Privacy Policy

1. Scope of This Policy

This Policy applies to personal information we collect through https://comfortcare.scriptsusa.com, when you place an order or create an account, when you request a facility or wholesale account, and when you contact us by email, telephone, or our inquiry form.

This Policy does not apply to websites, applications, or services operated by anyone else, including any website you reach by following a link from ours. Those are governed by their own privacy policies.

We are a retailer. We are not a health care provider, a health plan, or a health care clearinghouse, and we are not a HIPAA covered entity or business associate. The Health Insurance Portability and Accountability Act does not govern the information described in this Policy. Section 9 explains how we handle information that relates to health.

2. Information We Collect

We collect the following categories of personal information:

• Order information — the products you buy, quantities and prices, your shipping address, your billing address, your email address, and your telephone number if you provide one.
• Account information — if you create an account: your name, email address, a password (which we store only in encrypted, hashed form and cannot read), the addresses you save, and your order history. Facility and wholesale accounts also carry the account type and pricing tier assigned to them.
• Payment information — the outcome of your payment, the card brand, the last four digits, and the expiration date. We never receive or store your full card number, and we never receive your card security code. Section 8 explains how card payments work.
• Facility account requests — if you ask for a facility or wholesale account: your facility's name, your name, your email address, your telephone number, the facility's shipping address, the approximate number of residents you are buying for, and any notes you add.
• Inquiry and support information — if you use our inquiry form or contact us: your name, your email address, your telephone number if you provide one, the message you send, and our correspondence with you about it.
• Technical and security information — the internet protocol (IP) address and browser user-agent string of the device you use, together with the date and time, for requests to our website. We record these in our server logs, and we store them alongside inquiry-form and facility-account submissions and alongside account-registration and sign-in attempts, so that we can detect and stop automated abuse.
• Communication preferences — whether you have asked us to stop emailing you, and whether an email we sent you bounced or was reported as unwanted.

We do not ask for and do not want your Social Security number, your driver's license or other government identification number, your financial account numbers, your precise geolocation, your biometric information, or information about your race, religion, health conditions, diagnoses, prescriptions, or medical treatment. Please do not send us any of these. If you include them in a message to us anyway, we will delete them when we no longer need your message.

3. Where We Get It

Almost all of the information described above comes directly from you — from what you type into an order, an account, a facility request, or a message.

The rest comes from two places. Your device supplies technical information automatically whenever it requests a page, in the ordinary way the internet works. And our payment processor tells us the outcome of a payment, along with the card brand, the last four digits, and the expiration date.

We do not buy personal information, we do not rent it, and we do not obtain it from data brokers, advertising networks, or social media platforms.

4. How We Use It

We use personal information to:

• Take, process, ship, and deliver your order, and handle returns, refunds, cancellations, and exchanges under our Returns, Refunds & Cancellation Policy;
• Send you transactional messages about your order and your account, such as order confirmations, shipping and tracking notices, delivery problems, account confirmations, and password resets;
• Create and maintain your account, keep your saved addresses and order history available to you, and — for facility and wholesale accounts — review your request and apply the correct pricing;
• Answer your questions and provide customer service;
• Take payment, and detect, investigate, and prevent fraudulent, unauthorized, or abusive transactions and website use;
• Operate, secure, monitor, troubleshoot, and improve the website, including limiting the rate of automated requests;
• Keep the business records we are required or permitted to keep, including records for tax, accounting, and audit purposes; and
• Comply with the law, respond to lawful requests, and establish, exercise, or defend legal claims.

We do not use your personal information to build advertising or marketing profiles, to make inferences about your characteristics, or to make decisions about you by automated means that produce legal or similarly significant effects.

5. We Do Not Sell Your Information or Use It for Targeted Advertising

We do not sell personal information, and we have not sold personal information in the twelve months before the effective date of this Policy.

We do not share personal information for cross-context behavioral advertising or targeted advertising, and we have not done so in the twelve months before the effective date of this Policy.

