full

Thirty Madison Online Privacy Policy

Last Updated: December 1, 2022

1. INTRODUCTION

Thirty Madison, Inc., d/b/a Cove, Keeps, Facet, and River and 30M One, Inc. d/b/a Picnic (collectively “Thirty Madison”), and its subsidiaries and affiliates, understand the importance of your privacy and protecting your personal information. Accordingly, the purpose of this Privacy Policy (the “Policy”) is to describe how Thirty Madison collects, uses, and shares information about you to provide services to you (our “Service”) through our websites, social media, email exchanges, mobile apps, and other online services on which this Policy is posted. This Policy also describes how you can access, change, and remove your personal information. Please read this Policy carefully to understand what we do. If you do not understand or agree to any aspect of our Policy, please contact us before continuing to use our Service. This Policy is written in the English language. We do not guarantee the accuracy of any translated versions of this Policy. To the extent that any translated versions of this Policy conflict with the English language version, the English language version of this Policy shall control.

Nurx Inc. is also a part of the Thirty Madison family of brands. Nurx’s Privacy Policy can be found at: https://www.nurx.com/privacy-policy/.

Thirty Madison also manages medical groups that provide treatment to Thirty Madison customers and pharmacies that fill prescriptions for Thirty Madison customers. When Thirty Madison handles protected health information (“PHI”) on behalf of the medical groups and the pharmacies, Thirty Madison follows the medical group Notice of Privacy Practices and not this Policy. The medical group Notice of Privacy Practices, can be found at: https://patient.thirtymadison.com/dashboard/legals/kmg-notice-of-privacy-practices.

2. COLLECTION OF PERSONAL INFORMATION

Information You Provide to Us. We collect information you provide to us when you create or modify your account, register to use our websites (including, https://www.withcove.com/, https://www.keeps.com/, https://www.facet.thirtymadison.com, https://river.thirtymadison.com/, or https://picnic.thirtymadison.com/) (collectively, with our mobile application(s), the “Site”), purchase products or services from us, post comments or reviews on our Site, request information from us, contact customer support, or otherwise communicate with us.

Information We Obtain Indirectly. We may receive certain information about you through companies that provide us with such information as part of their relationship with us, including Meta, Google Analytics, Google Ads, Hotjar, Hubspot, Microsoft Bing Ads, Mixpanel, Stripe, and other third party tools. We may also receive information about you from your social media accounts if you use those accounts to sign-in to your account with us.

Information We Collect Automatically. When you use our Service, we collect certain information about you automatically through our use of cookies and similar technologies. These are described in more detail below.

Aggregate Information. We may combine information we receive from other sources with information you give to us and information we collect about you. Depending on the types of information received, we will use the information received from other sources or the combined information for the purposes described in this Policy.

3. CATEGORIES OF PERSONAL INFORMATION AND PURPOSE FOR COLLECTION

Thirty Madison only collects and processes the minimum amount of personal information from you necessary for our information processing activities, which includes the following categories of personal information: (1) contact information, including your name, address, email address, mailing address, postal address, and telephone number; (2) authentication information, including the user name and hashed password that you use to register an account on the Site; (3) financial information, which may include your debit or credit card number, its expiration date, and its security code for payment processing purposes; (4) personal characteristics, including date of birth, photographs of your ID and insurance card, general medical history, and other information relevant to diagnosis and treatment; (5) comments, reviews, and suggestions; (6) personal preferences, including product preferences, online preferences, and interests; (7) online behavior information including details of your visits to our Site, online activity, time spent viewing features, traffic data, location data, logs, language, date and time of access, frequency, and other communication data and the resources that you access and use on the Site; (8) and operating system, host domain, browser type, IP address, mobile network information, or device information. Our information processing activities include: conducting our business; customer communications and support; user verification; payment processing; shipping; quality management services; Site maintenance and improvements; designing, developing, and communicating with you about our features, products, and services; any purpose where you have given your consent (where legally required); enforcing our legal rights or subject to any consents or authorizations that are required by applicable law, including those of our subsidiaries, affiliates, etc. and any of their related businesses and those of our third-party partners; and complying with legal requirements. Where applicable, if Thirty Madison intends to further process your personal information for any other purpose, we will provide you with any relevant information on such additional purpose and obtain your consent, to the extent required by applicable law.

