Draft. This document is awaiting review by counsel and is not yet in effect. Highlighted items are still to be confirmed.

Privacy and cookie policy

Allied Medical Management LLC · alliedmedical.supplies

Effective date: [effective date]

This Privacy and Cookie Policy explains how Allied Medical Management LLC ("Allied," "we," "us," or "our") collects, uses, shares, and protects personal information through our website at https://alliedmedical.supplies (the "Site"). It also describes the cookies and browser storage used on the Site and the choices you have. Please read it together with our Terms of Use, Terms of Sale, Product Notice, and Accessibility Statement.

Summary

• We collect the information you enter in our quote request form. Our host, Cloudflare, also processes basic technical data, such as IP addresses, to deliver and protect the Site.
• Your quote list is saved only in your own browser until you choose to submit it.
• Allied sets no cookies. We use no analytics, advertising, social media pixels, or other tracking tools. Cloudflare may set cookies that are strictly necessary for security.
• We do not sell personal information or use it for targeted advertising, and we do not share it with anyone for advertising.
• Do not submit patient information or protected health information (PHI) through the Site.
• To access, correct, or delete your information, email sales@alliedmedical.supplies.

This summary is for convenience only. The full policy below controls.

Who we are

Allied Medical Management LLC is a Wyoming limited liability company registered to do business in New York as a foreign limited liability company located at 38 Corbin Pl, Brooklyn, NY 11235, USA. We sell durable medical equipment (DME) and related supplies at wholesale to licensed businesses, such as DME suppliers, pharmacies, clinics, physical therapy practices, medical spas, and distributors. We sell only to approved trade accounts. We do not sell to patients or consumers.

Allied is responsible for the personal information described in this policy. Our contact details are in the "Contact us" section below.

Scope of this policy

This policy covers personal information we collect through the Site and through related business dealings with us, such as quote requests, requests to open a trade account, and orders. Because we sell only to businesses, most of the personal information we hold is business contact information about people who work for or represent our customers and prospective customers.

This policy does not cover websites or services that we do not own or control.

Information we collect

Quote request form

When you submit a quote request, we collect:

• company name
• contact name
• business email address
• phone number (optional)
• business type
• US state (optional)
• anything you write in the notes field
• the product IDs and quantities in your quote list

The form sends your request over an encrypted HTTPS connection to a Cloudflare Worker that runs our Site code. The Worker stores the request in our Cloudflare D1 database and sends a copy by email to our sales inbox. It does not store your IP address with the request.

Information you give us in other ways

If you email or call us, ask to open a trade account, or place an order, we collect the information you choose to give us. To open a trade account, we need business details that show your business qualifies, including a resale certificate. To fill orders, we keep account and order records.

We do not collect payment card information through the Site. Do not send full payment card numbers, Social Security numbers, or similar sensitive identifiers to us through the Site or by email.

Quote list saved in your browser

When you add products to your quote list, the Site saves the product IDs and quantities in your browser's local storage under the key "allied-quote". This information stays on your device. We receive it only if you submit the quote request form. You can clear it at any time by removing items from your quote list or by clearing this Site's data in your browser.

Technical information processed by Cloudflare

Cloudflare hosts the Site and protects it from attacks. When your browser requests a page or submits the form, Cloudflare processes your IP address and request details, such as your browser's user agent, the URL requested, and the date and time of the request, and records them in logs. To tell people apart from automated traffic, Cloudflare's security tools may also check technical signals from your browser and connection. Cloudflare needs this information to deliver the Site and keep it secure. We may review it to keep the Site working and to investigate abuse or attacks. Allied does not use it to track you.

What we do not collect

• Allied sets no cookies.
• We use no analytics, advertising, social media pixels, or other tracking tools.
• We do not use browser fingerprinting to identify or track you.
• We serve our fonts from our own Site, so your browser does not contact Google Fonts or any other font service.
• We do not embed content from other companies, such as videos, maps, or social media feeds.
• We do not intentionally collect sensitive personal information, as state privacy laws define that term.

Categories of personal information

The table below groups the personal information we collect using the categories in California law. It also shows where the information comes from, why we use it, and who receives it.

How we use personal information

We use personal information only for the purposes below and to make the disclosures described in "How we share personal information":

• to respond to quote requests and questions
• to review requests to open a trade account, confirm that your business qualifies, and manage your account
• to process, fulfill, invoice, and support orders
• to comply with legal obligations, such as sales tax and recordkeeping requirements, and to respond to lawful requests from authorities
• to keep the Site working and to protect it, our business, and our customers, including by preventing spam, fraud, and attacks
• to send you marketing emails, but only if you ask to receive them

We do not use personal information for targeted advertising.

