J&B Medical Privacy Notice

Last Updated: July 20th, 2026

California Notice at Collection

Please click the sections below to learn more about how we process personal data. California residents may also view the California section of the Supplemental Privacy Notice for information specific to California residents.

1. Personal information we collect

2. How we use personal information

3. How we disclose personal information

4. How long we retain personal information

5. How we protect personal information

Introduction and Scope

J&B Medical Supply Co, Inc. and its affiliated entities (collectively, “J&B Medical,” “we,” “us,” or “our”) respects your privacy and is committed to being transparent about how we handle your personal information. This Privacy Notice describes our practices for the websites and applications that link to it (the “Sites”), the services we offer through or in connection with the Sites (the “Services”), and our offline data processing activities. This Privacy Notice applies to the following entities and lines of business when they process personal information in connection with the Services, as well as any other webpage where this Privacy Notice is made available: J&B Medical Supply (www.jandbmedical.com), J&B Pharmacy Services (www.jandbpharmacy.com), J&B At Home (www.jandbathome.com), J&B Pet Source (www.jandbpetsource.com), J&B Virtual Solutions (www.jandbvirtualsolutions.com), J&B EMS (ems.jandbmedical.com), Dynamic Synergy (www.dsynergy.net), Sylaps, and Med Surg (medsurg.jandbmedical.com). This Privacy Notice also covers personal information collected from J&B Medical job applicants in connection with the recruitment and hiring process.

HIPAA EXCLUSION: This Privacy Notice does NOT cover Protected Health Information (“PHI”) as defined under the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”), or information that is otherwise subject to HIPAA’s privacy and security requirements. Certain J&B Medical affiliates are HIPAA covered entities or Business Associates. For information about how we collect, use, and disclose your health information in our capacity as a covered entity or Business Associate, please refer to our Notice of Privacy Practices.

By using the Sites and the Services, you acknowledge that you have read and agree to this Privacy Notice and expressly consent to J&B Medical’s data processing as described below, including its information collection. You further acknowledge and consent to the use of cookies and similar tracking technologies by J&B Medical and third parties on the Sites, as described in this Privacy Notice and in our Cookie Policy, including the collection of your browsing activity, device information, IP address, and interactions with content through such technologies.

1. Information We Collect

Categories and Examples

We collect the following categories of personal information. Examples are illustrative and may vary by product, line of business, feature, or user choices. To the extent any information described below constitutes Protected Health Information under HIPAA, it is excluded from the scope of this Privacy Notice and is instead governed by our Notice of Privacy Practices.

