CCPA Privacy Notice
Last Updated: January 1, 2023
This California Consumer Privacy Act (“CCPA”) notice (this “CCPA Notice”) is incorporated into GoodRx’s (“GoodRx,” “we,” “us,” or “our”) general privacy policy found here (and other related policies). This CCPA Notice provides additional information solely for California “consumers” (as such term “consumers” is defined under the CCPA) (collectively, “Consumers,” “you,” or “your”) and applies solely to the personal information of such Consumers, whether collected online or offline. In the event of a conflict between this CCPA Notice and any of our other privacy policies, this CCPA Notice shall control only with respect to Consumers and their personal information.
General Information Regarding Your Personal Information
Categories of Personal Information We Collect
We collect the following categories of Personal Information via our Services (and have done so within the past 12 months when engaging with our Services):
- Identifiers (such as your name, home, work, billing, and/or shipping addresses, home and/or mobile phone number, email address, online identifiers, username and password for your account with us)
- Categories of Personal Information listed in Section 1798.80(e) of the California Customer Records Act (such as name, home, work, billing, and/or shipping addresses, home and/or mobile phone number, health and medical information, credit card information, debit card number, health and medical information)
- Characteristics of protected classifications under California or federal law (such as age, gender)
- Commercial information (such as products or services considered or used, or the fact that someone has considered or used products or services)
- Internet or other electronic network activity information (such as browsing history, search history, and information regarding your interaction with our website, mobile application, or advertisements)
- Geolocation data (such as zip code, home, work, billing, and/or shipping addresses)
- Audio, electronic, visual or similar information (such as survey responses, reviews or testimonials that you post or send us, messages you send us and other information that you type in an open text field on our websites or mobile application or communicate to us over the phone)
- Professional or employment-related information (such as National Provider Identification numbers, medical specialty)
- Education information (such as how many years you attended school)
- Inferences (such as potential interest in our content or services)
- Sensitive personal information (such as data concerning a Consumer’s health, account log-in details).
- We process sensitive information for purposes where a Consumer can opt out (as such opt out is described further below).
The Business or Commercial Purposes for Which We Use Your Personal Information. We use your personal information in order to provide our services (including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments), to directly or indirectly enable or effectuate commercial transactions, to run our business (including for internal research for technological development and demonstration, activities to verify or maintain the quality of the services or improving, upgrading or enhancing our services, debugging to identify and repair errors that impair existing intended functionality, internal business operations, analytics, and to provide, develop, change, market or optimize our services and products), to communicate and market to you, to personalize communications and marketing (whether regarding our Services or third-party services we believe you may find interesting) and to measure the effectiveness of communications and marketing (directly or via third parties), to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for that activity, debugging to identify and repair errors that impair existing intended functionality. Please see our Privacy Policy for more information about how we use your personal information.
Sources of Personal Information. As also discussed in our general Privacy Policy, we collect personal information from various sources, including directly from the Consumer and from advertising networks, internet service providers, data analytics and marketing providers, operating systems and platforms, social networks, data brokers, healthcare providers, and pharmacy benefit managers.
Categories of Personal Information We “Sell” or “Share”. The CCPA defines “sales” broadly to include not only traditional selling of data, but also many sharing arrangements where the recipient can use the personal information that they receive for the recipient’s own commercial purposes. The CCPA defines “shares” broadly to include disclosures of personal information to third parties for cross-context behavioral advertising (or “targeted advertising,” as such practice is more commonly referred to).
We make certain categories of personal information available to third parties in order to receive targeted advertising-related services, such as when we make browsing information available (e.g., through third-party tags on our digital properties) to carry out, measure, and improve our ad campaigns and reach users with more relevant ads and content. These disclosures may be considered a “sale” and “share” of personal information under the CCPA.
More specifically, the categories of Personal Information that we may have “sold” and “shared” in the past twelve (12) months are: identifiers; categories of personal information listed in Section 1798.80(e) of the California Customer Records Act; commercial information; internet or other electronic network activity information; geolocation information; electronic or similar information; professional or employment-related information; inferences; and sensitive personal information. The categories of third parties to whom we have “sold” or “shared” such data in the past twelve (12) months: are data analytics providers, advertising networks, and social networks. We do not have actual knowledge of “selling” or “sharing” personal information of individuals under 16 years of age.
Data Retention: We retain the categories of personal information listed above as reasonably necessary to fulfill the purposes outlined in this notice, unless a longer retention period is required or permitted by law. In many situations, we must retain all, or a portion, of your personal information to comply with legal obligations, resolve disputes, enforce our agreements, protect against fraudulent, deceptive, or illegal activity, or for another one of our business purposes.
Your Consumer Rights Under the CCPA
This section describes your various rights in relation to your personal information under the CCPA. For more information on how to effectuate such rights, please see the Submitting CCPA Requests section below.
Right to Know. You have the right to request, free of charge, that we disclose information about our collection and use of your personal information over the past twelve (12) months (or longer, unless this proves impossible or involves disproportionate effort), including:
- The categories of personal information we collect about you;
- The categories of sources of the personal information we collect about you;
- The business or commercial purpose for collecting, “selling,” or “sharing” the personal information;
- The categories of third parties to whom the business discloses personal information; and
- The specific pieces of personal information we’ve collected about you.
