Website & Mobile App Visitors

Information for individuals who visit our website or mobile app.

Privacy Notice – This notice sets out the personal data we collect, for what purposes and your rights in this respect.

Effective Date: October 2025

California “Notice at Collection”

If you are a website or mobile app visitor, Covetrus is required under the California Consumer Privacy Act (as amended by the California Privacy Rights Act, “CCPA/CPRA”) to provide you with this Notice at Collection. This Notice describes the categories of personal information (“personal data”) and sensitive personal information (“sensitive personal data”) we collect about you, the purposes for which we collect and use this information, and your rights under California law. The table below summarizes this information in the format required by California regulations. Click here to go to the California Supplemental Notice.

1. Personal Data We Collect

• Identifiers: name, email, telephone number, mailing/billing addresses, account login credentials, IP address.
• Commercial Information: products or services purchased, prescription or diet orders, transaction history.
• Internet/Device/Usage Data: browsing history, clickstream data, cookies, beacons, SDKs, device identifiers, log files, location data.
• Geolocation Data: both general (e.g., IP-based) and precise (GPS, mobile device location).
• Audio/Visual Information: recordings of customer service interactions, chat transcripts, or in-app support.
• Biometric Information: fingerprints or voiceprints (when using authentication features).
• Inferences: preferences, characteristics, purchase likelihood, or personalized user profiles based on browsing/purchase history.

2. Personal Data vs. Sensitive Personal Data

• Personal Data: identifiers, commercial data, online activity, communications, inferences.
• Sensitive Personal Data (SPI):
  • Biometric data (fingerprint, voiceprint for authentication).
  • Precise geolocation data.
  • Payment card and account data.
  • Contents of communications (e.g., misdirected emails/text messages when Covetrus is not the intended recipient).

3. How We Use Your Personal Data

We use personal data to:

• Provide access to our websites, mobile apps, and online services.
• Process and fulfill orders, prescriptions, or product requests.
• Authenticate users, secure accounts, and prevent fraud.
• Enable customer service support (calls, chat, email).
• Personalize services, marketing, and product recommendations.
• Conduct analytics and measure website/app performance.
• Improve features, user experience, and system functionality.
• Comply with legal, regulatory, and security obligations.

Automated Decision-Making

• In some instances, our automated systems may process your information to make decisions or create profiles. For example, we may use automated systems to:
• Analyze your purchase history to recommend products
• Determine when to send you reminders about prescription refills
• Personalize your online experience based on your browsing behavior
• You have the right to not be subject to a decision based solely on automated processing if it produces legal or similarly significant effects on you by contacting privacy@covetrus.com, except where the automated decision is necessary for a contract, authorized by law, or based on your explicit consent.

4. Who We Share the Personal Data With

• Service providers: IT hosting, analytics platforms (e.g., Google Analytics, Facebook Pixel), payment processors, delivery services, marketing vendors.
• Affiliates: Covetrus group entities for consolidated operations.
• Regulators and authorities: as legally required.
• Business partners: when legally permitted or with consent.

5. Security of Personal Data

We apply organizational, technical, and administrative measures designed to protect personal data from loss, misuse, unauthorized access, disclosure, alteration, and destruction.

6. Data Retention

We retain personal data only for as long as needed:

• To provide requested services (e.g., accounts, purchases, subscriptions).
• To fulfill legal, tax, and regulatory requirements.
• To resolve disputes and enforce contracts.
• For analytics and improvement, generally within reasonable periods consistent with industry practice.

7. Your Rights

Depending on your jurisdiction (including California and the EU/UK), you may have rights to:

• Access, correct, or delete your personal data.
• Object to or restrict processing.
• Withdraw consent for optional processing (e.g., marketing cookies).
• Receive a copy of your data in portable form.
• Opt out of targeted advertising or the use of sensitive personal data.

Contact us at: Privacy Request – Covetrus.com

8. Changes to This Privacy Notice

We may update this Privacy Notice periodically to reflect changes in our practices, technologies, or legal obligations. We encourage you to review it regularly.

9. Notice at Collection Table

The following chart details which categories of personal information we collect and process as well as which categories of personal information we disclose to third parties for our operational business purposes within the 12 months preceding the date this Policy was last updated. The chart also details the categories of personal information that we “sell” and/or “share” for purposes of cross-context behavioral advertising within the 12 months preceding the date this Policy was last updated. 

10. No Sale or Sharing of Personal Information

We don’t “sell” Personal Data or “share” Personal Data for cross-contextual behavioral advertising purposes (as those terms are defined under state privacy laws). We also don’t process sensitive Personal Data for the purposes of inferring characteristics about you.

Exercising Your Rights. You can exercise privacy rights described in this section by submitting a request through: Privacy Request – Covetrus.com 

Verification. In order to protect your Personal Data from unauthorized access, change, or deletion, we may require you to verify your credentials before you can submit a request to know, correct, or delete Personal Data. If you do not have an account with us, or if we suspect fraudulent or malicious activity, we may ask you to provide additional Personal Data for verification. If we cannot verify your identity, we will not be able to honor your request.

Authorized Agents. You may also submit a rights request through an authorized agent. If you do so, the agent must present signed written permission to act on your behalf and you may also be required to independently verify your identity with us. Authorized agent requests can be submitted to: Privacy Request – Covetrus.com