CVS Privacy Policy

LAST UPDATED: 12/02/2024

This Privacy Policy describes how CVS Pharmacy, Inc. and its subsidiaries and affiliated companies ("CVS," "we," "our," or "us") collects Personal Information from and about you, including through your interactions with us in our CVS Pharmacy stores, on CVS.com (the "Site"), and on our mobile application (the "CVS App"). We refer to these collectively as the "Services." It also describes the types of Personal Information we collect, how we may use and disclose such information, and your choices and legal rights with respect to such information.

If you are looking for information about how a CVS Health company collects and uses information for any healthcare services including CVS Pharmacy and MinuteClinic, please review the privacy policy provided for those services, which you can find at our Privacy Center.

By using our Services, you agree to the collection, use, and disclosure of your information as described in this Privacy Policy. If you do not agree, please do not use our Services.

Contenido:

1. Personal Information We Collect

There are several ways we may collect Personal Information about you, including through information you provide to us; information we collect through your use of the Services and interactions with us; information we receive from third parties; and by combining information from different sources. This includes data that identifies you personally, whether directly or indirectly. For purposes of this Privacy Policy, "Personal Information" refers to information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to you, and includes "personal data" or similar terms as defined in applicable law.

a) Categories of Information We May Collect

We may collect certain categories of Personal Information, such as:

• Identifiers/demographic information, such as name, age, date of birth, sex, gender, postal and email address, phone number, and online identifiers, Internet Protocol (“IP”) address, and other similar identifiers.
• Commercial information, such as items purchased, obtained, or considered and other purchasing or consuming histories or tendencies.
• Internet or other electronic network activity information.
• Geolocation data (non-precise).
• Biometric information.
• Audio, electronic, visual, or similar information.
• Professional or employment-related information.
• Inferences, meaning inferences drawn from the listed categories of Personal Information reflecting consumer preferences or characteristics.
• Sensitive Personal Information as defined by applicable laws, including government identification numbers, biometric information, account log-in and password, credit or debit card number, precise geolocation, racial or ethnic origin, and Personal Information collected and analyzed concerning a consumer’s health, sex life, or sexual orientation.

We may share or sell, or use for targeted advertising, as those terms are defined by applicable law, certain categories of Personal Information, including online and other identifiers, commercial information, internet activity, and non-precise location information.

b) Information You May Provide

When you use our Services, we may collect Personal Information from you, such as when you create an account, your interactions with our CVS Pharmacy stores, our Site, or CVS App, or your enrollment in programs such as e-receipt or ExtraCare^®.

c) Information We May Automatically Collect

When you visit and interact with our Services, we or our third-party advertising and analytics partners and service providers may use a variety of technologies, such as cookies, tags, SDKs or scripts, to collect certain information regarding your activity.

The specific types of information that we and our partners and service providers may automatically collect when you visit and interact with our Services include:

• Device and Browser Information. This includes your device’s IP address and/or other unique identifiers, browser type, device type, internet service provider, and operating system.
• Información sobre ubicación. When you access our Services from a mobile device, your device's approximate location (derived from your device's IP address or other signals) may be collected. Additionally, when you visit one of our stores, your location may also be collected.
• Usage Information. When you interact with our Services, certain information may be collected by us or our third party vendors, such as the date and time of your visit, the pages you view immediately before and after you access our Services, the areas or pages of our Services that you visit, the amount of time you spend viewing or using our Services, items placed or left in your shopping cart on the Site or CVS App, keystrokes, mouse movements, form field entries, recordings of chat sessions or your use of and inputs to other AI-supported tools, and other use and overall engagement with our Services.
• Marketing Information. If you receive an email from us, information may be collected about your interactions with the message (e.g., whether you opened, forwarded, or clicked through to our Site).
• Third-Party Analytics Technologies. We may use third-party analytics tools to better understand who is using our Services, how people are using them, and how to improve their effectiveness as well as the effectiveness of any related content.

Cookies and Other Similar Technologies: “Cookies” are text files that are placed on your browser by the websites that you visit. Cookies are used for various purposes, such as to distinguish you from other users, make your site navigation more efficient, help remember your preferences, enhance your browsing experience, and improve the use and functionality of our Sites and related content. They can also enable the delivery of relevant and personalized advertisements to you across the internet.

