Consumer Health Data Privacy Policy

CPAP Supplies 1992, LLC d/b/a Sleeplay

3200 N 29th Ave, Hollywood, Florida 33020 | 1-844-451-6555 | [email protected]

Effective Date: November 2, 2026

1. Why This Policy Exists

Sleeplay sells equipment used to treat sleep apnea. Buying that equipment says something about your health. Several states, including Washington and Nevada, treat that kind of information as consumer health data and require a company that handles it to publish a policy explaining what it does with it. This is that policy. Connecticut also gives consumer health data special protection.

This policy supplements our Privacy Policy. Where the two differ as to consumer health data, this policy controls. It applies to everyone, not only to residents of the states whose laws require it. Where a practice differs by state, this policy says so.

2. What We Treat as Consumer Health Data

We treat the following as consumer health data, whether you give it to us directly, we observe it, or we infer it:

• The fact that you have visited our Site, or have purchased, viewed, searched for, added to a cart, or asked us about equipment used to treat sleep apnea or another respiratory condition.
• Any prescription you submit to us, including the prescriber's name and license information, the date, the device prescribed, and the pressure or other settings prescribed.
• Any image or file you upload in connection with a prescription.
• Your answers to any sleep questionnaire, mask fitting tool, or product finder on our Site.
• Information you give our customer service team about your therapy, your diagnosis, your symptoms, your mask fit, or your comfort.
• The fact that you have requested or completed a consultation with a clinician through a service we make available.
• Any inference we or a service provider could draw from the above about your physical or mental health status, or your seeking of health care services.

3. Where the Data Comes From

From you, when you place an order, create an account, upload a prescription, contact customer service, use a product finder, or subscribe to our communications. From your device and browser, when you use our Site, in the form of the pages you view and the products you interact with. From your prescriber or their office, when we verify a prescription. From an independent telehealth medical group, if you use one through our Site and it sends us a prescription. From our carriers and payment processors, in connection with fulfilling and paying for your order.

4. How We Use It

We use consumer health data only for the following purposes and, where advertising technologies are enabled, for the advertising use of the fact of a visit described in Section 5:

Except for the fact of a visit described in Section 5, which can reach an advertising platform only where advertising technologies are enabled, we do not use consumer health data to build advertising audiences or for targeted advertising. We do not use it for profiling. We do not use it to train any machine learning or large language model, and our contracts with service providers that receive consumer health data limit their use of it to providing services to us.

5. Who Receives It, and Who Does Not

We share consumer health data only with the following categories of recipients. The advertising and outside analytics providers are named on our Advertising and Analytics Partners page, and you may ask us for a list of every third party and affiliate that has received your consumer health data (Section 7). Our service providers (the first, second, fourth and fifth categories) are contractually restricted to processing it on our instructions and for no other purpose. Our shipping carriers receive only what they need to deliver your package. The other recipients receive it only for the purpose described:

• Our order management, e-commerce and fulfillment platforms.
• Our payment processors, for the limited purpose of processing your payment.
• Our shipping carriers, which receive your name and address but not your prescription or clinical information.
• Our customer service and communications platforms.
• Our secure prescription storage provider.
• The independent telehealth medical group, if you elect to use it, and the prescriber or prescriber's office we contact to verify a prescription.
• Our professional advisors, including counsel and accountants, under a duty of confidentiality.
• A government authority, where we are compelled by subpoena, court order or other legal process, or where disclosure is necessary to protect someone's safety.
• An acquirer, in the event of a merger, acquisition or sale of assets, subject to this policy continuing to apply.
• Advertising platforms, where advertising technologies are enabled in your browser, which receive only the fact that your browser visited our Site.

We do not share consumer health data with any affiliate.

The consumer health data we share consists of order and purchase information, prescription information and images, questionnaire and product finder answers, customer service communications about your therapy, the browsing information collected by the tools built into our e-commerce platform, and, where advertising technologies are enabled, the fact of your visit described in the next paragraph. Each recipient receives only the categories it needs for the purpose described. Other than the fact of a visit, we do not sell consumer health data and we do not share it for advertising. We never disclose consumer health data to a data broker, and we do not use identity resolution services. We do not disclose to an advertising platform, or to an analytics provider used for advertising, your prescription, your purchases, the pages or products you view, your searches, the contents of your cart, your questionnaire or product finder answers, or your contact information. Advertising technologies, chat and session recording tools, and analytics tools other than those built into our e-commerce platform, do not run on our prescription upload pages, our telehealth intake pages, our cart, our checkout, or our order confirmation pages, in any jurisdiction, regardless of consent.

Advertising technologies, and analytics tools other than those built into our e-commerce platform, may run on the rest of our Site. Where they are enabled in your browser, an advertising platform can learn that your browser visited our Site, and because our Site sells sleep therapy equipment, that fact alone may suggest something about your health. We treat that fact as consumer health data. An advertising platform that receives it may collect information about your visits to our Site over time and across different websites and online services, and may use the fact of your visit to show you our ads elsewhere. That is why we ask for your consent before loading them where the law requires it, and why we do not load advertising technologies or outside analytics tools at all in some states, including Washington, Nevada, Maryland and New Jersey. We configure them so that they do not receive the pages or products you view, your searches, the contents of your cart, your purchases, or your contact information.

