Privacy Policy

1. Information We Collect

Information you provide. We collect the information you provide when you place an order, create an account, request a facility account, or contact us, including:

• Contact information, such as your name, email address, telephone number, and shipping and billing addresses;
• Order information, such as the products you purchase, quantities, prices, and order history;
• Account information, such as your login credentials and saved addresses. Passwords are stored only in hashed form;
• Facility account information, such as the facility's name and shipping address, the approximate number of residents, and the name and contact details of the person making the request;
• Payment information, such as the card brand, the last four digits, and the expiration date of your card. Card numbers and security codes are collected by our payment processor and are not stored on our systems; and
• Communications, such as messages you send us through our inquiry form, by email, or by telephone, and our responses.

Information collected automatically. When you use the Website, we and our service providers automatically collect your IP address, browser type, device type, the pages you visit, the referring website, and the date and time of your visit. We store IP addresses with inquiry-form submissions, facility account requests, and account registration and sign-in attempts to prevent fraud and abuse. We also use cookies and similar technologies, as described in Section 4.

Information from third parties. Our payment processor provides us with the outcome of your payment and the card details described above. We do not obtain personal information from data brokers.

We do not request, and you should not provide, Social Security numbers, government identification numbers, or information about medical conditions, diagnoses, prescriptions, or treatment. Facility customers should not provide the names or health information of residents or patients.

2. How We Use Your Information

We use personal information to:

• Process, fulfill, and deliver your orders, and handle returns, refunds, and cancellations;
• Create and manage your account and, for facility accounts, review requests and apply account pricing;
• Process payments and detect and prevent fraud;
• Send transactional communications, such as order confirmations, shipping notices, and account and password messages;
• Respond to your inquiries and provide customer support;
• Operate, maintain, secure, and improve the Website, including through analytics and error monitoring;
• Measure the effectiveness of our advertising, with your consent, as described in Section 5; and
• Comply with legal obligations, maintain business records, and establish, exercise, or defend legal claims.

We do not use personal information for targeted advertising or for profiling that produces legal or similarly significant effects.

3. How We Disclose Your Information

We disclose personal information to the following categories of recipients:

• Service providers that perform services on our behalf under contracts that restrict their use of the information, as listed below;
• Shipping carriers, which receive the name, address, and package information needed to deliver your order;
• Google LLC, if you accept advertising cookies, as described in Section 5;
• Government authorities and other parties, when we believe disclosure is required by law or legal process, or is necessary to protect the rights, property, or safety of ComfortCare, our customers, or others;
• A successor entity, in connection with a merger, acquisition, reorganization, or sale of all or part of our business; and
• Other parties, with your consent or at your direction.

Our service providers are:

• Vercel Inc. — website hosting;
• Medusa (Medusa Commerce) — e-commerce platform, database, and file storage, where account and order records are held;
• Stripe, Inc. — payment processing and, if you choose to save a card, card storage;
• Resend (Plus Five Five, Inc.) — delivery of transactional email;
• PostHog, Inc. — website analytics;
• Sentry (Functional Software, Inc.) — error monitoring;
• Google LLC (Google Maps Platform) — address suggestions; and
• Google LLC (YouTube) — hosting of the video on our facilities page.

Payment information. Card payments are processed by Stripe. Card details are entered into fields hosted by Stripe and are sent directly to Stripe, not to us. Stripe also uses payment information for its own purposes, such as fraud prevention and regulatory compliance, in accordance with the Stripe Privacy Policy, available at https://stripe.com/privacy. If you are signed in, you may choose to save a card for future orders. Saved cards are stored by Stripe, and you may remove a saved card from your account at any time.

4. Cookies and Similar Technologies

Cookies are small text files placed on your device when you visit a website. Local storage is a similar technology that stores information in your browser. The tables below list the cookies and similar technologies used on the Website.