Cookies (and other similar tracking technologies) provided by third parties may be placed on certain places within our Sites and the providers of these technologies may combine information collected from your interaction(s) with our Services with information they collect from other sources and use the combined information for analytics and/or advertising purposes.

To learn more about your choices regarding the automatic collection and use of your information as you browse our Services, please see the Your Privacy Choices and Rights section below.

d) Information We May Receive from Third Parties

We may receive Personal Information from other sources. Our third-party sources may include:

• Our Business Partners, such as companies that co-sponsor our promotions.
• Our Marketing/advertising and analytics partners, such as online advertising networks and analytics providers.
• Social Media Platforms (note that the information we receive from such platforms is dependent upon their policies and your settings on the platforms).
• Other Companies that provide Personal Information to supplement what we already know about you, including data aggregators.

e) Combination of Information

We may combine Personal Information that we receive from various sources. For example, we may combine Personal Information that we receive from third parties with Personal Information we already have about you. We use, disclose, and protect combined Personal Information as described in this Privacy Policy.

f) Retention

We will retain your Personal Information for as long as reasonably necessary to provide you with our Services that you request, for marketing purposes unless you opt out as described in our Privacy Policy, or otherwise where permitted or required in accordance with applicable law. We will retain and use your Personal Information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. What this means in practice will vary between different types of information, and when we consider our approach we take into account ongoing business or legal needs for the information, for example in relation to tax, health and safety, and potential or actual disputes or investigations.

2. How We May Disclose Your Personal Information

We may disclose Personal Information that we collect to the following categories of recipients:

• Our Service Providers. We disclose your Personal Information to our service providers that provide business, professional, or technical support services to us, help us operate our business and the Services, or administer activities on our behalf. We require our service providers to only use your Personal Information in connection with providing services to CVS.
• Third-Party Ad Networks and Providers. We may disclose Personal Information to third-party ad network providers, sponsors and/or traffic measurement services. Estos terceros pueden usar cookies, JavaScript, web beacons (incluyendo GIF transparentes) y otras tecnologías de rastreo para medir la eficacia de sus anuncios y personalizar el contenido de anuncios que se le muestra. These third-party cookies and other technologies are governed by each third party's specific privacy policy, and not this one.
• Our Research Partners. We disclose your Personal Information to our research partners, such as those that administer surveys or conduct research projects in partnership with us or on our behalf.

In certain circumstances, we may disclose each category of your Personal Information to:

• Competent Governmental, Regulatory, and Public Authorities. We may disclose your Personal Information only as permitted or if required to do so by government and law enforcement authorities We disclose Personal Information in matters involving claims of personal or public safety, or in litigation. This may include disclosure of your Personal Information to allow us to pursue remedies or to limit the damages we may sustain. We may also use or disclose your information to enforce our terms and conditions, to protect our operations or those of any of our affiliates, to prevent misuse of our Services, or to protect our rights, privacy, safety or property and/or that of our affiliates, you, or others.
• Relevant Third Parties as Part of a Corporate Transaction. In the event of a reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with a bankruptcy or similar proceeding), we may disclose or transfer your Personal Information to certain third parties, such as the acquiring entity and its advisers.
• Other Third Parties. We will disclose your Personal Information to other third parties at your direction or with your consent. Additionally, we will disclose your Personal Information as we believe necessary or appropriate to: (a) comply with applicable law; (b) enforce our terms and conditions; (c) protect our operations; (d) protect our rights, privacy, safety, or property, and/or those of you or others; and (e) allow us to pursue available remedies or limit damages that we may sustain.

We may disclose Personal Information for other reasons that we will describe at the time of information collection or prior to disclosing your information.

Please note that we may de-identify or aggregate Personal Information so that it will no longer be considered Personal Information and disclose such information to other parties for purposes consistent with those described in this Privacy Policy. Unless you take action to re-identify your de-identified information, we will not attempt to re-identify this information so that it may be associated with you.

