Privacy Policy

Effective: March 5, 2026
Last Updated: March 5, 2026

This Privacy Policy describes the personal data that we, Afaxys, Inc., Afaxys Pharma, LLC, Afaxys Drug Development, LLC, and Afaxys Group Services, LLC (collectively, “Company”, “we”, “us”, or “our”) collect about you, why we collect it, how we use it, and when we disclose it with third parties or service providers.

This Privacy Policy covers our websites, including Afaxys.com, Afaxyspharma.com, GPOAfaxys.com, and EContraOneStep.com (collectively the “Site”), our associated services, and any other future platforms or offerings that we may develop where this Privacy Policy is made available (collectively, the “Platform”).

This Privacy Policy applies to personal data and does not apply to information that may be regulated by a different legal framework, such as the Health Insurance Portability and Accountability Act (“HIPAA”). To the extent that we process deidentified data, we will maintain and use the data in deidentified form and will not attempt to reidentify the data unless permitted by applicable law. Deidentified data that remains deidentified is not personal data and we may use such data for any lawful purpose. Deidentified data that is reidentified and otherwise qualifies as personal data is subject to this Privacy Policy. We may create and share aggregate or de-identified information about users with third parties for marketing, advertising, research, or other commercial purposes.

What personal data do we collect about you?

Our data collection practices differ depending on our relationship with you and your interactions with the Platform. We generally interact with the following categories of individuals:

Physicians, health care professionals, or business users of our services, including those provided through Afaxys Group Services, LLC (“HCPs”)
Users of our prescription or over-the-counter products (“Consumers”)
Visitors to our Site (“Site Users”)

Unless otherwise stated in this Privacy Policy, any references to “you” or “your” include HCPs, Consumers, and Site Users.

We collect the below categories of personal data from you when you access the Platform:

Contact, Account, and Transaction Information: Name, email address, postal address, and phone number. We also collect information necessary to process your request to purchase our products, such as your payment and shipping details. We work with a third-party payment processor to process any payment information. For HCPs, we may also collect your account credentials (username and password) if you create an account with us to access our business services.
Website Activity: We collect information related to your access to and use of our Platform, including the type of browser you use, access times, pages viewed, your IP address, and the page you viewed before and after visiting our Platform. We may also collect this type of information in visual form when you visit our Platform, including video snippets of your Platform activity.
Device Information: We collect information about the computer or mobile device you use to access our Platform, including the hardware model, operating system and version, unique device identifiers, and mobile network information.
Health Related Information: If you are a Consumer, we collect information that may relate to your health in the context of our regulatory responsibilities under the Federal Food, Drug, & Cosmetic Act (such as adverse event and product complaint reporting). We may also collect health-related data (including sexual health data) about Consumers and Site Users when they interact with certain health-related online content on our Platform intended for Consumers (like EContraOneStep.com) or disclose this data to us through offline and online interactions, such as calling customer service or any communication features we make available through the Platform.
Geolocation Information: We may collect the approximate location of your device from your IP address.
Employment and Professional Information: For HCPs, we collect your place of employment; credentials, license, or other qualification information; and occupational or professional membership or participation information (such as 340B program and GPO participation).
Commercial Information: Information about your product and service preferences and interests, including our products and services.
Social Media Information: Account names, handles, biographies, and other details that you make available on social media networks.
Other information that you may provide to us or that we may infer based on the above.

How do we collect personal data?

We collect personal data directly from you in the below contexts. We also collect personal data from you using sources like advertising or marketing networks, data analytics providers, social media platforms, and other service providers or third parties.

If you purchase our products, create an account with us, or otherwise access the Platform
In connection with your interactions, inquiries, or other requests
If you interact with or share content linking to any of our social media accounts
If you participate in a contest, promotion, or survey
If you contact us via e-mail or through our customer service, including through the use of online chat tools that we may make available
We and our third-party vendors may use tracking tools like browser cookies, flash cookies, pixels, and web beacons to collect information from you. Please see “How do we use cookies and other tracking technologies?” for more information.

How do we use your personal data?

We may use your personal data in the following ways:

To provide, operate, maintain, and protect our Platform;
To analyze and improve our Platform, including developing new products or services;
To communicate with you, respond to your inquiries, and to send you information by email, postal mail, telephone, text message, notifications, or other means about our products and services;
To promote and conduct educational or promotional events, including those that may be in person and to support our marketing and advertising activities, including delivering personalized advertising;
To enhance and help us better understand your browsing experience, needs, and preferences and provide consistent, personalized services and experiences across our Platform;
To protect the security or integrity of the Platform, including to perform security analyses to verify that the Platform is working properly and has not been compromised based on our legitimate interests;
To protect us, our users, and the public, and comply with applicable law, regulation, or legal process, including to validate user information for fraud and risk detection purposes, resolve disputes and protect the rights of users and third parties, respond to claims and legal process (such as subpoenas and court orders), fulfill our reporting obligations, monitor and enforce compliance with our contracts, including any agreements between you and us, and otherwise detect, prevent, or stop any activity that may be illegal, unethical, or legally actionable; and
To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal data held by us about our customers is among the assets transferred.