We do not disclose personal information to third parties for their own direct-marketing purposes.

We do not use personal information for profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

These statements describe what we do, not merely what we intend. If any of them ever ceases to be accurate, we will update this Policy before the change takes effect and, where the law requires it, we will offer you a way to opt out.

6. When We Disclose Information

We disclose personal information only in these circumstances:

• To service providers — the companies listed in Section 7, which process information on our behalf, under contract, only for the purposes we specify, and not for their own purposes;
• To shipping carriers — the carrier delivering your order receives your name, delivery address, and the information needed to deliver the package and provide tracking;
• For payment and fraud prevention — our payment processor receives the information it needs to charge your card and to assess whether a transaction is fraudulent;
• When you tell us to — for example, if you ask us to speak with a family member, a caregiver, or a colleague about your order;
• For legal reasons — when we believe in good faith that disclosure is required by law, regulation, legal process, or an enforceable governmental request, or is necessary to protect the rights, property, or safety of ComfortCare, our customers, or the public; and
• In a business transfer — if all or part of our business is sold, merged, reorganized, or transferred, personal information may pass to the successor, which would remain bound by this Policy for information collected before the transfer unless you are notified and given any choice the law requires.

We do not disclose personal information to anyone else without your consent.

7. Service Providers

These are the companies that process personal information on our behalf in order to run this website and this store. Each is bound by contract to use the information only to provide its service to us. This list is complete as of the effective date of this Policy, and we maintain it as a complete list rather than as examples.

• Vercel Inc. — hosts the website, serves its pages, and keeps operational request logs.
• Medusa (Medusa Commerce) — provides the store's backend, its database, and its file storage. This is where your account, your addresses, and your order records are held.
• Stripe, Inc. — processes card payments and, if you ask us to save a card, stores that card. Stripe is a PCI DSS Level 1 certified service provider.
• Resend (Plus Five Five, Inc.) — delivers our transactional email, such as order confirmations, shipping notices, and account messages.
• Sentry (Functional Software, Inc.) — receives an error report when something on this website or in our store system fails, so that we find out about the failure and can fix it. A report is sent only when an error actually occurs. It contains a technical description of the fault, the address of the page you were on, your browser and device type, your IP address, and a short list of the actions immediately before the fault, such as the pages you moved between or the button you pressed. It is not sent on ordinary visits, and Sentry receives nothing about a visit in which nothing goes wrong.
• PostHog, Inc. — measures how this website is used, so that we can see which pages and products people look at and where they run into trouble. It is set up to count visits rather than to identify visitors: it sets no cookies, stores nothing on your device, is never told who you are or connected to your account, and does not record what you click or what you type. Section 11 describes exactly what it receives.
• Google LLC (Google Maps Platform) — powers the address suggestions offered while you type into an address field. Section 11 explains what Google receives and how to avoid it.
• Google LLC (YouTube) — hosts the video on our facilities page. Nothing is requested from YouTube unless you press play. Section 11 explains what happens if you do.

All of these providers process information in the United States for us.

8. Payment Information

Card payments are handled by Stripe. The card fields at checkout are supplied and controlled by Stripe and are hosted by Stripe, not by us. Your card number, expiration date, and security code travel from your browser to Stripe directly. They do not pass through our website and they are never stored on our systems.

What we receive back, and store, is the result of the charge, the card brand, the last four digits, the expiration date, and a reference number that lets us match a payment to an order and issue a refund.

If you are signed in to an account, you may choose to save a card for future orders by ticking the box at checkout. That box is off unless you tick it, and it is not offered to guests. If you tick it, Stripe stores the card and gives us a reference to it; we still do not receive or store the card number. You can remove a saved card at any time from your account, or by emailing us.

Stripe processes payment information both on our behalf and for its own purposes as a payment processor, including fraud prevention and compliance with financial regulations. Stripe's handling of that information is governed by Stripe's own privacy policy.

