This privacy policy (“Privacy Policy”) describes the privacy practices of WebMD (“WebMD”) and EngagedMedia (“EngagedMedia” a subsidiary of WebMD, and referred to collectively with WebMD as “us”, “we” and “our”) and applies solely to users (“consumers” or “you”) who use the WebMDRx and EngagedMedia services, websites and mobile applications and other resources related to prescription adherence and coupons, including texts (SMS), notifications, fill or refill reminders, pharmacy transactions, savings cards and savings coupons (collectively, the “Services”).
By using the Services, you consent to our collection, use, processing and sharing of information about you and your use of the Services, as described in this Privacy Policy. If you do not agree with these terms, please do not use the Services.

Information We Collect About You

Certain information that we collect identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“personal information”).
The definition of sensitive personal information (“Sensitive Personal Information”) varies by state, and it may include (1) personal information that reveals (A) racial or ethnic origin; (B) religious beliefs; (C) mental or physical health condition or diagnosis; (D) citizenship or immigration status; (E) sex life or sexual orientation; (2) genetic or biometric data that is processed for the purpose of uniquely identifying an individual; (3) precise geolocation data; and (4) personal information collected from a known child.

To the extent necessary to provide the Services to you, you may be required to provide your personal information, including Sensitive Personal Information, and Consumer Health Data (“CHD”) (as defined under applicable U.S. state privacy laws). Such personal information may include:

• Personal information, such as your full name, date of birth, email address, phone number and zip code,
• Information about your health conditions and treatment that you provide to us, or you authorize us to collect from a third party in connection with your use of our Services, which may include your prescription information, your pharmacy information, your prescriber information and your pharmacy transactions, and
• Other personal information you provide to us in your communications to us.

You are responsible for ensuring the accuracy of the personal information that you submit to us. You are not required to be a registered user of WebMD.com to enjoy the Services, and if you are registered with WebMD.com, any information you submit as part of the Services will not be associated with the registration information that you have previously provided to WebMD.com.

Automated Collection of General Information

We may collect information you provide directly on our websites, as well as information about the website you came from (including URL), your IP address, browser ID, mobile device ID, the type of browser you use, the time and date of access, your preferences and settings, cookies and other similar information about your interactions with our Services (e.g., browsing activity, viewed content, and clicking behavior). We may use cookies and other tracking technologies to collect information about how you interact with our Services. These technologies help us understand usage patterns, improve site functionality, and enhance the user experience. We do not use these technologies to monitor your activity across third-party websites, nor do we use them for targeted advertising purposes. While we have implemented a Consent Management Platform (CMP) on WebMDRx.com to allow consumers to opt-in to the use of certain tracking technologies, these are not used for retargeting or for targeted advertising purposes.

Children

The Services are not designed or intended for children under the age of 18. The Services do not collect personal information from any person we actually know is under the age of 18. A parent or guardian, however, may use the Services on behalf of a minor. The parent or guardian is solely responsible for the use of the Services on a minor’s behalf. The parent or guardian assumes full responsibility for ensuring that the information submitted is accurate, and for the interpretation and use of any information or suggestions provided through the Services for a minor.

Categories of Sources From Which Information is Collected

We may obtain the categories of personal information listed above from the following categories of sources:

• Directly from you, such as when you request to use our Services,
• Directly and indirectly from your activity on WebMDRx.com and the WebMD App, as described under the Automated Collection of General Information section, and
• From third parties that interact with us in connection with the Services, such as partners and service providers for the business purposes described below.

Use of Your Personal Information

Your personal information may be used for the following business or commercial purposes:

• To send you personalized SMS and/or emails pertaining to the Services requested by you, including notifications, prescription fill or refill reminders, your pharmacy transactions, savings cards, savings coupons and confirmation message of receipts of your instructions,
• To send you SMS and/or emails featuring WebMD content that we believe may be relevant to you based on your use of the Services,
• To compare prescription prices at nearby pharmacies and get product descriptions, as requested by you,
• To respond to your inquiries and to send you administrative communications about the Services,
• To obtain your feedback and enhance the Services,
• To detect and defend against fraud and other threats to the Services and/or our users, and
• To identify issues with the Services,

In addition, we may use personal information about you for other purposes that are disclosed to you at the time we collect the information and/or with your consent.

Sharing Your Personal Information

We may disclose your personal information to the following categories of third parties for a business purpose:

• Affiliates and subsidiaries when providing the Services that you have requested,
• Adjudicator service providers in connection with the Services requested by you, including to issue the savings cards,
• Communication service providers to send SMS and emails,
• Service providers supporting site analytics and search engine optimization for WebMDRx.com,
• Third party customers with aggregated and de-identified information in connection with the Services, which cannot be identified back to an individual user of the Services, and
• Third parties to whom you or your agents authorize us to disclose your personal information in connection with the Services.

We engage third-party service providers to assist in operating the Services provided to you. These service providers may receive access to your personal information as necessary to perform their contracted services. We maintain contractual obligations that limit our service providers from using or disclosing your information for purposes other than performing their specific contracted services for us.

We do not “sell” or “share” personal information, including any CHD, as those terms are defined by applicable U.S. state privacy laws.

We also do not “sell” or “share” the personal information of consumers that we know are under 18 years of age.

Certain Services may be served on, or contain links to, websites that are hosted and operated by our customers or by a company other than us (“Third Party Websites”). We do not share your personal information with these Third Party Websites without your consent, but you should be aware that any information you disclose to these Third Party Websites once you access these Third Party Websites is not subject to this Privacy Policy. We do not endorse and are not responsible for the privacy practices of these Third Party Websites. You should review the privacy policy posted on the Third Party Website to understand how that Third Party Website collects and uses your information. We make an effort to make it obvious to you when you leave our sites and enter a Third Party Website, either by requiring you to click on a link or by notifying you on our sites before you visit the Third Party Website.