Right to Request Deletion. You have the right to request the deletion of your personal information that we’ve collected from you, subject to certain exceptions.
Right to Correct.You have the right to correct any inaccuracies in your personal information, taking into account the nature of the personal information and the purposes of the processing of the personal information.
Right to Request Opt-Out of the “Sale” and “Share” of Your Personal Information. The CCPA allows you to opt-out of “sales” and “shares” of personal information, as such terms are further described above.
Right to Limit Use and Disclosure of Sensitive Personal Information.The CCPA allows you to limit our uses/disclosures of “sensitive personal information” to certain reserved purposes.
Right of Non-Discrimination. You have the right to not receive discriminatory adverse treatment for exercising any of your CCPA rights.
Submitting CCPA Requests
Requests to Know or Delete. To exercise your rights to know, delete, or correct, you may submit a request by contacting us by phone at the toll-free number, +1 (855) 817-7639. You may also submit a request to know at goodrx.com/datarequest and a request to delete at goodrx.com/requestdeletion. You can also have an authorized agent make a request via such links by following the instructions therein.
Requests to Correct. To exercise your right to correct, please log into your account and edit the information therein.Please note that we may be unable to process certain requests to correct, depending on the nature of the information and the purposes of the processing of the personal information.
How to Request to Opt-Out of “Sales” and “Shares” of Your Personal Information and Limiting Our Use/Disclosure of Sensitive Personal Information. To opt-out, please click our “Your Privacy Choices” link (found here and at the bottom of our website homepage) and follow the instructions therein. As set forth in the link above, you may use the Global Privacy Control (GPC) browser extension for opt-outs on the browser level in relation to “cookies.” Learn more about global privacy controls at globalprivacycontrol.org.
Verification of Requests
Only you, or an individual legally authorized to act on your behalf, may make a request to know, delete, correct, or opt-out related to your personal information. You may only submit a request to know twice within a 12-month period. Your request to know, delete, or correct must:
- Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information, or that the requestor is your authorized representative.
- Describe your request with sufficient detail that allows us to properly respond to it.
We may request information from you in order to verify your identity. Additionally, we may require that authorized agents provide proof of their authorization. We cannot respond to your request if we are unable to verify your identity, your authority to make a request on behalf of another person, or if we cannot confirm that the personal information relates to you. In general, we will verify your request and your identity by matching the information you provided with the information we have in our records.
You do not need to create an account with us to submit a request to know, correct, or delete your personal information or opt-out of “sales” or “shares” of your personal information or certain use/disclosure of sensitive personal information.
We will only use personal information provided in the request to verify the requestor’s identity or authority to make it.
CCPA Reporting Metrics
Below are reporting metrics for GoodRx Data Deletion Requests and Data Access Requests received in 2021 (January 1, 2021 - December 31, 2021). Please note, GoodRx Data Deletion Requests are open to all users nationwide and Data Access Requests are open to California residents.
|
Reporting Metrics for 2021 |
Received |
Fulfilled |
Average Duration to Fulfillment |
|
Deletion requests |
819 |
535 |
47 days |
|
Access requests |
34 |
3 |
81 days |
|
Deletion & Access requests |
23 |
2 |
39 days |
|
Total number of requests |
876 |
540 |
47 days |
Notice of Financial Incentives
We make various programs available to you that may be considered “financial incentive” programs under the CCPA.
1. GoodRx Rewards Program and Other Account-Based Discount Offers
Through the GoodRx Rewards Program (“Rewards Program”) and other account-based discount offers (“Offers”), GoodRx offers various “financial incentives” (as set forth under the CCPA) to encourage you to register for an account and use GoodRx to fill prescriptions. The Rewards Program and Offers are only available to registered users who qualify per these Rewards Program Terms and Conditions or Offer Terms and Conditions. For more information about the Rewards Program or Offer, please see the Rewards Program Terms and Conditions and/or Offer Terms and Conditions that are available when you sign up for the Rewards Program or an Offer.
The categories of personal information that GoodRx collects to administer the Rewards Program or Offer include:
- Identifiers (such as name, date of birth or e-mail address);
- Commercial information (such as records of coupons used);
- Internet or other electronic network activity information (such as browsing history and information regarding your interactions with an internet website or mobile application); and
- Sensitive personal information (such as data concerning health, account log-in information)
As an example of an Offer, GoodRx may offer a $5 or $10 automatic savings coupon for a qualifying prescription to encourage you to register for an account and use a GoodRx coupon. Qualified participants who use the designated coupon within 30 days of qualifying using the provided coupon will automatically receive the stated amount of savings on their prescription at the pharmacy. You have the right to withdraw from the Offer at any time by not utilizing your GoodRx accounts further. You can continue to use GoodRx services without participating in the Offer.
