada Revised Statutes Chapter 603A and Senate Bill 370

See "Nevada Privacy Rights" and consumer health data below

New Hampshire

New Hampshire Data Privacy Act

Universal opt-out signal honored; appeal available

New Jersey

New Jersey Data Privacy Act

Universal opt-out signal honored; appeal available

Oregon

Oregon Consumer Privacy Act (OCPA)

Includes a right to a list of specific third parties

Rhode Island

Rhode Island Data Transparency and Privacy Protection Act

Appeal available

Tennessee

Tennessee Information Protection Act (TIPA)

Appeal available

Texas

Texas Data Privacy and Security Act (TDPSA)

Universal opt-out signal honored; appeal available

Utah

Utah Consumer Privacy Act (UCPA)

Narrower rights set; no correction right or appeal right

Virginia

Virginia Consumer Data Protection Act (VCDPA)

Appeal available

Washington

My Health My Data Act (MHMDA)

Consumer health data only; see the section below

Maryland residents. Consistent with the Maryland Online Data Privacy Act, we do not sell sensitive data, we do not sell the personal data of, or process for targeted advertising the personal data of, any consumer we know to be under 18, and we limit our collection of personal data to what is reasonably necessary and proportionate to provide the products and services you request.

Processing details for state privacy law purposes. We process the categories of personal data described in "Information We Collect" for the purposes described in "How We Use Information We Collect." We obtain opt-in consent before processing sensitive data where required. We engage in targeted advertising and in activities that may constitute the sale or sharing of personal data, and you may opt out as described above. The categories of third parties with whom we share personal data include shipping and order-fulfillment companies, payment processors, advertising and marketing companies, social media platforms, fraud-prevention and security companies, research and analytics companies, website and application developers, technology and hosting services providers, consulting and business services providers, temporary staffing providers, and recipients with which we are legally obligated to share data.

CALIFORNIA PRIVACY RIGHTS

This section supplements the information above and applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"). Some terms in this section are defined in the CCPA. This section applies to personal information that the CCPA covers. A statutory exclusion or exemption can still apply to specific information. This section describes our practices within the preceding 12 months. In the event of a conflict between this section and other privacy notices we provide, this section governs for California consumers, unless a notice given at the point of collection provides otherwise as permitted by law.

Categories of Personal Information We Collect

In the preceding 12 months, we have collected the following categories of personal information as defined by the CCPA:

  • Identifiers, such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, e-mail address, or account name;
  • Personal information categories listed in Cal. Civ. Code § 1798.80(e), such as name, signature, address, telephone number, and payment card or other financial information;
  • Characteristics of protected classifications under California or federal law, such as gender and age;
  • Commercial information, such as products or services purchased, obtained, or considered, and purchasing histories or tendencies;
  • Internet or other electronic network activity information, such as browsing and search history and interactions with our Services and advertisements;
  • Geolocation data;
  • Audio, electronic, visual, thermal, olfactory, or similar information, such as call recordings or content you submit;
  • Inferences drawn from the above to create a profile reflecting preferences and characteristics; and
  • Sensitive personal information, which may include a Social Security, driver's license, state identification, or passport number, and account log-in or financial account information in combination with any required security or access code, password, or credentials allowing access to an account.

Retention. We retain each category of personal information and sensitive personal information listed above pursuant to our retention schedule, which is based on the purposes for which we collect and process the information, our legal and regulatory requirements, and our legitimate business purposes, as described in "Data Retention" above.

Sources of Personal Information

We collect personal information from you directly; automatically through your use of our Services; from people who refer others to us or purchase for others; from information we create in the operation of our business; and from other companies such as advertising networks, internet service providers, data analytics providers, government entities, operating systems and platforms, social networks, and data brokers.

Purposes for Collecting, Selling, or Sharing Personal Information

We collect, use, sell, or share personal information for the business and commercial purposes described in "How We Use Information We Collect" and "How We Share Information We Collect," which include performing services (account provision and maintenance, product sales and fulfillment, customer service and communications, marketing and advertising, payment-related activities, and providing technology and storage); maintaining and improving our Services and user experience; fraud prevention and information security; short-term transient use permitted under the CCPA; internal research; complying with legal obligations; and other purposes for which we provide notice.

We collect and use sensitive personal information only to perform the services or provide the goods reasonably expected by an average consumer who requests them, to help ensure security and integrity, for short-term transient use permitted under the CCPA, to perform services for our business operations, and to verify or maintain the quality or safety of our products and services. We do not use or disclose sensitive personal information for purposes to which the right to limit use and disclosure applies under the CCPA.

Sale or Sharing of Personal Information

We "sell" or "share" (as those terms are defined by the CCPA) the categories of personal information listed below for cross-context behavioral advertising. We do not sell or share sensitive personal information or consumer health data, and we do not knowingly sell or share the personal information of consumers under 16 years of age. Because we require customers to be 18 years of age or older, we have no actual knowledge of any sale or sharing of the personal information of consumers under 16.