9. Health-Related Information

We sell incontinence and personal-care supplies. We recognize that what a person buys from us — or buys on behalf of a resident, a patient, or a family member — can reveal something about health needs, even though we never ask about them.

We do not ask you for, and we do not want, any diagnosis, prescription, medical record, treatment history, insurance or benefit information, or any other clinical detail. Nothing on our website requires it in order to place an order.

Where information we hold relates to health because of what was purchased, we treat it with the same care as the rest of your order information, and specifically:

• We collect it only because it is necessary to provide the products you have asked us to supply, and to support you afterwards;
• We never sell it, and we would not sell it even with your permission;
• We never use it for advertising, marketing profiles, or targeting of any kind;
• We never disclose it to a data broker, an advertising network, or a social media platform;
• We limit access to it inside our business to the people who need it to fulfill orders, take payment, and provide support; and
• We will delete it on your request, as described in Section 16, except where we are required to keep a transaction record.

The same care shapes how we measure the website. Which product pages a person opens could suggest something about a health need, so our analytics service is set up so that those page views are counted but not tied to a person: it is given no name, email address, or account, it stores nothing on your device that would let it recognize you on a later visit, and the temporary code it uses to group one visit together changes every day. We do not build profiles of what individual people looked at, and we do not use anything measured on this website to advertise to anyone. Section 11 sets out what is and is not collected.

Some states — including Washington and Nevada — give residents specific rights over health-related information, including the right to have it deleted and the right to withdraw consent to its collection. If you live in one of those states, you may exercise those rights by contacting us as described in Section 16, and we will honor them.

Nothing we publish is medical advice, and our staff cannot give it. Please consult a physician, nurse, or other qualified professional when professional advice is needed.

10. Cookies

A cookie is a small file a website stores on your device so that it can recognize your browser on a later request. Every cookie this website sets is a first-party cookie — set by us, readable only by us, and used only to make the website work. We set no advertising cookies and no cross-site tracking cookies.

These are all of the cookies we set, and what each one is for:

• _medusa_jwt — keeps you signed in to your account. It is set only when you sign in, is not readable by scripts running in the page, is not sent with requests from other websites, and expires after seven days.
• _medusa_cart_id — remembers which cart is yours, so your basket survives a page reload. It is not readable by scripts running in the page, is not sent with requests from other websites, and expires after seven days.
• _cc_cart_ctx — records whether your cart was started as a retail cart or a facility cart, so you are charged the right prices. It is not readable by scripts running in the page, and it expires after seven days.
• _cc_recent_orders — if you check out as a guest, holds the reference numbers of your most recent orders (up to ten) so that you can open your own order confirmation without an account, and so that nobody else can open it by guessing a reference number. It is not readable by scripts running in the page, and it expires after thirty days.
• _medusa_cache_id — a random identifier that keeps one visitor's cached pages separate from another's. It holds no information about you and expires after twenty-four hours.
• _medusa_locale — remembers your regional preference.

All six are strictly necessary to operate the website and to provide the service you have asked for, so we do not ask for consent to set them. You can delete or block cookies in your browser settings, but if you block these you will not be able to stay signed in, keep items in your cart, or reopen a guest order.

That list is complete, and it stays complete even though we measure how the website is used. Our analytics service is deliberately run in a mode that sets no cookie and writes nothing at all to your device — no cookie, no local storage, nothing that survives after you close the tab. This is also why you are not asked to accept cookies when you arrive: there is nothing stored on your device for you to accept.

We do not use web beacons, tracking pixels, or session-recording tools anywhere on this website, and we do not embed tracking pixels in our emails. Nor do we fingerprint your device: nothing here inspects your fonts, screen, graphics hardware, or installed software to build a lasting identifier for you. Because our analytics service stores nothing on your device, it needs some way to tell one visit from another, and it does that by deriving a temporary code from your IP address and browser type combined with a secret value that changes daily. The practical effect is that a visit can be counted as one visit, and that the same person returning tomorrow cannot be recognized as the same person.

