Granite Pharmacy Website Privacy Policy

Effective Date: September 4, 2026

Last Updated: September 4, 2026

1. Introduction and Scope

. This Privacy Policy explains how we collect, use, disclose, and protect information obtained through the Site and describes the choices and rights that may be available to you under applicable privacy laws. This Privacy Policy does not replace or modify our HIPAA Notice of Privacy Practices (“Notice of Privacy Practices”), which governs protected health information (“PHI”) maintained by Granite Pharmacy in connection with providing pharmacy services. This Privacy Policy does not apply to Granite Pharmacy employees or job applicants

Granite Pharmacy is a pharmacy and a HIPAA covered entity. Our Notice of Privacy Practices explains how Granite Pharmacy may use and disclose PHI and describes the privacy rights available to individuals under HIPAA A copy may also be requested directly from any Granite Pharmacy location

Our Site currently provides a prescription-transfer form

Information submitted for a prescription transfer is transmitted to Granite Pharmacy’s pharmacy systems, including PioneerRx, for processing. If you have questions about your medical information, prescriptions, medication records, or other PHI, please refer to our Notice of Privacy Practices or contact Granite Pharmacy directly

Granite Pharmacy also provides access to electronic pharmacy services, including prescription refills and other patient services through third-party systems such as RxLocal/PioneerRx. Where required by law, Granite Pharmacy maintains appropriate agreements with service providers that create, receive, maintain, or transmit PHI on our behalf

We collect information in several ways

The information we collect depends on how you use the Site

When you submit a prescription-transfer request, we may collect information such as:

• Name

• Email address

• Information about the pharmacy from which you are transferring prescriptions

Prescription-transfer information may constitute PHI and is handled in accordance with HIPAA and our Notice of Privacy Practices

If you subscribe to our Pharmacy Insider or other electronic communications, we collect the information you provide, which currently includes your email address. Our email communications are supported by MailUp

If you contact us through the Site, we may collect the information you voluntarily provide, such as your name, email address, telephone number, and the contents of your message.

4. Information Collected Automatically

. This may include:

• IP address

• Operating system

• Screen or display information

• Pages viewed

• Referring or exit pages

• Date and time of visits

IP addresses may be processed at the network or server level as part of normal internet communication. Google may nevertheless temporarily process IP information for purposes such as approximate geographic location

Granite Pharmacy uses Google Analytics 4 (GA4) to understand how visitors use the Site and to help us improve website functionality and content. Google Analytics is also present on certain pages that relate to pharmacy services or health-related topics, including pages associated with refills and immunizations. However, visitors should understand that Google Analytics may receive information concerning the webpage being visited. Granite Pharmacy does not use Google Analytics for advertising or remarketing

The Site uses cookies and similar technologies for purposes such as:

• Operating and securing the Site

• Remembering certain preferences

• Measuring and improving website performance. Analytics technologies, including Google Analytics, may be controlled through the Site’s consent mechanism where available.

  7. Advertising and Remarketing

  . We do not currently use Meta/Facebook tracking pixels or similar social-media advertising technologies. Granite Pharmacy does not sell personal information for advertising purposes.

  8. How We Use Information

• Process prescription-transfer requests

• Communicate with patients and website visitors

• Operate and maintain the Site

• Understand general website usage

• Detect and prevent fraud, abuse, or security incidents

• Carry out other purposes permitted by applicable law. We do not use website information for automated decisions that produce legal or similarly significant effects about an individual.

  9. How We Share Information

  . Depending on the service involved, these providers may include:

  Website Platform and Hosting

  .

  Pharmacy Systems and Patient Services

  . Information submitted through pharmacy services may be transmitted to or maintained within pharmacy systems for purposes of providing pharmacy services.

  Email Communications

  . The email address and related engagement information necessary to administer these communications may be processed by MailUp on our behalf

  We may disclose information when we believe in good faith that disclosure is reasonably necessary to:

  • Comply with applicable law, regulation, legal process, or enforceable governmental request

  • Protect the rights, property, or safety of Granite Pharmacy, our patients, employees, or others

  Business Transfers

  .

  No Sale of Personal Information

  . Granite Pharmacy does not share personal information for cross-context behavioral advertising

  The Site may contain links to websites, applications, resources, or services operated by third parties. Granite Pharmacy does not control third-party websites or services and is not responsible for their privacy practices.

  11. Data Retention

  . Information that constitutes PHI is retained in accordance with our Notice of Privacy Practices and applicable pharmacy recordkeeping requirements. When information is no longer required or reasonably necessary, we may delete, destroy, or de-identify it in accordance with applicable law and our record-retention practices

  Granite Pharmacy maintains administrative, technical, and physical safeguards designed to protect information against unauthorized access, use, disclosure, alteration, or destruction. Accordingly, we cannot guarantee absolute security.

  13. Your Privacy Rights

  . These rights may include, where applicable:

  • Right to Access: Request access to certain personal information we maintain about you.

  • Right to Delete: Request deletion of certain personal information.

  • Right to Opt Out: Opt out of certain sales, sharing, targeted advertising, or profiling activities where applicable.

  • Right to Appeal: Appeal a decision concerning a privacy request where required by applicable law.

  These rights are subject to exceptions and limitations under applicable law

  Requests involving prescriptions, medication records, medical records, or other PHI are handled under HIPAA and our Notice of Privacy Practices rather than through the general website privacy-request process.

  14. How to Submit a Privacy Request

  :

  • Email: info@granitepharmacy.com

  • Mail: Granite Pharmacy Attn: Privacy Policy Inquiry 2230 27th Ave, Missoula, MT 59804. We will use information reasonably available to us for verification and may request additional information when necessary to protect your information from unauthorized disclosure. If we deny a request, we will explain the reason for the denial and provide any appeal rights required by applicable law

    The Site is intended for a general audience and is not directed toward children under 13. If you believe that a child under 13 has provided personal information through the Site, please contact us using the information in Section 14

    Depending on how you use the Site, Granite Pharmacy may collect the following categories of information

    Internet or network activityPages viewed, browser information, cookies, website interactions

    Yes

    Commercial informationInformation relating to requests or transactions made through the Site

    May be collected

    Pharmacy/health informationPrescription information submitted through the prescription-transfer process

    Yes, when voluntarily submitted

    Personal information submitted through the prescription-transfer process may constitute PHI and is governed by HIPAA and our Notice of Privacy Practices. Granite Pharmacy does not share personal information for cross-context behavioral advertising

    Certain browsers and extensions may transmit privacy preference signals, including the Global Privacy Control (“GPC”). To the extent applicable law requires Granite Pharmacy to recognize a privacy preference signal as an opt-out request, we will process that signal as required by applicable law

    California residents may have additional rights under applicable California privacy laws. California residents may submit a privacy request using the contact information provided in Section 14.

    19. Changes to This Privacy Policy

    . When we make changes, we will update the Last Updated date at the top of this Privacy Policy.

    20. Contact Us

    For questions regarding prescriptions, medication records, medical information, or other PHI, please contact Granite Pharmacy directly or refer to our Notice of Privacy Practices: https://www.granitepharmacy.com/privacy-policy

    This Privacy Policy is intended to describe Granite Pharmacy’s current website information practices. Granite Pharmacy should have this Privacy Policy reviewed by qualified legal counsel before publication, particularly to confirm applicability of state privacy laws, HIPAA requirements, vendor/business-associate arrangements, cookie and analytics disclosures, and the actual configuration of Google Analytics, Google Tag Manager, RxLocal/PioneerRx, Lumistry, and MailUp