Table of Contents

PRIVACY POLICY

Introduction

At Covetrus, we’re committed to protecting the privacy and security of your information. Whether you are a veterinary healthcare provider or patient owner, we know the privacy of your information is important. This unified privacy notice is designed to help you understand what information we collect, why we collect it, how we use it, and how you can manage your information with us.

Covetrus strives to improve the health of companion animals and horses, and to improve the experience of the people involved along the way. Information you provide to us allows us to alert patient owners when their patient’s medication is running out, to notify veterinary healthcare providers when a patient is overdue for a visit, or to make sure we always stock enough of the products you rely on us to provide.

Scope

This Privacy Notice applies to website visitors, veterinary healthcare providers, patient owners, application and product users, and other customers of Covetrus, Inc. and its affiliated entities and business units including but not limited to:

• Covetrus North America
• Covetrus Software Services including Covetrus Connect and VetData
• Covetrus Global Prescription Management, including all Covetrus pharmacies and outsourcing facilities
• PSIvet
• VetScout
• SmartPak Equine
• epiq Animal Health
• Veterinary Management Groups
• Other related Covetrus entities and affiliates

By using our websites, downloading any application from our websites, or using our products or services (collectively, the “Online Platforms”), you signify your acceptance of this privacy notice. This Privacy Policy applies regardless of the country where you are located. 

This Privacy Notice doesn’t apply to other companies that advertise our services, or to services offered by other companies, including those that may be linked to from our services. Clicking on those links or enabling those connections may allow the third party to collect, share, or otherwise use data about you. We do not control these third-party websites, and we encourage you to read the privacy notice of every website you visit.

Information We Collect

Information You Provide to Us

We collect information at several different points as we interact with you. This includes when you:

• Create an account
• Order from our online stores
• Chat with customer service
• Exchange email or text messages with us
• Speak with your account representative
• Use one of our products or services, including our mobile applications
• Register for our newsletter
• Participate in promotions or surveys
• Apply for employment with Covetrus

The information we collect may include, but is not limited to:

• Names of patient owners or veterinarians
• Patient names and health updates
• Mailing and/or Billing addresses
• IP addresses
• Email addresses
• Telephone numbers
• Payment information (such as credit card numbers)
• Passwords
• Education information (when applicable for veterinary professionals)
• Audio/visual information (such as when you interact with our customer service or use our mobile applications)
• Biometric information (e.g., fingerprints, voiceprints) when using certain secure features
• Job applications (if you apply for employment with Covetrus)
• Sensitive personal information as defined by privacy regulations, including health information about animals under your care

Information We Collect When You Use Our Products and Services

When you use our products and services, we collect information about how you are using them and how well those products and services are working. This includes:

• Usage data: Information about how you interact with our Online Platforms, including the full Uniform Resource Locators (URLs), clickstream information to, through, and from our Online Platforms (including date and time), products viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), or methods used to browse away from the page browsing history
• Device data: Information about your device such as IP addresses, operating system types, and browser types and plug-ins
• Practice Information Management Systems (PIMS) data: When you use our veterinary healthcare products
• Geolocation data: Information about your physical location when using our mobile applications or services, including your time zone and both general and precise geolocation information
• Inferences drawn from other personal information: We may analyze the information we collect to create a profile about your preferences and characteristics to personalize your experience

Our Online Platforms utilize technology to collect information, including:

• Web beacon data in emails
• Cookies and flash cookie data
• Device identifiers

You can adjust your settings in your device browser to disable some of these if you prefer not to share this information. Each of our veterinary healthcare products is subject to your consent when you subscribe to the product, and each product has its own terms and conditions. You can withdraw your consent at any time by unsubscribing from the product and discontinuing use.

Cookies and Tracking Technologies

Our Online Platforms use cookies, web beacons, tracking pixels, and other tracking technologies  such as SDKs to help customize your experience and analyze website usage.