How do we disclose your personal data?

We disclose your personal data to the following categories of parties:

Service providers: We engage vendors and consultants to assist with and perform certain functions on our behalf such as: auditing and accounting firms, professional services consultants, providers of data hosting, storage, and analytics services, and IT and security vendors.
Social media platforms: Where you choose to interact with us through social media, your interaction with these platforms typically allows the social media company to collect some information about you through cookies and other digital tracking mechanisms that they place on your device. In some cases, the social media company may recognize you through these technologies even when you do not interact with their platform. Please visit the social media companies’ respective privacy policies to better understand their data collection practices and the controls they make available to you.
Companies involved in advertising: We work with companies that assist us in advertising our Platform to you and others who may be interested in the Platform. These companies may use tracking technologies on our Platform to collect or receive information over time and across different websites or platforms, including on this Platform and elsewhere on the internet, and use that information to provide measurement services and provide you with targeted ads. Some jurisdictions may consider this a “sale” of personal data. For more information, including rights you may have to opt out of this practice, please see “Your Privacy Rights” below.
Corporate affiliates: We share personal data with our subsidiary companies.
Business partners: We may work with other companies to provide you with certain product or service offerings.
Law enforcement, government agencies, or parties in a legal proceeding: We may share personal data with these entities to comply with the law or assist law enforcement. We may also provide your personal data to third parties in the context of a subpoena or similar legal process.
Third parties in the context of a merger or similar business transaction.

How do we use cookies and other tracking technologies?

We and our third-party vendors use cookies, pixel tags, and other tracking technologies on the Platform in a variety of ways to enhance or personalize your online browsing experience. These tracking technologies, such as Google Analytics, help us better understand your needs and preferences and tell us which parts of our Platform you have visited, facilitate and measure the effectiveness of our advertisements, and provide consistent and personalized services and experiences. We and our vendors also use these technologies in out emails to help us track e-mail response rates, identify when our e-mails are viewed, track whether our e-mails are forwarded, and related interaction data. These tracking technologies gather information over time and across different websites about you, some of which may be personal data as identified above in “What personal data do we collect about you?”

You can set your browser not to accept cookies or to notify you when you are sent a cookie, giving you the opportunity to decide whether or not to accept it. If you do not accept cookies, however, you may not be able to access your account information or utilize certain functionalities on our Platform. Please note that our Platform does not currently recognize “Do Not Track” signals. However, our Platform may recognize certain opt-out preference signals, such as the Global Privacy Control, and will process such signals in accordance with applicable law, potentially including “do not sell”, “do not share”, “limit the use or disclosure of sensitive personal information,” and opt out of targeted advertising requests. You may set such a signal through your browser or browser extension.

Third-Party Links

Our Platform may contain links to third-party websites. Any access to and use of such linked websites is not governed by this Privacy Policy, but instead is governed by the privacy policies of those third-party websites. We are not responsible for the information practices of such third-party websites.

How do you protect my personal data?

We have implemented commercially reasonable precautions to protect the information we collect from loss, misuse, and unauthorized access, disclosure, alteration, and destruction. Please be aware that despite our best efforts, no data security measures can guarantee 100% security.

You should take steps to protect against unauthorized access to your password, phone, and computer by, among other things, signing off after using a shared computer, choosing a robust password that nobody else knows or can easily guess, and keeping your log-in and password private. We are not responsible for any lost, stolen, or compromised passwords or for any activity associated with you due to unauthorized password activity.

Do we collect children’s information?

We will never knowingly request personal data from anyone under the age of 18. Our Platform is not targeted to or intended for use by children. However, if we learn that we have received personal data from a child under the age of 18 without appropriate parental consent, we will delete that information from our database.

How long do we keep your personal data?

We retain personal data for as long as needed or permitted in light of the purpose(s) for which it was obtained and consistent with applicable law. The criteria used to determine our retention periods include:

The length of time we have an ongoing relationship with you and provide the Platform to you (for example, for as long as you have an account with us);
Whether there is a legal obligation to which we are subject (for example, we are required to keep records of your transactions for a certain period of time); or
Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation, or regulatory investigations).

What choices do I have about my personal data?

If you prefer not to receive promotional communications from us, such as information about special offers, you can let us know by contacting our customer service as described in the section entitled, “Contact Us” below. You may also follow the instructions included with the message, such as by following unsubscribe or opt out links. Please note that we may still send you messages in response to your inquiries or about other non-promotional items, such as managing your account or relationship with us.