CATEGORIES OF PERSONAL INFORMATION SOLD OR SHARED

CATEGORIES OF THIRD PARTIES

Identifiers

Advertising and marketing partners; analytics providers; social media platforms

Personal information records (Cal. Civ. Code § 1798.80(e))

Advertising and marketing partners; analytics providers

Commercial information

Advertising and marketing partners; analytics providers; social media platforms

Internet or other electronic network activity information

Advertising and marketing partners; analytics providers; social media platforms

Geolocation data

Advertising and marketing partners; analytics providers

Inferences

Advertising and marketing partners; analytics providers

Disclosures for a Business Purpose

In the preceding 12 months, we have disclosed each category of personal information listed above to the following categories of service providers and contractors for business purposes: breach and fraud detection, prevention, and response; consulting and business services; mandatory recipients, meaning recipients with which we are obligated to share personal information; marketing and advertising; order fulfillment; payment and collection services; research and analytics; security; shipping; social media platforms; technology and hosting services; temporary staffing; and website and application developers. Sensitive personal information may be disclosed for these purposes to payment and collection providers, fraud-prevention and security providers, mandatory recipients, technology services providers, temporary staff, and website and application developers.

Your California Rights

California residents have the right to know and access personal information; the right to delete personal information we collected from them, subject to exceptions that permit us to retain certain information; the right to correct inaccurate personal information; the right to obtain a copy of personal information in a portable format; the right to opt out of the sale or sharing of personal information; the right to limit the use and disclosure of sensitive personal information; and the right to non-discrimination for exercising these rights. To exercise any of these rights, see "How to Exercise Your Rights" above. You may also designate an authorized agent as described there.

California "Shine the Light"

California Civil Code Section 1798.83 permits California residents to request information regarding our disclosure of certain categories of personal information to third parties and affiliates for their own direct marketing purposes. You may request, once per calendar year: (1) the categories of information we disclosed to third parties for their direct marketing purposes during the preceding calendar year; (2) the names and addresses of the third parties that received that information; and (3) if the nature of a third party's business cannot be determined from its name, examples of the products or services marketed. To make such a request, e-mail us at legal@patchaid.com with "California Shine the Light" in the subject line. We may provide this information in a standardized format that is not specific to you.

Financial Incentives

From time to time we may offer incentives such as discounts on products or shipping, contest prizes, loyalty benefits, and similar offers. In connection with an incentive, we may collect personal information such as your name, e-mail address, and phone or text number, as described in the specific offer. Where we collect personal information from a California consumer in connection with an incentive, the value of that information is generally calculated as the value of the incentive less our expenses in operating the incentive program and other costs associated with our related business activities. Participation is voluntary. You may opt in by following the method of participation described for the offer, and you may withdraw at any time through the methods described in the terms of the incentive program, including, where the incentive relates to marketing e-mails or text messages, by unsubscribing.

CONSUMER HEALTH DATA RIGHTS (WASHINGTON, NEVADA, AND SIMILAR LAWS)

This section supplements "Consumer Health Data and Sensitive Information" above and applies to consumers who are Washington residents, whose consumer health data is collected in Washington, or who are Nevada residents, under the Washington My Health My Data Act (the "MHMDA") and Nevada Senate Bill 370 ("SB 370"). It also applies to residents of other states whose laws provide comparable consumer health data rights.

Under the MHMDA, "consumer health data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status, including information derived or inferred from information that is not itself health information, such as purchases. Nevada's SB 370 uses a similar definition.

What we collect and why. We may collect consumer health data such as the products you purchase or view, information you volunteer about your dietary preferences or wellness goals, and inferences drawn from that information. We collect it from you directly and, in some cases, automatically through your use of our Services. We use it to fulfill your orders, respond to your inquiries, operate and improve our Services, provide relevant products and content, and meet legal obligations.

How we share it. We may share consumer health data with service providers and processors that perform functions on our behalf, such as order fulfillment, customer service, payment processing, technology, and analytics, under contracts that limit their use of the data. We do not sell consumer health data, and we do not share it for cross-context behavioral advertising or targeted advertising. We will not sell consumer health data without obtaining the valid authorization required by law.

Your consumer health data rights. You have the right to:

  • Confirm whether we collect, share, or sell your consumer health data, and access that data;
  • Obtain a list of all third parties and affiliates with whom we have shared or to whom we have sold your consumer health data, together with contact information for each;
  • Withdraw your consent to our collection and sharing of your consumer health data; and
  • Request that we delete your consumer health data, including from our archived and backup systems, subject to the exceptions permitted by law.

To exercise these rights, use any channel in "How to Exercise Your Rights" above, and please include "Consumer Health Data" in the subject line if you write to us. We will verify your request and respond within the time required by law. You may use an authorized agent. We will not discriminate against you for exercising these rights. If we deny your request, you may appeal as described above, and Washington residents may also file a complaint with the Washington State Attorney General.

NEVADA PRIVACY RIGHTS

Nevada residents have the right, under Chapter 603A of the Nevada Revised Statutes, to direct us not to sell certain personal information we have collected or will collect about them. We do not sell personal information as that term is defined in the Nevada statute. To submit a request, e-mail us at legal@patchaid.com with "Nevada" in the subject line and include your name, Nevada resident address, and e-mail address. Nevada residents may also submit requests regarding consumer health data under SB 370, as described in the section above.