Retention of Your Personal Information

We may retain your personal information as long as necessary to provide the Services you have requested. In general, we retain personal information for up to two (2) years following your last interaction with our Services. After this period, we will de-identify your personal information in compliance with U.S. state privacy laws.

Your Consumer Rights

If you are a resident of a U.S. state with applicable privacy laws, including California, Virginia, Colorado, Connecticut, Utah, Oregon, Texas, Montana, Iowa, Tennessee, Indiana, Delaware, New Jersey, New Hampshire, Kentucky, Nebraska, Maryland, Minnesota, Rhode Island and Washington, you may have additional rights regarding our use of your personal information, including any CHD. This section describes your consumer rights and explains how to exercise such rights, which may vary depending on your state of residence. If you do not want your personal information, including any CHD, used by us as provided in this Privacy Policy, please do not use the Services.

Right to Access and Data Portability

You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and verify your consumer request, we will disclose to you:

• The categories of personal information we collected about you,
• The categories of sources from which we collected personal information about you,
• Our business or commercial purposes for collecting, using, processing and sharing that personal information,
• The categories of third parties with whom we disclose your personal information, and
• The specific pieces of personal information we collected about you in a readily file format (also called the right to data portability).

You may only submit an access or data portability request twice within a 12-month period.

Right to Delete

You have the right to request that we delete any of your personal information that we have collected from you and stored, subject to certain exceptions. Once we receive and verify your request, we will delete (and direct our partners and service providers to delete) your personal information from our records, unless an exception applies.

We may deny your deletion request if retaining the information is necessary for us or our service providers to:

• Complete the transaction for which the personal information was collected, provide the Services you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise fulfill our contract with you,
• Prevent, detect and investigate security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities,
• Debug Services to identify and repair errors that impair existing intended functionality,
• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law,
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.),
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, if deletion would likely render the research impossible or seriously impair its achievement and you previously provided informed consent,
• Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us,
• Comply with a legal obligation, or
• Make other internal and lawful uses of the information that are compatible with the context in which it was provided.

Right to Correct Your Personal Information

You have the right to request that we correct any inaccurate personal information we maintain about you. Once we receive and verify your request, we will use commercially reasonable efforts to correct your inaccurate information from our records (and direct our partners and service providers to do the same), unless doing so would be impossible or would require a disproportionate effort.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your rights under applicable U.S. state privacy laws. Unless permitted by the applicable U.S. state privacy laws, we will not:

• Deny you access to the Services,
• Provide you a different level of quality of Services, or
• Suggest that you may receive a different price or rate for Services or a different level or quality of Services.

We may provide a different level of Services if the difference is reasonably related to value provided by your personal information.

Right to Withdraw Consent

If you are a resident of Washington State, you have the right to withdraw your consent to our collection and use of your CHD. Please follow the steps below to exercise such right. Please note that some Services rely on the use of CHD, and withdrawing your consent may prevent us from continuing to provide those Services.

Exercising Your Consumer Rights

To exercise your consumer rights described above, please click here.
You can opt-out from our personalized SMS or withdraw your consent by following the directions included at the bottom of our SMS that will require you to text “STOP”. You can also unsubscribe from our personalized emails following the directions included at the bottom of the email and using the “UNSUBSCRIBE” link found in the email. If enrolled in push notification, you may unsubscribe at any time by going into the digital wallet on your device and disabling push notifications in the digital wallet pass or by removing the digital wallet pass from your device.
By using the above link, you will be asked to provide certain identifying information, such as email address or phone number and state of residency, which we will only use to process or verify your request. You will be asked to validate your request by clicking a validation link in an email that will be sent to the email address provided.

The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

You may be asked to provide further verifying documentation, such as proof of residency and identity.

Only you or a person that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. If you are making a request through an authorized agent acting on your behalf, such authorized agent must provide proof of written authorization to do so, and you must verify your identity directly with us, unless such authorized agent provides proof of the power of attorney pursuant to Probate Code sections 4000 to 4465.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.

In case you want to appeal the denial of a decision with regard to a previous request, please submit a request to us by sending an email to userprivacy@webmd.net.

Response Timing and Format

We shall confirm receipt of your request, and we will use commercially reasonable efforts to respond to a verified consumer request within 45 days of its receipt. If we require more time (up to a total of 90 days), we will inform you of the reason and extension period in writing. Any disclosures we provide will cover the 12-month period preceding the receipt of a verifiable consumer request, unless you specifically request data beyond the 12-month period and we are required to provide such data under applicable law. The response we provide will explain the reasons why we cannot comply with a request, if applicable.
We do not charge a fee to process or respond to your consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Updates to this Privacy Policy

We reserve the right to update or modify this Privacy Policy and our Services at any time and any updates will be effective upon being posted, unless we advise otherwise. By continuing to use the Services after updates are made to this Privacy Policy, you agree to the updated Privacy Policy. We encourage you to periodically review this Privacy Policy for the latest information on our privacy practices.

Contact Us About Your Personal Information or Privacy

Please send us an email to userprivacy@webmd.net if you have any questions about this Privacy Policy or the personal information we maintain about you. We will respond to your request within a reasonable timeframe.

You can also contact our Privacy Office at:

WebMD LLC
Attn: Office of Privacy
283-299 Market Street, 3rd Floor
2 Gateway Center
Newark, NJ 07102

Effective date: December 22, 2025