6. Consent

Where the law requires your consent, we ask for it before we collect consumer health data beyond what is necessary to provide the product or service you asked us for, and we ask separately before we share it. Each request identifies the specific data, the specific purpose, and the specific categories of recipients. Consent is requested through a clear affirmative act. It is never bundled into acceptance of our Terms of Use, and we do not treat your use of the Site, or closing or ignoring a banner, as consent. Where we ask for consent through our cookie preference center, the request states that it covers consumer health data.

You may withdraw consent at any time by emailing [email protected] with the subject line "Withdraw Health Data Consent," by calling 1-844-451-6555, or, for consent you gave through our cookie preference center, through the "Your Privacy Choices" link on our Site. We will stop the collection or sharing covered by that consent and confirm when we have done so. Withdrawing consent does not affect processing that already occurred, and it does not affect our ability to keep records we are required by law to keep.

7. Your Rights

You have the right to:

1. Confirm whether we collect, share or sell your consumer health data, and access the data we hold.
2. Obtain a list of all third parties and affiliates with whom we have shared your consumer health data, including an active contact for each.
3. Withdraw consent to the collection or the sharing of your consumer health data, separately as to each.
4. Have your consumer health data deleted. When you ask us to delete, we delete it from all of our systems, including archived and backup systems, and we notify every service provider, processor, contractor and other third party to whom we disclosed it, directing our service providers and processors to delete it and asking the others to do the same. We will tell you when this is complete.
5. Be free from discrimination or retaliation for exercising any of these rights.

There is one limit worth stating plainly. To the extent the law of your state permits it, where the law requires us to keep a record, such as a prescription that substantiates a shipment of a prescription device or a tax exemption, we will keep that record for the period the law requires, tell you that we are doing so and why, and delete it at the end of that period. We will not use a retained record for any other purpose.

8. How to Exercise Your Rights

Email [email protected] with the subject line "Health Data Request," call 1-844-451-6555, or write to CPAP Supplies 1992, LLC, Attn: Privacy, 3200 N 29th Ave, Hollywood, Florida 33020. You may use an authorized agent, in which case we will require written proof of the agent's authority.

We will acknowledge your request promptly and respond within forty-five (45) days. We may extend that period once by an additional forty-five (45) days where reasonably necessary, and if we do, we will tell you before the first period ends and explain why. For Nevada residents, we complete a deletion within thirty (30) days after we verify the request, without extension.

Before we act on a request to access or delete, we will verify your identity using information already in our records, such as the email address, order number and shipping address associated with your account. We will not ask you for a government identification document unless the sensitivity of the request makes it necessary. You may review and request changes to your consumer health data by contacting us as described above, and you can review your orders and update your account information by signing in to your account.

9. Appeals

If we decline your request, we will tell you why and how to appeal. To appeal, reply to our decision or write to Privacy Appeals at the address in Section 8. We will decide the appeal within forty-five (45) days and give you a written explanation. If we deny the appeal, we will provide you with a method to submit a complaint to the Attorney General of your state.

10. No Geofencing

We do not use, and will not use, a geofence around any health care facility, hospital, sleep laboratory, sleep clinic, pulmonology or otolaryngology practice, or durable medical equipment provider, for the purpose of identifying or tracking consumers, collecting consumer health data, or sending any advertisement or message relating to consumer health data. This prohibition applies to us and to anyone acting on our behalf.

11. How Long We Keep It

Prescriptions and prescriber information: seven (7) years after the end of the calendar year of the last order they support, because those records substantiate both our medical device compliance and our sales tax treatment. Order records containing consumer health data: seven (7) years after the end of the calendar year in which the order was placed. Customer service correspondence: three (3) years after our last contact with you, except that complaints, returns, warranty claims, reports of a product malfunction or injury, and billing or prescription disputes are kept for five (5) years after our last contact with you. Product finder and questionnaire responses: two (2) years after your last interaction with us. Everything else: no longer than necessary for the purpose for which it was collected. Each of these periods is subject to your right to deletion under Section 7. We keep a record longer than the period stated here only where the law requires it or a legal hold applies, and then only for as long as that requirement lasts.

12. Security

Prescription images and prescriber information are stored in an access-restricted repository available only to personnel who need them to verify an order or substantiate a tax exemption. Other consumer health data is available only to personnel and service providers who need it for the purposes described in Section 4. Our systems encrypt it in transit and at rest, access is logged, and administrative accounts require multi-factor authentication. Personnel with access are trained on the handling of this data. No system is perfectly secure, and we do not claim otherwise, but these are the measures we take.

13. If Something Goes Wrong

If consumer health data is subject to unauthorized access, acquisition, use or disclosure, we will notify you and, where required, the applicable regulators within the time and in the manner required by law. We treat an unauthorized disclosure as a breach, including a disclosure caused by a misconfigured tracking technology on our own Site. We do not limit the concept of a breach to an intrusion by an outsider.

14. Children

Our Site is not directed to children and you must be at least eighteen (18) years of age to purchase from us. We do not knowingly collect consumer health data from anyone under thirteen (13). If you believe we have, contact us and we will delete it.

15. Changes to This Policy

We will post any change here with a new Effective Date. If a change is material, we will notify you by email where we have your address, and we will not apply the change to consumer health data already collected without obtaining any consent the law requires.

16. Contact

CPAP Supplies 1992, LLC d/b/a Sleeplay, Attn: Privacy, 3200 N 29th Ave, Hollywood, Florida 33020. Telephone 1-844-451-6555. Email [email protected].