Marketing emails

We do not send marketing emails unless you ask to receive them. If you do, each marketing email will include a way to unsubscribe, and we will honor your request as the federal CAN-SPAM Act requires. Messages about your quote requests, account, or orders are not marketing, and we will continue to send them while we do business with you.

Cookies and browser storage

Allied sets no cookies. The Site uses one item of browser storage, and Cloudflare, our host and security provider, may set cookies that are strictly necessary for security. The table below lists each of them.

Cloudflare sets these cookies only in some situations, such as when its bot protection is active or after you complete a security challenge. They support security only. Allied does not use them to track you. For details, see Cloudflare's cookie documentation and privacy policy.

Why we do not show a cookie banner

We do not show a cookie consent banner because the Site uses only cookies and browser storage that are strictly necessary. Each item in the table above is needed to deliver the Site securely or to provide the quote list you ask for. We do not use cookies or browser storage for analytics, advertising, or tracking. If that changes, we will update this policy before the change takes effect and ask for your consent where the law requires it.

Your controls

You can block or delete cookies and clear local storage in your browser settings. If you block Cloudflare's security cookies, you may see more security challenges or be unable to use parts of the Site. If you clear local storage, your saved quote list will be deleted.

How we share personal information

We share personal information only as described below.

Service providers

• Cloudflare, Inc., which hosts the Site and provides content delivery, security, the database that stores quote requests, and the service that emails quote requests to our sales inbox
• Google LLC, through Google Workspace, which hosts our email, including our sales inbox
• [other providers used to fulfill orders, such as freight carriers or accounting software, if any]

These providers process personal information to provide their services to us. Cloudflare describes how it handles technical data in its own privacy policy.

Legal, safety, and business reasons

• When the law requires it, such as to respond to a subpoena, court order, tax audit, or request from a regulator.
• When we believe in good faith that disclosure is needed to protect the rights, property, or safety of Allied, our customers, or others, including to prevent fraud.
• To our professional advisers, such as lawyers and accountants, who must keep it confidential.
• As part of a merger, acquisition, financing, or sale of all or part of our business. The recipient must handle the information under this policy or under protections at least as strong.
• With your direction or consent.

No sale, sharing, or targeted advertising

We do not sell personal information. We do not share personal information for advertising based on your activity across other businesses' websites, which California law calls "sharing." We do not use personal information for targeted advertising. We have not sold or shared personal information in the past 12 months. We do not disclose personal information to third parties for their own direct marketing. California residents may contact us with questions about this under California Civil Code section 1798.83.

Visitors outside the United States

The Site is intended for businesses in the United States. If you are outside the United States, please do not submit personal information through the Site.

We store the personal information we collect in the United States. Cloudflare may process your page requests at a data center near your location. If you send us information from outside the United States anyway, we will handle it as this policy describes, and you may use the process in "Your choices and rights" to ask us to access, correct, or delete it.

How long we keep personal information

We may keep information longer if the law requires it or if we need it to resolve a dispute or enforce an agreement. When we no longer need information, we delete it or remove the details that identify you. Deleted information may remain in backups for a limited time until those backups expire.

How we protect personal information

• The Site uses HTTPS for every page and for form submissions.
• Only staff who need personal information to do their jobs can access it.
• We maintain reasonable administrative, technical, and physical safeguards, as the New York SHIELD Act requires.
• Cloudflare's security services help protect the Site from attacks and abuse.

No website, email system, or database is completely secure, and we cannot guarantee the security of information you send us. Email in particular is not a secure way to send sensitive information. If a security breach affects your personal information, we will notify you and any government authorities as applicable law requires.

Your choices and rights

Rights available to everyone

Wherever you live, you may ask us to:

• tell you what personal information we hold about you and give you a copy (access)
• correct personal information that is inaccurate (correction)
• delete personal information about you (deletion)
• stop sending you marketing emails

We may keep some information when the law allows or requires it, such as records we must keep for tax purposes or information we need to complete an order you placed. If we cannot fully meet a request, we will tell you why. If you ask us to delete information we need to run your trade account, we may not be able to keep the account open.

State privacy rights, including California

California and several other states give their residents rights over their personal information. These laws include the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"). Many of these laws apply only to businesses that meet revenue or data volume thresholds. Some do not cover information about people acting on behalf of a business. Allied may not be subject to some or all of these laws. We still honor the requests described in this section from any person, using the process below.