Strictly necessary cookies. These cookies are required for the Website to function and cannot be switched off. Cookies beginning with "_medusa_" are set by Medusa, the e-commerce platform on which our store runs. Cookies beginning with "_cc_" are set by ComfortCare. Cookies beginning with "__stripe_" are set by Stripe on the checkout page to prevent fraud.

Advertising cookies. These cookies are used to measure the effectiveness of our advertising. They are set only if you select "Accept" on our cookie banner.

Third-party cookies. Google may set cookies on its own domains when the Google tag runs, Stripe may set cookies on its own domains on the checkout page, and YouTube may set cookies on its own domains if you play the video on our facilities page. These cookies are governed by those companies' privacy policies. Our analytics and error-monitoring services do not set cookies.

Managing cookies. You may accept or reject advertising cookies, and change your choice at any time, by selecting "Cookie Settings" at the bottom of any page. If you withdraw your consent, we delete the advertising cookies on the Website. You may also block or delete cookies through your browser settings. If you block strictly necessary cookies, features such as signing in, your cart, and checkout will not work.

5. Analytics, Advertising, and Third-Party Services

Analytics. We use PostHog to understand how visitors use the Website, such as which pages are viewed. PostHog does not set cookies, does not record clicks, keystrokes, or screen activity, and does not receive your name, email address, or account information. It receives the address of each page you visit, with order numbers and security codes removed, the referring website, your browser and device type, and an approximate location derived from your IP address. Your IP address is not stored. To count visits, PostHog uses a temporary identifier that changes daily.

Error monitoring. We use Sentry to detect and fix errors on the Website. When an error occurs, Sentry receives a technical report that includes the page address, your browser and device type, your IP address, and the actions that led to the error. No information is sent to Sentry when no error occurs.

Google Ads. We use the Google Ads conversion tracking service provided by Google LLC ("Google") to measure the effectiveness of our advertising. If you accept advertising cookies, the Google tag runs on pages you reach by clicking one of our Google ads and on the order confirmation page. When you complete an order, we send Google the order number, the order total, and the currency, together with the ad-click identifier stored in your browser. Google also receives your IP address, information about your browser, and the address and title of the page on which the tag runs. We do not send Google the contents of your order or information about other pages you visit, and we do not use Google Ads for remarketing or personalized advertising.

Google processes this information in accordance with the Google Privacy Policy, available at https://policies.google.com/privacy. For information about how Google uses data from websites that use its services, see https://policies.google.com/technologies/partner-sites.

Google Maps Platform. When you type in an address field, the characters you enter and your IP address are sent to Google Maps Platform to provide address suggestions.

YouTube. The video on our facilities page is hosted by YouTube, a service of Google. No information is sent to YouTube unless you select play.

6. Sale and Sharing of Personal Information

We do not sell personal information.

If you accept advertising cookies, our disclosure of information to Google for advertising measurement, described in Section 5, may be considered "sharing" of personal information for cross-context behavioral advertising under the California Consumer Privacy Act and similar state laws. We make this disclosure only with your consent. You may opt out at any time by selecting "Cookie Settings" at the bottom of any page or by using a Global Privacy Control signal, as described in Section 13.

We do not disclose personal information to third parties for their own direct marketing purposes.

7. Health-Related Information

We sell incontinence and personal care products. Although we do not ask for health information, the products you purchase may reveal information about your health or the health of a person in your care. We are not a health care provider or a covered entity under the Health Insurance Portability and Accountability Act (HIPAA), and HIPAA does not apply to the information described in this Policy.

We use purchase information only to provide the products you request and to support you afterwards. We do not sell it, use it for targeted advertising, or disclose the products you view or purchase to advertising providers. Access is limited to personnel who need it to fulfill orders, process payments, and provide customer support.

Residents of Washington, Nevada, and other states with consumer health data laws may request access to or deletion of this information, and may withdraw consent, as described in Section 12.

8. Email Communications

We send transactional emails, such as order confirmations, shipping notices, account messages, and responses to your inquiries. We do not operate a newsletter or marketing mailing list. If we begin sending marketing emails, we will do so only with your consent and will update this Policy first.