Category	Examples	Primary Purposes of Processing	Third-Party Recipients	Sold or Shared for Targeted Advertising
Contact Information	Name, email, mailing address, phone number; account identifiers	Provide and support the Services; fulfill orders/prescriptions; account management; customer support; communications; security/fraud prevention	Service providers; affiliates; healthcare providers and insurers (non-PHI); shipping carriers	No
Insurance Information	Insurance company name, policy number, group number, member ID.	Claims processing; eligibility verification; service delivery; coordination of benefits	Insurance companies; CMS/Medicaid; service providers	No
Healthcare Provider Information	Doctor/prescriber name, NPI numbers, referring provider information	Fulfill prescriptions and DME orders; referral management	Healthcare providers; service providers	No
Account and Service Information	Saved preferences, product purchase history, account username and password	Provide, develop, and improve the Services; personalization; order management; analytics and reporting	Service providers; affiliates	No
Internet, Network Activity and Usage	IP address, browser type and version, device type and identifiers, operating system, cookie identifiers, pages viewed, links clicked, referring/exit URLs, date/time stamps, browsing and click-stream data, push notification tokens and preferences, and technical information collected through Google Tag Manager, Google Analytics, and similar technologies	Site operations; security; fraud detection; analytics and measurement; limited targeted advertising (via cookies)	Service providers; analytics and marketing providers	Yes
Geolocation Data	Approximate location derived from IP address	Localized content; analytics; fraud prevention	Service providers; analytics providers	No
Payment Information	Payment card or financial account details processed through third-party payment processors	Process transactions; billing; fraud prevention	Third-party payment processors; service providers	No
Family / Authorized Representative Information	Names and contact details of relatives or authorized persons who manage accounts on behalf of patients	Account management; order fulfillment; communications	Service providers; affiliates	No
Health Screening Data	First name, last name, date of birth, email, phone, health screening responses and risk thresholds	Deliver telemedicine/screening services; reporting to state partners; quality assurance.	State government partners (CO, MI); service providers; healthcare providers	No
Professional / Business Information (B2B)	Name, contact information, employer, business role	Business relationship management; order fulfillment; partner reporting	Affiliates; service providers	No
SMS / Communications Data	Phone numbers for text messaging communications, message content and metadata	Prescription notifications; appointment reminders; service communications	Service providers	No
Audio / Visual Information	Call recordings and metadata (date, time, duration, originating number); video conferencing content, including audio, video, chat messages, files shared, and shared screens during meetings hosted or joined through the Sylaps platform; meeting usage data (time, duration, frequency, and features used); performance metrics	Quality assurance; training; dispute resolution; service delivery; enabling video, audio, chat, and file sharing functionality; performance improvement and troubleshooting	Service providers	No
Pet Information	Pet owner and veterinarian information	Prescription fulfillment; service delivery	Service providers	No
Job Applicant Information	Name, email, phone number, mailing address, resume/CV, cover letter, employment history, education history, professional licenses and certifications, references, date of birth, government identification numbers (e.g., Social Security Number, driver’s license number), immigration and work authorization status, protected classification characteristics (e.g., race, gender, veteran status, disability status) collected voluntarily for EEO purposes	Evaluate job applications; make hiring and employment decisions; conduct background checks; comply with EEO and legal obligations; onboard new hires; benefits administration	Service providers (background check vendors, recruiting platforms such as Paylocity); government agencies (as required by law)	No
Sensitive Personal Information (SPI)	Account credentials; government identifiers (to the extent not PHI); health-related information (predominantly governed by HIPAA — see Notice of Privacy Practices)	Account security/authentication; fraud prevention; essential service functionality.	Service providers supporting these limited purposes	No

Notes: (i) J&B Medical does not sell personal information. (ii) We do not sell or share personal information of consumers we know are under 16. (iii) Aggregated, de-identified population-level data (e.g., total number of screenings conducted by Virtual Solutions) is not personal information and is not subject to this Privacy Notice.

Sources of Information

• Directly from you: For example, when you create an account, place an order, submit a prescription request, complete a health screening, request DME, apply for a job, use our contact forms, or otherwise use the Services.

• Automatically: For example, from your browser, device, and applications through cookies, Google Tag Manager, Google Analytics, and similar automated tracking technologies when you interact with the Sites and Services. For more detail, please review our Cookie Policy.

• From third parties: For example, from insurance companies, healthcare providers, state government partners, and third-party integration services. If you connect your Sylaps account to third-party services (such as Single Sign-On providers like Google or Facebook, cloud storage services, or social media platforms), we may receive information from those services with your consent.

2. How We Use Information

We use personal information for the following purposes:

• Operations and service delivery: provide, operate, and support the Sites and Services; fill prescriptions and process DME orders; deliver telemedicine/screening services (Virtual Solutions); enable video, audio, chat, and file sharing functionality (Sylaps); fulfill retail orders (J&B At Home, Pet Source); process wholesale and emergency medical supply orders (Med Surg, J&B EMS); manage referrals received through Parachute Health; and support third-party integrations you choose to connect.

• Account and communications: send account notices, order confirmations, prescription notifications, safety or security alerts, and service updates; respond to inquiries; conduct surveys; and send marketing communications where permitted.