3. Your Privacy Choices and Rights

You have the ability to make certain choices about how we use your Personal Information, as follows:

a) Unsubscribing from our Marketing and Promotional Communications

From time to time, we may send you marketing and promotional communications, including special offers from us or our partners. If you no longer wish to receive promotional and marketing emails from us, you may opt out of such communications at any time by following the opt-out instructions included in any promotional or marketing email you receive from us.

b) Privacy Rights and Requests

Depending on your U.S. state of residence, you may have certain rights in relation to your Personal Information, including:

• Right to Know: You may have the right to know what Personal Information we have collected about you, including the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, the categories of third parties to whom we disclose Personal Information, the categories of Personal Information disclosed to third parties, and the specific pieces of Personal Information we have collected about you. Please note that we may not be required to respond to your requests "to know" or access specific pieces of Personal Information more than twice in any 12-month period.
• Right to Request Specific List of Third Parties: You may have the right to request a list of the specific third parties with whom we have shared or sold your Personal Information.
• Right to Data Portability:You may have the right to access your information in a portable format.
• Right to Delete: You may have the right to request that we delete Personal Information that we have collected from or about you, subject to certain exceptions.
• Right to Correct: You may have the right to correct inaccurate Personal Information that we may maintain about you, subject to appropriate verification.
• Right to Opt Out of Certain Types of Personal Information Uses and Disclosures: We use and disclose to third parties Personal Information for analytics and advertising purposes. Accordingly, you may have the right to opt out of the "sale" or "sharing" of your Personal Information, or the use and disclosure of your Personal Information for "targeted advertising" (as these terms are defined under applicable law).

Please note that, where permitted under applicable law, we may decline a request (other than for opt outs) if we are unable to verify your identity (or an agent’s authority to make the request) and confirm the Personal Information we maintain relates to you.

If you are interested in exercising one or more of the rights outlined above except for the Right to Opt Out (see Section 3(d) below), please click aquí o llámenos al 1-866-287-1189. We may take steps to verify your identity before responding to your request by asking you a series of questions about you or your previous interactions with us. Submitting a privacy rights request does not require you to create an account with us.

We will not discriminate against you if you decide to exercise your privacy rights.

c) Agent Requests

Only you, or someone legally authorized to act on your behalf, may submit a request related to your Personal Information.

Depending on your U.S. state of residence, you may authorize someone to make a privacy rights request on your behalf (an authorized agent). Authorized agents will need to demonstrate that you've authorized them to act on your behalf. CVS retains the right to request confirmation directly from you confirming that the agent is authorized to make such a request, or to request additional information to confirm the agent's identity.

d) Opt-Out Requests

You may request to opt out of the sale or sharing of your Personal Information, or of targeted advertising, at any time by clicking the “Your Privacy Choices” link aquí or at the bottom of our Services’ homepages.

Submitting an opt-out request does not require you to create an account with us.

Alternatively, you can use certain preference signals to opt out automatically with all businesses that you interact with online, including CVS. If you enable a browser-based opt-out preference signal, such as Global Privacy Control (GPC), upon receipt or detection, we will endeavor to recognize and treat the signal as a valid request to opt out. If you use different browsers or browser profiles, you may need to enable the signal on each browser or profile if we're unable to associate your preference signal with you.

If you are not logged in on the Services, you may need to opt out separately on all of your browsers and devices, as each opt out will apply only to the specific browser or device from which you opt out if we do not recognize who you are. If you delete or reset your cookies or mobile identifiers, change browsers, or use a different device, this also may mean that the opt-out cookie or tool may no longer work and you will have to opt out again.

In addition, you may opt out of the collection and use of your Personal Information for ad targeting by Google Ad Manager on the Site and the CVS App. You can opt out of this ad targeting powered by Google Ad Manager aquí.

Further, you may be able to opt out of receiving certain targeted or interest-based advertisements using the browser opt-out tools and consumer choice mechanisms provided by advertising industry self-regulatory groups by following the links below:

• Network Advertising Initiative (NAI): https://optout.networkadvertising.org/?c=1
• Digital Advertising Alliance (DAA): https://youradchoices.com/control

You also can control whether you see interest-based advertisements on your mobile device(s) in the following ways:

• Your device operating system may provide mechanisms that allow you to opt in or opt out of the use of information about your use of mobile apps to deliver interest-based advertising to your mobile device. For more information, consult your device settings.
• The DAA offers a tool for opting out of the collection of cross-app data on mobile devices for interest-based advertising. To exercise your choices with respect to participating companies, please download the AppChoices tool at www.aboutads.info/appchoices.

