Walgreens Privacy Policy

This document is Walgreens' publicly accessible privacy policy governing the collection, use, and sharing of personal information across its retail pharmacy website, mobile applications, and related services. The policy states that Walgreens collects identifiers, contact information, health and pharmacy data, financial information, device and browsing activity, location data, and inferences drawn from these categories; the terms authorize sharing this data with advertising partners, analytics providers, social media platforms, data brokers acting as service providers, and affiliates. Notably, the policy discloses sharing of certain personal data that may qualify as a 'sale' or 'sharing for cross-context behavioral advertising' under California law, and includes sensitive health-adjacent data collected in the pharmacy context alongside general retail data without consistently distinguishing HIPAA-covered data from non-HIPAA data. The policy engages CCPA/CPRA (California Consumer Privacy Act and its amendment), HIPAA as applicable to pharmacy and health services, the FTC Act governing unfair or deceptive practices, and state consumer protection frameworks; the applicability of HIPAA protections depends on whether specific data interactions occur within a covered entity context, and CCPA rights apply primarily to California residents. Material compliance considerations include the scope of health-related data sharing for advertising purposes, the adequacy of consent mechanisms for sensitive data categories, and the delineation between HIPAA-governed and non-HIPAA-governed data flows.