PRIVACY POLICY

Last modified: October 20, 2025

Pathway Drugs, Incorporated ("we," "us," or "our") is committed to protecting your privacy. We have adopted this privacy policy (the "Privacy Policy"), which sets forth, among other things, the type of information that will be collected, the purpose and use of the collected information, and your rights with regard to the collected information. This Privacy Policy governs how we collect and use your Personal Information (defined below) wherever you access our website found at https://www.viapathway.com or otherwise use our platform made available through our website or mobile applications that directly link to this Privacy Policy (collectively the “Platform”), communicate with us, or otherwise utilize our services made available through the Platform (“Services”).


1. SCOPE

1.1 U.S.-Based Platform

Our Platform and Services are intended for users located in the United States. If you visit or use the Platform from outside the United States, you acknowledge that your information may be transferred to and processed in the United States.

1.2 Not a Healthcare Provider

We are not a healthcare provider. For medical advice or treatment, please consult a qualified healthcare professional in the United States.

1.3 US-Based and International Partners

Our Platform and Services include disclosing certain information to healthcare providers, pharmacies, prescription benefit managers, insurance carriers, and self-funded health plans located within and outside the United States, and receiving information from the same (“Partner Entities”). Some of our Partner Entities might be considered "covered entities" or "business associates" under the Health Insurance Portability and Accountability Act (“HIPAA”), and Pathway might sometimes act as a "business associate" for a Partner Entity. It is important to know that HIPAA does not always apply just because health information is involved, and instead it only applies if such information is provided by a “covered entity” for a covered transaction (example, when your health insurance payments are involved). If HIPAA applies, then we process personal health information (“PHI”) in accordance with Section 1.4 below.

1.4 Protected Health Information

Partner entities that are covered entities may share PHI under HIPAA. Where Partner Entities provide us PHI, we process such information under a business associate agreement (“BAA”) that we have in place with such Partner Entity, which dictates processing, privacy, and security requirements. Where processing PHI on behalf of a Partner Entity, we process in accordance with such BAA and in accordance with HIPAA. Any information that does not constitute PHI under HIPAA may be used or disclosed in any manner permitted under this Privacy Policy.


2. INFORMATION WE COLLECT

To utilize our Platform and Services, including connecting you with Partner Entities, you will be required to provide personal information that will allow you to be identified ("Personal Information"). This section explains what categories of Personal Information we collect and how we may collect such Personal Information.

2.1 Information You Provide Directly

We collect Personal Information you provide directly, when setting up an account or communicating with us. This Personal Information may include the following:

  • Basic Identifying Information – such as your name, mailing address, phone number, and email address;

  • Unique Identifiers – such as user name, account number, and password;

  • Demographic Information – such as your age and gender;

  • Preferences Information – such as product or content interests, communication or marketing preferences;

  • Health Information – such as prescription, treatment, allergies, and other medical information related to physical and mental health, health providers, and insurance-related information;

  • Payment Information – such as your payment method, including your credit card number, card expiration date, security code, and billing address. Payment information may be processed by our payment processor, in which case such payment processor will be collecting and processing such information on our behalf and share with us limited details as necessary for us to verify, record, and fulfill completed transactions (for more information about payment processors see Payment Processor below).

2.2 Information Collected Automatically

When visiting our Platform, we may automatically collect information about your device and usage, including IP address, browser type, operating system, referring URLs, pages viewed, and links clicked, which may be considered Personal Information. This information may include the following:

  • Internet or Other Network Activity – such as your browsing or search history, and other information regarding your interactions with our Platform, Services, emails, and advertisements;

  • Device Information – such as device IDs, IP address, cookies, beacons, pixel tags, mobile ad identifier, and other unique identifiers (for more information about cookies and online technologies see Cookes and Online Technologies below);

  • Geolocation Data – such as imprecise location data (such as location derived from an IP address or data that indicates a city or postal code level), and precise location data (such as latitude/longitude data);

  • Inferences – such as inferences drawn from or created based on the information identified above.

2.3 Information From Third Parties

We may receive information from third parties related to you in connection with your use of the Services. The third-party sources and related categories of information we may receive include the following:

  • Partner Entities – When you use the Service and engage with a Partner Entity, it may share limited information back with us about your engagement as necessary for us to provide you with the Platform and support the transaction through the Platform. This information may include the status of your transactions and the Partner Entity you engaged with.

  • Payment Processors – When a payment processor is used, you will provide information directly to the payment processor to process payments, and such payment processor may send limited information back to us to confirm the status of the transaction. This may include the last four digits of your payment instrument, your basic identifying information, and the transaction status.