Our Online Platforms use various automatic data collection technologies to distinguish you from other Online Platform users. We also may use these technologies to collect information about your online activities over time and across third-party websites, applications, or other online services (behavioral tracking). This helps us deliver a better and more personalized service when you interact with our Online Platforms. It also allows us to improve our Online Platforms by enabling us to:

• Estimate our audience size and usage patterns.
• Store your preferences so we may customize our Online Platforms according to your individual interests.
• Speed up your searches.
• Recognize you when you return to our Online Platforms.
• The technologies we use for this automatic data collection may include:
  • Cookies (browser cookies or mobile cookies). A cookie is a small file placed on the hard drive of your computer or on your smart phone. You may refuse to accept browser cookies by activating the appropriate setting on your browser or smartphone. However, if you select this setting, certain parts of our Online Platforms may become inaccessible and certain features may not work correctly. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our website. See below for more information on our use of cookies.
  • Web Beacons. Pages of our Online Platforms and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Company, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).
  • Google Analytics. We use “Google Analytics” to collect information about the usage of our Online Platforms. This service collects information about how often users visit our websites, what pages they visit and when they visit, as well as what other websites they used prior to landing on our websites, among other additional information. We use this information to improve our websites and our services.
  • Facebook Meta Pixel. We use the “Facebook Meta Pixel” to collect information about the visitors to our websites to assist us with determining target groups for the presentation of advertisements.
  • Flash Cookies. Certain features of our website may use local stored objects (or Flash cookies) to collect and store information about your preferences and navigation to, from, and on our website. Flash cookies are not managed by the same browser settings as are used for browser cookies and you must manage their settings separately.
  • Web Server Logs, Tags, SDKs, and Other Similar Tracking Technologies. We use these technologies to offer you a more tailored experience. As we adopt additional technologies, we may also gather information through other methods.
• A web server log is a file where website activity is stored.
• An SDK is a set of tools and/or code that we embed in our Application and software to allow third parties to collect information about how users interact with the Online Platforms.
• We may tie this information to personal information about you that we collect from other sources, or you provide to us.

Types of cookies we use:

• Essential cookies: Required for basic website functionality
• Preference cookies: Remember your settings and preferences
• Analytics cookies: Help us understand how visitors interact with our websites
• Marketing cookies: Used to deliver relevant advertisements and track marketing campaign performance

You can manage your cookie preferences through your browser settings. Most browsers allow you to refuse to accept cookies and to delete cookies. However, if you block all cookies (including essential cookies), you may not be able to use all the features of our websites.

Third parties or publicly available sources

We may receive information about you if you visit other websites employing our cookies or from third parties including, for example, business partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, credit reference agencies, data brokers, or aggregators, such as:

• Information we collect from social media and other content platforms.  When you “like” or “follow” us on Facebook, Instagram, X, YouTube, or other social media sites, we may collect some information from you including your name, email address, and any comments or content you post relevant to us. We also collect your information if you sign up for one of our promotions or submit information to us through social media sites.
• Information we receive from other sources. We work closely with third parties, including, for example, third-party intermediaries, such as the advertising networks, analytics providers, and search information providers. Such third parties will sometimes provide us with additional information about you.

How We Use Your Information

For Veterinary Healthcare Providers

For veterinary healthcare providers accessing our Online Platforms, we collect data in user accounts, and we may access, use and archive information to:

• Ensure that digital prescriptions and patient records are always consistent
• Provide you with a complete view of your patient records
• Share your clinic’s name, sales volume, and products sold with manufacturers and other industry partners to comply with contractual obligations, such as providing information to manufacturers as an authorized distributor of a product subject to drug supply chain security and transparency reporting requirements, or for manufacturer marketing purposes

Our Online Platforms may also each be subject to additional terms and conditions. In addition:

• We do not share personally identifiable information from your customers (including patient owner names, addresses, emails, telephone numbers, or health information on an individually identifiable animal), with any other veterinary healthcare providers, corporate veterinary groups, industry partners, manufacturers, or anyone else, without your express consent to share that information.
• We may share your own data with you, as a veterinary healthcare provider, so you can use that information to deliver the best possible care to your patients.
• We share data analytics, based on de-identified information, with manufacturers and industry partners. For example, this may include data such as total sales of a medication in a certain region or overall compliance percentages of animals with a particular disease, in order to identify trends in the market and inform overall animal care outcomes.
• We work with manufacturers on targeted manufacturer marketing programs. Your participation in any targeted manufacturer marketing program is on an opt-in basis, and any non-de-identified data would only be shared with manufacturers with your consent. 

For Patient Owners

For Patient owners accessing veterinarian storefronts or otherwise using our services, we collect data to help improve your user experience, and help identify and close gaps in your animal’s care. Information we collect provides insights, which we help turn into action, which means healthier and happier patients! 