Depending on where you live, your rights may include the right to:

• know what personal information we collect, use, and disclose, and get a copy of specific pieces of it
• correct inaccurate personal information
• delete personal information
• opt out of the sale or sharing of personal information, targeted advertising, and certain profiling (we do none of these)
• limit our use of sensitive personal information (we do not intentionally collect it)
• appeal our decision on your request
• not be discriminated against for using these rights

We will not deny you goods or services, charge you different prices, or give you a different level of service because you used a privacy right.

How to make a request

You or your authorized agent can make a request by:

• emailing sales@alliedmedical.supplies with "Privacy request" in the subject line
• calling us at [phone]
• writing to Allied Medical Management LLC, 38 Corbin Pl, Brooklyn, NY 11235, USA

Tell us what you are asking for and how we can reach you. We do not charge a fee to handle a request. Where the law allows, we may charge a reasonable fee for, or decline, a request that is clearly unfounded or excessive, and we will explain why.

How we verify requests

Before we act on a request to access, correct, or delete personal information, we must confirm your identity. This protects you from someone else getting or changing your information. We usually do this by matching details you give us, such as your name, company name, and email address, to the information we hold. We may ask you to reply from the email address you used with us or to confirm details of a quote request or order. We may ask for more details before we provide specific pieces of information or delete information. We use the information you give us for verification only to verify your request. We do not require verification for a request to stop marketing emails or to opt out of sale or sharing.

Authorized agents

You may have an authorized agent make a request for you. The agent must give us your signed written permission. We may also ask you to verify your own identity directly with us or to confirm directly with us that you gave the agent permission. These extra steps do not apply if the agent holds a valid power of attorney under applicable state law. We may deny a request from an agent who does not show proof of authority.

Response times

We will respond within 45 days after we receive your request. If we need more time, we may extend this once by up to 45 more days where the law allows. If we do, we will tell you why within the first 45 days.

Appeals

If we deny your request in whole or in part, you may appeal. Email us with "Privacy appeal" in the subject line and explain why you disagree. We will review the appeal and send you a written decision, with our reasons, within 45 days after we receive it. If you disagree with our decision, you may contact your state attorney general.

Global Privacy Control and Do Not Track

Global Privacy Control (GPC) is a browser setting that tells websites you want to opt out of the sale or sharing of your personal information. Because we do not sell or share personal information or use it for targeted advertising, there is nothing for a GPC signal to turn off, and the Site works the same way with or without it. If we ever begin any of those activities, we will treat GPC as a valid opt-out request as the law requires, and we will update this policy before the change takes effect.

Some browsers send a "Do Not Track" signal. We do not track visitors across websites, and we do not allow advertising or analytics companies to collect information on our Site. The Site works the same way whether or not your browser sends this signal.

Children

The Site is for business users. It is not directed to children under 13, and we do not knowingly collect personal information from anyone under 16. If you believe a child has given us personal information, contact us and we will delete it.

Patient information and protected health information

Do not submit patient information or protected health information (PHI) through the Site, including in the notes field of the quote request form, or in related emails to us. This includes patient names, dates of birth, diagnoses, prescriptions, insurance details, and any other information about a patient's health or care. A quote request should describe only the products and quantities your business needs.

Allied is not a HIPAA covered entity for the purposes of this Site, and the Site is not designed to receive or protect PHI. If we learn that PHI was sent to us through the Site, we will take reasonable steps to delete it unless the law requires us to keep it.

Links to other websites

This policy and other pages on the Site may link to websites run by others, such as Cloudflare. We do not control those websites and are not responsible for their privacy practices. Read their policies before you give them personal information.

Changes to this policy

We may update this policy from time to time. When we do, we will post the new version on this page and change the effective date at the top. If we make a material change, such as starting to use analytics or other cookies that are not essential, we will update this policy before the change takes effect. Where the law requires, we will also give you additional notice or ask for your consent. We will not use personal information we already hold in a materially different way from what this policy describes unless we first get your consent.

Contact us

For questions about this policy or to make a privacy request, contact us:

• Email: sales@alliedmedical.supplies (use "Privacy request" in the subject line for privacy requests)
• Phone: [phone]
• Mail: Allied Medical Management LLC, 38 Corbin Pl, Brooklyn, NY 11235, USA

If you have a disability and need this policy in another format, contact us at the email address above. To learn about the accessibility of the Site, see our Accessibility Statement.