• Analytics and website improvement: measure and understand how users interact with our Sites using Google Analytics and similar tools; improve Site performance and user experience; and generate aggregated insights (including population-level reporting such as total screenings conducted).

• Security, integrity, and fraud prevention: detect, prevent, and investigate fraud, abuse, and unauthorized access; protect against threats; ensure platform reliability; and conduct quality assurance.

• Legal compliance: comply with applicable law and legal process; respond to lawful requests from government agencies; enforce our agreements and terms; and support corporate transactions and governance.

• Limited targeted advertising: certain cookies and tracking technologies deployed on our Sites may facilitate limited ad measurement and advertisement efficiency tracking.

• Quality assurance: monitor and review calls managed by Dynamic Synergy for training, quality control, and dispute resolution purposes.

• Recruitment and employment: evaluate job applications; make hiring decisions; conduct background checks and verify credentials; comply with equal employment opportunity and other legal obligations; onboard new hires; and administer employee benefits.

3. How We Disclose Information

We disclose personal information to the following recipient categories for the purposes described above.

• Affiliates and subsidiaries: within the J&B Medical family of companies (including J&B Pharmacy Services, J&B At Home, J&B Pet Source, J&B Virtual Solutions, Dynamic Synergy, Sylaps, and Med Surg) for coordinated operations, centralized reporting, security administration, and as otherwise consistent with this Notice.

• Service providers: vendors performing services for us under contracts that restrict their use of personal information, including: cloud hosting and infrastructure; payment processing and billing; shipping and delivery carriers; customer support tools; call center services; SMS/communications platforms; analytics; and referral management.

• Healthcare providers and insurers: to the extent not covered by HIPAA, to coordinate services, process orders, verify eligibility, and manage referrals.

• Government agencies: CMS, state Medicaid programs, and state partners as required by law or contract.

• Analytics providers: Google Analytics and similar services that help us understand Site usage and improve performance.

• Third-party integration partners: when you choose to connect your Sylaps account to third-party services such as Single Sign-On providers (e.g., Google, Facebook, or other OpenID providers), cloud storage services, or social media platforms, we may disclose limited information to those services as necessary to support the integration. These integrations are optional and require your consent. You can review and revoke access to third-party integrations at any time through your Sylaps account settings.

• Legal, safety, and corporate transactions: to comply with subpoenas, court orders, and other lawful requests; enforce terms and investigate violations; protect the rights, property, and safety of J&B Medical, users, and the public; and in connection with due diligence and completion of mergers, acquisitions, financings, or asset transfers.

• Recruiting service providers: vendors that support the application and hiring process, including recruiting platforms, background check providers, and applicant tracking systems.

• With consent or at your direction: when you authorize us to share your information with a specific party or for a specific purpose.

When we engage vendors, we require contracts that restrict use of personal information to our documented instructions and prohibit sale, sharing, or targeted advertising by those vendors.

4. Targeted Advertising, Sale, and Sharing

Definitions

• “Sale” of personal information: disclosing personal information to a third party for monetary or other valuable consideration.

• “Share” of personal information: disclosing personal information to a third party for cross-context behavioral advertising or, more simply, “targeted advertising.”

• “Targeted advertising”: displaying ads to you based on your activities across non-affiliated websites, applications, or services, over time and across devices.

J&B Medical’s Practices Regarding Sale, Sharing, and Targeted Advertising

• J&B Medical does not sell personal information. We do not receive monetary or other valuable consideration in exchange for disclosing personal information to third parties.

• J&B Medical shares personal information for cross-context behavioral advertising. Our Sites use cookies and similar tracking technologies that allow our advertising partners to collect identifiers, browsing activity, and device information from our Sites. Under certain state privacy laws, this activity may be characterized as “sharing” personal information for targeted advertising purposes.

• We do not sell or share personal information of consumers we know are under 16.