Notice of Financial Incentive

We may offer coupons, discounts, or other price reductions for our products and services in exchange for your providing us with personal data to register a product and/or receive marketing emails or similar communications. These coupons, discounts, or other price reductions may be considered to be “financial incentives” or a similar term loyalty program offering under applicable law. To opt in to receive these financial incentives, you will be asked to provide personal data (such as email address) through an online form or similar means.

When you choose to opt into a financial incentive, we use the information you provide to send you marketing emails, special offers, and other advertising, and the information may be shared with our email providers and advertising partners. You may opt out of email marketing at any time by unsubscribing from marketing emails using the “unsubscribe” link in such emails. If you opt out, we will not reduce the value of any financial incentives you previously received from us; however, you may no longer continue to receive offers from us.

We do not assign a monetary value to the data that we collect in connection with the financial incentives. The financial incentives we offer to consumers are reasonably related to the value of the personal data to our business, considering the expenses that we incur to collect, store, and keep personal data. We also considered the expenses related to providing the financial incentive and managing its administration.

Your Privacy Rights

You may have the rights listed below (“Data Subject Rights”) with respect to the personal data that we collect or process about you, however, these rights differ depending on your place of residency, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, Nevada, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia.

Please note that we reserve the right to honor your Data Subject Rights to the extent required by applicable law.

Right to Confirm Processing, Access, and/or Obtain a Copy (referred to in some places as a Data Subject Access Request): If you ask us, we will confirm whether we are processing your personal data. Additionally, upon request, we will provide you with a copy of all personal data you are lawfully entitled to receive, potentially including specific pieces of information, along with certain other details.
Right to Amend: If you believe your personal data is inaccurate or incomplete, you may request that we correct it.
Right to Delete: You may request that we delete personal data that we maintain about you.
Right of Portability: You may request that we move, copy, or transfer the electronic personal data that we hold about you to another organization.
Right to Revoke Consent and/or Opt Out of Certain Processing Activities: You may ask us to restrict or stop the processing of your personal data. This includes general requests and requests in specific contexts, such as if we process personal data that is considered “sensitive” under applicable U.S. state laws or engage in certain automated decision-making activities.
Right to Limit Use and Disclosure of Sensitive Personal Data: You may ask us to limit the use and disclosure of sensitive personal data.
Right to Opt Out of Targeted Advertising or “Sharing”: Targeted advertising is the practice of serving you tailored advertisements based your personal data gathered over time and across other businesses, websites, applications, or services. Some jurisdictions may refer to this activity as “sharing.” You have the right to opt out of this practice.
Right to Opt Out of Sales: Some jurisdictions may consider targeted advertising a “sale” of personal data. You may request that we not “sell” your personal data.
Right to Non-Discrimination: We will not discriminate against you for exercising Data Subject Rights, but we may charge a reasonable fee as permitted by law in fulfilling these rights, such as if you request multiple copies of your personal data.
Right to Appeal: If we deny your request to exercise a Data Subject Right, you may have the right to appeal the decision with us. If you would like to appeal a prior decision, please be sure to include information about your prior request so that we may locate our earlier determination.
Right to Lodge a Complaint: You may submit a complaint to the competent supervisory authority in the country or state in which you live if you have any concerns about our processing of your personal data or if we deny your appeal to review a prior decision about your Data Subject Rights.

If you or your authorized agent would like to exercise a Data Subject Right, you may do so by following the instructions in “Contact Us” below.

In order to process your request to exercise a Data Subject Right, we will ask you to verify your identity by confirming your name, e-mail address, phone number, or other identifiable information that we have in our records, such as most recent interaction with us, if applicable.

If you exercise your right to appeal our determination with respect to your Data Subject Rights, and we deny your appeal, you may have the right to submit a complaint to your regulator. Information for your relevant regulator may be found below:

California Residents: You may contact the California Privacy Protection Agency here and the California Attorney General here.
Colorado Residents: You may contact the Colorado Attorney General here.
Connecticut Residents: You may contact the Connecticut Attorney General here.
Delaware Residents: You may contact the Department of Justice here.
Iowa Residents: You may contact the Iowa Attorney General here.
Indiana Residents: You may contact the Indiana Attorney General here.
Maryland Residents: You may contact the Consumer Protection Division here.
Minnesota Residents: You may contact the Minnesota Attorney General here.
Montana Residents: You may contact the Montana Attorney General here.
Nebraska Residents: You may contact the Nebraska Attorney General here.
Nevada Residents: You may contact the Nevada Attorney General here.
New Hampshire Residents: You may contact the New Hampshire Attorney General here.
New Jersey Residents: You may contact the Division of Consumer Affairs here.
Oregon Residents: You may contact the Oregon Attorney General here.
Rhode Island Residents: You may contact the Rhode Island Attorney General here.
Tennessee Residents: You may contact the Tennessee Attorney General here.
Texas Residents: You may contact the Texas Attorney General here.
Utah Residents: You may contact the Utah Attorney General here.
Virginia Residents: You may contact the Virginia Attorney General here.

Additional Disclosures for California Residents

If you reside in California, please read this section for additional disclosures about how we collect, use, and disclose information about you under the California Consumer Privacy Act (or “CCPA”) (California Civil Code Section 1798.100 et seq.).

Categories of Personal Information Collected: In the previous 12 months, we have collected the personal information listed in the section “What personal data do we collect about you?” above. This information falls into the following categories under the CCPA: identifiers; categories of personal information described in Cal. Civ. Code 1798.80(e); commercial information; geolocation information; audio, electronic, or visual information; internet or electronic network activity information; inferences drawn from the above categories.
Sensitive Personal Information Uses or Disclosures: The data that we capture about Consumers’ or Site Users’ interactions with some of our health-related online content intended for Consumers (like EContraOneStep.com) may be considered sensitive personal information related to your health and/or sex life. We use this interaction data to support cross-context behavioral advertising. You may request that we limit this use of personal information by contacting us as described in Contact Us at the end of this Privacy Policy.
Business or Commercial Purpose for Collecting and Selling Information: We collect personal information for the business and commercial purposes described in “What personal data do we collect about you?” and “How do we use your personal data?” above.
Categories of Sources of Personal Information: We collect personal information from and about you as described in “How do we collect personal data about you?” above.
Categories of Third Parties with Whom We Disclose Information: We may disclose your personal information with third parties as described in “How do we disclose your personal data?” above.
Categories of Personal Information Disclosed: In the preceding 12 months, we have disclosed the categories of personal information listed in “What personal data do we collect about you?” for the reasons described in “How do we disclose your personal data?” above.
Sale or Share of Personal Information: Because we engage in the practice of cross-context behavioral advertising, also known as online targeted advertising, we may “sell” and/or “share” your personal information as those terms are defined by the CCPA. In the preceding 12 months, we may have “sold” or “shared” identifiers, commercial information, employment or professional information, health and/or sex life information (usage and interaction data with certain health-related webpages in our Platform intended for Consumers like EContraOneStep.com), and internet or electronic network activity information with data analytics, advertising networks, and/or social media networks. We do not have any actual knowledge that we sell or share the personal information of users under the age of 16.

Cross Border Transfers

Company is headquartered in the United States and uses service providers around the world. As part of our data processing activities, we may transfer your personal data across borders, including into countries whose laws protecting personal data may not be as robust as your home country’s laws.

Updates to this Privacy Policy

This Privacy Policy is current as of the Effective Date set forth above. We may change this Privacy Policy from time to time, so please be sure to check back periodically. If we make any changes to this Privacy Policy that materially affect our practices with regard to the personal data we have previously collected from you, we will endeavor to provide you with notice in advance of such change by notifying you of the change on our Site or Platform, or by sending you an email. Your use of the Site or Platform following any such updates will constitute your acceptance of such updates.

For questions about our privacy policy, to make choices about receiving promotional communications, to request to exercise a Data Subject Right, or to update your personal data, you can contact us by email, at notices@afaxys.com or by writing us at Attn: Legal Department, PO Box 20158, Charleston, SC. 29413. If you would like to request to exercise a Data Subject Right, you may also use our webform, available here.

Additional Information for Job Applicants

This section supplements the information provided above and describes the additional personal information we collect when you apply for a job with the Company. We may collect the personal information in the below list in the following ways: directly from you; from publicly available sources, such as government entities, public records systems, and social media networks; data analytics providers and data brokers; or as you may otherwise authorize, such as former employers or references.

Please note if you use our Platform in the job application process, additional information is collected, as described above. We may collect the personal information categories listed in Cal. Civ. Code § 1798.80(e) (the California Customer Records Statute) in addition to the categories of personal information listed below. Items with an asterisk (*) may be considered “sensitive” personal information according to the CCPA.

Identifiers*: Government-issued identification numbers, including your Social Security, driver’s license, passport, state identification card, or military identification card numbers.
Public records and background check information (pursuant to your consent in accordance with applicable law): Current and past addresses, court records, credit and criminal history, and drug test results.
Demographics and Protected Classifications*: Citizenship, gender, date of birth, age, and other traditionally protected classifications that you choose to disclose, such as race and ethnicity, marital status, sexual orientation, veteran or military status, disability, and medical status.
Professional or Employment Related Information: professional associations and employment history, including name of employer, position, employer contact information, and associated employment records.
Educational Information: educational institutions attended, degrees and certifications attained, and other educational or student records, which may include details about attendance, grades, and academic and disciplinary history.

We generally collect this personal information in order to evaluate your application for employment. For more details about how we use and disclose the personal information listed here, please refer to “How do we use your personal information?” and “How do we disclose your personal information?” above.