Online Privacy and Security Policy

Last Updated: December 29, 2023

This Privacy Policy lets you know how we collect, use, share, and protect information about you. By interacting with Walgreens through our stores, websites, mobile applications, and any other Walgreens affiliate websites where you may interact with Walgreens, you consent to the practices described in this Privacy Policy. Any changes in our Privacy Policy will appear on this page so that you are aware of the data we collect and how we use it. We will notify you of material changes to this Privacy Policy by posting on our websites notification that the Privacy Policy has been revised and by updating the effective date of the Privacy Policy. For California, Colorado, Connecticut, Virginia, and Utah residents, there is an "Information for California Consumers", "Information for Colorado Consumers", "Information for Connecticut Consumers", "Information for Virginia Consumers", and "Information for Utah Consumers" section in this Privacy Policy.

In some circumstances, Walgreens' use of your information will be subject to the requirements of the Health Insurance Portability and Accountability Act (commonly known as "HIPAA"). For example, if you log in to your pharmacy account and submit information regarding a prescription order, that information is subject to HIPAA's requirements. In those circumstances, the Walgreens Notice of Privacy Practices and not this Privacy Policy will apply. If you have questions about which policy applies to the information you have submitted, please do not hesitate to Contact Us.

At Walgreens, we are committed to maintaining our customers' privacy. We take great care to safeguard the information that we collect to maintain our customers' privacy. We have provided this Privacy Policy to you to describe information collection and use practices at Walgreens. This Privacy Policy describes the choices you can make about the way your information is collected and used.

We want you to understand how information you provide to us is collected and used. When you interact with Walgreens or use our services, we collect certain information about you and the services you use. An example of using our "services" would be when you visit one of our stores or websites. We may collect and store information from you in the following situations:

• Make an in-store or online purchase, or other transaction with us;
• Create an account on one of our websites or mobile application;
• Participate in our loyalty programs;
• Participate in a contest, sweepstake, promotion, or survey;
• Correspond directly with us, such as through our websites, postal mail, customer service, or dispute resolution mechanisms; or
• Post a review or comment on one of our websites, or post other user-generated content on one of our websites or mobile application.

Identifiers: such as name, address, telephone number, email address, age, date of birth, username and password for our websites, online identifiers, IP address.
Commercial information: such as products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies, payment information, health and medical information, health insurance information, loyalty program participation information.
Inferences: such as consumer preferences, characteristics, predispositions, and behavior.
Biometric Information: such as facial scans for safety and security purposes.

• We may collect device-specific information when you visit our websites or use our mobile applications or services. This includes information such as Internet Protocol (IP) address, hardware model, operating system, unique device identifiers, mobile network information, location data such as zip code, the address of referring websites, the path you take through our websites, and other information about your session on our websites. We may also associate the information we collect from your different devices, which helps us provide consistent services across your devices.

• This includes details of how you used our websites or mobile applications including clicks and page information such as the address (or URL) of the website or mobile application you came from before visiting our website or mobile application, which pages you visit on our website or mobile application, which browser you used to view our website or mobile application, and any search terms entered.
• Other information from your interaction with our websites, services, content and advertising, including computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information.

• When you use our services on your mobile phone or device and enable location services on your mobile phone or device browser, we may collect information about your physical location through satellite, cell phone tower, WiFi signal, beacons, Bluetooth and near field communication protocols ("precise location information"). If you use our mobile application, your device may share precise location information when you enable location services for our application. To learn how to opt-out of sharing your precise location information with Walgreens, go to the "Your Choices" section of this Privacy Policy. When you use our mobile application, we may also request access to your Bluetooth signal from your device. If you enable our mobile application to use your Bluetooth signal, we may be able to determine your device's in-store location. To learn how to opt-out of sharing your device's Bluetooth signal with Walgreens, go to the "Your Choices" section of this Privacy Policy.
• We may also collect certain precise location information that may be considered "precise geolocation" under state law. Please see the "Information for California Consumers", "Information for Connecticut Consumers", "Information for Virginia Consumers", and "Information for Utah Consumers" sections for additional information on precise geolocation.

• We use cameras in and around our stores for security purposes and for operational purposes such as measuring traffic patterns and tracking in-stock levels.

• Our website may provide interactive services, including chatbot and managed chat. By accessing or using these features, you agree that we may record and retain a transcript of all communications with you via these interactive tools and may record or recreate your activity while using the website, in order to provide services, enhance your website experience, and for quality and verification purposes. We may work with trusted service providers to analyze, store, and/or use this data on our behalf. Your use or access of any of these tools or of our website is governed by the Privacy Policy and this section.

• "Cookies" are small data files that are sent from a website's server and are stored on your device's hard drive either for only the duration of your visit ("session cookies") or for a fixed period of time ("persistent cookies"). Cookies may store user preferences and other types of information. We use cookies to provide features and services, such as:
• Remembering your preferences and allowing you to enter your username less frequently;
• Presenting information that's targeted to your interests, including Walgreens content presented on another website;
• Measuring the effectiveness of our websites, services, content and advertising; and
• Providing other services and features that are available only through the use of cookies.
• The Options/Settings section of most internet browsers will tell you how to manage cookies and other technologies that may be transferred to your device, including how to disable these technologies. You can disable our cookies or all cookies through your browser setting, but please note that disabling cookies may impact some of our website's features and prevent the website from operating properly.
• A "Web Beacon" is an electronic image placed in the code of a webpage, application, or email. We use web beacons to monitor the traffic patterns of users from one page to another and to improve website performance, and in our emails to understand when our email communications are opened or discarded.

• We may use or engage a third party that uses Local Stored Objects, sometimes referred to as "Flash Cookies," and other technologies to collect and store information about the use of our services. A Flash cookie is a small data file placed on your computer or device using Adobe Flash technology. Flash cookies are different from the cookies discussed above because cookie management tools provided by your browser will not remove Flash cookies. To limit the websites that can store information in Flash cookies on your device, you must visit the Adobe website:
  https://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager07. html

We may collect information that is publicly available. For example, we may collect information you submit to a blog, chat room, or social network. We also may collect information from other companies, organizations, or third-party partners. For example, we may receive information about you from a partner when we jointly offer services or from an advertiser about your experiences with them. By gathering additional information about you, we can correct inaccurate information and give you product recommendations and special offers more likely to interest you.

Our primary purpose in collecting information is to provide you with a safe, smooth, efficient, and customized experience. We may use your information in a variety of ways, including for the following purposes:

• We use your contact information to respond to your inquiries, fulfill your requests and improve your experience.

• We use your information to deliver coupons, mobile coupons, newsletters, emails, mobile messages, and social media notifications about our brands, products, events or other promotional purposes.
• We use your information for reporting and analysis purposes. We examine metrics such as how you are shopping on our website, in our stores, and on our mobile applications, the performance of our marketing efforts, and your response to those marketing efforts.
• We use your information to administer promotions, surveys, and focus groups.
• We use your information to enable Online Tracking and Interest Based Advertising as further described in this Privacy Policy.
• We use your information to improve your experiences when you interact with us.
• We use your Precise Location Information to provide location based services for these marketing purposes. For example, using the Store Locator feature in our mobile application can allow you to quickly find the nearest Walgreens location.