• Depending on where you live, you may have the right to opt out of your personal information being used for these purposes. Please visit the U.S. State Privacy Rights and California Privacy Rights sections of this Notice for additional information.

5. How to Exercise Your Choices

• Global Privacy Control (GPC): if you enable a browser- or device-level GPC signal, we will recognize it as a valid request to opt out of targeted advertising in applicable jurisdictions. We apply GPC at the browser/device level. Please note that we do not respond to Do Not Track signals.

• Cookie/Preference tools: you can adjust cookie and tracking preferences through your browser/device settings. You may disable or delete individual cookies through your browser settings; however, disabling certain cookies may affect the functionality of the Sites. For information about the specific cookies in use and their purposes, please review our Cookie Policy.

• Opt out of promotional messages: to opt out of promotional emails, follow the “unsubscribe” instructions in the email message. To opt out of promotional text messages, reply “STOP” to our message. Reply “HELP” for assistance. Even if you opt out of marketing messages, we will still send you transactional messages, such as order confirmations and prescription notifications.

• Analytics: we use Google Analytics to understand how users interact with our Sites. You can learn about Google Analytics’ currently available opt-outs at https://tools.google.com/dlpage/gaoptout/ and manage the information collected through your browser or device settings.

6. Cookies and Other Tracking Technologies

We and our partners use cookies and similar automated data collection technologies to operate the Sites, provide features, perform analytics, detect fraud, and measure performance. Our Sites utilize the following types of cookies and tracking technologies:

• Strictly necessary cookies: these cookies are required for the operation of our Sites and Services. They enable core functionality such as user authentication, security, session management, and consent management. These cookies cannot be disabled without impairing the Sites.

• Functional cookies: these cookies enable enhanced functionality and personalization, such as remembering your preferences and supporting localized features. If you do not allow these cookies, some features may not function properly.

• Performance and analytics cookies: these technologies allow us to count visits, measure traffic sources, and understand how visitors navigate our Sites so we can improve performance. They include tools such as Google Analytics and internal analytics tools. These tools assign unique identifiers to your browser and collect information such as pages visited, session duration, and interactions with content.

• Advertising/measurement cookies: certain cookies may be used by our advertising partners, such as Google, and their partners to measure advertisement efficiency and deliver relevant advertisements.

For a comprehensive list of the specific cookies deployed on our Sites, including their names, purposes, and expiration periods, please review our Cookie Policy. You may also manage your cookie preferences through your browser settings.

7. Call Recordings and Offline Collection

When you call J&B Medical or its affiliated call center (Dynamic Synergy), J&B Medical or its service providers may record the call date, time, duration, originating number, and the content of the call. We collect and process call recordings to support quality assurance, training, metrics/analytics, fraud prevention, security, and dispute resolution. Where required by law, we provide call-recording notices and obtain consent. We do not use call recordings for marketing or profiling, and we do not sell or share call recordings for targeted advertising. We disclose call recordings to service providers that support these limited purposes under appropriate contracts and as required by law.

J&B Virtual Solutions may also collect audio/visual information through its WebRTC-based video conferencing platform for the delivery of telemedicine services. Such information, to the extent it constitutes PHI, is governed by HIPAA and the applicable Business Associate Agreement, and is not subject to this Privacy Notice.

8. Data Retention

We retain personal information for as long as needed to provide the Services, for the purposes outlined in this Notice, to comply with legal obligations (including HIPAA record retention requirements, which are addressed separately in our Notice of Privacy Practices), resolve disputes, enforce agreements, and protect our rights and users. Retention varies by category and context; we apply documented criteria such as business need, sensitivity, user expectations, legal/regulatory requirements, and technical constraints.

When we no longer need personal information, we will delete, de-identify, or aggregate it consistent with applicable law. When we de-identify information, we commit to maintain it in de-identified form and not to attempt to reidentify it except to test and validate our de-identification processes.