• We share information with your veterinarian, including any medication or prescription diet purchases you make, so that it can be added to your animal’s medical records.
• We use your information to provide customer service to you, like checking order status or working with your veterinarian to confirm your prescription.
• We do not share your personal information in any way that is not covered in this policy without a lawful basis for doing so, such as getting your consent first.

For All Users

When you use our products and services, we may also use your information:

• To maintain and improve our products and services: By making sure they are working well. For example, knowing which pages of our website frequently result in calls from confused customers helps us know where we need to improve our site design.
• To help develop new products and services: For example, tracking the number of calls for basic pharmacy refills enabled us to develop a Refill App to make things easier for our patient owners.
• To personalize your experience: With our products and services according to the information we collect. This means we talk to cat owners about cats, and dog owners about dogs — or we remind you when your prescription needs to be refilled so that it arrives before your current medication runs out.
• To allow third-party providers to send you postal mailings: We may use your data to allow third-party providers to send you postal mailings regarding products and services that may be of interest to you. This practice is specific to SmartPak operations and does not apply to other Covetrus entities. You can opt out of these third-party mailings at any time by contacting SmartPak customer service at 1-800-461-8898.
• To provide services to you, including through our contractors: This includes sharing your address with providers of delivery services like UPS or FedEx, or sharing information with third parties that provide Covetrus with email solutions, cloud hosting services, payment processing, website support and maintenance, and legal, regulatory, or audit services.
• For regulatory compliance: We maintain prescription records as required by state and federal law, and we may share your personal information to comply with state boards of pharmacy, DEA, FDA, and other regulatory agency laws, rules, and regulations. This can include providing required personal information in connection with mandatory controlled substance prescription disclosures to state regulatory agencies, and providing disclosures of prescription records in response to state or federal regulatory agency requests.
• For legal reasons: We may share your personal information to comply with inquiries from governmental authorities, or to protect, defend, exercise legal rights or claims, in connection with end user license agreements, terms of service or other applicable agreements, or as otherwise required by law. If we are legally required to share your information, we will attempt to notify you, unless such notification would violate law or court order.
• In the event of business transfer: If Covetrus is involved in a sale of assets, merger, acquisition, business transfer, or other change of control, we may share your information with other entities involved. We will require any such successor business entity to honor this Privacy Notice, and we will notify you of any changes that could affect your information. In the event of a business transfer, unless we are otherwise required by law to retain or provide your information to the other entity, you may request that your information be deleted from our records.

Combined Information. We may combine the information that we collect through the Online Platform and/or services we provide with information that we receive from other sources, both online and offline, and may use and share such combined information in accordance with this Privacy Policy. If we combine or connect non-personal, demographic, or technical data with personal data so that it directly or indirectly identifies an individual, we treat the combined information as personal data.

Automated Decision-Making

In some instances, our automated systems may process your information to make decisions or create profiles. For example, we may use automated systems to:

• Analyze your purchase history to recommend products
• Determine when to send you reminders about prescription refills
• Personalize your online experience based on your browsing behavior

You have the right to not be subject to a decision based solely on automated processing if it produces legal or similarly significant effects on you by contacting privacy@covetrus.com, except where the automated decision is necessary for a contract, authorized by law, or based on your explicit consent.

How We Share Your Information

We may share your information with:

• Veterinary healthcare providers: We share patient owners’ information with their veterinarians to ensure complete medical records.
• Service providers: We share information with companies that help us operate our business, such as delivery services, payment processors, and technology providers.
• Analytics providers: Our website uses Google Analytics and the Facebook Pixel to collect and analyze certain information as described above. Information on Google Analytics’ privacy policy may be found here. Information on how to opt-out from Google Analytics may be found here. Information on Meta Facebook’s privacy policy may be found here. To configure the advertisements you receive through Facebook, you can access Facebook’s page here and follow their instructions.
• Manufacturers and industry partners: We share de-identified, aggregated data analytics with manufacturers and industry partners to identify market trends and improve animal care outcomes. We only share non-de-identified data with manufacturers with your express consent. 
• Regulatory authorities: We share information as required by law with regulatory agencies such as state boards of pharmacy, DEA, and FDA.
• Affiliated companies: We may share your information with our affiliates, which include our parent company and any subsidiaries, joint venture partners, or other companies that we control or that are under common control with us.

