Supplemental Privacy Notice for Residents of Certain U.S. States

Last Updated: August 10, 2026

This Supplemental Privacy Notice is for residents of certain U.S. States and supplements the information contained in our main Privacy Notice and applies to information collected by Prestige Consumer Healthcare, Inc. and each of its affiliates and subsidiary entities (collectively, “Prestige,” “we,” “our,” or “us”) from individuals who reside in U.S. states that have enacted comprehensive consumer data privacy laws (“consumers” or “you”).

PERSONAL INFORMATION WE COLLECT

The following lists the categories of personal information, as listed in the CCPA, that we collect and/or have collected currently and during the preceding 12 months.

• identifiers, like your contact information (i.e., email address, postal address, telephone number);
• information subject to Cal. Civ. Code § 1798.80(e) (i.e., information that identifies, relates to, describes, or is capable of being associated with a particular individual) like employment information, insurance information, education, or government records;
• internet or other electronic network activity information, including interaction with our Website;
• geolocation data, such as the location of your device or computer, for example if you enable location services to enhance your experience through event applications we offer or otherwise consent;
• sensory data, including audio, electronic, visual, or similar information;
• professional or employment-related information, such as work history, W2, background checks, resume or CVs, educational background, benefit information, professional experience, and other information, and user sessions and website IDs recorded from first-party cookies through the use of Google Analytics, if you are an employee with us;
• Sensitive personal information, including health information when you call us and voluntarily provide this information as part of your reason for the call; for employees, this may also include certain government identifiers such as SSN, driver’s license, or passport number.

RETENTION OF PERSONAL INFORMATION

We retain your personal data no longer than is reasonably necessary for the purposes for which it was collected and processed and in accordance with Prestige's data retention policy, and as required by applicable law, contract, or otherwise to comply with our legal obligations, resolve disputes, and/or to enforce our agreements.

SOURCES OF PERSONAL INFORMATION

To see the categories of sources from which we collect the personal information listed above, please see the Personal Data We Collect section in our main Privacy Notice.

PURPOSES OF USE OF PERSONAL INFORMATION

For the business and commercial purposes we have for collecting such personal information, please see the How We May Use Your Personal Data section in our main Privacy Notice.

The business purposes for which we may use personal information include:

• Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
• Helping to ensure security and integrity to the extent the use of the consumer’s personal information is reasonably necessary and proportionate for these purposes.
• Debugging to identify and repair errors that impair existing intended functionality.
• Short-term, transient use, including, but not limited to, non-personalized advertising shown as part of a consumer’s current interaction with the us.
• Performing services on our behalf, such as maintaining or servicing accounts, providing customer service, or verifying your information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services.
• Providing advertising and marketing services.
• Undertaking internal research to develop and demonstrate technology; and
• Conducting activities to verify, maintain, improve, upgrade, or enhance the quality or safety of our products and services.

DISCLOSURES OF PERSONAL INFORMATION

For the categories of third parties to whom we disclose such personal information, please see the How We May Disclose Your Personal Data section of our main Privacy Notice.

SALE, SHARING, AND TARGETED ADVERTISING

In the preceding twelve (12) months, Prestige has not engaged in the sale of personal information in exchange for monetary or other valuable consideration. However, as is common practice among businesses that operate Internet websites, Prestige has disclosed personal information collected through its websites to third parties for business and commercial purposes, including analytics and advertising. These disclosures may qualify as “sales” of personal information for consideration, sharing of personal information for cross-context behavioral advertising, or processing of personal information for targeted advertising under U.S. state comprehensive data privacy laws. We do not disclose personal information of individuals we know to be under the age of 18 to businesses or third parties for monetary or other valuable consideration as a “sale” of personal information, for targeted advertising, or as the “sharing” of personal information as defined under U.S. state comprehensive data privacy laws.

To instruct us not to sell or share personal information that is facilitated by cookies on our site, California residents can click “Do Not Sell or Share My Personal Information and request to opt out. Residents of other states with comprehensive privacy laws can click on “Your Privacy Choices” and request to opt-out. To opt out of offline sharing for targeted advertising contact us as set forth below.

USE AND DISCLOSURE OF SENSITIVE PERSONAL INFORMATION

We do not collect or process sensitive personal information for the purpose of inferring characteristics about you and therefore we do not offer a right under applicable law for you to limit our use or disclosure of sensitive personal information.

YOUR RIGHTS

If you are a resident of a U.S. state that has enacted a comprehensive consumer data privacy law, you may have one or more of the following rights, subject to certain conditions or exceptions as set forth under comprehensive privacy laws:

The Right to Access and Right to Know. You may have the right to request that we disclose to you:

• whether we process personal information about you;
• the specific pieces of information that we have collected about you;
• the categories of personal information we collected about you;
• the categories of sources from which it was collected;
• the business or commercial purpose of collecting, sharing or selling the personal information;
• the categories of personal information about you that we disclosed, sold or shared (as defined by the relevant laws) and the categories, or if applicable, a list of third parties with whom we disclosed, sell or share information;
• You may request to receive a copy of your personal information including specific pieces of personal information, including, where applicable, request to obtain a copy of your personal information in a portable, readily usable format (also called a data portability request).