4. DISCLOSURE OF PERSONAL INFORMATION

Thirty Madison does not trade, rent, or sell your personal information to third parties. We may share or disclose de-identified information for any purpose without restriction and may share or disclose your personal information for the following limited purposes.

Healthcare Providers. We share your personal information with health care providers, including without limitation, clinicians, health care facilities and organizations, pharmacies, and laboratories. Health care providers will follow a separate Notice of Privacy Practices in how they use and disclose your personal information.

Vendors and Services Providers. We may provide information to third party vendors and service providers that perform services and functions on our behalf, such as to help us operate and manage our Service and the Site, process orders, and fulfill and deliver products and services that you purchase from us. These vendors and service providers may have access to your personal information in order to provide these services to us, but when this occurs, we implement contractual protections to limit their use of that information to help us provide our Service and support our interactions with you.

Your Consent to Have Your Personal Information Shared. We may also share personal information with companies, organizations, or individuals outside of Thirty Madison when we have your consent to do so.

Legal Disclosure. We will share personal information with third party companies, organizations, or individuals outside of Thirty Madison: (1) when we believe in good faith that access, use, or disclosure of the information is reasonably necessary to comply with a legal obligation; (2) when we believe in good faith that the law requires it; (3) at the request of governmental authorities conducting an investigation; (4) to verify or enforce our agreements, terms of use, or other applicable policies; (5) to respond to an emergency; or (6) otherwise to protect the rights, property, safety, or security of Thirty Madison, third parties, visitors to our Site, or the public, as required or permitted by law.

Transfer in the Event of Sale or Change of Control. If the ownership of all or substantially all of our business changes, or we otherwise transfer assets relating to our business or the Site to a third party, such as by merger, acquisition, bankruptcy proceeding, or otherwise, we may transfer personal information to the new owner. In such a case, unless prohibited by applicable law, your information would remain subject to the privacy policy applicable at the time of such transfer, unless you discontinue use of our Service. We will inform you of any such changes in ownership.

5. ACCESS TO YOUR INFORMATION AND CHOICES

Contact Us. You can access and update certain information we have relating to your online account by signing into your account and going to the Account section of our Site. If you have questions about personal information we have about you or need to update your information, you can contact us at,

Social Media Account Sign On. To the extent that you choose to use a social media account application (such as Google, Facebook, or Apple) to create your online account on the Site or otherwise sign into the Site, you understand that if another person has access to your social media account, they will also have access to your account on the Site. That means that other person could access any personal information contained on the Site. It is your decision about whether to give another person access to your social media account and whether to use that account to sign on to the Site. Also, if you use a social media account application to sign into the Site, you understand that the social media account application may send information from your social media account to Thirty Madison.

6. SECURITY OF YOUR INFORMATION

We have taken steps and implemented administrative, technical, and physical safeguards designed to protect against the risk of accidental, intentional, unlawful, or unauthorized access, alteration, destruction, disclosure, or use. The Internet is not 100% secure and we cannot guarantee the security of information transmitted through the Internet. Thirty Madison cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security, and improperly collect, access, steal, or modify your personal information. Where you have been given or you have chosen a password, it is your responsibility to keep this password confidential.

The sharing and disclosing of information via the internet is not completely secure. We strive to use best practices and industry standard security measures and tools to protect your data. However, we cannot guarantee the security of Personal Information transmitted to, on, or through our Services. Any transmission of Personal Information is at your own risk. We are not responsible for the circumvention of any privacy settings or security measures contained on our Site, in your operating system, or mobile device. Accordingly, it is your responsibility to protect the security of your login information, including your username and password.