• We use your information to improve the effectiveness of our services, conduct research and analysis, or to perform other business activities as needed.

• We use your information to detect, prevent or investigate potential security breaches, fraudulent transactions and monitor against theft.

• We may use your information as necessary or appropriate under applicable law, to comply with legal process, to respond to such requests from public and government authorities (including law enforcement), to enforce our terms and conditions, including investigations of potential violations, to detect, prevent or otherwise address fraud, security or technical issues, to protect our rights, privacy, safety or property, and to allow us to pursue available remedies to limit the damages that we may sustain. In matters involving claims of personal or public safety or in litigation where the data is pertinent, we may use personal information without your consent or court process.

We do not directly sell, rent, or loan your personally identifiable information, except as described in the ‘When We Work On Business Transactions’ paragraph below. We may share your information with companies, organizations and individuals outside of Walgreens as described below. Please note that certain state laws have adopted a broad definition of a "sale" or "share" and may treat certain of these disclosures as sales or sharing under their definitions. Please see the "Information for California Consumers", "Information for Colorado Consumers", "Information for Connecticut Consumers", "Information for Virginia Consumers", and "Information for Utah Consumers" sections for additional information.

• We may share your information with our parent company or affiliates, including but not limited to, Walgreens Boots Alliance Inc., Boots Retail USA Inc., Walgreens Specialty Pharmacy Holdings, LLC, and Walgreens Specialty Pharmacy, LLC, Walgreens Mail Services, LLC, Walgreens Health Services, LLC.

• We may share your information with affiliated and unaffiliated companies that perform tasks on our behalf related to our business. Such tasks include analyzing website usage data, customer service, electronic and postal mail service, and social and other media services.
• We may work with other companies who place cookies, tags, and web beacons on our websites. These companies help operate our websites and provide you with additional products and services.
• We may also use third-party advertising networks to serve advertisements on our behalf. The cookies received with the banner advertisements served by these networks may be used to collect and build behavioral profiles by these companies to deliver targeted advertisements on our website and unaffiliated websites.
• We may work with other companies who operate their own websites or mobile applications, to allow them to offer Walgreens customers the ability to connect to Walgreens services. These services give you more options for ways to use Walgreens services from websites or applications that are not owned or operated by Walgreens.
• We contract with partner companies to allow Walgreens customers to access one of their loyalty program accounts from those partners' websites and/or mobile applications. This may include the ability to join a loyalty program, add an existing membership, and/or access your account balance.
• If you participate in a loyalty program component which permits you to connect your loyalty program accounts with websites, application and devices, including non-Walgreens partners and their websites, application and devices. Notwithstanding the uses and disclosures set forth above, Walgreens may use or disclose personally identifiable information gathered under one of its loyalty programs for improving health, health research, or with your consent.
• Social Media: Our online services may use social media plugins (e.g., the Facebook "Like" button, "Share to Twitter" button) to enable you to easily interact with certain social media websites (e.g., Facebook, Twitter, Instagram) and share information with others. When you visit our services, the operators of the available social media plugins can place a cookie on your device enabling such operators to recognize individuals who have previously visited our services. If you are logged in to these social media websites while visiting our services, the social media plugins allow the relevant social media websites to receive information that you have visited our services or other information. The social media plugins also allow the applicable social media websites to share information about your activities on our services with other users of the social media website. We do not control any of the content from the social media plugins. We may also interact with you on social media platforms. If you contact us on one of our social media platforms, request services, or otherwise communicate directly with us on social media, we may contact you to interact with you. For more information about social media advertising and social media plugins from other social media websites, please refer to those websites' privacy and data sharing statements.
• We may share your information with business partners who may offer services or products to you. For example, in connection with the myWalgreens credit card, we share some information with our partner so it can prescreen individuals to see if they qualify for offers. You can learn about your rights relating to prescreened offers including how to opt out by calling 1-888-567-8688 or by going to https://www.optoutprescreen.com/. Certain state laws may also allow consumers the ability to opt out of processing activities that may be considered "profiling" under state law, such as prescreened credit card offers. Please see the "Information for California Consumers", "Information for Colorado Consumers", "Information for Connecticut Consumers" and "Information for Virginia Consumers" for additional information.

• We will disclose your information as necessary or appropriate under applicable law, to comply with legal process, to respond to such requests from public and government authorities, to enforce our terms and conditions, including investigations of potential violations, to detect, prevent or otherwise address fraud, security or technical issues, to protect our rights, privacy, safety or property, and to allow us to pursue available remedies to limit the damages that we may sustain. In matters involving claims of personal or public safety or in litigation where the data is pertinent, we may use or disclose personal information without your consent or court process.

• As we continue to develop our business, we might sell or buy stores or assets, or engage in mergers, acquisitions or sale of company assets. Personal information may be disclosed in connection with the evaluation of or entry into such transactions or related business arrangements, or in the course of providing transition of services to another entity as permitted by law. In such transactions, customer information generally is one of the transferred business assets. Additionally, in the event that Walgreens or substantially all of its assets are acquired, customer information will likely be one of the transferred assets as is permissible under law.

• We may share non-identifiable or aggregate information with third parties for lawful purposes.

• At your direction or request, or when you otherwise consent, we may share your information.

By interacting with any of the Walgreens family of companies as described herein, you consent to the practices described in this Privacy Policy. However, we want you to know that you do have certain choices with regard to how your information is collected and used.

• You may choose to stop receiving email and mobile marketing communications by changing your preferences online. If you have an online account, log in to Your Account and click on Communication Preferences. If you do not have an online account, you may click Unsubscribe from the bottom of Walgreens emails, and reply STOP to our text messages to stop receiving emails and SMS text messages. To request unsubscribing by email, contact Customerservice@mail2.walgreens.com.

• Push Notifications
  You can opt out from further allowing Walgreens to send you push notifications by adjusting the permissions in your mobile device or from the Walgreens mobile application.
• Precise Location Data
  You can opt out from further allowing Walgreens to access precise location data by adjusting the permissions in your mobile device.
• In-Store Location
  You can opt out from further allowing Walgreens to access your Bluetooth signal in our stores by adjusting the location permissions in your mobile device or from the Walgreens mobile application.

• Walgreens engages third-party advertisers to provide interest-based advertising on our website, as well as other third-party websites in order to display advertising that is relevant to you. These third parties may collect information about your use of our services over time and that information may be combined with information collected on different websites and online services. These third-party advertisers may be participants in the Network Advertising Initiative and/or the Self-Regulatory Program for Online Behavioral Advertising, which allow users to opt out of ad targeting from participating companies. To learn more about interest-based advertising, or to opt out of having your web browsing information used by certain third-party advertisers for behavioral advertising purposes, go to:  www.aboutads.info/choices or https://www.networkadvertising.org/choices/.
  
  Please Note: When you "opt out" of receiving interest-based advertisements, this does not mean you will no longer see advertisements from Walgreens. It means that the online ads that you do see will not be tailored for you based on your particular interests. We may still collect information about you for any purpose permitted under the Policy, including for analytics and fraud prevention.