3. HOW WE USE YOUR INFORMATION

3.1 Operating and Improving the Platform

To deliver content, personalize user experience, and maintain and optimize our Platform and Services, including but not limited to improving the design, features, and performance of our existing Platform and Services and to develop new tools or offerings.

3.2 Communication

To send you information, such as notifications and updates related to our Platform and Services.

3.3 Analytics and Marketing

To understand how users engage with our Platform or Services and to develop targeted marketing campaigns.

3.4 Legal Compliance and Security

To comply with applicable laws and ensure the security of our Platform and use of our Services, including but not limited to, monitoring, detecting, and preventing fraud, abuse, security breaches, and other harmful or unlawful activities on the Platform or in connection with the Services.

3.5 Healthcare Providers

To facilitate your healthcare experience, we may share your personal information with licensed healthcare providers and pharmacies, including Partner Entities located outside of the United States.

3.6 Receiving Personal Information from Third Parties

We may receive your Personal Information from third parties.

3.7 Business Associates

To contract with third parties to perform certain Services for us, such as accounting services, consulting services, logistics companies, customs brokers, or information technology services. In some cases, these third-party service providers may need to access your Personal Information to perform services for us.

3.8 Account Management

To create, manage, and maintain your account with respect to the Platform and Services.

3.9 Support

To provide you with necessary technical support with respect to our Platform and Services.

3.10 Consent Management and Recordkeeping

To manage and document consents and authorizations as required under applicable laws, including HIPAA and other health information regulations.

3.11 Payment Processing

To process payments for Services, including billing, invoicing, and payment-related communications. This may involve sharing Personal Information with payment processors.

3.12 Standard Business Functions

To support our core business functions, including maintaining records related to business management, loss prevention, collecting amounts owed, and identifying and repairing errors or problems in the Platform or with respect to the Services.


4. COOKIES; ONLINE TECHNOLOGIES; AND PAYMENT PROCESSORS

4.1 Cookies and Online Technologies

We use cookies and similar technologies to collect information about your interactions with our Platform and Services, and such information may be considered Personal Information. These technologies are used to maintain the security of our Platform and Services, manage your account, prevent crashes, fix bugs, save your preferences, assist with basic Platform and Services functions, advertising, analytics, and other performance functions.

4.2 Payment Processor

We use third-party payment processors to process payments on our behalf. When you make a payment through the Platform, your payment information (such as credit card number, billing address, and other financial data) is collected and processed directly by these third-party providers. We do not store or have access to your complete payment card information. These payment processors are contractually required to protect your Personal Information and to use it only for purposes of processing transactions on our behalf and complying with legal obligations.

We currently use Stripe, Inc. (“Stripe”) For more information about how Stripe processes Personal Information, please see its privacy policy at https://stripe.com/privacy.


5. SHARING AND DISCLOSING INFORMATION

5.1 Service Providers and Business Associates

We may share your information, including Personal Information, with third-party vendors, business associates, or service providers who perform services on our behalf. Such third-parties may include internet service providers, advertising networks, data analytics providers, governmental entities, logistics companies, customs brokers, operating systems and platforms, social media networks, payment processors, and other service providers who provide us a service (e.g., customer service, auditing, marketing, debugging to identify and repair errors that impair existing intended functionality on our Platform, including our websites and applications, and/or protecting against malicious, deceptive, fraudulent, or illegal activity). You acknowledge that some of these third-party vendors may be based outside of the United States.

5.2 Legal and Compliance

We may disclose your information, including Personal Information, if required to satisfy any law, regulation, legal process, government request, or where we have a good faith belief that access, use, preservation, or disclosure of such information is reasonably necessary (1) to enforce or apply our agreements; (2) to protect our rights, interests, property, or the safety of others; (3) in connection with claims, disputes, or litigation; and (4) to protect our Platform and Services.

5.3 In a Business Transfer

We may disclose or share your information, including Personal Information, as part of a corporate business transaction, such as a merger or acquisition, joint venture, corporate reorganization, financing, or sale of company assets, or in the unlikely event of insolvency, bankruptcy, or receivership, in which such information could be transferred to third parties as a business asset in the transaction.

5.4 Partner Entities

We may share information, including Personal Information, with Partner Entities that require such information in order to provide you with the Services.


6. DATA RETENTION

We retain your Personal Information for as long as necessary to fulfill the purposes outlined in this Privacy Policy and to complete other legitimate business purposes.


7. YOUR RIGHTS AND CHOICES

7.1 Personal Information Rights

Depending on your U.S. state of residence, you may have certain rights in relation to your Personal Information, including:

  • You may have the right to know what Personal Information we have collected about you.