Data Retention

We retain your personal information only for as long as is necessary for the purposes we set out in this privacy notice, such as:

• For as long as you maintain an account or subscription with us
• As needed to provide you with our products and services
• As necessary to comply with our legal obligations (such as maintaining prescription records as required by state and federal law)
• As needed to resolve disputes
• As needed to enforce our agreements 

When determining appropriate retention periods, we consider the nature and sensitivity of the data, potential risks, the purposes for processing, and applicable legal requirements.

Your Privacy Rights

You have certain rights regarding your personal information:

Right to Access and Know

You have the right to request information about the personal information we have collected about you, including:

• The categories of personal information we have collected
• The sources from which we collected the personal information
• The purposes for which we use your personal information
• The categories of third parties with whom we share your personal information
• The specific pieces of personal information we have collected about you

Right to Request Deletion

You have the right to request the deletion of your personal information that we have collected from you, subject to certain exceptions.

We may deny your deletion request where we are legally required to retain your personal information, including:

• Where we have a legal obligation to retain your personal information under state or federal laws
• Where it is necessary to protect you from unwanted data misuse, fraudulent activity, or to maintain data security
• Where retention of data is necessary to comply with a legal or contractual requirement to a Covetrus customer, such as a veterinarian who is required by veterinary board rules to retain your personal information related to your patient’s medical records

Right to Correct Inaccuracies

You have the right to request that we rectify inaccurate information about you.

Right to Non-Discrimination

You have the right not to receive discriminatory treatment for exercising these rights. However, please note that if the exercise of these rights limits our ability to process personal information (such as in the case of a deletion request), we may no longer be able to provide you our products and services or engage with you in the same manner.

Do Not Track Signals

Some browsers have a “Do Not Track” feature that signals to websites that you visit that you do not want your online activity tracked. Due to differences in how browsers interpret this feature, our websites do not currently respond to Do Not Track signals.

Data Security Measures

The security and confidentiality of your information is extremely important to us. We have implemented technical, administrative, and physical security measures to protect your information. As part of our efforts to protect your information, we have technical safeguards in place across our products and services, which may include the following:

• Requiring a password or a unique token in order for you to access your personal information
• Using firewalls to protect information held in our servers
• Utilizing Secure Socket Layer (SSL) encryption in transmitting personal information to our servers
• Limiting the number of personnel who have potential access to personal information
• Routinely backing up the systems to protect the integrity of personal information

There is always some risk that an unauthorized third party may find a way around our security systems. In the event of a security breach, the first thing we would do is notify you. This notice would include what happened, what information was breached, what Covetrus is doing to respond, and who to contact with questions.

In addition, where a password is required for access to certain parts of our Online Platforms, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

State Privacy Laws

Covetrus complies with various state privacy laws that may apply to you based on your residency. Below is a consolidated summary of your rights under these state laws.

Common Rights Across State Privacy Laws

Residents of states with comprehensive privacy laws generally have the following rights:

• Right to Access: You can request information about what personal data we collect and how we use it
• Right to Delete: You can request deletion of your personal data, subject to certain exceptions
• Right to Correct: You can request correction of inaccurate personal data
• Right to Data Portability: You can request a copy of your personal data in a portable format
• Right to Opt Out: You can opt out of certain data processing activities, including:
  • Sale of personal data
  • Targeted advertising
  • Profiling that produces legal or similarly significant effects

State-Specific Provisions

While most state privacy laws share common elements, some states have unique requirements:

California

California residents have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), including:

• The right to limit use and disclosure of sensitive personal information
• The right to know what personal information is sold or shared and to whom
• Additional “Shine the Light” rights regarding third-party marketing

See our California Privacy Supplement for complete details.