• Walgreens respects enhanced user privacy controls. We support the development and implementation of a standard "do not track" browser feature, which signals to websites that you visit that you do not want to have your online activity tracked. Please note that at this time Walgreens.com does not interpret or respond to "do not track" signals. However, you may set your Web browser to not accept new cookies or web beacons, be notified when you receive a new cookie, or disable cookies altogether. Please note that by disabling these features, your experience on Walgreens.com will not be as smooth and you will not be able to take full advantage of our website's features. Please see the Help section of your browser for instructions on managing security preferences.

• If you are under 18 years old and a registered user, you can request that we remove content or information that you have posted to our website or other online services. Note that fulfilment of the request may not ensure complete or comprehensive removal (e.g., if the content or information has been reposted by another user). To request removal of content or information, please contact us.

• You can review and update information you have given us by emailing us or calling 877-924-4472. Our customer care staff will update your information. If you have a Walgreens.com account, you can log in and update your information.

• Our services may contain links to, or otherwise make available, social media websites and other third-party services, websites and mobile applications that are operated and controlled by third parties. We do not take responsibility for the content or the privacy practices employed by other websites. Unless otherwise stated, any Information you provide to any such third-party website will be collected by that party and not by Walgreens, and will be subject to that party's privacy policy (if any), rather than this Privacy Policy. In such a situation, we will have no control over, and shall not be responsible for, that party's use of the Information you provide to them.

• Walgreens recognizes the importance of maintaining the security of your information. Whether you are shopping on our website, through our mobile services, or in our stores, we use reasonable security measures, including administrative, technical, and physical safeguards.

• "Phishing" is a common email scam where your email address is used to contact you and ask for personally identifiable or sensitive information. Always be cautious when opening links or attachments from unsolicited third parties. Also know that Walgreens will not send you emails asking for your credit card number, social security number or other personally identifiable information. If you are ever asked for this information, you can be confident it is not from Walgreens.

• We recognize the importance of protecting children's online privacy. Our website and mobile services are intended for a general audience and are not directed to children. We do not knowingly collect personal information online from children under the age of 13.

• Collection. Consistent with the "Information We Collect" section above, we collect certain categories and specific pieces of CA Personal Information about individuals who reside in California. In the 12 months prior to the date of this Privacy Policy, we collected the following types of categories of CA Personal Information, which we will continue to collect:
• Identifiers: such as name, address, telephone number, email address, age, date of birth, username and password for our websites, online identifiers, IP address;
• Characteristics of protected classifications under California or federal law: such as sex, gender, age (40 or older);
• Commercial information: such as products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies, payment information, health and medical information, health insurance information, loyalty program participation information;
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information;
• Geolocation information: including location data and precise location data such as physical location information through the use of our services on your mobile phone or device by, for example using satellite, cell phone tower, WiFi signal, beacons, Bluetooth and near field communication protocols, when you are in or near a Walgreens store;
• Audio, visual, or similar information: such as photographs you share, store security video, customer service audio recordings;
• Inferences drawn from the above categories of CA Personal Information: such as consumer preferences, characteristics, predispositions, and behavior; and
• Sensitive Personal Information: such as driver's license, state identification card, or passport number, precise geolocation (within a radius of 1,850 feet), information on racial or ethnic origin, and information concerning your health.
• Sources. We may collect certain categories of CA Personal Information from you and third parties as described in the "Information We Collect" section above. The categories of sources from which we collected CA Personal Information in the 12 months prior to the date of this Privacy Policy include the following:
• In our stores (parent, subsidiary and affiliate brands)
• On our websites and mobile applications (parent, subsidiary and affiliate brands)
• When you communicate with our Customer Care Center
• Through participation in loyalty programs
• Third party websites and mobile applications (e.g., websites and applications that share information with us or our advertising partners regarding your online activities)
• Data Suppliers (e.g., companies that provide demographics and other information regarding consumers)
• Joint marketing or other commercial business partners
• Online advertising networks
• Delivery partners/carriers
• Social media companies
• Other service providers
• Survey providers

We will continue to collect CA Personal Information from these same sources.

• Purposes. We collect CA Personal Information for the business and commercial purposes described in the "How We Use Your Information" section above. Specifically, we collect CA Personal Information to respond to your inquiries, fulfill your requests and improve your experience; for marketing, advertising and promotional purposes; for reporting and analytics; to improve the effectiveness of our services, conduct research and analysis, or for other internal operations purposes; to detect, prevent or investigate potential security breaches, fraudulent transactions and monitor against theft.
• Retention. We retain CA Personal Information for the business and commercial purposes described in the "How We Use Your Information" and “Purposes” sections above. Retention of you CA Personal Information may also be required to provide products and services you requested, to maintain our business relationship with you, or for us to fulfill a legal obligation. Once no longer needed for these purposes, we will not retain your CA Personal Information in our systems.

Sharing your CA Personal Information for business purposes: As described above in the "How We Share Your Information" section, we share information for business purposes. In the 12 months prior to the date of this Privacy Policy, we shared and we may continue to share the following categories of CA Personal Information with third parties who are considered "service providers" as defined under California law since we disclose CA Personal Information to them for our business purposes.

• Identifiers: such as name, address, telephone number, email address, age, date of birth, username and password for our websites, online identifiers, IP address;
• Characteristics of protected classifications under California or Federal Law: such as sex, gender, age (40 or older);
• Commercial information: such as products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies, payment information, health and medical information, health insurance information, and loyalty program participation information;
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information;
• Geolocation information: including location data and precise location data, such as physical location information through the use of our services on your mobile phone or device by, for example using satellite, cell phone tower, WiFi signal, beacons, Bluetooth and near field communication protocols. If you use our mobile application, your device may share location information when you enable location services. We may be able to recognize the location of a mobile device in stores through use of Bluetooth technology;
• Audio, visual, or similar information: such as photographs you share, store security video, customer service audio recordings;
• Inferences drawn from the above categories of CA Personal Information: such as consumer preferences, characteristics, predispositions, and behavior; and
• Sensitive Personal Information: such as driver's license, state identification card, or passport number, precise geolocation (within a radius of 1,850 feet), information on racial or ethnic origin, and information concerning your health.

As described above, examples of business purposes include product and service fulfillment, internal operations, prevention of fraud and other harm, and legal compliance.

The categories of third party service providers to which we may share the above described categories include Payment Processing Companies, Data Analytics Providers, Fraud Prevention Providers, Cloud Storage Providers, IT Service Providers, Professional Service Providers, Delivery Partners, and Marketing Companies.

In addition, we may share the aforementioned categories of CA Personal Information with third parties involved in the evaluation of or entry into the sale or purchase of stores or company assets, mergers, or acquisitions. The categories of third parties to which we may share the above described categories of CA Personal Information include potential Business Partners or Purchasers, Professional Service Providers (e.g., consultants, lawyers, accountants), and Data Analytics Providers. In the event of sale, merger, or acquisition, customer information (including CA Personal Information) generally is one of the transferred business assets, as is permissible under law.