11. Analytics, Advertising, and Third-Party Content

We use one analytics service, PostHog, to understand how this website is used — how many people come, which pages and products they look at, where they arrived from, and at what point they leave. We use it to improve the website, and for nothing else. We run no advertising of any kind, on this website or anywhere else, using information collected here. Our web fonts are served from our own website rather than from a font provider, so no font provider is ever contacted.

It is set up to measure visits rather than to identify visitors. Specifically, and these are commitments about how it is configured, not merely about how we intend to use it:

• It sets no cookie and stores nothing on your device — see Section 10.
• It is never told who you are. We do not send it your name, your email address, your account, or your order, and it does not build a profile of you. If you are signed in, it is not told that either.
• It does not record what you click, what you type, or what you hover over. The setting that would capture that is switched off.
• It does not record your screen. No session-recording or screen-replay tool runs on this website, and the software is configured to refuse such a recording even if one were somehow produced.
• It receives the address of the page you are on, with sensitive parts removed before anything is sent. Password-reset and unsubscribe links are stripped of their codes, and an order confirmation page is reported only as "an order confirmation" rather than as your specific order.
• It receives the website you arrived from, if any, and your general location, browser, and device type, which are worked out from your IP address. Your IP address is used to do that and is not stored as part of the record of your visit.
• If your browser sends a "Do Not Track" or Global Privacy Control signal, it does not run at all. See Section 17.

If you would rather not be counted at all, turning on Global Privacy Control or Do Not Track in your browser is the most reliable way to do it, and it takes effect immediately with no account or request needed. You can also block analytics with a browser extension or content blocker; nothing on this website depends on the analytics running, so blocking it does not affect browsing, ordering, or your account.

Apart from the analytics described above, there are exactly two places where content from another company is involved, and both are described here in full:

• Address suggestions. When you type into an address field — at checkout, in your account, or in a facility request — the characters you type in that field are sent to Google Maps Platform so that it can suggest matching addresses, and Google receives your device's IP address with that request. This happens only while you are typing in an address field. If you would rather Google were not involved, type the address in full and ignore the suggestions, or turn off JavaScript for the page; the address fields work as ordinary text boxes either way, and your order is unaffected.
• The facilities video. The video on our facilities page is hosted by YouTube. We show a still image instead of the video player, and nothing at all is requested from YouTube or Google unless you press play. If you press play, YouTube loads its player and may set its own cookies and collect information about you under Google's privacy policy, which we do not control. If you do not press play, no request to YouTube is ever made.

Separately from those two, if something on the website fails while you are using it, an error report is sent to Sentry, the error-monitoring provider named in Section 7, so that we learn about the fault. That happens only when an error occurs. It is not a measurement of your visit, and it does not happen on a visit where nothing goes wrong. Sentry, the analytics service described above, and the providers running the store itself are together the complete list of companies that receive anything at all when you load or use a page.

Our website contains no social media buttons, feeds, share widgets, chat widgets, comment systems, or third-party advertising slots.

12. Email and Other Communications

The email we send is transactional. It confirms an order, tells you about its status or shipment, confirms or secures your account, resets a password, invites an approved facility contact to set one up, or answers something you asked us. As our Terms of Service explain, you consent to receive these messages electronically when you use the website or place an order, and we send them because they are necessary to complete the transaction you began.

We do not operate a newsletter or a marketing mailing list, and there is no list on this website to join. If we ever begin sending marketing email, it will be to people who have asked for it, every message will carry an unsubscribe link, and we will update this Policy first.

You can ask us to stop emailing you at any time, either through the unsubscribe link in a message or by emailing us. We record that request so that it is honored, and we also record when a message bounces or is reported as unwanted. Because these records exist to keep us from emailing you, we keep them rather than deleting them. If you ask us to stop, we may still need to send you messages required to complete an order you have already placed, or messages the law requires.

If you telephone us, we may keep a record of your call and what it concerned so that we can follow up on it.