Colorado, Connecticut, and Virginia

These states provide similar comprehensive privacy protections, including:

• The right to appeal a company’s decision regarding your privacy request
• Recognition of universal opt-out mechanisms
• Requirements for data protection assessments for high-risk processing activities

Maryland

Maryland’s law includes stricter data minimization requirements:

• Collection limited to what is “reasonably necessary and proportionate” to provide requested products or services
• For sensitive data, collection limited to what is “strictly necessary”
• Complete prohibition on the sale of sensitive personal data

Minnesota

Minnesota provides additional rights:

• The right to be informed about and question automated decision-making
• The right to know the reasoning behind profiling decisions
• The right to access data used in automated decisions
• The right to learn about actions you can take to secure a different decision

Utah

Utah’s law provides more limited consumer rights:

• The right to delete only personal data that the consumer has provided
• No right to correct inaccurate personal data
• No right to opt out of profiling

Sensitive Data Processing

Several state privacy laws have specific requirements regarding the processing of sensitive personal data, which generally includes:

• Data revealing racial or ethnic origin
• Religious beliefs
• Mental or physical health diagnosis
• Sexual orientation
• Citizenship or immigration status
• Genetic or biometric data
• Precise geolocation data
• Personal data of children under 16
• Financial account information

Depending on your state of residence, we may be required to:

• Obtain your explicit consent before processing sensitive data
• Provide clear notice and the opportunity to opt out of sensitive data processing
• Limit the collection and use of sensitive data to what is strictly necessary
• Implement additional safeguards for sensitive data

Universal Opt-Out Mechanisms

For residents of states that require recognition of universal opt-out mechanisms (such as Texas, Oregon, Montana, Colorado, Connecticut, Delaware, Nebraska, Minnesota, New Hampshire, New Jersey, and Maryland), we honor opt-out preference signals (such as Global Privacy Control) that communicate your choice to opt out of sales of personal data and targeted advertising.

Data Protection Assessments

For states that require data protection assessments (such as Texas, Oregon, Montana, Virginia, Colorado, Connecticut, New Jersey, Maryland, and Minnesota), we conduct and document assessments for processing activities that present heightened risks to consumers, including targeted advertising, sale of personal data, processing of sensitive data, and certain profiling activities.

How to Exercise Your State Privacy Rights

To exercise any of these rights under state privacy laws, please contact us using the methods described in the “Contact Information” section of this Privacy Notice. We will respond to your request in accordance with applicable law.

If your request is denied, you have the right to appeal the decision. We will provide instructions for appealing a denial when we respond to your request. If your appeal is denied, we will provide you with an online mechanism or other method to contact the appropriate state attorney general to submit a complaint.

We do not discriminate against you for exercising any of these rights. However, we may be unable to provide certain products or services if you choose to exercise your rights to delete or opt out of certain processing of your personal information.

International Data Transfers

As a global company, Covetrus may transfer your personal information to countries other than the one in which you reside. We ensure that such transfers comply with applicable data protection laws and that appropriate safeguards are in place to protect your information.

If you are using the Online Platform, or any part thereof, from outside of the United States, please be aware that your information, including personal data, may be transferred to, stored, or processed in the United States and maintained on computers or servers located outside of your state, province, country, or other governmental jurisdiction where the privacy laws may not be as protective and/or comprehensive as those in your jurisdiction. By providing us with your information you acknowledge that your information, including personal data, will be transferred to the United States and processed and stored on servers in the United States. Your information, including personal data, may also be processed by employees or by other third parties who work for us, or by the representatives and employees or workers of the Company located outside your home country. By submitting your information, including personal data, or engaging with our Online Platform, you consent to this transfer, storing, and/or processing of information, including personal data, to the United States and those third parties with whom we share it.

Children’s Privacy

Covetrus does not knowingly sell products to, solicit, collect or retain personal information about children under the age of 18 without parental consent. If we learn that a child under 18 has submitted information to us without parental consent, we will take all reasonable measures to delete it from our databases and not use the information for any purpose (except where necessary to protect the child or others). If you become aware of any personally identifiable information we have collected from children under 18, please contact us at privacy@covetrus.com.

Accessibility

We are committed to making our privacy notice accessible to individuals with disabilities. If you encounter any difficulty accessing this privacy notice, please contact us at privacy@covetrus.com.

Managing Your Data

You have several options to manage your personal information:

• Websites: You can adjust and manage the privacy of your information via our websites, which allow you to opt out of certain features that we offer. By adjusting your device or browser settings, you can manage information by adjusting your personal profile, your subscriptions, your cookies, and your location services.
• Email Communication Preferences: You can opt out of emails through links in the emails you receive from us. You may not opt-out of service-related communications (e.g., account verification, transactional communications, changes/updates to features of the Services, technical and security notices).
• Products: All use of products is subject to the user consent in the product’s subscription terms and conditions for each product. You can withdraw your consent at any time by unsubscribing from the product and discontinuing use.
• By Contacting Us: You can also contact us anytime at privacy@covetrus.com if you would like to change or update your personal information. In some cases, we may have to keep certain information for legal or business reasons (like prescription records).