Sale and Sharing of CA Personal Information. As described above in the "How We Share Your Information" section, we may share the following categories of CA Personal Information with third parties who are considered "third parties" as defined under California law since we disclose CA Personal Information to them which they may use for secondary purposes. Our disclosure of CA Personal Information to the third parties who use the information for secondary purposes may constitute a "sale" or "sharing" of CA Personal Information as defined under California law.

In the 12 months prior to the date of this Privacy Policy, we shared for secondary purposes (which may constitute a "sale" or "sharing" of CA Personal Information under California law), and may continue to share, the following categories of CA Personal Information:

• Identifiers: such as online identifiers, IP address;
• Commercial information: such as products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies;
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information;
• Geolocation information: including location data and precise location data, such as physical location information through the use of our services on your mobile phone or device by, for example using satellite, cell phone tower, WiFi signal, beacons, Bluetooth and near field communication protocols. If you use our mobile application, your device may share location information when you enable location services. We may be able to recognize the location of a mobile device in stores through use of Bluetooth technology;
• Inferences drawn from CA Personal Information: such as consumer preferences, characteristics, predispositions, and behavior; and
• Sensitive Personal Information: such as information concerning your health, which may include certain health-related retail product purchases.

The categories of third parties to which we may sell or share (as defined by California law) the above-described categories of CA Personal Information include online Advertising Networks, Marketing Companies, Financial Services Partners and Social Media Companies.

Opting Out of the Sale and Sharing of CA Personal Information. You may stop our disclosure of your CA Personal Information to these entities for their use for secondary purposes by opting-out of the sale or sharing of your CA Personal Information. You can do so by submitting an opt-out request through this link here or by contacting us at 800-925-4733.

• Opt-out Preference Signal. As described on our Data Preferences page, under the "Sale and Sharing" tab, you may opt out of the sale and sharing of your CA Personal Information at a browser level. Browser level opt outs are based on your unique browser and device. In addition to manually opting out at a browser level through this link here, we also have processes in place to recognize opt-out preference signals you set on your browser or device and honor those signals when you visit our website as a request to opt out of the sale and sharing of your CA Personal Information. To enable an opt-out preference signal, you must use a platform or internet browser with technology to set and communicate your preferred privacy setting.
• Notice of Financial Incentive. We may provide price discounts, coupons, services and other perks for members of our loyalty programs such as myWalgreens. Through these offerings, consumers may provide us with any or all of the categories of CA Personal Information set out above in the "Collection" section depending on how they choose to interact with us when and after they opt-in to our programs. There is no obligation to opt-in and consumers may opt-out at any time. The details of each program are contained in the program offering. We offer these programs, among other things, to enhance our relationship with you so you can enjoy more of our products/services at a lower price. We invest heavily in our marketing and brands, in part, so we can provide programs to our customers. Consumer data is more valuable to our business when it is combined with a sufficient amount of other consumer data and after it is enhanced by our efforts described in this Privacy Policy. The value to our business of any individual consumer's data is dependent on a number of factors, including, for example, whether and to what extent you take advantage of any offerings, whether and to what extent you opt out of any offerings, and whether we are able to enhance the data through our efforts described in this Privacy Policy. We do not calculate the value of consumer data in our accounting statements. We make this good faith estimate for California residents. To the extent we create overall value from our programs to our business that could be directly or reasonably related to the value of customer data, the method for calculating the value would include: (1) costs related to maintaining the program including but not limited to IT infrastructure, delivery of offers, and skilled marketing teams with the appropriate knowledge to enhance customer data; (2) whether the sales generated by the program exceeds the cost to us of offering the program including value of discounts to customer; and (3) value of the insights we are able to create based upon aggregate data.
• Deidentified Patient Information. We may also disclose information that does not identify an individual and cannot reasonably be used to identify an individual which is derived from CA Personal Information, as well as deidentified protected health information that has been modified to remove individually identifiable information in accordance with HIPAA's expert determination (also known as "statistician's method") or safe harbor deidentification standards.

Limiting Use and Disclosure of Sensitive Personal Information. We may collect certain categories of CA Personal Information from you and third parties as described in the "Collection" section above that may be considered "Sensitive Personal Information" under California law. Our use of your Sensitive Personal Information is generally limited to performing services or providing goods you requested. You may limit our use and disclosure of your Sensitive Personal Information for purposes not subject to an exception pursuant to law by submitting a request to limit through this link here or by contacting us at 800-925-4733.

This "Information for California Consumers" section, including the "California Consumer Rights" sub-section below, also applies to CA Personal Information collected from individuals acting as an employee, owner, director, officer, or contractor of another company, partnership, sole proprietorship, nonprofit, or government entity, in the context of conducting business with us.

California Consumer Rights. As a California resident, you have the right to request and access, including in a portable, machine-readable format, any or all of following types of information regarding the CA Personal Information we have collected about you from January 1, 2022, to the date of receipt of your request:

• Specific pieces of CA Personal Information we have collected about you;
• Categories of CA Personal Information we have collected about you;
• Categories of sources from which such CA Personal Information was collected;
• Categories of CA Personal Information we sold or disclosed for a business purpose about you; and
• The business or commercial purpose for collecting or selling your CA Personal Information.

You also have the right to request correction or deletion of your CA Personal Information and to opt out of the sale or sharing and automated processing ("profiling") of your CA Personal Information. In addition, you have the right to limit the use and disclosure of your Sensitive Personal Information and appeal our refusal to act on your request.

Exercising California Consumer Rights. You or your authorized agent may submit a request to exercise your California Consumer Rights by using one of the following specifically designated methods:

• Self-service on our digital properties by logging on to your account and using the Customer Preference Center
• Click the following links and confirm your choices:
  To submit a sale/sharing opt out or request to limit, click here

  Exercise California Consumer Privacy Rights
• Contacting our Customer Care Center at 800-WALGREENS (800-925-4733)
• Responding to Requests. For requests for access, correction, deletion, or appeal, we will first acknowledge receipt of your request within 10 business days of receipt of your request. We provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know.
  
  For requests to opt out of the sale or sharing or to opt out of automated processing ("profiling") of your CA Personal Information or request to limit the use and disclosure of your Sensitive Personal Information, we will comply within 15 business days after receipt of your request.
  
  We usually act on requests and provide information free of charge, but we may charge a reasonable fee to cover our administrative costs of providing the information in certain situations. In some cases, the law may allow us to refuse to act on certain requests. When this is the case, we will endeavor to provide you with an explanation as to why.
• Requests By Authorized Agents. You may designate an agent to submit requests on your behalf. The agent must be a natural person or a business entity that is registered with the California Secretary of State.
  
  If you would like to designate an agent to act on your behalf, your agent must provide us your CA Personal Information as required on the request form and provide signed documentation demonstrating that you authorized the agent to submit a request on your behalf. For access and correction requests, the agent must also follow the verification process outlined below.
  
  Please note that this subsection does not apply when an agent is authorized to act on your behalf pursuant to a valid power of attorney. Any such requests will be processed in accordance with California law pertaining to powers of attorney.
• Requests for Household Information. There may be some types of CA Personal Information that can be associated with a household (a group of people living together in a single dwelling). Requests for access, correction, or deletion of household CA Personal Information must be made by each member of the household. We will verify each member of the household using the verification criteria explained below.
• Verification of Requests. Our verification process depends on the type of request you submit to exercise a California Consumer Right as described above.
  