7. COOKIES AND OTHER TECHNOLOGIES

We also collect information automatically as you navigate through our Site. We use the following technologies to automatically collect data:

Cookies. We and our service providers (e.g. sub-contractors, analytics providers, advertising networks, etc.) may use cookies, web beacons, and other technologies to receive and store certain types of information whenever you interact with our Site or Service through your computer or mobile device. A “cookie” is a small file or piece of data sent from a website and stored on the hard drive of your computer or mobile device. Some of the cookies we use are “session” cookies meaning that they are automatically deleted from your hard drive after you close your browser at the end of your session. Session cookies are used to optimize performance of the Site and to limit the amount of redundant data that is downloaded during a single session. We also may use “persistent” cookies, which remain on your computer or device unless deleted by you (or by your browser settings). We may use persistent cookies for various purposes, such as statistical analysis of performance to ensure the ongoing quality of our Site and/or Service. We and third parties may use session and persistent cookies for analytics and advertising purposes, as described herein. On your computer, you may refuse to accept browser cookies by activating the appropriate setting on your browser, and you may have similar capabilities on your mobile device in the preferences for your operating system or browser. However, if you select this setting you may be unable to access or use certain parts of our Site or our Service. Unless you have adjusted your browser or operating system setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our Site.

Meta Platforms. We use Meta Platforms (including, Facebook and Instagram) (collectively, “Meta”), a web analytics and advertising service provided by Meta on our Site. With its help, we and our customers can keep track of what users do after they see or click on a Meta advertisement, keep track of users who access our Site or advertisements from different devices, and better provide advertisements to our target audiences. The data from Meta is also saved and processed by Meta. Meta can connect this data with your Facebook or Instagram account and use it for its own and others advertising purposes, in accordance with Meta’s Data Policy which can be found at, https://www.facebook.com/about/privacy/. Please click here if you would like to withdraw your consent for use of your data with Meta https://www.facebook.com/settings/?tab=ads#=.

Google Analytics. We use Google Analytics, a web analytics service provided by Google, Inc. (“Google”) to collect certain information relating to your use of our Site. Google Analytics uses cookies, to help our Site analyze how users use our Site. You can find out more about how Google uses data by visiting “How Google Uses Data When You Use Our Partners’ Sites or Apps” located at www.google.com/policies/privacy/partners/. For more information, please visit Google and pages that describe Google Analytics, such as www.google.com/analytics/learn/privacy.html.

Google Ads (AdWords). Google Ads remarketing service is provided by Google Inc. You can opt-out of Google Ads for Display Advertising and customize the Google Display Network ads by visiting the Google Ads Settings page, http://www.google.com/settings/ads. Google also recommends installing the Google Ads Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout) for your web browser. Google Ads Opt-out Browser Add-on provides visitors with the ability to prevent their data from being collected and used by Google Analytics. For more information on the privacy practices of Google, please visit the Google Privacy Terms web page: https://policies.google.com/privacy?hl=en.

Hotjar. Our Site uses Hotjar’s services, a third party service provider, which helps us better understand our users’ experiences (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and enables us to build and maintain our Site and Service with user feedback. Hotjar uses cookies and other technologies to collect data on our users’ behavior and their devices, in particular: device IP address, captured and stored only in anonymized form; device screen size; device type (unique device identifiers); browser information; geographic location (country only); and preferred language used to display our website. Hotjar stores this information in a user profile that does not reveal who the user is to Hotjar. Neither Hotjar nor Thirty Madison will ever use this information to identify individual users or to match it with further data on an individual user. For further details, please see Hotjar’s privacy policy by clicking, https://www.hotjar.com/legal/policies/privacy/. You can opt-out to the creation of a user profile, Hotjar’s storing of data about your usage of our Site, and Hotjar’s use of tracking cookies on other websites by clicking this link, https://www.hotjar.com/policies/do-not-track/.

Hubspot. We use Hubspot, a service provided by Hubspot, Inc. Hubspot uses web beacons and cookies stored on your computer and mobile device and enabled to allow us to analyze the use of our Site. HubSpot evaluates the collected information (e.g. IP address, geographical location, type of browser, duration of the visit, and pages accessed) on our behalf in order to generate reports on the visit and the pages visited. You can find more information on the data collected by HubSpot and its processing in HubSpot’s privacy policy, https://legal.hubspot.com/privacy-policy. You can find more information on the cookies used by HubSpot here and here. If you generally do not want HubSpot to collect data, you can prevent cookies from being stored at any time using your browser settings.