INTERNATIONAL VISITORS, GDPR, AND UK GDPR

Our Services are operated from the United States and are directed primarily to residents of the United States. If you visit our Services, place an order, or otherwise provide information to us from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where our servers are located and our central database is operated. The data protection and other laws of the United States may differ from those of your country. By using our Services, you understand that your information may be transferred to our facilities and to the third parties with whom we share it as described in this Privacy Policy.

This section applies to individuals located in the European Economic Area ("EEA"), the United Kingdom ("UK"), and Switzerland, to the extent the EU General Data Protection Regulation, the UK GDPR and the Data Protection Act 2018, or the Swiss Federal Act on Data Protection apply to our processing of your personal data.

Controller

For the purposes of applicable data protection law, PatchAid is the controller of the personal data described in this Privacy Policy. Our contact details are in "How to Contact Us" below. Privacy questions may be sent to legal@patchaid.com.

EU and UK Representative

We have not appointed a representative in the European Union or the United Kingdom under Article 27 of the EU GDPR or the UK GDPR. If we appoint one, we will publish the representative's name and contact details here and you will be able to contact that representative on all matters relating to our processing of your personal data.

Lawful Bases for Processing

We process personal data only where we have a lawful basis to do so. Depending on the activity, our lawful bases are:

  • Performance of a contract. To create and administer your account, process and fulfill your orders, arrange shipping, process payments, handle returns, exchanges, and refunds, and provide customer support.
  • Legitimate interests. To operate, secure, and improve our Services; to prevent fraud and abuse; to conduct analytics and internal research; to communicate with existing customers about similar products where permitted; and to establish, exercise, or defend legal claims. We balance these interests against your rights and freedoms.
  • Consent. For marketing e-mails and text messages where consent is required, for non-essential cookies and similar technologies, for any processing of special category data, and for other processing where we ask for your consent. You may withdraw consent at any time, which does not affect the lawfulness of processing carried out before withdrawal.
  • Compliance with a legal obligation. To meet tax, accounting, consumer protection, product safety, and other legal and regulatory requirements, and to respond to lawful requests from authorities.
  • Vital interests. In rare cases, to protect your vital interests or those of another person, such as an urgent product safety matter.

Where you provide information that reveals health data or another special category of data under Article 9, we process it only with your explicit consent or where another Article 9 condition applies. We ask that you not send us information about diagnosed medical conditions.

International Data Transfers

When we transfer personal data out of the EEA, the UK, or Switzerland to a country that has not been the subject of an adequacy decision, we rely on recognized transfer mechanisms. These include the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses, and the Swiss addendum, as applicable, together with any supplementary technical, contractual, and organizational measures required following a transfer impact assessment. Some of our service providers self-certify under the EU-U.S. Data Privacy Framework and its UK Extension and Swiss-U.S. Data Privacy Framework. You may request a copy of the relevant transfer mechanism by e-mailing legal@patchaid.com; we may redact commercial terms.

Your EEA and UK Data Subject Rights

Subject to the conditions and exceptions in applicable law, you have the right to:

  • Access your personal data and receive information about how we process it;
  • Rectification of inaccurate or incomplete personal data;
  • Erasure of your personal data, sometimes called the right to be forgotten;
  • Restriction of processing in certain circumstances;
  • Data portability, meaning to receive personal data you provided to us in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible;
  • Object to processing based on our legitimate interests, and to object at any time and without any justification to processing for direct marketing, including profiling related to direct marketing;
  • Withdraw consent at any time where processing is based on consent;
  • Not be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you; and
  • Lodge a complaint with a supervisory authority.

To exercise these rights, use any channel in "How to Exercise Your Rights" above. We will respond within one month, and we may extend that period by two further months where the request is complex or numerous, in which case we will tell you within the first month.

Complaints

If you have a complaint about how we process your personal data, please contact us first at legal@patchaid.com so we can try to resolve it. You also have the right to lodge a complaint with your local supervisory authority. A list of EEA supervisory authorities is available at edpb.europa.eu. In the United Kingdom, you may complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.

NO RIGHTS OF THIRD PARTIES

This Privacy Policy does not create rights enforceable by third parties or require disclosure of any personal information relating to users of our Services beyond what is required by applicable law.

CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, our Services, or applicable law, or for other operational, legal, or regulatory reasons. When we make material changes, we will post the revised Privacy Policy on our Services, revise the "Last Updated" date above, and, where required by law, provide additional notice or obtain your consent. We encourage you to review this Privacy Policy periodically.

HOW TO CONTACT US

If you have questions about this Privacy Policy or our information-handling practices, if you would like to exercise your privacy rights, or if you would like to request information about our disclosure of personal information to third parties for their direct marketing purposes, please contact us:

PatchAid
Attn: Privacy
25 Corporate Circle, Suite 118
Albany, NY 12203

Toll-Free: (866) 230-3615
Customer Service E-mail: hello@patchaid.com
Privacy and Legal E-mail: legal@patchaid.com
Online: patchaid.com/pages/contact-us
Your Privacy Choices: patchaid.com/pages/data-sharing-opt-out