9. Security

We use reasonable and appropriate administrative, technical, and physical safeguards designed to protect personal information, including access controls, encryption in transit, continuous monitoring, and, for the Sylaps video conferencing platform, end-to-end encryption for meetings where available. Please note, however, that no system can be guaranteed to be 100% secure.

10. Children’s Privacy

Our Services are not intended to collect the non-PHI personal information of children under 13. If we learn that a child under 13 has provided personal information that is not covered by HIPAA, we will delete it. We do not sell or share personal information of consumers we know are under 16.

11. External Links

The Sites may link to third-party websites or services, and their privacy practices are governed by their own policies. We are not responsible for the websites, content, or privacy practices of any third party.

12. Changes to This Privacy Notice

We will update this Privacy Notice from time to time. If we make material changes, we will post the updated Notice, provide notification as required by applicable laws, and adjust the “Last Updated” date. Your continued use of the Sites after changes indicates acceptance of the updated Notice.

13. How to Contact Us

• Email: info@jandbmedical.com

• Phone: (800) 737-0045

• Mailing address:

50496 Pontiac Trail,
Wixom, MI 48393

 

 

U.S. State Privacy Rights

Supplemental Notice for U.S. State Residents

If you reside in one of the following states, this section applies to you and supplements the information above: Alabama, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Louisiana, Maryland, Minnesota, Montana, Nebraska, Nevada, New Hampshire, New Jersey, Oklahoma, Oregon, Rhode Island, Tennessee, Texas, Utah, Vermont, Virginia. To exercise any of the rights described below consistent with applicable law, please follow the instructions in the “Exercising Your Rights” subsection.

To comply with your request, we may ask that you verify your identity for security purposes before we take further action. Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

Your Rights Under Applicable State Law

Most residents covered by this section share the following core rights. State-specific variations and additional rights are described in the callouts below.

• Right to Access and Data Portability: you have the right to confirm whether J&B Medical is processing your personal information and to access that personal information. You may obtain a copy of the information in a portable and readily usable format, to the extent technically feasible.

• Right to Correct: you have the right to correct inaccuracies in your personal information, taking into account the nature of, and purposes for, processing the personal information.

Note: Utah and Iowa residents do not have a statutory right to correct (only to delete).

• Right to Delete: you have the right to delete your personal information that J&B Medical has collected from you and retained, subject to certain exceptions.

• Right to Opt Out: you have the right to opt out of your personal information being processed:

– For targeted advertising;

– For the sale of personal information; or

– For profiling to make automated decisions that produce legal or similarly significant effects (this right applies in most states but not Utah or Iowa).

Please note that J&B Medical does not sell personal information or engage in profiling to make automated decisions that produce legal or similarly significant effects.

• Right to Appeal: you may appeal J&B Medical’s refusal to take action on your consumer rights request within a reasonable time after you received our decision. We will respond within the timeframe required under applicable law, generally 45 or 60 days of receipt of your appeal. You may contact the state Attorney General if you have concerns about the result of the appeal.

• Right to Consent to Processing of Sensitive Personal Information: several states grant residents the right to consent to the processing of Sensitive Personal Information. As noted above, the majority of sensitive personal information J&B Medical collects is PHI governed by HIPAA. To the extent any SPI falls outside HIPAA, we process it only for the limited purposes described in Section 1 above. You may withdraw your consent to the processing of this data at any time.

State-Specific Callouts

• Delaware, Maryland, Minnesota, and Oregon — Additional Right: Obtain a List of Third Parties

In addition to the core rights above, residents of Delaware, Maryland, Minnesota, and Oregon have the right to obtain a list of the specific third parties to which J&B Medical has disclosed their personal information.

• Nevada — Covered Information and Sale Opt-Out

Nevada law applies specifically to information collected about Nevada residents through a website or online service, including first and last name; home or physical address; email address; telephone number; social security number; online or physical identifier; or other information that, combined with an identifier, makes the information personally identifiable (“covered information”).