You may ask us to stop sending emails at any time by using the unsubscribe link in an email or by contacting us. We keep a record of unsubscribe requests and undeliverable addresses so that we can honor them. We may still send messages that are necessary to complete an order you have placed or that are required by law.

9. Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this Policy, unless a longer period is required by law. Specifically:

• Order records are retained for the period required for tax, accounting, and legal purposes;
• Account information is retained while your account is open and is deleted or de-identified after you ask us to close it, except for order records;
• Inquiry and facility account request records are retained while we handle them and for a reasonable period afterwards;
• Security records, including IP addresses, are retained only as long as needed to prevent fraud and abuse; and
• Unsubscribe records are retained indefinitely so that we continue to honor them.

10. Data Security

We use reasonable administrative, technical, and physical safeguards to protect personal information, including encryption in transit, hashed passwords, and access controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a security breach affects your personal information, we will notify you as required by applicable law.

11. Your Privacy Rights

Depending on where you live, you may have the following rights regarding your personal information. We extend these rights to all customers in the United States:

• Right to know and access — to request the personal information we hold about you and information about how we collect, use, and disclose it;
• Right to correct — to request correction of inaccurate personal information;
• Right to delete — to request deletion of your personal information, subject to exceptions permitted by law;
• Right to data portability — to receive your personal information in a portable format;
• Right to opt out — to opt out of the sale or sharing of personal information, targeted advertising, and profiling. You may opt out of the sharing described in Section 6 by selecting "Cookie Settings" at the bottom of any page; and
• Right to limit — to limit the use of sensitive personal information. We do not use sensitive personal information for purposes that give rise to this right.

We will not discriminate against you for exercising any of these rights, including by denying you goods or services or charging you a different price.

12. How to Exercise Your Rights

To exercise your rights, email us at ComfortCare@ScriptsUSA.com or call us at the telephone number in Section 18.

We will verify your identity before responding, usually by confirming your email address and details of your orders. You may designate an authorized agent to make a request on your behalf. We may require written proof of the agent's authority and ask you to verify your identity directly.

We will respond within 45 days. If we need more time, we will notify you and may take up to an additional 45 days. We do not charge a fee to process a request unless it is manifestly unfounded or excessive.

If we decline your request, you may appeal by replying to our response or by emailing us with "Privacy Appeal" in the subject line. We will respond to your appeal in writing within 60 days. If your appeal is denied, you may contact the Attorney General of your state.

13. Opt-Out Preference Signals

We honor Global Privacy Control (GPC) signals as a request to opt out of the sale and sharing of personal information. If your browser sends a GPC signal, the Google tag and our analytics service do not run, and the cookie banner is not shown. We treat Do Not Track signals in the same way.

14. Notice to California Residents

This section supplements this Policy for California residents and is provided under the California Consumer Privacy Act, as amended (the "CCPA").

In the past 12 months, we collected the following categories of personal information: identifiers; customer records information described in California Civil Code § 1798.80(e); commercial information; and internet or other electronic network activity information. We collected this information from the sources and for the purposes described in Sections 1 and 2, and disclosed it for business purposes to the categories of recipients described in Section 3.

We do not sell personal information. With your consent, we share identifiers and commercial information with Google for advertising measurement, as described in Section 6. We did not share personal information in the 12 months before the effective date of this Policy. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.

We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA.

Under California Civil Code § 1798.83, California residents may request information about our disclosure of personal information to third parties for their direct marketing purposes. We do not make such disclosures.

15. Children's Privacy

The Website is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

16. Users Outside the United States

The Website is intended for users in the United States. We and our service providers process and store personal information in the United States.

17. Changes to This Policy

We may update this Policy from time to time. We will post the updated Policy on this page and update the effective date. If we make material changes, we will notify you before the changes take effect, as required by law.

18. Contact Us

If you have any questions about this Policy or wish to exercise your rights, please contact us at: