Hayden Health Mart Privacy Policy

Effective Date: 9/10/2026

Last Updated: 2026-09-18

1. Introduction and Scope

Hayden Health Mart, doing business as Hayden Health Mart ("we," "us," or "our"), operates the website at www.haydenpharmacy.net (the "Site"). This Privacy Policy explains what information we collect through the Site, why we collect it, how we use it, who we share it with, and the choices you have.

This policy covers the public-facing Site and the non-medical information we collect through it — for example, newsletter sign-ups, event registration, and general website analytics under certain circumstances.

This policy does not apply to employees or job applicants.

This policy does not cover protected health information (PHI). When you fill or transfer a prescription, use our patient portal or mobile app, request a refill, pay for a prescription, or otherwise engage us as your pharmacy, the health information involved is protected under the Health Insurance Portability and Accountability Act (HIPAA) and is governed by our separate Notice of Privacy Practices, not by this policy. See Section 2.

2. This Policy and Our HIPAA Notice of Privacy Practices

We are a pharmacy, so most of the health information we hold about you is protected health information under HIPAA. As a covered entity, we handle that information — your prescriptions, medications, insurance and payment records tied to your care, and communications with our pharmacy staff — under our Notice of Privacy Practices on request at the pharmacy counter.

Where a vendor helps us operate patient-facing services that touch PHI, then, where required by law, that vendor acts as our business associate under a Business Associate Agreement and may use PHI only as we are permitted to under HIPAA.

Note that if you pay for a prescription through a link on the Site, payment is handled by our third-party payment processor. We do not receive, store, or process your full card number. We may retain transaction-related details such as billing name, transaction amount, payment status, and a transaction reference identifier. The information we retain is processed in accordance with our Notice of Privacy Practices, not this policy.

If any conflict exists between this policy and our Notice of Privacy Practices regarding PHI, the Notice of Privacy Practices controls.

3. Information We Collect

Information you give us directly:

• Name, email address, and phone number (when you contact us, register for an event, or subscribe to updates)
• Mailing or store-location preference (when relevant to your request)
• The content of messages, survey responses, or form fields you submit

We ask you to keep Site form submissions limited to what a request needs. Please do not enter diagnoses, medication details, or other health specifics into general website forms — use the patient portal or call the pharmacy for anything involving your care.

Information collected automatically when you use the Site:

• Device and browser information (browser type, operating system, screen size, language)
• IP address and general location derived from it (city or region level)
• Pages viewed, links clicked, referring/exit pages, and time on page (clickstream)
• Cookies and similar technologies (see Section 6)

Information from third parties:

• Analytics and Site-performance data from Google Analytics
• Interaction data from our email platform
• Support and site-operation data from our website platform provider, Lumistry

4. How and Why We Use Your Information

We use the information above for these purposes:

| Purpose | Data used |

|---|---|

| Respond to your requests and inquiries | Name, email, phone, message content |

| Send general updates you subscribed to | Email address, engagement data |

| Operate, secure, and improve the Site | Technical data, analytics, cookies |

| Detect and prevent fraud, abuse, and security incidents | Technical data, IP address |

| Meet legal and regulatory obligations | Any relevant category above |

We do not use general website information to make decisions about your medical care, and we do not use it for automated decisions that produce legal or similarly significant effects about you. Where required by law, we will ask for your consent before using information for a materially different purpose.

5. How We Share Your Information

We share information with parties that help us operate the Site, and only for the purposes above.

We may also share information with our affiliates, including subsidiaries and sister companies.

Disclosures required by law. We may share information with parties outside the pharmacy when we have a good-faith belief that it is reasonably necessary to meet an applicable law, regulation, legal process, or enforceable government request; to enforce our terms; to detect or address fraud, security, or technical issues; or to protect the rights, property, or safety of our patients, our staff, or the public.

Business transfers. If we are acquired by or merged with another organization, or if substantially all of our assets are transferred, information about our website users may be among the transferred assets.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. If this ever changes, we will update this policy, post a clear "Do Not Sell or Share My Personal Information" choice, and honor opt-out preference signals (see Section 7) before doing so.

We may also share information for additional purposes with your consent.

Third-Party Sharing

We respect your privacy. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

6. Cookies and Tracking Technologies

The Site uses cookies, web beacons, clickstream logging, and similar technologies to function, to remember your preferences, and to understand how visitors use the Site.

| Category | Purpose | Can you turn it off? |

|---|---|---|

| Strictly necessary | Core site function, security, load balancing | No — the Site needs these |

| Preference | Remember choices such as language or location | Yes |

| Analytics | Measure Site usage and improve pages, via Google Analytics | Yes |

| Advertising | Not in use | N/A |

Our position on health-context tracking. We do not place third-party advertising or social-media tracking technologies (for example, advertising pixels) on pages tied to prescriptions, refills, transfers, appointment scheduling, or specific health topics. We configure our analytics so that it does not transmit information that could identify you together with a health-related action.

How to control cookies:

• Use the cookie-preference control on the Site, where available.
• Adjust your browser settings to block or delete cookies.
• Turn on a browser-level opt-out preference signal (see Section 7).

7. Global Privacy Control and Opt-Out Preference Signals

Some browsers and extensions let you send a Global Privacy Control (GPC) signal that tells websites you want to opt out of the sale or sharing of your personal information. We honor GPC and similar opt-out preference signals as a valid opt-out request for the browser or device that sends them.

