PRIVACY POLICY

Effective Date: October 2, 2026

Asheville Mountain Pharmacy, Inc. (“Asheville Mountain Pharmacy,” “we,” “us,” or “our”) respects your privacy and is committed to protecting the personal information entrusted to us.

This Privacy Policy explains how we collect, use, disclose, and protect information when you access or use the Asheville Mountain Pharmacy website and related online services, including online forms, online shopping, prescription and refill request tools, appointment scheduling, patient communications, and other digital features (collectively, the “Digital Services”).

Our website and certain Digital Services are developed, hosted, maintained, operated, or supported using technology provided by Rx Growth Hub and other service providers.

This Privacy Policy applies to information collected through our Digital Services.

When information is Protected Health Information (“PHI”) under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), our use and disclosure of that information is additionally governed by HIPAA and our Notice of Privacy Practices.

1. INFORMATION WE COLLECT

The information we collect depends on how you interact with Asheville Mountain Pharmacy and the Digital Services.

We may collect the following categories of information.

A. Contact and Identification Information

This may include:

First and last name.

Mailing address.

Email address.

Telephone number.

Date of birth.

Account identifiers.

Other information used to identify or contact you.

B. Pharmacy and Health Information

When you use pharmacy or healthcare-related Digital Services, we may collect information such as:

Prescription information.

Medication information.

Prescription numbers.

Refill requests.

Prescription transfer requests.

Allergies.

Medical conditions.

Health history.

Healthcare provider information.

Pharmacy information.

Patient intake information.

Health-related questions or communications.

Insurance information.

Other information relevant to providing pharmacy services.

Certain health information may constitute PHI under HIPAA.

When HIPAA applies, our Notice of Privacy Practices provides additional information about how PHI may be used and disclosed and about your rights regarding that information.

C. Insurance and Payment Information

We may collect information such as:

Insurance plan information.

Prescription benefit information.

Member or policy information.

Payment status.

Billing information.

Transaction information.

Payment card information may be collected and processed directly by third-party payment processors.

We may receive transaction information without receiving or retaining your complete payment card number.

D. Purchase and Transaction Information

When you purchase products or services, we may collect:

Products purchased.

Services requested.

Transaction amount.

Order history.

Shipping information.

Delivery information.

Pickup information.

Refund or return information.

Transaction status.

E. Appointment and Service Information

If you schedule an appointment or request a pharmacy service, we may collect:

Appointment date and time.

Service requested.

Scheduling preferences.

Contact information.

Information needed to provide the requested service.

F. Communications

We may collect information contained in communications you send or receive through our Digital Services, including:

Website forms.

Email.

Text/SMS messages.

Online chat.

Customer support communications.

Appointment communications.

Prescription communications.

Survey responses.

Other messages.

G. Account Information

If you create an account, we may collect:

Username.

Password or authentication information.

Profile information.

Account preferences.

Communication preferences.

Login and account activity.

Passwords and sensitive authentication information may be stored using security measures designed to protect them.

H. Device and Technical Information

When you use the Digital Services, certain information may be collected automatically, including:

Internet Protocol (“IP”) address.

Browser type.

Device type.

Operating system.

Referring website.

Pages visited.

Date and time of access.

Session information.

Clickstream information.

General location inferred from an IP address.

Website interactions.

Device identifiers where applicable.

2. COOKIES AND SIMILAR TECHNOLOGIES

Our Digital Services may use:

• Cookies.

• Session cookies.

• Local browser storage.

• Pixels.

• Tags.

• Analytics technologies.

• Similar technologies.

These technologies may be used to:

• Operate the website.

• Maintain user sessions.

• Remember preferences.

• Improve website performance.

• Understand how visitors interact with the website.

• Diagnose technical problems.

• Prevent fraud.

• Maintain security.

• Measure the effectiveness of website content or marketing where permitted by law.

You may be able to block or delete cookies through your browser settings.

Disabling cookies may cause some Digital Services to operate improperly.

3. HOW WE USE INFORMATION

We may use information collected through the Digital Services to:

• Provide pharmacy services.

• Process prescription refill requests.

• Facilitate prescription transfer requests.

• Process transactions.

• Fulfill product orders.

• Schedule appointments.

• Communicate about prescriptions or services.

• Respond to customer service requests.

• Verify your identity.

• Create and maintain accounts.

• Process insurance information.

• Provide order, shipping, delivery, or pickup information.

• Send requested reminders.

• Maintain and operate the Digital Services.

• Improve website functionality.

• Troubleshoot technical problems.

• Protect against fraud.

• Detect unauthorized access.

• Maintain system security.

• Comply with legal obligations.

• Maintain pharmacy and business records.