Microsoft Bing Ads. Our Site uses Bing Ads technology to collect and store data that is used to track user activity on our Site. On our Site Bing UET tag is integrated. This service enables us to track user activity on our Site when it has reached our Site via advertisements from Bing Ads. If the page visitor reaches our Site via such an ad, a cookie is set on their computer. This cookie enables us to track, among other things, the length of time spent on our Site, which areas of the Site were accessed, and which advertisements reached our Site. The collection of the data generated by the cookie and related to the use of our Site, as well as the processing of this data, can be prevented by deactivating the cookies setting by visiting your browser setting. In addition, based on the user’s preferences, Microsoft may be able to track usage behavior across multiple electronic devices through cross-device tracking, enabling it to display personalized advertising on or in Microsoft websites and apps. This behavior can be disabled by the site visitor at https://choice.microsoft.com/en-us/opt-out. For more information on Bing analytics services, visit the Bing Ads Web site. For more information about privacy at Microsoft and Bing, see the Microsoft Privacy Bing Ads Website Policy.

Mixpanel. Mixpanel is provided by Mixpanel, Inc. (“Mixpanel”) and is used to provide analytics about our Site application. You can prevent Mixpanel from using your information for analytics purposes by opting-out. To opt-out of the Mixpanel service please visit Mixpanel’s site, at https://help.mixpanel.com/hc/en-us/articles/360000679006-Managing-Personal-Information. For more information on what type of information Mixpanel collects, please visit Mixpanel’s terms of use, https://mixpanel.com/legal/terms-of-use/.

Stripe. We use Stripe as our payment processor. In order to allow Stripe to function properly, a cookie is stored on your browser, which assists Stripe in detecting and preventing fraud. These are considered session cookies and typically only remain on your browser for 24 hours. For more information on Stripe, please visit their privacy policy at, https://stripe.com/au/privacy.

Other Third Party Tools. We use other third party tools that allow us to track the performance of our Site. These tools provide us with information about errors, app and website performance, and other technical details we may use to improve our Site and/or our Service. For more information related to these third-party analytics providers please review Sections 2 through 4 above.

8. ADVERTISEMENT

We may use data about how you browse and shop in order to show you ads for Thirty Madison or our advertising partners that are relevant to your interests. We may use cookies and other information to provide relevant interest-based advertising to you, and ad networks to which we belong may use your browsing activity across participating websites to show you interest-based advertisements on those websites. We may also share your Personal Information with entities that assist us with marketing and advertising. Interest-based ads are ads presented to you based on your browsing behavior to provide you with ads more tailored to your interests. These interest-based ads may be presented to you while you are browsing our Site or third-party sites not owned by Thirty Madison. Where permitted by applicable law, we may also receive Personal Information about you from third party sources (e.g., lead generators) to determine whether a Thirty Madison product or service is right for you and to send promotional emails to customers and prospective customers. Currently, our Site does not recognize if your browser sends a “do not track” signal or similar mechanism to indicate you do not wish to be tracked or receive interest-based ads. If you would like more information about these practices, please click, https://optout.aboutads.info/#!/

9. CHILDREN’S PRIVACY

If you are under the age of 18, please do not attempt to register with us at this Site, engage our Service, or provide any personal information about yourself to us. If we learn that we have collected personal information from someone under 18, we will promptly delete that information. If you believe we have collected personal information from someone under the age of 18, please contact us at:

10. SPECIAL NOTE TO CALIFORNIA RESIDENTS

In compliance with California law, we provide California residents with certain information and access upon request (“Consumer Request”). If you are a resident of California, the California Consumer Privacy Act (“CCPA”) provides you with additional rights regarding your Personal Information. This section describes the Personal Information we collect about you, how we use and disclose it, and how you can exercise your privacy rights under the CCPA.

Your privacy rights under the CCPA do not apply to all information that we might collect, use, or disclose. For example, the CCPA does not apply to PHI governed by the Health Insurance Portability and Accountability Act (“HIPAA”), “medical information” governed by the California Confidentiality of Medical Information Act (“CMIA”), or other patient information we maintain in the same manner as PHI or “medical information.” The CCPA also excludes other categories of information. When we collect, use, or disclose information not covered by the CCPA, we do so as described in this Policy (excluding this Section) and applicable Notice of Privacy Practices. If you would like to learn more about how we collect, process, or disclose your information that is not covered by the CCPA, or to exercise the rights that may be available to you under HIPAA and other laws, please review this Policy (excluding this Section) and applicable Notice of Privacy Practices.

For your Personal Information covered by the CCPA, your rights are outlined below, including how California residents can request the information and what you can receive. If you would like to submit a Consumer Request related to the CCPA, you or your authorized agent can contact us at:

If you choose to submit a Consumer Request, you must provide us with enough information in your request to identify you. Thirty Madison will only use the information you provide to respond to your request. Thirty Madison will not be able to disclose information if it cannot verify that the person making the Consumer Request is the person about whom we collected information, or someone authorized to act on such person’s behalf. “Personal Information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. “Personal Information” does not include publicly available information.

Request to Access. You may submit a Consumer Request to obtain a copy of or access to the Personal Information that Thirty Madison has collected on you. You also may designate an authorized agent to make a request for you. To use authorized agent, you or your authorized agent must: submit proof that the authorized agent is registered with the California Secretary of State and that you have authorized be able to act on your behalf, submit evidence that you have provided the authorized agent with power of attorney pursuant to the California Probate Code; or provide the authorized agent written and signed permission to act on your behalf, verify your identity with us, and directly confirm with us that you have provided the authorized agent permission to submit the request. We may deny a request from an authorized agent who does not submit sufficient proof to act on your behalf.

Request to Correct Inaccurate Personal Information. You may submit a Consumer Request to correct inaccurate personal information. Thirty Madison will use commercially reasonable efforts to comply with such requests and correct inaccurate Personal Information.

Request to Know. You may submit a Consumer Request to receive information about Thirty Madison’s Personal Information collection practices. You may request information on: the categories of Personal information Thirty Madison has collected about you; the categories of data collection sources; Thirty Madison’s business or commercial purpose for collecting, using, or selling that Personal Information; the categories of Personal Information that Thirty Madison has sold or shared; the categories of third parties with whom Thirty Madison shares Personal Information, if any; and the specific pieces of Personal information we collected about you. Thirty Madison is not required to retain any information about you if it is only used for a one-time transaction and would not be maintained in the ordinary course of business. Thirty Madison is also not required to reidentify Personal Information if it is not stored in that manner already, nor is it required to provide Personal Information to you more than twice in a twelve-month period. If you would like to know if the Thirty Madison has disclosed information about you to specific third parties, you may receive information about the categories of Personal Information that we disclosed to third parties for their direct marketing purposes by contacting us at:

You may receive the names and addresses of those third parties, and you may request this information for the year prior to your request. Note that these particular requests may only be made once per calendar year. Additionally, please be aware that only sharing activities covered by California law will be included in our response to your request.

Request to Delete. You may request that Thirty Madison delete your Personal Information. Subject to certain exceptions set out below, upon receipt of a verifiable Consumer Request we will delete your Personal Information from our records and direct any service providers to do the same. We will also notify all third parties with whom Thirty Madison has shared your Personal Information of your request to delete your Personal Information. Please note that we may not delete your Personal Information if it is necessary to: complete the transaction for which the personal information was collected; provide a good or service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between you and us; detect security incidents, protect against malicious, deceptive activity, and take all necessary and appropriate steps to mitigate current and future risk; debug and repair internal information technology as necessary; undertake internal research for technological development and demonstration; exercise free speech, ensure the right of another consumer to exercise his/her/their right of free speech, or exercise another right provided for by law; comply with the California Electronic Communications Privacy Act; engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the achievement of such research, provided we have obtained your informed consent; enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us; comply with an existing legal obligation; or otherwise use your Personal Information, internally, in a lawful manner that is compatible with the context in which you provided the information.

