California Supplemental Notice

This notice applies to residents of California. Effective Date: October 2025

Sensitive Personal Information Under CPRA

What Constitutes Sensitive Personal Information

Under the California Privacy Rights Act (CPRA), sensitive personal information includes specific categories of data that warrant heightened protection. At Covetrus, the sensitive personal information we may collect includes:

• Data revealing racial or ethnic origin

• Religious beliefs

• Mental or physical health diagnosis

• Sexual orientation

• Citizenship or immigration status

• Genetic or biometric data

• Precise geolocation data

• Personal data of children under 16

• Financial account information (if applicable to individuals)

• Contents of mail, email, and text messages (unless Covetrus is the intended recipient)

• Social security numbers, driver’s license numbers, passport numbers, or other similar identifiers

How We Limit Use and Disclosure

Covetrus limits the use and disclosure of sensitive personal information to purposes that are necessary to perform the services or provide the goods reasonably expected by an average consumer. These include:

• Providing veterinary healthcare services and products

• Processing prescription orders and maintaining prescription records

• Ensuring compliance with regulatory requirements

• Maintaining the security and integrity of our systems

• Detecting security incidents and protecting against fraudulent activity

• Verifying customer information when required for service delivery

How to Exercise Your Right to Limit

As a California resident, you have the right to limit our use and disclosure of your sensitive personal information to only what is necessary to provide our goods and services. To exercise this right:

• Call us at (888) 280-2221

• Visit https://covetrus.com/legal/privacy-request/

When submitting your request, please specify that you are exercising your “right to limit use and disclosure of sensitive personal information.” We will verify your identity using reasonable methods and respond to your request within 45 days (with a possible 45-day extension if reasonably necessary). If we deny your request, we will explain the reasons for denial and your right to appeal the decision.

Please note that certain limitations apply to this right, such as legal obligations that require us to retain or disclose certain information. After processing your request, we will retain a record of it as required by law.

Retention of Personal Information

We retain each category of personal information for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

Your California Privacy Rights

As a California resident, you may be able to exercise the following rights in relation to the Personal Information that we have collected about you (subject to certain limitations at law):

The Right to Access/Know

You have the right to request information about your Personal Information we have collected and disclosed in the last 12 months.

The Right to Request Deletion

You have the right to request the deletion of Personal Information we have collected from you, subject to certain exceptions.

The Right to Correct

You have the right to request that we correct inaccurate Personal Information that we maintain about you.

The Right to Opt Out of Sales and Sharing

You have the right to direct us not to sell Personal Information we have collected about you to third parties now or in the future and to not share your Personal Information for cross-context behavioral advertising.

The Right to Limit Use and Disclosure of Sensitive Personal Information

You have the right to request that we limit our use and disclosure of your sensitive personal information to uses which are necessary to perform the services or provide the goods reasonably expected by an average consumer. Sensitive personal information we collect may include data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data, precise geolocation data, and financial account information (if applicable to individuals). To exercise your right to limit the use and disclosure of your sensitive personal information, you can contact us using the methods described in the ’Contact Information’ section of this Privacy Notice. Please note that this right is subject to certain limitations, such as legal obligations that require us to retain or disclose certain information. Upon receiving your request, Covetrus will review and respond within the timeframes required by applicable law, providing confirmation of the actions taken or explaining any reasons for denial.

The Right to Non-Discrimination

You have the right not to receive discriminatory treatment for exercising these rights.

Making a Request

To exercise your rights under the CCPA, you may submit a request by:

• Calling us at (888) 280-2221
• Visiting www.covetrus.com/legal/privacy-request

Only you, or someone legally authorized to act on your behalf, may make a request related to your Personal Information. You may also make a request on behalf of your minor child.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you.

Response Timing and Format

We will acknowledge receipt of your request within 10 business days and will endeavor to respond to a verifiable consumer request within 45 days of its receipt. If we require more time, we will inform you of the reason and extension period in writing.

Shine the Light

California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of our website that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please visit www.covetrus.com/legal/privacy-request.

Do Not Track Signals

We do not currently respond to browser “Do Not Track” signals or other mechanisms that provide a method to opt out of the collection of information across the networks of websites and online services in which we participate.