Changes to This Privacy Notice

We comply with data privacy regulations applicable in the jurisdictions in which we operate. We review and may revise this notice from time to time as we add new features and services, as laws change, and as industry best practices evolve. We indicate the date the most recent changes were published on this page. If we update this privacy notice with significant changes, we will let you know, for example, by placing a note on our website. Please review this notice periodically, and especially before you provide any information to us.

Contact Information

If you have any questions about this privacy notice or our practices at Covetrus, please contact us:

California Privacy Supplement

This CALIFORNIA PRIVACY SUPPLEMENT (“Supplement”) is in addition to the information contained in the Covetrus Privacy Notice and applies to California residents. We have adopted this Supplement to comply with the California Consumer Privacy Act of 2018 (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”) and other related privacy laws. Any terms defined in the CCPA have the same meaning when used in this Supplement.

Notice at Collection

The following chart details which categories of personal information we collect and process as well as which categories of personal information we disclose to third parties for our operational business purposes within the 12 months preceding the date this Policy was last updated. The chart also details the categories of personal information that we “sell” and/or “share” for purposes of cross-context behavioral advertising within the 12 months preceding the date this Policy was last updated. 

Categories of Personal Information	Business or Commercial Purpose for Collection	Categories of Third Parties with Whom We Share	Categories of Third Parties to Whom We Sell/Share
Identifiers (e.g., name, postal address, email address, phone number, account name, IP address)	To provide our services, process transactions, communicate with you, maintain security, and as described in this Privacy Notice	Service providers, affiliated companies, veterinary healthcare providers, regulatory authorities	We do not sell identifiers. We may share with advertising partners for cross-context behavioral advertising
Personal information categories listed in the California Customer Records statute (e.g., name, address, telephone number, credit card number)	To process payments, fulfill orders, provide customer service, and comply with legal obligations	Payment processors, service providers, affiliated companies, regulatory authorities	We do not sell this information. We do not share this information for cross-context behavioral advertising
Commercial information (e.g., products purchased, ordering history)	To process orders, provide customer service, improve our products and services, and for marketing purposes	Service providers, affiliated companies, manufacturers (in aggregated form)	We do not sell commercial information. We may share with advertising partners for cross-context behavioral advertising
Internet or other electronic network activity information (e.g., browsing history, search history)	To improve our websites and applications, personalize your experience, and for analytics purposes	Service providers, analytics providers, affiliated companies	We do not sell this information. We may share with advertising partners for cross-context behavioral advertising
Professional or employment-related information (for job applicants and employees only)	For recruitment, employment, and HR administration purposes	HR service providers, affiliated companies	We do not sell or share this information for cross-context behavioral advertising
Protected classification characteristics (for job applicants and employees only)	For recruitment, employment, and HR administration purposes, and to comply with equal opportunity laws	HR service providers, affiliated companies, government agencies as required by law	We do not sell or share this information for cross-context behavioral advertising
Biometric information (e.g., fingerprints, voiceprints)	To enhance security and prevent fraud	Service providers, security providers	We do not sell biometric information. We do not share this information for cross-context behavioral advertising
Sensitive personal information (as defined by CPRA)	To comply with legal obligations and provide personalized services	Service providers, regulatory authorities	We do not sell sensitive personal information. We do not share this information for cross-context behavioral advertising
Inferences drawn from other personal information	To personalize your experience and improve our services	Service providers, analytics providers	We do not sell inferences. We may share with advertising partners for cross-context behavioral advertising
Geolocation data	To provide location-based services and improve user experience	Service providers, technology providers	We do not sell geolocation data. We may share with advertising partners for cross-context behavioral advertising
Audio/visual information	To improve customer service and ensure security	Service providers, security providers	We do not sell audio/visual information. We do not share this information for cross-context behavioral advertising
Education information	For recruitment and employment purposes	HR service providers, affiliated companies	We do not sell or share this information for cross-context behavioral advertising