13. How Long We Keep Information

We keep personal information only as long as we need it for the purposes described in this Policy, and then for any further period the law requires. In practice:

• Order and transaction records are kept for as long as we are required to keep business, tax, and accounting records, and for as long as a claim relating to the order could still be brought;
• Account information is kept while your account is open, and is deleted or de-identified after you ask us to close it, except for the transaction records above;
• Inquiry-form messages, facility-account requests, and the correspondence attached to them are kept while we are dealing with them and for a reasonable period afterwards, so that we can pick up a conversation where it left off;
• Security and abuse-prevention records, including the IP addresses recorded against sign-in and registration attempts, are kept only for as long as they serve that purpose, and are short-lived by design; and
• Records of requests to stop emailing you are kept indefinitely, because deleting them would cause us to email you again.

When information is no longer needed, we delete it or de-identify it so that it can no longer be associated with you.

14. How We Protect Information

We use reasonable administrative, technical, and physical safeguards designed to protect personal information against loss, misuse, and unauthorized access, disclosure, alteration, or destruction. These include encryption of traffic between your browser and our website, storage of passwords in hashed form that we cannot reverse, session cookies that scripts cannot read and that other websites cannot cause your browser to send, limits on the rate of automated requests, restricting staff access to what each person needs to do their job, and keeping card data out of our systems entirely by leaving it with our payment processor.

No method of transmitting or storing information is completely secure, and we cannot guarantee absolute security. Please choose a strong, unique password, keep it confidential, and tell us promptly if you believe your account has been used without your permission.

If a breach of security affects your personal information, we will notify you and the appropriate authorities as required by applicable law.

15. Your Rights and Choices

Several states give residents rights over their personal information, and the rights available depend on where you live. Rather than ask you to work out whether your state's law applies to us, we extend the following to every customer in the United States, and we will honor your request whether or not a law requires us to:

• Know and access — ask us to confirm whether we hold personal information about you and to give you a copy of it, together with the categories we collected, the purposes we collected them for, and the categories of recipients we disclosed them to;
• Correct — ask us to correct personal information about you that is inaccurate;
• Delete — ask us to delete personal information about you;
• Portability — receive a copy of the personal information you gave us in a portable, readily usable electronic format;
• Opt out of sale, sharing, targeted advertising, and profiling — although, as Section 5 explains, we do none of these, so there is nothing to opt out of;
• Limit the use of sensitive information — although, as Sections 2 and 4 explain, we do not collect sensitive personal information in order to infer characteristics about you; and
• Withdraw consent — where we relied on your consent, withdraw it at any time.

We will not deny you goods or services, charge you a different price, or provide you a different level of quality because you exercised any of these rights. We offer no financial incentive in exchange for your personal information.

Some requests we may have to decline in part. If you ask us to delete everything, we will still keep the transaction records we are required to keep, and we will keep any record of your request not to be emailed. We will tell you when we do this and why.

16. How to Make a Privacy Request

Email us at ComfortCare@ScriptsUSA.com, or write to us at the address at the end of this Policy, and tell us what you would like us to do. You may also telephone us on the number at the end of this Policy.

So that we do not give your information to someone else, we will ask you to verify your identity before we act. Usually this means confirming that you control the email address on the account or the order, and confirming details of an order only you would know. We use what you send us for verification only, and then delete it.

An authorized agent may make a request for you. We will ask the agent for written proof that you authorized them, and we may ask you to confirm it directly.

We will acknowledge your request promptly and respond within forty-five days. If we need more time, we will tell you within that period, explain why, and take no more than a further forty-five days.

If we decline your request, we will tell you why. You may appeal by replying to our response, or by emailing us with "Privacy Appeal" in the subject line. A different person will review the appeal, and we will give you a written answer within sixty days explaining the outcome and the reasons for it. If we deny your appeal, we will tell you how to complain to your state's Attorney General.