Right to Correct

• You may have the right to request to correct inaccuracies in the personal information we have collected about you.

Right to Delete

• You may have the right to request to have the personal information that we collected from or about you deleted.

Right to Opt-Out

• You may request to opt out of sales or sharing for targeted advertising (or the “sharing” of your personal information for cross-context behavioral advertising). To submit an opt-out request, click here or as provided below under “How to Make a Request.”
• We do not process your personal information for profiling in furtherance of “decisions that produce legal or similarly significant effects” as such term is defined under applicable U.S. state comprehensive privacy laws.

If we receive and are able to process a signal from your device indicating your preference to opt out of the sale or sharing of personal information, as defined by applicable law, then we will apply that preference to personal information we collect from that device, provided that we may not be able to associate the signal with the same device if:

• you use a different web browser or other tool to interact with us,
• you make changes to your browser (e.g., uninstall and reinstall or certain types of upgrades) that impact our ability to associate the device with the signal your device originally sent, or
• you clear cookies or browsing data from your browser or device in a way that impacts our ability to associate the device with the signal your device originally sent.

Please note that a signal sent from one device may not apply to other devices you use or to data that we collect from you through other sources.

To learn more about opt-out preference signals generally, please visit the California Attorney General’s “California Consumer Privacy Act (CCPA)” page or the California Privacy Protection Agency’s “Frequently Asked Questions (FAQs).”

Right to appeal

If we decline to take action in any request that you submit in connection with the rights described above, you may ask that we reconsider our response by sending an email to privacy@PrestigeBrands.com or call us toll-free at 1-877-297-0721. You must ask us to reconsider our decision within a reasonable time after we send you our decision. We will respond to your appeal in accordance with the timeline set forth under applicable law. For all other questions or inquiries not related to your privacy related appeal, please reach out to 1-800-443-4908 or medical_affairs@cbfleet.com.

If we are acting as a data processor or service provider, we will forward your request to the applicable data controller, and reasonably assist the controller in honoring your request. We do not discriminate against any individual for exercising his or her data rights.

No Discrimination We will not discriminate against any consumer for exercising their rights under the state comprehensive privacy laws.

How to Make a Request

You may request to exercise the rights mentioned above via an online form here or call us toll-free at 1-877-297-0721. You will need to confirm your address and provide us with a way to contact you and sufficient information for us to confirm who you are. For all other questions or inquiries not related to privacy or a State Data Subject Request, please reach out to 1-800-443-4908 or medical_affairs@cbfleet.com.

We will verify and respond to your request consistent with applicable law, taking into account the type and sensitivity of the personal information subject to the request.

Authorized Agent

You may have the right to submit requests under the rights above through an authorized agent. To have an authorized agent submit a Data Subject Request Form on your behalf, the agent can do so by completing this Data Subject Request Form and specifying the agent's identity in the "I am a (an)*" text box.

We will ask for written, signed permission that the agent has been authorized to act on your behalf. Once written authorization is provided, we will review your Data Subject Request Form and respond to you as quickly as possible. We will respond directly to the email address provided by the authorized agent regarding the fulfillment of the Data Subject Request Form.

Verifiable Requests

As required or permitted under applicable law, we may take steps to verify your request before we can provide personal information to you, correct or delete personal information, or otherwise process our request, which may include the use of service providers. If we believe we need further information to verify your request as required by law, we may ask you to provide additional information to us. We will verify your request using only the necessary information required to validate your identity. We will not use personal information you provide in order for us to verify and process your request for additional purposes.

De-identified Information

Where we maintain or use de-identified data, we will continue to maintain and use the de-identified data only in a de-identified fashion and will not attempt to re-identify the data.

Direct Marketing Lists - California Shine the Light Law

California residents can request a list of all the third parties to which we have disclosed certain personal information (as defined by California’s Shine the Light law) during the preceding year for those third parties’ direct marketing purposes. California residents may contact us at Prestige Consumer Healthcare Inc., ATTN: Privacy, 660 White Plains Rd., #250, Tarrytown, NY 10591. (For all other questions or inquiries not related to privacy, please reach out to medical_affairs@cbfleet.com.)

In the body of your request, you must include: “California Shine the Light Request”, your name, a current California address including street address, city, state, and zip code, as well as sufficient information for us to determine if the law applies to you. You will need to attest to the fact that you are a California resident.

We will not accept requests by telephone, email, or facsimile, and we are not responsible for notices that are not labeled or sent properly, or that do not have complete information.