Another example, when you initially enroll in the GoodRx Rewards Points Program, you automatically receive GoodRx Rewards Points in accordance with the GoodRx Rewards Point Value System. You then have the option to redeem the GoodRx Rewards Points accrued as a part of this Rewards Program in the form of a digital gift card. Qualified participants will receive a digital gift card via email after they redeem their GoodRx Rewards Points. You may opt-in to the Rewards Program by registering for a free account on the website and using GoodRx to fill prescriptions to accrue GoodRx Rewards Points. You have the right to withdraw from the Rewards Program at any time by not utilizing your GoodRx accounts further. You can continue to use GoodRx services without participating in the GoodRx Rewards Program.
The financial incentive GoodRx offers to you through the Rewards Program or Offer is reasonably related to the value of your data. To form the basis for offering the financial incentive, GoodRx has valued the personal information it obtains through the program based on a reasonable and good faith calculation determined by considering expenses related to the offer, provision, or imposition of any financial incentive as permitted under the CCPA.
For the Rewards Program and the Offers, the amount of expenses associated with this Rewards Program, is calculated by measuring the proportionate IT, product, and development costs incurred for the third quarter of 2022 annualized to calculate full-year amounts, the specific details of which we maintain as a trade secret.
2. GoodRx Gold Subscription
The GoodRx Gold Subscription Program (“GoodRx Gold”) is a monthly membership program that provides Consumers with discounts on prescription drugs and healthcare services through its website, mobile application, and membership cards issued to Consumers. The categories of personal information that GoodRx collects to administer GoodRx Gold include: (1) identifiers (such as name, e-mail address and mailing address; (2) other categories of personal information described in subdivision (e) of Civil Code Section 1798.80 (credit card number or debit card number); (3) commercial information (such as records of services purchased or obtained); (4) Internet or other electronic network activity information (such as browsing history, search history, and information regarding Consumer interactions with an internet website or mobile application); and (5) sensitive personal information (such as data concerning health, account log-in information)
For more information regarding GoodRx Gold, please see the full Terms of Service, available at support.goodrx.com.
Consumers may opt-in to this program by visiting the GoodRx Gold website at gold.goodrx.com/sign-up or downloading the GoodRx mobile application and completing the registration process. Consumers have the right to withdraw from GoodRx Gold at any time and may withdraw by canceling their GoodRx Gold memberships by logging into their GoodRx Gold account via the website or mobile application.
The financial incentive GoodRx offers to Consumers through GoodRx Gold is reasonably related to the value of the Consumers’ data. To form the basis for offering the financial incentive, GoodRx has valued the personal information it obtains through the GoodRx Gold program based on a reasonable and good faith calculation determined by considering expenses related to the offer, provision, or imposition of any financial incentive as permitted under the CCPA. The amount of expenses associated with this program is calculated by measuring the people costs and proportionate IT, product, and development costs incurred for the third quarter of 2022 annualized to calculate full-year amounts, the specific details of which we maintain as a trade secret.
3. Kroger Rx Savings Club Powered by GoodRx
The Kroger Rx Savings Club Powered by GoodRx (“Kroger Rx Savings Club”) provides access to discounts on prescription drugs at participating pharmacies. The categories of personal information that GoodRx collects to administer the Kroger Rx Savings Club include: (1) identifiers (such as name, e-mail address and mailing address); (2) other categories of personal information described in subdivision (e) of Civil Code Section 1798.80 (credit card number or debit card number); (3) commercial information (such as records of services purchased or obtained); and (4) Internet or other electronic network activity information (such as browsing history, search history, and information regarding Consumer interactions with an internet website or mobile application); and (5) sensitive personal information (such as data concerning health, account log-in information).
For more information about the Kroger Rx Savings Club, please see the full Terms of Service, available at krogersc.com/terms-of-service.
Consumers may opt-in by visiting the Kroger Rx Savings Club website at krogersc.com/sign-up or downloading the Kroger Rx Savings Club mobile application and completing the registration process. Consumers have the right to withdraw from Kroger Rx Savings Club at any time and may withdraw by canceling their Kroger Rx Savings Club membership by logging into their Kroger Rx Savings Club account via the website or mobile application.
The financial incentive GoodRx offers to Consumers through Kroger Rx Savings Club is reasonably related to the value of the Consumers’ data. GoodRx has valued the personal information it obtains through the Kroger Rx Savings Club based on a reasonable and good faith calculation determined by considering expenses related to the offer, provision, or imposition of any financial incentive as permitted under the CCPA. The amount of expenses associated with this program is calculated by measuring the people costs and proportionate IT, product, and development costs incurred for the third quarter of 2022 annualized to calculate full-year amounts, the specific details of which we maintain as a trade secret.
Changes to this CCPA Notice
This CCPA Notice is current as of the Last Updated set forth above. We may change this CCPA Notice from time to time, so please be sure to check back periodically. We will post any changes to this CCPA Notice on this page with the Last Updated date so that you can see easily if it has changed.
Contact Us
For questions about this privacy policy, please email legal@goodrx.com. For a copy of this privacy policy for printing purposes, please email legal@goodrx.com with “CCPA Privacy Notice” in the subject line.