Making a privacy request is free. We may charge a reasonable fee, or decline, only if a request is manifestly unfounded or excessive — for example, repetitive — and we will explain our reasoning if that ever happens.

17. Opt-Out Preference Signals and Do Not Track

Some browsers and extensions can send an opt-out preference signal, such as Global Privacy Control, telling a website not to sell or share personal information. We honor those signals. We do not sell or share personal information at all, so nothing about a sale changes — but we go further than the signal requires: if we receive it, our analytics service is not loaded at all for that visit, so no measurement of your visit takes place. Section 11 describes what that measurement otherwise involves.

Browsers may also send an older "Do Not Track" signal. There is no common industry standard for how a website should respond to it, and most browsers have now removed it, but we treat it exactly as we treat Global Privacy Control: if we receive it, our analytics service is not loaded for that visit. Neither signal affects your ability to browse, order, or use your account, and neither is recorded.

18. Additional Information for California Residents

If you are a California resident, the following supplements the rest of this Policy.

In the twelve months before the effective date of this Policy, we collected the categories of personal information described in Section 2. Under the California Consumer Privacy Act, those fall within these statutory categories: identifiers; personal information listed in the California customer records statute; commercial information; and internet or other electronic network activity information, being the requests your device makes to our own website together with the anonymous measurement of those visits described in Section 11. We collected them for the purposes described in Section 4, from the sources described in Section 3, and disclosed them for a business purpose to the categories of recipients described in Sections 6 and 7.

We did not sell personal information and did not share it for cross-context behavioral advertising. We do not have actual knowledge that we have sold or shared the personal information of consumers under sixteen years of age.

We do not collect or process sensitive personal information for the purpose of inferring characteristics about you, so the right to limit its use and disclosure does not apply to anything we hold.

California's "Shine the Light" law lets residents ask a business each year about personal information it disclosed to third parties for their own direct-marketing purposes. We disclose no personal information for that purpose, so we have nothing to report — but you may still ask, using the contact details in Section 16.

19. Children's Privacy

This website is intended for adults. It is not directed to children, we do not knowingly collect personal information from anyone under thirteen years of age, and we do not knowingly sell or share the personal information of anyone under sixteen.

Some of what we sell is bought by an adult for a child in their care. That is an adult's account and an adult's order, and we ask that a parent, guardian, or caregiver place it. Please do not give us a child's name, age, or any information about their health.

If you believe a child has given us personal information, please contact us and we will delete it.

20. Facility and Business Accounts

If you request an account for a facility or organization, the information you give us is about your business and about you in your professional capacity. We use it to check that the request is genuine, to decide whether to approve it, to set the right pricing, and to contact you about the account and its orders.

We ask for the approximate number of residents you are buying for so that we can recommend appropriate quantities and pricing. That is a figure about your facility. Please do not send us the names of residents or patients, or any information about their health or care.

If you place orders on behalf of a facility, the facility can see the orders placed on its account, including who placed them.

We keep a record of requests we decline, and of the IP address and browser a request came from, so that we can recognize and stop abusive or fraudulent applications.

21. Where Your Information Is Processed

We are based in New Jersey, we ship only within the United States, and we and our service providers store and process personal information in the United States.

This website is not directed to people outside the United States, and we do not offer goods or services to them. If you visit from elsewhere, understand that your information will be transferred to and processed in the United States, where privacy laws may differ from those where you live.

22. Changes to This Policy

We may revise this Policy. When we do, we will post the revised version on this page and change the Effective Date at the top.

If a change materially reduces the protection given to personal information we already hold about you — for example, if we ever began selling personal information or using it for advertising — we will tell you before the change takes effect and, where the law requires it, obtain your consent or offer you a way to opt out.

Please review this page from time to time. Continuing to use the website after a revision means the revised Policy applies to your use of it from that point forward.

23. Contact Us

If you have a question about this Policy, want to exercise a right described in Section 15, or want to complain about how we have handled your personal information, contact us and we will answer: