California Consumer Privacy Addendum

California Consumer Privacy Act Privacy Notice

CCPA Privacy Notice

Last Updated: June 22, 2022 (“Effective Date”)

This California Consumer Privacy Act (“CCPA”) notice (this “CCPA Notice”) is incorporated into GoodRx’s (“GoodRx,” “we,” “us,” or “our”) general privacy policy found here (and other related policies). This CCPA Notice provides additional information solely for California residents (collectively, “Consumers,” “you,” or “your”) and applies solely to the personal information of California Consumers, as defined in the CCPA, whether collected online or offline. In the event of a conflict between this CCPA Notice and any of our other privacy policies, this CCPA Notice shall control only with respect to Consumers and their personal information.

At Collection Notice

Categories of Personal Information We Collect

Depending on how you use the services, we collect the following categories of Personal Information through our Site and services that are listed in the CCPA law:  

• Identifiers (such as your name, home, work, billing, and/or shipping addresses, home and/or mobile phone number, email address, online identifiers, user name and password for your account with us)
• Categories of Personal Information listed in Section 1798.80(e) of the California Customer Records Act (such as name, home, work, billing, and/or shipping addresses, home and/or mobile phone number, health and medical information, credit card information, debit card number, health and medical information)
• Characteristics of protected classifications under California or federal law (such as age, gender)
• Commercial information (such as products or services considered or used, or the fact that someone has considered or used products or services)
• Internet or other electronic network activity information (such as browsing history, search history, and information regarding your interaction with our website, mobile application, or advertisements)
• Geolocation data (such as zip code, home, work, billing, and/or shipping addresses)
• Audio, electronic, visual or similar information (such as survey responses, reviews or testimonials that you post or send us, messages you send us and other information that you type in an open text field on our websites or mobile application or communicate to us over the phone)
• Professional or employment-related information (such as National Provider Identification numbers, medical specialty)
• Education information (such as how many years you attended school)
• Inferences (such as potential interest in our content or services)

The Business or Commercial Purposes for Which We Use Your Personal Information. We use your personal information in order to provide our services (including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments), to directly or indirectly enable or effectuate commercial transactions, to run our business (including for internal research for technological development and demonstration, activities to verify or maintain the quality of the services or improving, upgrading or enhancing our services, debugging to identify and repair errors that impair existing intended functionality, internal business operations, analytics, and to provide, develop, change, market or optimize our services and products), to communicate and market to you, to personalize communications and marketing and to measure the effectiveness of communications and marketing (directly or via third parties), to detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for that activity, debugging to identify and repair errors that impair existing intended functionality. Please see our Privacy Policy for more information about how we use your personal information.

Your Right to Opt out of “Sales” of Personal Information. The CCPA gives you the right to opt out of “sales” of your personal information, which the CCPA defines broadly to include not only traditional selling of data, but also data many sharing arrangements where the recipient can use the personal information that they receive for the recipient’s own business purposes.     

To exercise this right to opt out of these “sales”, you can use a browser with the Global Privacy Control browser extension, or you can use the “Do Not Sell” and other toggle controls that are available by clicking on the “Do Not Sell My Info” link at the bottom of our website homepage. Learn more about global privacy controls at globalprivacycontrol.org.

Categories of Personal Information Collected and Disclosed. 

In this section we describe generally how we have collected and disclosed personal information about consumers in our role as a business over the previous twelve (12) months. 

Categories of Personal Information We Collect. Depending on how you use the services, we collect the following categories of Personal Information through our services that are listed in the CCPA in the prior twelve (12) months: identifiers; categories of personal information listed in Section 1798.80(e) of the California Customer Records Act; characteristics of protected classifications under California or federal law; commercial information; internet or other electronic network activity information; geolocation information; audio, electronic, visual, thermal, olfactory, or similar information; professional or employment-related information; education information and inferences.

Sources of Personal Information. As also discussed in our general Privacy Policy, we may have collected personal information from various sources, including from directly from the consumer, advertising networks, internet service providers, data analytics and marketing providers, operating systems and platforms, social networks, data brokers, healthcare providers, pharmacy benefit managers.