Because we do not sell or share personal information for advertising, an opt-out signal will not change what we do — we treat it as your stated preference and record it. Please note that GPC is browser and device specific and you may need to opt out again.

We currently do not recognize the "Do Not Track" signal.

8. Data Retention

We set retention periods based on the amount, nature, and sensitivity of the information, the risk of harm from unauthorized use, whether we can meet the purpose another way, and applicable legal requirements. After the applicable period, we may delete or de-identify the information. To the extent that we use de-identified information, then, where required by law, we will not attempt to re-identify it except to ensure our de-identification methods are satisfactory.

Information protected under HIPAA is retained per our Notice of Privacy Practices and applicable pharmacy recordkeeping law.

9. How We Protect Your Information

We maintain administrative, technical, and physical safeguards that take into account the sensitivity of the information we handle.

No method of transmission or storage is completely secure. If we learn of a security incident affecting your personal information, we will notify you and any regulators as required by applicable law.

10. Your Privacy Rights

Depending on your state of residence, you may have certain rights with respect to the personal information governed by this Privacy Policy. These rights may include the following:

| Right | What it means |

|---|---|

| Right to know / access | Ask what personal information we hold about you and how we use it |

| Right to list of third parties | Ask what third parties receive personal information from us generally |

| Right to correct | Ask us to fix inaccurate personal information |

| Right to delete | Ask us to delete the personal information we hold about you |

| Right to data portability | Get a copy of your information in a usable format |

| Right to opt out of sale or sharing | We do not sell or share for advertising, but you may still register the choice |

| Right to opt out of targeted advertising and profiling | Opt out of targeted advertising and of profiling with legal or similarly significant effects (we do not do either) |

| Right to limit use of sensitive information | Direct us to limit use of sensitive personal information to permitted purposes |

| Right to appeal | If we deny a request, ask us to reconsider |

| Right to non-discrimination | We will not treat you differently for exercising a right |

How to make a request:

• Email drew.shipps@yahoo.com
• Call 205-590-1515

We will attempt to confirm your identity using information you already have with us but may request additional information if necessary — we will not make you create a new account to submit a request. You may have the right to use an authorized agent; we may ask for proof that the agent has valid authorization to submit a request on your behalf. We respond within the time period required by applicable law. If we deny a request, we will explain why, and you may appeal by replying to our response or contacting us at drew.shipps@yahoo.com.

Deletion exceptions. We may deny a deletion request when keeping the information is necessary to:

• complete a transaction or service you requested, or perform our contract with you;
• detect security incidents and protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible;
• debug products to identify and repair errors that impair intended functionality;
• exercise free speech, protect another consumer's right to exercise free speech, or exercise another right provided by law;
• comply with a legal obligation or a law such as the California Electronic Communications Privacy Act;
• enable solely internal uses reasonably aligned with your expectations based on your relationship with us; or
• make other lawful internal uses compatible with the context in which you provided the information.

Please note that deleting your personal information may impact our ability to provide you with services.

Requests about prescription or medical records are handled under our HIPAA Notice of Privacy Practices — contact the pharmacy directly for those.

11. Sensitive Information

We do not seek sensitive personal information through the general Site, and we ask you not to submit it through website forms. We do not use or disclose sensitive personal information beyond the purposes permitted without a right to limit under applicable law.

12. Children's and Minors' Privacy

The Site is intended for adults and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child provided information through the Site, contact us at drew.shipps@yahoo.com. We do not sell or share the personal information of consumers under 16.

13. Additional Information on How We Use Personal Information

The table below describes the categories of personal information we handle, for residents of states that call for this disclosure.

| Category | Do we collect it? | Do we sell or share it? |

|---|---|---|

| Identifiers (name, email, phone, IP address) | Yes | No |

| Internet/network activity (Site usage, cookies, clickstream) | Yes | No |

| Geolocation (general, city/region level) | Yes | No |

| Commercial information (requests you make; online transaction details) | Yes | No |

| Sensitive personal information | We ask you not to submit it | No |

We obtain these categories directly from you, automatically through your use of the Site, and from the service providers and third parties listed in Section 3. We do not use or disclose sensitive personal information beyond purposes permitted without a right to limit.

California Shine the Light. If you are a California resident with whom we have an established business relationship, you may have the ability to request a list of third parties with whom we share personal information (as defined by the Shine the Light law) for those third parties' direct marketing purposes, if any. To make such a request, contact us at drew.shipps@yahoo.com with the subject line "California Shine the Light Request."

14. Third-Party Links

The Site may link to other websites, including manufacturer pages, health resources, or partner services. We do not control those sites and are not responsible for their privacy practices. Review their policies before sharing information with them.

15. Changes to This Policy

We may update this policy as our practices or the law change. When we do, we will revise the "Last Updated" date above and, for meaningful changes, post a more prominent notice on the Site. Continued use of the Site after an update means you accept the revised policy.

16. Contact Us

Hayden Health Mart

Attn: Privacy Policy Inquiry

4086 AL-160

Hayden, AL, 35079

US

Email: drew.shipps@yahoo.com

Phone: 205-590-1515

For prescription or medical-record privacy questions, contact the pharmacy directly and ask for our HIPAA Notice of Privacy Practices.