  • You may have the right to request a list of the specific third parties with whom we have shared your Personal Information.

  • You may have the right to request a list of the categories of third parties to which we have disclosed Personal Information.

  • You may have the right to access your information in a portable format.

  • You may have the right to request that we delete Personal Information that we have collected from or about you, subject to certain exceptions.

  • You may have the right to correct inaccurate Personal Information that we may maintain about you, subject to appropriate verification.

We use and disclose to third parties Personal Information for analytics and advertising purposes. Accordingly, you may have the right to opt out of the “sale” or "sharing” of your Personal Information, or the use and disclosure of your Personal Information for “targeted advertising” (as these terms are defined under applicable law).

7.2 Account

You may access, update, or remove certain information that you have provided to us through your account by visiting your account settings or sending an email to the email address as set out in the Contact Us section below. We may require additional information from you to allow us to confirm your identity.

We will retain and use information about you as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

7.3 Communications

The following is information about how to opt out of receiving certain communications from us, depending on means of delivery:

  • Email – You may unsubscribe from our promotional emails at any time. You can opt-out of receiving promotional emails from us at any time by following the instructions as provided in emails to click on the unsubscribe link, or emailing us at the email address as set out in the Contact Us section below with the word UNSUBSCRIBE in the subject field of the email. Please note that you cannot opt-out of non-promotional emails, such as those about your account, transactions, servicing, or our ongoing business relations.

  • Communications – You can opt-out of receiving text messages or calls to your phone number at any time by (i) for text messages, texting “STOP” in response to any text message you receive from us or contacting us as set out in the Contact Us section below and specifying you want to opt-out of text messages; and (ii) for calls, requesting opt-out during any call you receive from us or contacting us as set out in the Contact Us section below and specifying you want to opt-out of calls.

7.4 Cookies and Online Technologies

The following disclosures relate to your rights and choices in connection with cookies and other online technologies: 

  • Do Not Track – Your browser settings may allow you to automatically transmit a “Do Not Track” signal to online services you visit. We do not currently monitor or take action with respect to “Do Not Track” signals.  For more information on “Do Not Track,” visit http://www.allaboutdnt.com.

  • Cookies and Pixels – Most browsers accept cookies by default. You can instruct your browser, by changing its settings, to decline or delete cookies. If you use multiple browsers on your device, you will need to instruct each browser separately. Your ability to limit cookies is subject to your browser settings and limitations.

  • Google Ads – In addition, you may opt out of the collection and use of your Personal Information for ad targeting by Google Ad Manager. 

  • Other Target Advertising – Further, you may be able to opt out of receiving certain targeted or interest-based advertisements using the browser opt-out tools and consumer choice mechanisms provided by advertising industry self-regulatory groups by following the links below:

  • Mobile Apps – You also can control whether you see interest-based advertisements on your mobile device(s) in the following ways:

    • Your device operating system may provide mechanisms that allow you to opt in or opt out of the use of information about your use of mobile apps to deliver interest-based advertising to your mobile device. For more information, consult your device settings.

    • The DAA offers a tool for opting out of the collection of cross-app data on mobile devices for interest-based advertising. To exercise your choices with respect to participating companies, please download the AppChoices tool at www.aboutads.info/appchoices.

Please be aware that if you disable or remove online technologies, some parts of the Platform or Service may not function correctly.

7.5 Access, Correction, and Deletion

Contact us to access, correct, or request deletion of your personal information by calling our customer service line at XXXX or by sending an email to support@viapathway.com.


8. CHILDREN’S PRIVACY

Our Platform and Services are not directed to individuals under 18, and we do not knowingly collect Personal Information from anyone under 18.


9. DATA SECURITY

We will take commercially reasonable measures to protect your Personal Information, but no method of transmission over the internet is 100% secure.


10. THIRD-PARTY LINKS AND WEBSITES

Our Platform may contain links to third-party websites. We are not responsible for their privacy practices.


11. CHANGES TO THIS PRIVACY POLICY

We may make modifications, deletions, and/or additions to this Privacy Policy ("Changes") at any time. Changes will be effective: (i) thirty (30) days after we provide notice of the Changes, whether such notice is provided through the Platform, including any applicable website or application user interface, or is sent to the email address associated with your account or otherwise; or (ii) when you opt-in or otherwise expressly agree to the Changes or a version of this Privacy Policy incorporating the Changes, whichever comes first.


12. CONTACT

If you have any questions about this Privacy Policy, please contact us at: support@viapathway.com.