Categories of Personal Information We May “Sell”. The CCPA defines “sales” broadly to include not only traditional selling of data, but also data many sharing arrangements where the recipient can use the personal information that they receive for the recipient’s own business purposes. We may “sell” personal information by sharing it with third parties, subject to your right to opt-out of those sales. We may also make certain categories of personal information available in order to receive certain benefits or services, such as when we make browsing information available to third party ad companies (through third party tags on our Sites) in order to improve and measure our ad campaigns and reach users with more relevant ads and content. This sharing can also constitute “sales” under the CCPA. The categories of Personal Information  that we may have shared in a manner that is considered a “sale” as defined under CCPA in the prior twelve (12) months include: identifiers; categories of personal information listed in Section 1798.80(e) of the California Customer Records Act; commercial information; internet or other electronic network activity information; geolocation information; electronic or similar information; professional or employment-related information; and inferences. The categories of third parties under the CCPA to whom we have shared data that can be considered a “sale” of personal information as defined under the CCPA in the past twelve (12) months are data analytics providers, advertising networks and social networks. Our personal information sales do not include information about individuals we know are under age 16. 

Categories of Personal Information Disclosed For a Business Purpose. The categories of Personal Information that we have disclosed for a business purpose in the prior twelve (12) months include: identifiers; categories of personal information listed in Section 1798.80(e) of the California Customer Records Act; characteristics of protected classifications under California or federal law; commercial information; internet or other electronic network activity information; geolocation information; audio or electronic, or similar information; professional or employment-related information; education information; and inferences. The categories of third parties under the CCPA to whom we have disclosed personal information as defined under the CCPA for business purposes in the past twelve (12) months may include advertising networks, internet service providers, data analytics providers, data brokers, government entities and law enforcement, operating systems and platforms and social networks.

Your Consumer Rights Under the CCPA

Right to Request Disclosure. You have the right to request, free of charge, that we disclose information about our collection and use of your personal information over the past twelve (12) months, including:

• The categories of personal information we collect about you;
• What personal information we collect, use, or disclose about you;
• The categories of sources of the personal information we collect about you;
• Our business or commercial purpose for collecting the personal information;
• For each category of personal information, the categories of third parties with whom it was disclosed; and
• The specific pieces of personal information we collect about you.

For more information on how to request information about our collection, use, and disclosure of your personal information, please see the Submitting CCPA Requests section below.

Right to Request Deletion. You have the right to request the deletion of your personal information that we collected. For more information on how to request deletion, please see the Submitting CCPA Requests below. Once we receive your request and verify your identity, we will review your request to see if an exception allowing us to retain the information applies. We will delete or de-identify personal information not subject to an applicable exception from our records and will direct our service providers to take similar action.

You do not need to create an account with us to exercise your deletion rights. We will only use personal information provided in a deletion request to review and comply with the request.

Right to Request Opt-Out of the Sale of Your Personal Information. If you are age 16 or older, you have the right to direct us to not sell your personal information at any time. We do not sell the personal information of consumers we actually know are less than 16 years old.

Once you make an opt-out request, we will wait at least twelve (12) months before asking you to reauthorized personal information sales. However, you may change your mind and opt back in to personal information sales at any time by updating your preferences in the “Do Not Sell My Info” link at the bottom of our website homepage or of the applicable webpage or applicable website.

You do not need to create an account with us to exercise your opt-out rights. We will only use personal information provided in an opt-out request to review and comply with the request.

Right of Non-Discrimination. You have the right to be free from discriminatory adverse treatment for exercising these rights. We will not discriminate against you for exercising any of your CCPA rights.

How to Submit CCPA Requests to Us

Requests to Know or Delete. To exercise your rights to know or delete described above, you may submit a request by contacting us by phone at the toll-free number, +1 (855) 817-7639 or at goodrx.com/datarequest for requests to know and goodrx.com/requestdeletion for requests to delete.  You can also have an authorized agent make a request via goodrx.com/datarequest or goodrx.com/requestdeletion by following the instructions therein. 

How to Request to Opt-Out of Sales of Your Personal Information. To exercise this right to opt out of “sales” as defined under the CCPA, you can use a browser with the Global Privacy Control browser extension, , or you can use the “Do Not Sell My Info” link and other toggle controls that are available by clicking on the “Do Not Sell My Info” link at the bottom of our website homepage or of the applicable webpage or applicable website. Learn more about global privacy controls at globalprivacycontrol.org.

Verification of Requests

Only you, or an individual legally authorized to act on your behalf, may make a request to know, delete, or opt-out related to your personal information. You may only submit a request to know twice within a 12-month period. Your request to know or delete must:

1. Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information, or that the requestor is your authorized representative.
2. Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We may request information from you in order to verify your identity. Additionally, we may require that authorized agents provide proof of their authorization. We cannot respond to your request or provide you with personal information if we are unable to verify your identity, your authority to make a request on behalf of another person, or if we cannot confirm that the personal information relates to you. In general, we will verify your request and your identity by matching the information you provided with the information we have in our records.

You do not need to create an account with us to submit a request to know, or to submit a request to delete your personal information or opt-out of sales of your personal information.

We will only use personal information provided in the request to verify the requestor’s identity or authority to make it.

CCPA Reporting Metrics

Notice of Financial Incentives

We make various programs available to you that may be considered “financial incentive” programs under the CCPA.

1. GoodRx Rewards Program

Through the GoodRx Rewards Program (“Rewards Program”), GoodRx offers various “financial incentives” as potentially defined under CCPA to encourage you to register for an account and use GoodRx to fill prescriptions. The Rewards Program is only available to registered users who qualify per these Rewards Program Terms and Conditions. For more information about the Rewards Program, please see the Rewards Program Terms that are available when you sign up for the Rewards Program. 

The categories of personal information that GoodRx collects to administer the Rewards Program include: 

1. Identifiers (such as name, date of birth or e-mail address); 
2. Commercial information (such as records of coupons used); and 
3. Internet or other electronic network activity information (such as browsing history and information regarding your interactions with an internet website or mobile application).

As an example, GoodRx may offer the $5 or $10 Gift Card Rewards Program, which is a one-time gift card in the amount of $5 or $10 to encourage you to register for an account and use a GoodRx coupon. This program is only available to registered users who have not used a coupon before with the designated prescription. Qualified participants who use the designated coupon within 2 days of qualifying using the provided coupon will receive a digital gift card within thirty (30) days of use of the coupon. You have the right to withdraw from the Rewards Program at any time by not utilizing your GoodRx accounts further. You can continue to use GoodRx services without participating in the GoodRx Rewards Program.

Another example, when you initially enroll in the GoodRx Rewards Points Program, you automatically receive GoodRx Rewards Points in accordance with the GoodRx Rewards Point Value System. You then have the option to redeem the GoodRx Rewards Points accrued as a part of this Rewards Program in the form of a digital gift card. Qualified participants will receive a digital gift card via email after they redeem their GoodRx Rewards Points. You may opt-in to the Rewards Program by registering for a free account on the website and using GoodRx to fill prescriptions to accrue GoodRx Rewards Points. You have the right to withdraw from the Rewards Program at any time by not utilizing your GoodRx accounts further. You can continue to use GoodRx services without participating in the GoodRx Rewards Program.

The financial incentive GoodRx offers to you through the Rewards Program is reasonably related to the value of your data. To form the basis for offering the financial incentive, GoodRx has valued the personal information it obtains through the program based on a reasonable and good faith calculation determined by considering expenses related to the offer, provision, or imposition of any financial incentive or price or service difference as permitted under Title 11 of the California Code of Regulations, Section 999.337(a)(6). 

For the $5 or $10 Gift Card Rewards Program, the amount of expenses associated with this Rewards Program, is calculated by measuring the proportionate IT, product and development costs incurred for the third quarter of 2021 annualized to calculate full-year amounts, the specific details of which we maintain as a trade secret.

For the GoodRx Rewards Points Program, while this is a new program, we believe that the amount of expenses associated with this Rewards Program will be similar to our $5 or $10 Gift Card Rewards Program, which is calculated by measuring the proportionate IT, product and development costs incurred for the third quarter of 2021 annualized to calculate full-year amounts, the specific details of which we maintain as a trade secret. 