  Access and Correction Requests
  
  For Access and Correction requests, you will enter a two-part verification process. You must verify your identity by correctly answering demographic questions powered through LexisNexis® and confirm control over the email address you provide in the request form. If you successfully complete the LexisNexis® demographic questions and email confirmation, you will proceed to part two of the process in which we will attempt to match the data provided in the request form to the data we maintain. If you are matched to a reasonably high degree of certainty, your request will be processed as follows:
  
  
  • Access request: Your access report will include the specific pieces of CA Personal Information not otherwise subject to an exception pursuant to law that we match to you. If requested, your access report will also be provided in a portable, machine-readable format.
  • Correction request: If we determine the contested data to be inaccurate based on the totality of the circumstances, unless otherwise subject to an exception pursuant to law, your data will be corrected.
  If you fail the LexisNexis® demographic questions but successfully complete email confirmation, you proceed to part two of the process in which we will attempt to match the data provided in the request form to the data we maintain. If you are matched to a reasonable degree of certainty, your request will be processed as follows:
  
  
  • Access request: Your access report will include the categories of CA Personal Information we match to you unless otherwise subject to an exception pursuant to law.
  • Correction request: Your correction request cannot be processed if you fail the LexisNexis® demographic questions.
  If you fail both LexisNexis® and email confirmation, your Access or Correction request will be cancelled, and you will be notified.
  
  Deletion and Appeal Requests
  
  For Deletion and Appeal requests, you must confirm control over the email address you provide in the request form. If you successfully complete email confirmation, we will attempt to match the data provided in the request form to the data we maintain. If you are matched to a reasonably high degree of certainty, your request will be processed as follows:
  
  
  • Deletion request: All data matched to you and not otherwise subject to an exception pursuant to law will be deleted.
  • Appeal request: Your appeal request will be reviewed, and you will receive a communication with the outcome of the appeal, including any additional rights you may have.
  If you are matched to a reasonable degree of certainty, your request will be processed as follows:
  
  
  • Deletion request: Certain limited data we associate to you will be deleted.
  • Appeal request: We will review your appeal request and, after considering the totality of the circumstances, will respond accordingly.
  If you fail email confirmation, your Deletion or Appeal request will be cancelled, and you will be notified.
  
  Opt-Out Requests and Requests to Limit
  
  Requests to opt-out of profiling or sale and sharing of your CA Personal Information and requests to limit the use and disclosure of your Sensitive Personal Information do not require LexisNexis® verification.

Nondiscrimination. Should you wish to request the exercise of your rights as detailed above with regard to your CA Personal Information, we will not discriminate against you. To the extent you provide CA Personal Information in connection with programs such as myWalgreens, additional information about the terms applicable to those programs, including our use of CA Personal Information in exchange for the applicable financial incentives, can be found in the terms and conditions for those programs and in the Notice of Financial Incentive section above.

No Sale of Minors' Personal Information. Additionally, California law requires California residents under the age of 16 to opt-in to the sale or sharing of CA Personal Information. We have protections in place to prevent the sale and sharing of, and do not intend to and have no actual knowledge that we "sell" or "share" the CA Personal Information of California residents under the age of 16. As a result, certain programs and services may be unavailable to California residents under the age of 16.

Metrics. California law requires recording of metrics regarding requests for Access, Correction, Deletion, Opting-out of Sale/Sharing, and Limiting the use of Sensitive Personal Information submitted by California residents pursuant to the California Privacy Rights Act. The metrics below reflect the time period from January 1, 2022, to December 31, 2022, which does not include requests for Correction and Limiting the use of Sensitive Personal Information.

• Access Requests
• Request Received: 29
• Completed: 11
• Expired/Rejected: 18
• Median Days to Fulfill: 45
• Deletion Requests
• Requests Received: 117
• Completed: 80
• Expired/Rejected: 37
• Median Days to Fulfill: 20
• Opt-out Requests
• Requests Received: 29,615
• Completed: 28,665
• Expired/Rejected: 950
• Median Days to Fulfill: 0

• Processing. Consistent with the "Information We Collect" section above, we process certain categories and specific pieces of VA Personal Data about individuals who reside in Virginia. In the 12 months prior to the date of this Privacy Policy, we collected the following types of categories of VA Personal Data, which we will continue to collect:
• Identifiers: such as name, address, telephone number, email address, age, date of birth, username and password for our websites, online identifiers, IP address;
• Commercial information: such as products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies, payment information, health and medical information, health insurance information, loyalty program participation information;
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information;
• Geolocation information: including location data and precise location data such as physical location information through the use of our services on your mobile phone or device by, for example using satellite, cell phone tower, WiFi signal, beacons, Bluetooth and near field communication protocols, when you are in or near a Walgreens store;
• Audio, visual, or similar information: such as photographs you share, store security video, customer service audio recordings;
• Inferences drawn from the above categories of VA Personal Data: such as consumer preferences, characteristics, predispositions, and behavior; and
• Sensitive Data: such as precise geolocation (within a radius of 1,750 feet).
• Deidentified Information. We may also maintain and use information that does not identify an individual and cannot reasonably be used to identify an individual which is derived from VA Personal Data. We will not attempt to reidentify deidentified VA Personal Data unless permitted by law.
• Purposes. We collect VA Personal Data for the business and commercial purposes described in the "How We Use Your Information" section above. Specifically, we collect VA Personal Data to respond to your inquiries, fulfill your requests and improve your experience; for marketing, advertising and promotional purposes; for reporting and analytics; to improve the effectiveness of our services, conduct research and analysis, or for other internal operations purposes; to detect, prevent or investigate potential security breaches, fraudulent transactions and monitor against theft.

Sale and Targeted Advertising. As described above in the "How We Share Your Information" section, we may share the following categories of VA Personal Data with third parties who are considered "third parties" as defined under Virginia law. In the 12 months prior to the date of this Privacy Policy, we shared your VA Personal Data with third parties for purposes of "targeted advertising," which may constitute a "sale" of VA Personal Data under Virginia law, and may continue to share the following categories of VA Personal Data for "targeted advertising":

• Identifiers: such as online identifiers, IP address;
• Commercial information: such as products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies;
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information; and
• Inferences drawn from VA Personal Data: such as consumer preferences, characteristics, predispositions, and behavior.

The categories of third parties to which we may share the above-described categories of VA Personal Data include online Advertising Networks, Marketing Companies, Financial Services Partners and Social Media Companies.

Opting Out of Sale and Targeted Advertising. You may stop our disclosure of your VA Personal Data to these entities for purposes of targeted advertising by opting-out of the sale of your VA Personal Data. You can do so by submitting an opt-out request through this link here or by contacting us at 800-925-4733.