• Enforce our Terms of Use.

• Analyze website performance.

• Improve products, services, and customer experiences.

• Send marketing communications where permitted by law and consistent with your choices.

When we use PHI, we do so in accordance with HIPAA and our Notice of Privacy Practices.

4. RX GROWTH HUB

Asheville Mountain Pharmacy uses Rx Growth Hub as a website and technology services provider.

Rx Growth Hub may provide technology used for functions such as:

• Website operation.

• Online forms.

• Customer communications.

• Workflow automation.

• Scheduling.

• Website maintenance.

• Technical support.

• Digital customer experiences.

Rx Growth Hub may process information on behalf of Asheville Mountain Pharmacy as necessary to provide these services.

When Rx Growth Hub receives or maintains PHI on our behalf in a capacity subject to HIPAA, it will be treated as a Business Associate where applicable and will be required to protect the PHI in accordance with applicable law and contractual requirements.

Rx Growth Hub is not the dispensing pharmacy and does not independently determine how Asheville Mountain Pharmacy provides professional pharmacy services.

5. HOW WE MAY DISCLOSE INFORMATION

We may disclose personal information in the circumstances described below.

A. Service Providers

We may provide information to companies that perform services on our behalf, such as:

• Website technology providers.

• Hosting companies.

• Cloud service providers.

• Payment processors.

• Communication providers.

• SMS providers.

• Email providers.

• Scheduling providers.

• Shipping or delivery services.

• Information technology providers.

• Cybersecurity providers.

• Analytics providers.

• Customer support providers.

These providers receive information only as reasonably necessary to provide services to us and are subject to appropriate legal or contractual restrictions.

Where required by HIPAA, service providers that handle PHI are subject to applicable Business Associate requirements.

B. Healthcare Providers and Other Pharmacies

When necessary for treatment, prescription transfers, care coordination, or other legally permitted healthcare purposes, we may disclose appropriate information to:

• Physicians.

• Prescribers.

• Other pharmacies.

• Healthcare providers.

• Hospitals.

• Health plans.

• Other individuals or organizations involved in your healthcare.

Uses and disclosures involving PHI are further described in our Notice of Privacy Practices.

C. Insurance Companies and Health Plans

We may disclose information to insurance companies, health plans, pharmacy benefit managers, government programs, or other payers as necessary to:

• Verify coverage.

• Process claims.

• Obtain reimbursement.

• Coordinate benefits.

• Resolve claim issues.

D. At Your Direction

We may disclose information to a third party when you request or authorize us to do so.

E. Business Transactions

If Asheville Mountain Pharmacy is involved in a merger, acquisition, restructuring, financing, sale, or transfer of all or part of its business or assets, information may be transferred as part of that transaction as permitted by law.

F. Legal and Regulatory Requirements

We may disclose information when reasonably necessary or legally required to:

• Comply with applicable laws.

• Respond to lawful court orders.

• Respond to valid subpoenas or legal process.

• Cooperate with regulatory authorities.

• Prevent fraud.

• Protect our rights or property.

• Protect the safety of patients, employees, or others.

• Investigate suspected illegal activity.

Additional restrictions apply to PHI.

6. PROTECTED HEALTH INFORMATION

Personal information and PHI are not always regulated in the same way.

When information qualifies as PHI under HIPAA, our use and disclosure of that information is governed by HIPAA and our Notice of Privacy Practices.

If there is a conflict between this Privacy Policy and the Notice of Privacy Practices regarding PHI, the Notice of Privacy Practices and applicable law will govern.

7. WE DO NOT SELL PROTECTED HEALTH INFORMATION

We do not sell PHI in violation of HIPAA.

When HIPAA requires your written authorization for a particular use or disclosure of PHI, we will obtain the required authorization before making that use or disclosure.

8. SMS AND MOBILE INFORMATION

If you provide a mobile telephone number and consent to receive text messages, we may use that number to provide communications related to pharmacy services, appointments, orders, reminders, customer service, or marketing where permitted.

Mobile information, including telephone numbers and SMS consent or opt-in information, will not be sold or shared with third parties for their independent marketing or promotional purposes.

We may provide mobile information to vendors that assist us with delivering or managing our text messaging services.

Those providers may use the information only as necessary to provide the services requested on our behalf, subject to applicable requirements.

Message frequency may vary.

Message and data rates may apply.

You may opt out of marketing SMS communications by replying STOP where applicable.

You may request assistance by replying HELP where supported.

Opting out of promotional text messages may not prevent legally permitted transactional, prescription-related, healthcare-related, security, or service communications.

9. EMAIL COMMUNICATIONS

You may receive email regarding:

• Orders.