Sensitive Personal Information Under CPRA

What Constitutes Sensitive Personal Information

Under the California Privacy Rights Act (CPRA), sensitive personal information includes specific categories of data that warrant heightened protection. At Covetrus, the sensitive personal information we may collect includes:

• Data revealing racial or ethnic origin

• Religious beliefs

• Mental or physical health diagnosis

• Sexual orientation

• Citizenship or immigration status

• Genetic or biometric data

• Precise geolocation data

• Personal data of children under 16

• Financial account information

• Contents of mail, email, and text messages (unless Covetrus is the intended recipient)

• Social security numbers, driver’s license numbers, passport numbers, or other similar identifiers

How We Limit Use and Disclosure

Covetrus limits the use and disclosure of sensitive personal information to purposes that are necessary to perform the services or provide the goods reasonably expected by an average consumer. These include:

• Providing veterinary healthcare services and products

• Processing prescription orders and maintaining prescription records

• Ensuring compliance with regulatory requirements

• Maintaining the security and integrity of our systems

• Detecting security incidents and protecting against fraudulent activity

• Verifying customer information when required for service delivery

We do not use sensitive personal information for purposes that would require offering the right to limit, such as inferring characteristics about you, except with your explicit consent.

How to Exercise Your Right to Limit

As a California resident, you have the right to limit our use and disclosure of your sensitive personal information to only what is necessary to provide our goods and services. To exercise this right:

• Call us at (888) 280-2221

• Email us at privacy@covetrus.com

• Visit https://covetrus.com/legal/privacy-request/

When submitting your request, please specify that you are exercising your “right to limit use and disclosure of sensitive personal information.” We will verify your identity using reasonable methods and respond to your request within 45 days (with a possible 45-day extension if reasonably necessary). If we deny your request, we will explain the reasons for denial and your right to appeal the decision.

Please note that certain limitations apply to this right, such as legal obligations that require us to retain or disclose certain information. After processing your request, we will retain a record of it as required by law.

Retention of Personal Information

We retain each category of personal information for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

Your California Privacy Rights

As a California resident, you may be able to exercise the following rights in relation to the Personal Information that we have collected about you (subject to certain limitations at law):

The Right to Access/Know

You have the right to request information about your Personal Information we have collected and disclosed in the last 12 months.

The Right to Request Deletion

You have the right to request the deletion of Personal Information we have collected from you, subject to certain exceptions.

The Right to Correct

You have the right to request that we correct inaccurate Personal Information that we maintain about you.

The Right to Opt Out of Sales and Sharing

You have the right to direct us not to sell Personal Information we have collected about you to third parties now or in the future and to not share your Personal Information for cross-context behavioral advertising.

The Right to Limit Use and Disclosure of Sensitive Personal Information

You have the right to request that we limit our use and disclosure of your sensitive personal information to uses which are necessary to perform the services or provide the goods reasonably expected by an average consumer. Sensitive personal information we collect may include data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data, precise geolocation data, personal data of children under 16, and financial account information. To exercise your right to limit the use and disclosure of your sensitive personal information, you can contact us using the methods described in the ’Contact Information’ section of this Privacy Notice. Please note that this right is subject to certain limitations, such as legal obligations that require us to retain or disclose certain information. Upon receiving your request, Covetrus will review and respond within the timeframes required by applicable law, providing confirmation of the actions taken or explaining any reasons for denial.

The Right to Non-Discrimination

You have the right not to receive discriminatory treatment for exercising these rights.

Making a Request

To exercise your rights under the CCPA, you may submit a request by:

• Calling us at (888) 280-2221
• Emailing us at privacy@covetrus.com
• Visiting www.covetrus.com/legal/privacy-request

Only you, or someone legally authorized to act on your behalf, may make a request related to your Personal Information. You may also make a request on behalf of your minor child.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you.

Response Timing and Format

We will acknowledge receipt of your request within 10 business days and will endeavor to respond to a verifiable consumer request within 45 days of its receipt. If we require more time, we will inform you of the reason and extension period in writing.

Shine the Light

California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of our website that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please send an email to privacy@covetrus.com.

Do Not Track Signals

We do not currently respond to browser “Do Not Track” signals or other mechanisms that provide a method to opt out of the collection of information across the networks of websites and online services in which we participate.

Effective Date

This Privacy Notice was last updated on June 6, 2025.