Virginia Consumer Rights. As a Virginia resident, you have the right to ask us for and access, including in a portable, readily usable format, any or all of following types of information regarding the VA Personal Data we have collected about you:

• Specific pieces of VA Personal Data we have collected about you;
• Categories of VA Personal Data we have collected about you;
• Categories of sources from which such VA Personal Data was collected;
• Categories of VA Personal Data we sold or disclosed for a business purpose about you; and
• The business or commercial purpose for collecting or selling your VA Personal Data.

You also have the right to request correction or deletion of your VA Personal Data and to opt out of the use of your VA Personal Data for purposes of targeted advertising, sale, and automated processing ("profiling"). In addition, you have the right to appeal our refusal to act on your request.

• Exercising Virginia Consumer Rights. You or your authorized agent may submit a request to exercise your Virginia Consumer Rights by using one of the following specifically designated methods:
• Self-service on our digital properties by logging on to your account and using the Customer Preference Center
• Click the following links and confirm your choices:
  To submit a sale or targeted advertising opt out, click here

  Exercise Virginia Consumer Privacy Rights
• Contacting our Customer Care Center at 800-WALGREENS (800-925-4733)
• Responding to Requests. For requests for access, correction, deletion, or appeal, we will first acknowledge receipt of your request within 10 business days of receipt of your request. We provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know.
  
  For requests to opt out of the use of your VA Personal Data for purposes of targeted advertising, sale, and automated processing ("profiling"), we will comply within 15 business days after receipt of your request.
  
  We usually act on requests and provide information free of charge, but we may charge a reasonable fee to cover our administrative costs of providing the information in certain situations. In some cases, the law may allow us to refuse to act on certain requests. When this is the case, we will endeavor to provide you with an explanation as to why.

• myWalgreens Loyalty Program. If you enroll and participate in the myWalgreens Loyalty Program, the following information about how we collect, use and disclose your CO Personal Data applies.
• The categories of CO Personal Data collected from participants of the myWalgreens Loyalty Program include those listed under the “CO Processing” section below and the categories of CO Personal Data sold or processed for targeted advertising include those listed below under the “CO Sale and Targeted Advertising” section.
• The categories of third parties that may receive the categories of CO Personal Data listed below under “CO Sale and Targeted Advertising” include Online Advertising Networks, Marketing Companies, Financial Services Partners and Social Media Companies.
• We partner with Synchrony Bank to offer the myWalgreens credit card to myWalgreens loyalty members. As a loyalty member, you can apply for the myWalgreens credit card online or in our stores.
• If you request deletion of your CO Personal Data and are a myWalgreens loyalty member, your loyalty profile may be deleted. We use your loyalty profile to provide myWalgreens loyalty program benefits to you as a loyalty member. Without a loyalty profile, you would lose myWalgreens Cash rewards and other benefits such as sales prices in-store and online, personalized offers, and paperless coupons.
• CO Processing. Consistent with the "Information We Collect" section above, we process certain categories and specific pieces of CO Personal Data about individuals who reside in Colorado. In the 12 months prior to the date of this Privacy Policy, we collected the following types of categories of CO Personal Data, which we will continue to collect:
• Identifiers: such as name, address, telephone number, email address, age, date of birth, username and password for our websites, online identifiers, IP address;
• Commercial information: such as products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies, payment information, health and medical information, health insurance information, loyalty program participation information;
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information;
• Geolocation information: including location data and precise location data such as physical location information through the use of our services on your mobile phone or device by, for example using satellite, cell phone tower, WiFi signal, beacons, Bluetooth and near field communication protocols, when you are in or near a Walgreens store;
• Audio, visual, or similar information: such as photographs you share, store security video, customer service audio recordings; and
• Inferences drawn from the above categories of CO Personal Data: such as consumer preferences, characteristics, predispositions, and behavior.
• Deidentified Information. We may also maintain and use information that does not identify an individual and cannot reasonably be used to identify an individual which is derived from CO Personal Data. We will not attempt to reidentify deidentified CO Personal Data unless permitted by law.
• Purposes. We collect CO Personal Data for the business and commercial purposes described in the "How We Use Your Information" section above. Specifically, we collect CO Personal Data to respond to your inquiries, fulfill your requests and improve your experience; for marketing, advertising and promotional purposes; for reporting and analytics; to improve the effectiveness of our services, conduct research and analysis, or for other internal operations purposes; to detect, prevent or investigate potential security breaches, fraudulent transactions and monitor against theft.

Profiling Activities. Consistent with the "myWalgreens Loyalty Program" section above, we process certain categories of CO Personal Data from myWalgreens loyalty members in a manner that may be considered “profiling” under Colorado law, such as prescreened credit card offers. For myWalgreens loyalty members that have identifiers such as name and address populated in their loyalty account, our business partner, Synchrony Bank, may process those identifiers to complete a prequalification check for the myWalgreens credit card. This processing occurs at the point of sale, either in-store or online, and involves a soft credit check by Synchrony Bank to determine loyalty members’ eligibility for a credit card preapproval offer. If deemed eligible, you may receive a myWalgreens credit card preapproval offer at the point of sale. Those that are deemed ineligible may not receive a myWalgreens credit card preapproval offer at the point of sale but may still apply for a myWalgreens credit card online or in-person at any Walgreens or Duane Reade store. You may stop our processing of your CO Personal Data for these purposes by opting-out of profiling. You can do so by submitting an opt-out request through this link here or by contacting us at 800-925-4733.

CO Sale and Targeted Advertising. As described above in the "How We Share Your Information" section, we may share the following categories of CO Personal Data with third parties who are considered "third parties" as defined under Colorado law. In the 12 months prior to the date of this Privacy Policy, we shared your CO Personal Data with third parties for purposes of “targeted advertising,” which may constitute a "sale" of CO Personal Data under Colorado law, and may continue to share the following categories of CO Personal Data for “targeted advertising”:

• Identifiers: such as online identifiers, IP address;
• Commercial information: such as products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies;
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information; and
• Inferences drawn from CO Personal Data: such as consumer preferences, characteristics, predispositions, and behavior.

The categories of third parties to which we may share the above-described categories of CO Personal Data include Online Advertising Networks, Marketing Companies, Financial Services Partners and Social Media Companies.

Opting Out of Sale and Targeted Advertising. You may stop our disclosure of your CO Personal Data to these entities for purposes of targeted advertising by opting-out of the sale of your CO Personal Data. You can do so by submitting an opt-out request through this link here or by contacting us at 800-925-4733.

• Opt-out Preference Signal. As described on our Data Preferences page, under the “Sale and Sharing” tab, you may opt out of the sale of your CO Personal Data at a browser level. Browser level opt outs are based on your unique browser and device. In addition to manually opting out at a browser level through this link here, we also have processes in place to recognize opt-out preference signals you set on your browser or device and honor those signals when you visit our website as a request to opt out of the sale of your CO Personal Data. To enable an opt-out preference signal, you must use a platform or internet browser with technology to set and communicate your preferred privacy setting.

Colorado Consumer Rights. As a Colorado resident, you have the right to ask us for and access, including in a portable, readily usable format, any or all of following types of information regarding the CO Personal Data we have collected about you:

• Specific pieces of CO Personal Data we have collected about you;
• Categories of CO Personal Data we have collected about you;
• Categories of sources from which such CO Personal Data was collected;
• Categories of CO Personal Data we sold or disclosed for a business purpose about you; and
• The business or commercial purpose for collecting or selling your CO Personal Data.