Right to Opt-Out. You have the right to opt-out of the sale of your Personal Information. We do not sell your personal information for money, but we use cookies and similar technologies that may result in your Personal Information being shared with third-parties in a manner that could be construed as a sale under the CCPA. Please see the sections titled “Cookies and Other Technologies” and “Advertisement” for more information. Additionally, some of our vendors may use your data in a way that could be construed as a sale of data under the CCPA, for example by using machine learning on identity documents to improve an identity verification platform as a whole or for purposes of cross-context behavioral advertising. To opt out of the sale of data, click “Do Not Sell My Personal Information” on the Thirty Madison homepage or mobile application, click here, or contact us at:

Thirty Madison may not, and will not: treat you differently because of your Consumer Request or Opt-Out activity; deny goods or services to you; charge different rates for goods or services; provide a different level of quality of goods or services; or suggest any of the preceding will occur. However, we can and may charge you a different rate, or provide a different level of quality, if the difference is reasonably related to the value provided by your Personal Information. Further, some Service functionality and features may change or become unavailable upon deletion or restriction on use of your Personal Information.

11. SPECIAL NOTICE FOR NEVADA RESIDENTS

Thirty Madison does not sell, rent, or lease your Personal Information to third parties. However, if you are a resident of Nevada and would like to submit a request not to sell your personally identifiable information, you may do so by contacting us at:

12. LINKED SITES

The Site may contain links to third party owned or operated websites, including, without limitation, social media websites (each a “Linked Site”), as a convenient method of accessing information that may be useful or of interest to you. This Policy and the practices that we follow under this Policy do not apply to Linked Sites. We are not responsible for the content, accuracy, or opinions expressed on any Linked Site or for the privacy practices or security standards used by third parties on such Linked Sites. These Linked Sites have separate privacy and data collection practices, and we have no responsibility or liability relating to them. Accordingly, if you use Linked Sites through our Site, to login to our Site, or to share information about your experience on our Site with others, these Linked Sites may be able to collect information about you, including information about your activity on our Site. In accordance with their own privacy policies, the Linked Sites may further notify your social media connections about your use of our Site. You understand and agree that by clicking on a link to a Linked Site or using a Linked Site as described above, this Policy, as stated on the Site, is no longer in effect because you have either left our Site or used a Linked Site to interact with our Site.

13. USER CONTENT

Some features of our Service may now or in the future allow you to provide content, such as written comments or reviews, to be published or displayed on public areas of the Site (“User Content”). Be careful about giving out information in public areas of the Site. The information you share in public areas may be read, collected, or used by any user of the Site. We cannot control the actions of other users of the Site with whom you may choose to share your User Content.

14. CONSENT TO PROCESSING OF PERSONAL DATA IN UNITED STATES

This Site is intended for use only by residents of the United States (“U.S.”) . If you are a citizen of the European Economic Area (“E.E.A.”) or other jurisdiction outside of the U.S., please note that in order to provide our Site and Service to you, we may send and store your personal information (also commonly referred to as personal data) outside of the E.E.A., including the U.S. Accordingly, your personal information may be transferred outside of the country where you reside or are located, including to countries that may not or do not provide the same level of protection for your personal information. By using and accessing our Site, users who reside or are located in countries outside of the U.S. agree and consent to the transfer to and processing of personal information on servers located outside of the country where they reside, including to the U.S., and that the protection of such information may be different than required under the laws of their residence or location.

15. CHANGES TO OUR PRIVACY POLICY

While this Policy may change from time to time, Thirty Madison will enforce and comply with all applicable laws with respect to this Policy, any future versions of this Policy, our Service, our rights, and our obligations to you. We will post any privacy policy changes to our Site. The date this Policy was last modified is identified at the top of the page. You are responsible for periodically monitoring and reviewing any updates to this Policy. Your continued use of our Site after such amendments will be deemed your acknowledgement of these changes to this Policy.

16. QUESTIONS AND HOW TO CONTACT US

If you have any questions, concerns, complaints, or suggestions regarding this Policy, please contact us:

Or write us by U.S. postal mail at the following address:

Thirty Madison, Inc. 82 Nassau St #61392 New York, NY 10038

abbr

Go for a Picnic. Bring our newsletter.

Twitter

Take the Quiz


Thirty Madison

© 2022 Picnic