• Prescription or refill requests.

• Appointments.

• Pharmacy services.

• Account activity.

• Administrative matters.

• Customer support.

• Marketing where permitted.

Marketing emails will provide an unsubscribe method where required.

Unsubscribing from marketing does not stop necessary transactional or service-related communications.

10. ANALYTICS

We may use analytics services to better understand how visitors use our public website.

Analytics information may include:

• Pages viewed.

• Length of visits.

• Referral sources.

• Browser information.

• Device information.

• General website interaction.

We use this information to understand website performance and improve our Digital Services.

We do not authorize analytics or advertising vendors to use PHI for their own advertising purposes in violation of HIPAA.

11. THIRD-PARTY WEBSITES

Our Digital Services may contain links to websites or services operated by third parties.

Third-party websites have their own privacy policies and practices.

This Privacy Policy does not govern personal information you independently provide directly to an unrelated third-party website.

We encourage you to review the privacy practices of third-party services before providing information.

12. DATA SECURITY

We use administrative, technical, and physical safeguards designed to protect information appropriate to its sensitivity and our legal obligations.

Security measures may include:

• Encryption during transmission.

• Access controls.

• Authentication mechanisms.

• Workforce access restrictions.

• Security monitoring.

• Secure hosting infrastructure.

• Vendor controls.

• Policies and procedures relating to sensitive information.

No method of Internet transmission or electronic storage is completely secure.

Although we take reasonable measures to protect information, we cannot guarantee absolute security.

13. DATA BREACHES

When required by applicable law, Asheville Mountain Pharmacy will provide notifications regarding qualifying breaches of personal information or unsecured PHI.

Our HIPAA Notice of Privacy Practices describes our responsibilities regarding PHI.

14. RETENTION OF INFORMATION

We retain information for as long as reasonably necessary to:

Provide pharmacy services.

Maintain patient and prescription records.

Process and document transactions.

Meet pharmacy recordkeeping requirements.

Satisfy legal and regulatory obligations.

Maintain tax and accounting records.

Resolve disputes.

Prevent fraud.

Maintain security.

Enforce agreements.

Fulfill other legitimate business purposes.

Different categories of information may be retained for different periods.

PHI and pharmacy records may be subject to specific retention requirements under applicable law.

15. YOUR INFORMATION AND CHOICES

Depending on the type of information involved and applicable law, you may be able to:

• Review account information.

• Correct inaccurate account information.

• Update contact information.

• Change communication preferences.

• Unsubscribe from marketing email.

• Opt out of marketing text messages.

• Request information about personal information we maintain.

Rights relating specifically to PHI are described in our Notice of Privacy Practices.

Some information cannot be deleted or modified when we are legally required to retain it, including certain prescription, pharmacy, billing, or healthcare records.

16. CHILDREN'S PRIVACY

The general Digital Services are intended primarily for adults.

We do not knowingly use the public-facing website to collect personal information directly from children for general marketing purposes without appropriate authorization.

Parents, guardians, or authorized representatives may provide information relating to minors when obtaining pharmacy or healthcare services on their behalf.

Information relating to minors receiving pharmacy services will be handled in accordance with applicable healthcare and privacy laws.

17. PERSONAL REPRESENTATIVES

An authorized personal representative may exercise certain rights on behalf of another individual where permitted by law.

We may require documentation verifying the representative's authority before releasing information or acting on a request.

18. DO NOT TRACK AND PRIVACY SIGNALS

Web browsers and devices may provide privacy or tracking preference signals.

Because technologies and legal requirements continue to evolve, our response to such signals may vary depending on applicable law and the technology used by our website.

Where applicable law requires recognition of a particular privacy preference signal, we will comply with applicable requirements.

19. INTERNATIONAL USERS

Our Digital Services are operated in the United States and are primarily intended for individuals located in the United States.

If you access our Digital Services from outside the United States, information may be transferred to, processed in, and stored in the United States.

Applicable privacy protections may differ from those available in your country.

20. CHANGES TO THIS PRIVACY POLICY

We may revise this Privacy Policy periodically.

When changes are made, we will update the Effective Date.

If required by law, we may provide additional notice of material changes.

We encourage you to review this Privacy Policy periodically.

21. PRIVACY QUESTIONS AND REQUESTS

Questions, concerns, or requests regarding this Privacy Policy may be directed to:

Privacy Officer
Asheville Mountain Pharmacy, Inc.
1272 Tunnel Road, Suite 20
Asheville, NC 28805

Phone: 828-575-0723
Email: [email protected]

For requests involving your Protected Health Information, please also review our Notice of Privacy Practices.

© 2026 Asheville Mountain Pharmacy, Inc. All rights reserved.