Nevada residents may review and request changes to their covered information, and may opt out of the sale of covered information. Note: J&B Medical does not sell personal information. Please also note that Nevada’s law does not provide a general right to delete or appeal in the same manner as other state laws listed here.

• Utah and Iowa — Narrower Scope of Rights

Utah and Iowa law do not provide a right to correct or a right to opt out of profiling.

Utah law does not provide the right to appeal if J&B Medical declines to take action regarding your consumer rights request.

How to Exercise Your Rights

To exercise the rights described in this section, please submit a verifiable consumer request by:

• Email: civilrights@jandbmedical.com

• Phone:  (800) 737-0045

• Mailing address:

50496 Pontiac Trail,

Wixom, MI 48393

Verifiable Consumer Requests

Your verifiable consumer request must provide sufficient information that allows us to reasonably verify you are the person about whom we collected information, and describe your request in sufficient detail that allows us to properly respond to it. We cannot respond to your request if we cannot verify your identity.

Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. To designate an authorized agent, please contact us via the methods noted above.

J&B Medical Responses

• Response Time: we will respond to verifiable consumer requests within the time allotted under applicable law, generally forty-five (45) days of its receipt. If we require more time (up to an additional 45 days), we will inform you of the reason and extension period in writing.

• Response Content: any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another without hindrance.

• Method of Response: you do not need to create an account with us to make a verifiable consumer request. However, if you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

California Privacy Rights

Supplemental Notice for California Residents

This section supplements the information contained in the Privacy Notice above and applies solely to individuals who reside in the State of California. We have adopted this notice to comply with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CCPA”), and any terms defined in the CCPA have the same meaning when used in this section.

1. Personal Information We Collect and Disclose

The following table identifies the categories of personal information we have collected from California consumers during the preceding 12 months, whether we have disclosed that information for a business purpose, and whether it has been collected:

Category	Examples	Collected
A. Identifiers	Real name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, or other similar identifiers.	YES
B. Personal information categories (Cal. Civ. Code § 1798.80(e))	Name, address, telephone number, insurance policy number, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Note: to the extent this constitutes PHI under HIPAA, it is excluded from this Privacy Notice.	YES
C. Protected classification characteristics	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion, marital status, medical condition, physical or mental disability, sex, sexual orientation, veteran or military status, genetic information. Note: collected from job applicants on a voluntary basis for EEO compliance purposes.	YES
D. Commercial information	Records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	YES
E. Biometric information	Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier, such as fingerprints, faceprints, and voiceprints.	NO
F. Internet or other similar electronic network activity	Browsing history, search history, information on a consumer’s interaction with a website or advertisement, including data collected through cookies, such as Google Tag Manager and Google Analytics.	YES
G. Geolocation data	Approximate physical location derived from IP address.	YES
H. Sensory data	Audio, electronic, visual, or similar information (e.g., call recordings at Dynamic Synergy call center; video conferencing content including audio, video, chat messages, files shared, and shared screens via Sylaps platform).	YES
I. Professional or employment-related information	Current or past job history, employer, business role (B2B contacts for Med Surg and wholesale operations); job applicant information including resume/CV, employment history, education history, professional licenses, and references.	YES
J. Non-public education information	Education records directly related to a student maintained by an educational institution.	NO
K. Inferences drawn from other personal information	Profile reflecting a person’s preferences, characteristics, behavior, or aptitudes.	YES
L. Sensitive Information	Account log-in credentials; potentially government identifiers and financial account information. Note: health-related sensitive information is governed by HIPAA — see Notice of Privacy Practices.	YES

2. Disclosure of Personal Information

For more information about the information we disclose for a business purpose, please read the Privacy Notice above. In the preceding 12 months, we have disclosed the following categories of personal information for a business purpose:

• Category A: Identifiers

• Category B: California Customer Records personal information categories

• Category D: Commercial information

• Category F: Internet or other similar network activity

• Category G: Geolocation data

• Category I: Professional or employment-related information

• Category L: Sensitive Information (limited — account credentials only)

3. Sale and Sharing of Personal Information

J&B Medical does not sell personal information.