You also have the right to request correction or deletion of your CO Personal Data and to opt out of the use of your CO Personal Data for purposes of targeted advertising, sale, and automated processing (“profiling”). In addition, you have the right to appeal our refusal to act on your request.

• Exercising Colorado Consumer Rights. You or your authorized agent may submit a request to exercise your Colorado Consumer Rights by using one of the following specifically designated methods:
• Self-service on our digital properties by logging on to your account and using the Customer Preference Center
• Click the following links and confirm your choices:
  To submit a sale or targeted advertising opt out, click here

  Exercise Colorado Consumer Privacy Rights
• Contacting our Customer Care Center at 800-WALGREENS (800-925-4733)
• Responding to Requests. For requests for access, correction, deletion, or appeal, we will first acknowledge receipt of your request within 10 business days of receipt of your request. We provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know.
  
  For requests to opt out of the use of your CO Personal Data for purposes of targeted advertising, sale, and automated processing (“profiling”), we will comply within 15 business days after receipt of your request.
  
  We usually act on requests and provide information free of charge, but we may charge a reasonable fee to cover our administrative costs of providing the information in certain situations. In some cases, the law may allow us to refuse to act on certain requests. When this is the case, we will endeavor to provide you with an explanation as to why.


• Requests By Authorized Agents. You may designate an agent to submit requests on your behalf. The agent must be a natural person or a business entity that is registered with the Colorado Secretary of State.
  
  If you would like to designate an agent to act on your behalf, your agent must provide us your CO Personal Data as required on the request form and provide signed documentation demonstrating that you authorized the agent to submit a request on your behalf. For access and correction requests, the agent must also follow the verification process outlined below.
  
  Please note that this subsection does not apply when an agent is authorized to act on your behalf pursuant to a valid power of attorney. Any such requests will be processed in accordance with Colorado law pertaining to powers of attorney.


• Verification of Requests. Our verification process depends on the type of request you submit to exercise a Colorado Consumer Right as described above.
  
  Access and Correction Requests
  
  For Access and Correction requests, you will enter a two-part verification process. You must verify your identity by correctly answering demographic questions powered through LexisNexis® and confirm control over the email address you provide in the request form. If you successfully complete the LexisNexis® demographic questions and email confirmation, you will proceed to part two of the process in which we will attempt to match the data provided in the request form to the data we maintain. If you are matched to a reasonably high degree of certainty, your request will be processed as follows:
  
  
  • Access request: Your access report will include the specific pieces of CO Personal Data not otherwise subject to an exception pursuant to law that we match to you. If requested, your access report will also be provided in a portable, machine-readable format.
  • Correction request: If we determine the contested data to be inaccurate based on the totality of the circumstances, unless otherwise subject to an exception pursuant to law, your data will be corrected.
  If you fail the LexisNexis® demographic questions but successfully complete email confirmation, you proceed to part two of the process in which we will attempt to match the data provided in the request form to the data we maintain. If you are matched to a reasonable degree of certainty, your request will be processed as follows:
  
  
  • Access request: Your access report will include the categories of CO Personal Data we match to you unless otherwise subject to an exception pursuant to law.
  • Correction request: Your correction request cannot be processed if you fail the LexisNexis® demographic questions.
  If you fail both LexisNexis® and email confirmation, your Access or Correction request will be cancelled, and you will be notified.
  
  Deletion and Appeal Requests
  
  For Deletion and Appeal requests, you must confirm control over the email address you provide in the request form. If you successfully complete email confirmation, we will attempt to match the data provided in the request form to the data we maintain. If you are matched to a reasonably high degree of certainty, your request will be processed as follows:
  
  
  • Deletion request: All data matched to you and not otherwise subject to an exception pursuant to law will be deleted.
  • Appeal request: Your appeal request will be reviewed, and you will receive a communication with the outcome of the appeal, including any additional rights you may have.
  If you are matched to a reasonable degree of certainty, your request will be processed as follows:
  
  
  • Deletion request: Certain limited data we associate to you will be deleted.
  • Appeal request: We will review your appeal request and, after considering the totality of the circumstances, will respond accordingly.
  If you fail email confirmation, your Deletion or Appeal request will be cancelled, and you will be notified.
  
  Opt-Out Requests
  
  Requests to opt-out of targeted advertising, sale, or profiling of your CO Personal Data do not require LexisNexis® verification.

• Processing. Consistent with the "Information We Collect" section above, we process certain categories and specific pieces of CT Personal Data about individuals who reside in Connecticut. In the 12 months prior to the date of this Privacy Policy, we collected the following types of categories of CT Personal Data, which we will continue to collect:
• Identifiers: such as name, address, telephone number, email address, age, date of birth, username and password for our websites, online identifiers, IP address;
• Commercial information: such as products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies, payment information, health and medical information, health insurance information, loyalty program participation information;
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information;
• Geolocation information: including location data and precise location data such as physical location information through the use of our services on your mobile phone or device by, for example using satellite, cell phone tower, WiFi signal, beacons, Bluetooth and near field communication protocols, when you are in or near a Walgreens store;
• Audio, visual, or similar information: such as photographs you share, store security video, customer service audio recordings;
• Inferences drawn from the above categories of CT Personal Data: such as consumer preferences, characteristics, predispositions, and behavior; and
• Sensitive Data: such as precise geolocation (within a radius of 1,750 feet).
• Deidentified Information. We may also maintain and use information that does not identify an individual and cannot reasonably be used to identify an individual which is derived from CT Personal Data. We will not attempt to reidentify deidentified CT Personal Data unless permitted by law.
• Purposes. We collect CT Personal Data for the business and commercial purposes described in the "How We Use Your Information" section above. Specifically, we collect CT Personal Data to respond to your inquiries, fulfill your requests and improve your experience; for marketing, advertising and promotional purposes; for reporting and analytics; to improve the effectiveness of our services, conduct research and analysis, or for other internal operations purposes; to detect, prevent or investigate potential security breaches, fraudulent transactions and monitor against theft.

Sale and Targeted Advertising. As described above in the "How We Share Your Information" section, we may share the following categories of CT Personal Data with third parties who are considered "third parties" as defined under Connecticut law. In the 12 months prior to the date of this Privacy Policy, we shared your CT Personal Data with third parties for purposes of “targeted advertising,” which may constitute a "sale" of CT Personal Data under Connecticut law, and may continue to share the following categories of CT Personal Data for “targeted advertising”:

• Identifiers: such as online identifiers, IP address;
• Commercial information: such as products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies;
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information; and
• Inferences drawn from CT Personal Data: such as consumer preferences, characteristics, predispositions, and behavior.

The categories of third parties to which we may share the above-described categories of CT Personal Data include online Advertising Networks, Marketing Companies, Financial Services Partners and Social Media Companies.

Opting Out of Sale and Targeted Advertising. You may stop our disclosure of your CT Personal Data to these entities for purposes of targeted advertising by opting-out of the sale of your CT Personal Data. You can do so by submitting an opt-out request through this link here or by contacting us at 800-925-4733.