2. GoodRx Gold Subscription

The GoodRx Gold Subscription Program (“GoodRx Gold”) is a monthly membership program that provides consumers with discounts on prescription drugs and healthcare services through its website, mobile application, and membership cards issued to consumers. The categories of personal information that GoodRx collects to administer GoodRx Gold include: (1) identifiers (such as name, e-mail address and mailing address; (2) other categories of personal information described in subdivision (e) of Civil Code Section 1798.80 (credit card number or debit card number); (3) commercial information (such as records of services purchased or obtained); and (4) Internet or other electronic network activity information (such as browsing history, search history, and information regarding consumer interactions with an internet website or mobile application).

For more information regarding GoodRx Gold, please see the full Terms of Service, available at support.goodrx.com.

Consumers may opt-in to this program by visiting the GoodRx Gold website at gold.goodrx.com/sign-up or downloading the GoodRx mobile application and completing the registration process. Consumers have the right to withdraw from GoodRx Gold at any time and may withdraw by canceling their GoodRx Gold memberships by logging into their GoodRx Gold account via the website or mobile application.

The financial incentive GoodRx offers to consumers through GoodRx Gold is reasonably related to the value of the consumers’ data. To form the basis for offering the financial incentive, GoodRx has valued the personal information it obtains through the GoodRx Gold program based on a reasonable and good faith calculation determined by considering expenses related to the offer, provision, or imposition of any financial incentive or price or service difference as permitted under Title 11 of the California Code of Regulations, Section 999.337(a)(6). The amount of expenses associated with this program are is calculated by measuring the people costs and proportionate IT, product and development costs incurred for the third quarter of 2021 annualized to calculate full-year amounts, the specific details of which we maintain as a trade secret.

3. Kroger Rx Savings Club Powered by GoodRx

The Kroger Rx Savings Club Powered by GoodRx (“Kroger Rx Savings Club”) provides access to discounts on prescription drugs at participating pharmacies. The categories of personal information that GoodRx collects to administer the Kroger Rx Savings Club include: (1) identifiers (such as name, e-mail address and mailing address); (2) other categories of personal information described in subdivision (e) of Civil Code Section 1798.80 (credit card number or debit card number); (3) commercial information (such as records of services purchased or obtained); and (4) Internet or other electronic network activity information (such as browsing history, search history, and information regarding consumer interactions with an internet website or mobile application).

For more information about the Kroger Rx Savings Club, please see the full Terms of Service, available at krogersc.com/terms-of-service.

Consumers may opt-in by visiting the Kroger Rx Savings Club website at krogersc.com/sign-up or downloading the Kroger Rx Savings Club mobile application and completing the registration process. Consumers have the right to withdraw from Kroger Rx Savings Club at any time and may withdraw by canceling their Kroger Rx Savings Club membership by logging into their Kroger Rx Savings Club account via the website or mobile application.

The financial incentive GoodRx offers to consumers through Kroger Rx Savings Club is reasonably related to the value of the consumers’ data. GoodRx has valued the personal information it obtains through the Kroger Rx Savings Club based on a reasonable and good faith calculation determined by considering expenses related to the offer, provision, or imposition of any financial incentive or price or service difference as permitted under Title 11 of the California Code of Regulations, Section 999.337(a)(6). The amount of expenses associated with this program is calculated by measuring the people costs and proportionate IT, product and development costs incurred for the third quarter of 2021 annualized to calculate full-year amounts, the specific details of which we maintain as a trade secret.

Changes to this CCPA Notice

This CCPA Notice is current as of the Effective Date set forth above. We may change this CCPA Notice from time to time, so please be sure to check back periodically. We will post any changes to this CCPA Notice on our Site with the Effective Date so that you can see easily if it has changed.

Contact us

For questions about this privacy policy, please email legal@goodrx.com. For a copy of this privacy policy for printing purposes, please email legal@goodrx.com with “CCPA Privacy Notice” in the subject line.