J&B Medical does not intentionally share personal information for cross-context behavioral advertising. However, certain cookies deployed on our Sites may allow our advertising partners to collect identifiers and browsing activity that may constitute “sharing” under the CCPA. To the extent this occurs, it is limited to the following category:

• Category F: Internet or other similar network activity (via cookies/tracking technologies)

4. Your California Privacy Rights

The CCPA provides California residents with specific rights regarding their personal information. This section describes your CCPA rights and explains how to exercise those rights.

A. Right to Access, Use Limitation, and Data Portability

You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Specifically, you may request that we:

• Disclose to you the categories of personal information we collected about you;

• Disclose to you the categories of sources for the personal information we collected about you;

• Disclose to you our business or commercial purpose for collecting that personal information;

• Disclose to you the categories of third parties with whom we share that personal information;

• Disclose to you the specific pieces of personal information we collected about you (data portability request);

• Disclose to you if we sold, shared, or otherwise disclosed your personal information for a business purpose;

• Limit the use and disclosure of your “Sensitive Personal Information.”

B. Right to Correct

You have the right to request that we correct any inaccurate personal information we hold about you. Upon receipt and verification of your request, we will use commercially reasonable efforts to correct your personal information as directed by you, pursuant to applicable law.

C. Right to Delete

You have the right to request that we delete your personal information that we have collected from you and retained, subject to certain exceptions.

D. Right to Appeal

You may appeal J&B Medical’s refusal to take action on your consumer rights request within a reasonable time after you received our decision. We will endeavor to notify you within 45 days of receipt of your appeal (and we will notify you if J&B Medical requires an additional 60 days) what action J&B Medical has taken in our written response. You may contact the state Attorney General if you have concerns about the result of the appeal.

E. Right to Opt Out

J&B Medical does not sell personal information. To the extent that certain cookie-based activities may constitute “sharing” under the CCPA, you may opt out by adjusting your browser cookie settings, enabling a Global Privacy Control signal, or emailing compliance@jandbmedical.com.

F. Right to Limit the Processing of Sensitive Personal Information

J&B Medical processes limited categories of Sensitive Personal Information outside of HIPAA, including account login credentials and payment information. Under California law, you have the right to direct us to limit our use and disclosure of your sensitive personal information to only what is reasonably necessary to perform the services or provide the goods you request. J&B Medical already limits its use of SPI to these purposes.

G. Right to Non-Discrimination

We will not discriminate against you for exercising any of your rights.

5. California Do Not Track Disclosure

Do Not Track (“DNT”) is a privacy preference that you can set in your web browsers, which allows you to opt out of tracking by websites and online services. We do not currently recognize or respond to DNT signals. For more information about DNT, please see https://www.eff.org/issues/do-not-track.

6. California Shine the Light

California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of our Services who are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. J&B Medical does not disclose personal information to third parties for their direct marketing purposes. To make such a request, please send an email to compliance@jandbmedical.com.

7. Exercising Your California Rights

To exercise the rights described above, please submit a verifiable consumer request by:

• Phone: (800) 737-0045

• Email: civilrights@jandbmedical.com

California residents may make a verifiable consumer request twice within a 12-month period, free of charge, unless the request is excessive, repetitive, or manifestly unfounded.

If you are a California resident and wish to designate an authorized agent to make a request on your behalf, the authorized agent must be a natural person or a business entity registered with the Secretary of State of California, and you must sign a written declaration authorizing the agent to act on your behalf. Please mail a copy of your signed written declaration authorizing the authorized agent to act on your behalf to the address above. If you provide an authorized agent with power of attorney pursuant to California Probate Code sections 4121 to 4130, it may not be necessary to perform these steps.