Even if you choose to opt out of receiving interest-based advertising, you may still receive advertising, but the advertisements may be less relevant.

Some of our partners may provide you with additional choices with respect to interest-based advertising. For example, certain social media platforms allow you to control your advertising preferences directly through their services. Please review the privacy policies of the third-party services you use for more information.

e) Right to Appeal

Depending on your U.S. state of residence, you may have the right to appeal a decision we have made in connection with your privacy rights request. To appeal a decision, please contact us at ConsumerPrivacy@CVSHealth.com.

f) Notice of Financial Incentive

We offer financial incentives to promote our products and services. Los grupos son los siguientes:

• ExtraCare: As further described below, in exchange for your enrollment in our ExtraCare program, we may offer you special pricing or service differences, including those you become eligible for when you opt in to earn rewards at the pharmacy or enroll in ExtraCare Plus™, which may be considered “financial incentive” programs under applicable state laws.
• ExtraCare Plus: If you join our ExtraCare Plus membership, we may offer additional ExtraBucks Rewards^® and members-only rewards by tracking additional data elements. As an ExtraCare Plus member, you may have the opportunity to join a third-party partners’ program at a discount. If you choose to join a third-party partners’ program through your ExtraCare Plus membership, you may receive additional ExtraBucks Rewards and members-only rewards in exchange for access and use of your information you provide to our partners as part of these third-party partners’ programs.

We may ask you to provide Personal Information in connection with these promotions, including the following Personal Information: identifiers, including contact information, date of birth, commercial information, purchase history, and information concerning your health. Because these promotions involve the collection of Personal Information, they may be interpreted as "financial incentive" programs under California law or "bona fide loyalty programs" under Colorado law. We use this information for the purposes described in our Notice at Collection of Personal Information, including for targeted advertising. We may share your Personal Information with third parties as described in our Notice at Collection of Personal Information, including data analytics providers, advertising technology vendors, and social media platforms.

Participation in any financial incentive is optional. To enroll, please click aquí. You may withdraw from the program at any time by signing into your account and submitting your request aquí, or by submitting a request to delete your Personal Information here. To stop receiving our emailed coupons or discounts, you may unsubscribe by clicking the "unsubscribe" button at the bottom of any such email. If you ask us to delete your Personal Information, we will not be able to provide you with access to these programs.

The value of any financial incentive we offer is reasonably related to the value of any Personal Information you provide to us. We estimate the value of your Personal Information by considering, without limitation, the expenses we incur from collecting your Personal Information and/or providing the financial incentive to you, the revenue generated by your use of the financial incentive, and any improvements we can make to our products and services based on aggregating information obtained through the financial incentive program.

We may provide additional terms that apply to a particular financial incentive. If applicable, those terms will be presented to you at sign up.

4. External Links

Our Services may have links to third-party services, which may have privacy policies that differ from our own. We are not responsible for the practices of third-party services.

5. Children’s Privacy

Our Services are intended for a general audience. We do not direct our Services to individuals under eighteen (18), nor do we knowingly solicit or collect any Personal Information from individuals under eighteen (18).

6. Data Security

We have implemented physical, administrative, and technical safeguards to maintain the security, confidentiality, and integrity of your information. However, as no transmission of information over the internet is absolutely secure, we cannot guarantee the safety of your information.

7. Revisions To This Privacy Policy

We reserve the right, in our sole discretion, to change, modify, add, remove, or otherwise revise portions of this Privacy Policy at any time. When we do, we will post the change(s) to our Services. Your continued use of our Services following the posting of changes to these terms means you accept these changes. If we change the Privacy Policy in a material way, we will provide appropriate notice to you and seek your consent where required by applicable privacy laws. Notice may be provided via a temporary banner on our Site, an email sent to users for whom we have an email address, or by temporarily noting "UPDATED" next to the Privacy Policy link on the footer of our Site.

8. How To Contact Us

If you have any questions or concerns about this Privacy Policy or the practices described herein, you may contact us by email at ConsumerPrivacy@CVSHealth.com, by mail to CVS Pharmacy, Attn: Privacy Office, 1 CVS Drive, Woonsocket, R.I. 02895, or by phone at 1-866-287-1189.