Connecticut Consumer Rights. As a Connecticut resident, you have the right to ask us for and access, including in a portable, readily usable format, any or all of following types of information regarding the CT Personal Data we have collected about you:

• Specific pieces of CT Personal Data we have collected about you;
• Categories of CT Personal Data we have collected about you;
• Categories of sources from which such CT Personal Data was collected;
• Categories of CT Personal Data we sold or disclosed for a business purpose about you; and
• The business or commercial purpose for collecting or selling your CT Personal Data.

You also have the right to request correction or deletion of your CT Personal Data and to opt out of the use of your CT Personal Data for purposes of targeted advertising, sale, and automated processing (“profiling”). In addition, you have the right to appeal our refusal to act on your request.

• Exercising Connecticut Consumer Rights. You or your authorized agent may submit a request to exercise your Connecticut Consumer Rights by using one of the following specifically designated methods:
• Self-service on our digital properties by logging on to your account and using the Customer Preference Center
• Click the following links and confirm your choices:
  To submit a sale or targeted advertising opt out, click here

  Exercise Connecticut Consumer Privacy Rights
• Contacting our Customer Care Center at 800-WALGREENS (800-925-4733)
• Responding to Requests. For requests for access, correction, deletion, or appeal, we will first acknowledge receipt of your request within 10 business days of receipt of your request. We provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know.
  
  For requests to opt out of the use of your CT Personal Data for purposes of targeted advertising, sale, and automated processing (“profiling”), we will comply within 15 business days after receipt of your request.
  
  We usually act on requests and provide information free of charge, but we may charge a reasonable fee to cover our administrative costs of providing the information in certain situations. In some cases, the law may allow us to refuse to act on certain requests. When this is the case, we will endeavor to provide you with an explanation as to why.

• Processing. Consistent with the "Information We Collect" section above, we process certain categories and specific pieces of UT Personal Data about individuals who reside in Utah. In the 12 months prior to the date of this Privacy Policy, we collected the following types of categories of UT Personal Data, which we will continue to collect:
• Identifiers: such as name, address, telephone number, email address, age, date of birth, username and password for our websites, online identifiers, IP address;
• Commercial information: such as products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies, payment information, health and medical information, health insurance information, loyalty program participation information;
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information;
• Geolocation information: including location data and precise location data such as physical location information through the use of our services on your mobile phone or device by, for example using satellite, cell phone tower, WiFi signal, beacons, Bluetooth and near field communication protocols, when you are in or near a Walgreens store;
• Audio, visual, or similar information: such as photographs you share, store security video, customer service audio recordings;
• Inferences drawn from the above categories of UT Personal Data: such as consumer preferences, characteristics, predispositions, and behavior; and
• Sensitive Data: such as specific geolocation (within a radius of 1,750 feet).
• Deidentified Information. We may also maintain and use information that does not identify an individual and cannot reasonably be used to identify an individual which is derived from UT Personal Data. We will not attempt to reidentify deidentified UT Personal Data unless permitted by law.
• Purposes. We collect UT Personal Data for the business and commercial purposes described in the "How We Use Your Information" section above. Specifically, we collect UT Personal Data to respond to your inquiries, fulfill your requests and improve your experience; for marketing, advertising and promotional purposes; for reporting and analytics; to improve the effectiveness of our services, conduct research and analysis, or for other internal operations purposes; to detect, prevent or investigate potential security breaches, fraudulent transactions and monitor against theft.

Sale and Targeted Advertising. As described above in the "How We Share Your Information" section, we may share the following categories of UT Personal Data with third parties who are considered "third parties" as defined under Utah law. In the 12 months prior to the date of this Privacy Policy, we shared your UT Personal Data with third parties for purposes of “targeted advertising,” which may constitute a "sale" of UT Personal Data under Utah law, and may continue to share the following categories of UT Personal Data for “targeted advertising”:

• Identifiers: such as online identifiers, IP address;
• Commercial information: such as products or services purchased, obtained or considered, other purchasing or consuming histories or tendencies;
• Internet or other electronic network activity information: such as computer and connection information, statistics on page views, traffic to and from the websites, ad data and other standard weblog information; and
• Inferences drawn from UT Personal Data: such as consumer preferences, characteristics, predispositions, and behavior.

The categories of third parties to which we may share the above-described categories of UT Personal Data include online Advertising Networks, Marketing Companies, Financial Services Partners and Social Media Companies.

Opting Out of Sale and Targeted Advertising. You may stop our disclosure of your UT Personal Data to these entities for purposes of targeted advertising by opting-out of the sale of your UT Personal Data. You can do so by submitting an opt-out request through this link here or by contacting us at 800-925-4733.

Utah Consumer Rights. As a Utah resident, you have the right to ask us for and access, including in a portable, readily usable format, any or all of following types of information regarding the UT Personal Data we have collected about you:

• Specific pieces of UT Personal Data we have collected about you;
• Categories of UT Personal Data we have collected about you;
• Categories of sources from which such UT Personal Data was collected;
• Categories of UT Personal Data we sold or disclosed for a business purpose about you; and
• The business or commercial purpose for collecting or selling your UT Personal Data.

You also have the right to request deletion of your UT Personal Data and to opt out of the use of your UT Personal Data for purposes of targeted advertising and sale. In addition, you have the right to opt-out of the processing of your Sensitive Data.

• Exercising Utah Consumer Rights. You or your authorized agent may submit a request to exercise your Utah Consumer Rights by using one of the following specifically designated methods:
• Self-service on our digital properties by logging on to your account and using the Customer Preference Center
• Click the following links and confirm your choices:
  To submit a sale or targeted advertising opt out, click here

  Exercise Utah Consumer Privacy Rights
• Contacting our Customer Care Center at 800-WALGREENS (800-925-4733)
• Responding to Requests. For requests for access or deletion, we will first acknowledge receipt of your request within 10 business days of receipt of your request. We provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may be allowed to take longer to process your request under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know.
  
  For requests to opt out of the use of your UT Personal Data for purposes of targeted advertising and sale or for requests to opt-out of the processing of your Sensitive Data, we will comply within 15 business days after receipt of your request.
  
  We usually act on requests and provide information free of charge, but we may charge a reasonable fee to cover our administrative costs of providing the information in certain situations. In some cases, the law may allow us to refuse to act on certain requests. When this is the case, we will endeavor to provide you with an explanation as to why.

If you have questions about our Privacy Policy, or to exercise your rights as detailed above, except for California, Colorado, Connecticut, Virginia, and Utah Consumer Rights which you may exercise by using the designated methods identified in the "Information for California Consumers, California Consumer Rights", "Information for Colorado Consumers, Colorado Consumer Rights", "Information for Connecticut Consumers, Connecticut Consumer Rights,", "Information for Virginia Consumers, Virginia Consumer Rights", and "Information for Utah Consumers, Utah Consumer Rights" sections above, contact us by:

To request this Privacy Policy in an alternative accessible format, call our Customer Care Center at 800-WALGREENS (800-925-4733).