HealthBoxed privacy policy.

1. Introduction

1.1 This policy sets out the policies and procedures of Anderson Health Services LLC DBA HealthBoxed (the "company") with respect to the retention, archiving and deletion of data, whether in hard copy or digital form, and including personal identifying information data.

1.2 The company is subject to a range of statutory obligations in relation to the retention of data. On the one hand, the company is obliged to retain some classes of data for a minimum period to fulfill their services. On the other hand, it is a fundamental principle of data protection law that personal data should be only retained for so long as required. Moreover, the retention of some classes of data may represent an unnecessary security risk. For these reasons, the company recognises the importance of formulating clear and specific policies in relation to data retention.

2. Definitions

2.1 In this policy:

(a) "appointed person" means the individual primarily responsible for handling data retention, archiving and deletion by the company, being the data protection officer of the company;

(b) "data controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data;

(c) "data processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller;

(d) "data subject" means an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

(e) "deletion" means the permanent and irreversible deletion of data from all relevant databases and storage media in the possession or control of the company including, where necessary to ensure the deletion of the data, the destruction of the relevant storage media; and

(f) "personal data" means any information relating to a data subject.

3. Data retention, archiving and deletion

3.1 The company must archive and delete data in its possession and/or control in accordance with schedule 1 (the next section: data retention periods).

3.2 Notwithstanding the archiving rules set out in this policy, the company may retain non-archived copies of data to the extent that the data is reasonably required in non-archived form only for:

(a) the fulfillment of any legal or contractual obligations of the company; and/or

(b) the establishment, exercise or defence of any legal claims.

3.3 The company must not delete data to the extent that:

(a) the company has a legal obligation to retain the data;

(b) the company has a contractual obligation to retain the data (providing that such contractual obligation is not overridden by any legal obligation to delete the data); and/or

(c) the retention of the data is reasonably required for the establishment, exercise or defence of any legal claims (providing that such requirement is not overridden by any legal obligation to delete the data).

4. Default archiving and deletion methods

4.1 Data must be archived by the company’s specific methods, save to the extent that specific archiving methods are provided for in schedule 1 (Data retention periods).

4.2 Data must be deleted by the company specify methods, save to the extent that specific deletion methods are provided for in schedule 1 (Data retention periods).

5. Reviewing and updating this policy

5.1 The appointed person shall be responsible for reviewing and updating this policy.

5.2 This policy must be reviewed and, if appropriate, updated annually on or around the 1st of January per calendar year.

5.3 This policy must also be reviewed and updated on an ad hoc basis if reasonably necessary to ensure:

(a) the compliance of the company with applicable law, codes of conduct or industry best practice;

(b) the security of data stored and processed by the company; or

(c) the protection of the reputation of the company.

5.4 The following matters must be considered as part of each review of this policy:

(a) changes to the legal and regulatory environment;

(b) changes to any codes of conduct to which the company subscribes;

(c) developments in industry best practice;

(d) any new data collected by the company;

(e) any new data processing activities undertaken by the company; and

(f) any security incidents affecting the company.

SCHEDULE 1 (DATA RETENTION PERIODS)

1. Introduction

1.1 This schedule 1 sets out the methods to be used by the company when archiving and deleting data and the periods during which data must be archived and deleted by the company.

2. Customer data: retention, archiving and deletion

2.1 In this policy, "customer data" means all customer relationship management records relating to the customers of the company, including the customer’s employees’ identity details and contact details, such as shipping addresses and names.

2.2 Customer data is stored by the company in the following databases: for each geographical data centre where HealthBoxed data is stored, Customer data will be stored in software protected, SQL-based database management systems, and configured in a high-availability pattern.

2.3 Customer data must be archived to this safe database daily.

2.4 Customer data must be deleted:

(a) within 48 hours of a Data Deletion Request from the customer

(i) the Data Deletion Request may be made by email at the following address: contact@healthboxed.com

2.5. Customer data will be deleted by deleting the backups from the storage medium.

2.6 The customer has full legal right to request deletion of the data and information they provided to the company at any time.

HealthBoxed SMS Terms and Conditions

1. Introduction

HealthBoxed may disclose Personal Data and other information as follows:

○ Third Parties that Help Provide the Messaging Service: We will not share

your opt-in to an SMS short code campaign with a third party for purposes

unrelated to supporting you in connection with that campaign. We may share

your Personal Data with third parties that help us provide the messaging service,

including, but not limited to, platform providers, phone companies, and other

vendors who assist us in delivering text messages.

○ Additional Disclosures:

■ Affiliates: We may disclose Personal Data to our affiliates or

subsidiaries; however, their use and disclosure of your Personal Data will

be subject to this Policy.

All the above categories exclude text messaging originator opt-in data

and consent; this information will not be shared with any third parties.

2. Purpose of SMS Notifications

Our SMS notifications are designed to:

○ Remind you of your scheduled visits.

○ Inform you of upcoming services, payment reminders, and other essential

notifications related to HealthBoxed.

3. Opt-In and Consent

By providing your phone number and opting into our SMS notifications, you confirm that

you are the owner or authorized user of the phone number provided. You consent to

receive recurring automated text messages (SMS, MMS) from us regarding your

scheduled visits, service updates, offers, and other important notifications. Consent is

not required to make any purchase from us. Message frequency may vary, but you can

generally expect to receive between 1-2 messages per month.

4. Opt-Out Instructions

Your consent to receive automated texts is entirely voluntary. You may opt-out at any

time:

○ To stop receiving messages, reply “STOP,” “END,” “CANCEL,” “UNSUBSCRIBE,”

or “QUIT” to any SMS message from us.

○ You may also email us at orders@healthboxed.com with your opt-out

request.

After you opt out, you will receive a final confirmation message, and no further

messages will be sent to your number unless you re-enroll.

5. Help and Support

If you are experiencing issues with our SMS notifications or need assistance, you can:

○ Reply with the keyword “HELP” to any message.

○ Email us directly at orders@healthboxed.com.

6. Message and Data Rates

Standard message and data rates may apply for any messages sent to you from us and

from you to us. Please consult your mobile service provider for details regarding your

text plan or data rates.

7. Privacy and Data Security

We value your privacy and are committed to protecting your personal information. Your

data will be used solely for the purposes described in this policy, such as managing your

service appointments, processing payments, and ensuring proper communication

regarding your services.

We do not sell, rent, or share your personal information with third parties for marketing

purposes. We may share your information with third parties only as required by law, for

billing and payment processing, or to fulfill our contractual obligations.

8. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes

for which it was collected, including legal, accounting, or reporting requirements. After

this period, your data will be securely deleted or anonymized.

9. Compliance with Regulations

We comply with all relevant laws and regulations, including the Telephone Consumer

Protection Act (TCPA) and CTIA guidelines. Our practices ensure that you can easily

manage your preferences, and we provide clear instructions for opting in or out of our

SMS notifications.

10. Indemnification

You agree to indemnify, defend, and hold us harmless from any privacy, tort, or other

claims, including claims under the TCPA or any state law equivalents, arising from your

voluntary provision of a telephone number that is not owned by you and/or your failure to

notify us of any changes to your mobile telephone number.

11. Participation Requirements

To participate in our SMS notifications service, you must:

● Be 18 years of age or older.

● Own a wireless device capable of two-way messaging.

● Be a subscriber to a wireless service with text messaging capabilities. Please note that

not all mobile carriers support this service.

12. Dispute Resolution and Arbitration

By using our SMS notifications service, you agree to resolve any disputes with us on an

individual basis and not as part of any class or representative action. You waive your

right to a trial by jury and agree that any claims will be resolved through final and binding

arbitration. If you do not agree to these terms, please do not participate in the service.

13. Miscellaneous

You warrant and represent that you have the necessary rights, power, and authority to

agree to these Terms and Conditions and that your participation in this service does not

violate any other contract or obligation. If any provision of this Agreement is found to be

unenforceable or invalid, the remaining provisions will remain in full force and effect.

We reserve the right to modify these Terms and Conditions at any time. Any updates will

be communicated to you via SMS or email, and your continued participation in the

service constitutes acceptance of the modified terms.

14. Contact Information

If you have any questions or concerns about these Terms and Conditions or our privacy

practices, please contact us at:

● Email: orders@healthboxed.com

● Phone: 920-221-1646

● Mailing Address: PO Box 28080 Green Bay WI 54324

15. Full Privacy Policy

For more detailed information on how we collect, use, and protect your data, please

review our full Privacy Policy above.