Consumer Health Data Privacy Notice

Consumer Health Data Privacy Notice

Last Updated: June 29, 2026

1. Purpose and Scope

This Consumer Health Data Privacy Notice (the “CHD Notice”) explains US Med Direct, LLC’s (“US Med Retail,” “we,” “us,” or “our”) collection, use, and disclosure of Consumer Health Data. This CHD Notice supplements our US Med Retail Privacy Notice, which may be consulted for additional information about our privacy practices.

Some of our affiliates and business units have their own privacy notices for their own websites, mobile apps, or other services. This CHD Notice only applies to them when they link to, or provide you with, this CHD Notice. Please review this CHD Notice before using our Services or sharing any Consumer Health Data with us.

Throughout this CHD Notice, we use the following defined terms:

· “Personal Data” refers to any information that directly or indirectly identifies you specifically. Data that is indirectly identifiable includes, for example, data that can be used to identify you as an individual when combined with other pieces of information that are reasonably available. Personal Data does not include information that is publicly available, de-identified, or aggregated, such that it can no longer be used to identify you as an individual.

· “Consumer Health Data” means Personal Data that identifies your past, present, or future physical or mental health status.

If you have any questions about this Privacy Notice, please email AHSprivacy@cardinalhealth.com.

This CHD Notice applies only to residents of Washington and Nevada acting in an individual or household context and does not apply to employees, applicants for employment, or other individuals acting in an employment-related context. Additionally, if you are in the United States, please note this CHD Notice does not apply to our use, collection, or disclosure of Protected Health Information (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”). Some of our affiliates and business units have a HIPAA Notice of Privacy Practices as required under HIPAA which governs their use, collection, and disclosure of PHI.

2. Consumer Health Data We Collect

We may collect Consumer Health Data such as health conditions and diagnoses, treatment information, medication and prescription information, information that identifies you as seeking healthcare services, and other health information you may voluntarily provide us.

3. How Your Consumer Health Data Is Collected

We collect Consumer Health Data from sources including: directly from you, such as when you share it with us or when you request certain health-related products and services, from your healthcare provider, through our websites, and from our business partners.

4. How We Use and Share Consumer Health Data

We use the Consumer Health Data we collect to provide a product or service requested by you or from your healthcare provider, communicate information about our products and services, and to comply with law or regulatory obligations.

We may disclose any Consumer Health Data we collect as described in “How We Use and Share Your Personal Data” in our US Med Retail Privacy Notice.

5. Your Rights and Choices

Residents of Washington and Nevada have the right to access and delete certain Consumer Health Data we collect about them. If you would like to exercise either of these rights, please email AHSprivacy@cardinalhealth.com or call 800.926.0834 (free of charge in the United States). In your email, please include your full name, zip code or postal code, the email address at which you prefer to be contacted, and the privacy right(s) you are requesting. If your request to exercise your rights is denied, you may appeal that decision using our web form. If you submit an appeal, describe the basis for your appeal in your email or phone call. Please note that the rights described are not absolute, and we reserve all of our rights available under applicable laws.

Subject to appropriate verification of your identity, where permitted or required by law, which may include asking you for additional information to match the information we have, US Med Retail will honor the privacy rights provided to you by applicable law. You can expect that US Med Retail will respond to your privacy request within the required time period under applicable law, unless we reach out to explain that it will take us longer. If we cannot fulfill your privacy request in whole or in part, we will explain why. It is our policy not to disclose any information in response to a privacy request that may adversely affect the privacy or rights of other persons unless legally required to do so.

Your state may also provide you with the right to revoke your consent for the processing of Consumer Health Data or to request that US Med Retail stop processing your Consumer Health Data. As described in this CHD Notice, US Med Retail does not process Consumer Health Data except as reasonably necessary to provide goods or services that you have requested or as required by law. As a result, we do not offer a generally applicable option to revoke consent or stop processing Consumer Health Data. If consent is required for US Med Retail to process your Consumer Health Data, you will be provided with a separate notice that describes how you may revoke your consent at the time your consent is obtained.

Depending on your state of residence, you may have additional privacy rights. For more information, please see “Your Privacy Rights and Choices” in our US Med Retail Privacy Notice.

6. Changes to this CHD Notice and Contacting Us

We reserve the right to modify this CHD Notice at any time. You can see when this CHD Notice was last revised by referring to the date it was “Last Updated” at the top of the CHD Notice.

If you have any questions or comments about our privacy practices or this CHD Notice, or if you would like to receive a copy of this CHD Notice in an alternate format or language, please contact us at: