California & Federal Compliance, Delivery Responsibility & Limitation of Liability Policy

PharmDL LLC provides professional, reliable, secure, and convenient transportation and delivery services to assist patients, families, caregivers, healthcare organizations, pharmacies, and community members. PharmDL's mission is to facilitate and simplify lawful delivery services while supporting patients, families, caregivers, and the community.

PharmDL conducts its business with the intention of acting lawfully and professionally, protecting customer privacy and confidential health information, promoting safety, preventing misuse, refusing unlawful or dangerous deliveries, respecting applicable laws, and providing services in good faith. PharmDL does not knowingly participate in, facilitate, conceal, or assist illegal activity, and reserves the right to refuse, suspend, delay, cancel, or terminate a delivery when reasonably necessary to comply with law, protect safety, prevent fraud, or protect its personnel, customers, vehicles, property, or the public.

PharmDL intends to conduct its operations in compliance with applicable federal, state, and local laws. Depending on the service, transaction, and item transported, applicable requirements may include:

Federal:

• HIPAA (1996), including 45 C.F.R. Parts 160 and 164
• HITECH Act and HIPAA Privacy, Security, and Breach Notification Rules
• Federal Controlled Substances Act and DEA requirements (where applicable)
• Federal Food, Drug, and Cosmetic Act and FDA requirements (where applicable)
• Federal Trade Commission Act (unfair/deceptive practices)
• E-SIGN Act (electronic signatures and records)

California:

• Confidentiality of Medical Information Act (CMIA), Cal. Civ. Code § 56 et seq.
• California Consumer Privacy Act (CCPA), as amended by CPRA
• California Uniform Electronic Transactions Act (UETA), Cal. Civ. Code § 1633.1 et seq.
• Business and Professions Code (pharmacy, medication, regulated services)
• California data-security, breach-notification, and consumer-protection laws

California's pharmacy statutes regulate pharmacies and specifically regulated entities and should not be interpreted as automatically imposing pharmacy licensure obligations on an independent delivery company merely because it transports a package. Where a law imposes a requirement upon PharmDL, PharmDL will comply to the extent applicable.

PharmDL LLC is a delivery and logistics service. Unless expressly authorized and legally permitted, PharmDL does not:

• Prescribe medication or diagnose medical conditions
• Provide medical treatment or dispense medication
• Fill prescriptions, select medications, or determine dosage/strength
• Determine medical necessity or treatment plans
• Provide pharmaceutical advice or substitute medications
• Alter prescription instructions or make clinical decisions
• Determine whether a medication is medically appropriate
• Act as the patient's physician, pharmacist, pharmacy, or healthcare provider

PharmDL's ordinary role is limited to facilitating the lawful transportation and delivery of an authorized package from an authorized pickup location to an authorized delivery destination.

PharmDL does not require customers to provide unnecessary clinical medication information merely to arrange delivery. Generally, PharmDL does not require medication name, dosage, strength, diagnosis, treatment plan, or prescription instructions. Medication-related clinical responsibilities remain with the prescribing provider, pharmacist, pharmacy, patient, caregiver, or other legally responsible healthcare party.

PharmDL may request information reasonably necessary to determine whether a delivery can legally be accepted, whether transportation presents a safety concern, to identify the authorized pickup location or recipient, or to comply with applicable law. PharmDL's acceptance of a package does not constitute clinical verification or approval of its contents.

The Ordering Party represents and warrants that the information supplied to PharmDL is truthful, accurate, and complete. The Ordering Party is responsible for:

• Full name, telephone number, email address
• Patient information, pickup address, and delivery address
• Recipient information and recipient authorization
• Accurate delivery instructions and lawful use of services
• Lawful contents of the package and appropriate packaging
• Updating PharmDL when material information changes

For ordinary deliveries, the preferred recipient is the patient or the authorized Ordering Party. If another person will receive the delivery, the Ordering Party must identify that person and provide the applicable relationship or authorization. Available recipient relationships include: Self, Daughter, Son, Mother, Father, Husband, Wife, Caregiver, Legal Guardian, Power of Attorney, Authorized Representative, or Other authorized person. PharmDL does not independently adjudicate legal capacity, guardianship, POA status, or legal authority.

If a patient is bedridden, incapacitated, disoriented, incoherent, cognitively impaired, physically unable to receive the delivery, or otherwise unable to personally receive it, an appropriately authorized person may receive the delivery subject to applicable law and PharmDL's verification procedures. The designating person may be required to provide the patient's full name, the designated recipient's full name, relationship, nature of authorization, contact information, and other information reasonably necessary to document authorization.

The person making the designation represents that the designated recipient is authorized to receive the delivery on behalf of the patient or Ordering Party. The designator acknowledges that the designated recipient is authorized and capable of receiving the package, understands it is intended for the patient, will safeguard the package, and will not knowingly misuse or unlawfully distribute the contents. The designator may be required to electronically sign the designation. PharmDL may rely upon such representation unless it has a reasonable basis to believe the designation is fraudulent, invalid, unsafe, or unlawful.

PharmDL may require the recipient to state their full name, confirm their relationship to the patient, present appropriate identification, confirm authorization, sign for the delivery, and confirm the date and time of receipt. The Proof-of-Delivery system may record: recipient name, relationship, delivery date/time, delivery status, signature, confirmation of receipt, ID-verification status (where applicable), and other minimum information necessary for delivery documentation.

PharmDL does not independently verify medication name, dosage, quantity, strength, prescription accuracy, medication appropriateness, medical equipment specifications, or clinical treatment information. The pharmacy, prescribing provider, patient, Ordering Party, or other legally responsible party remains responsible for verifying the contents. PharmDL's acceptance of a sealed package does not constitute verification or endorsement of the contents.

The Ordering Party represents that the package is lawful and reasonably safe for transportation. PharmDL prohibits use of its services for illegal drugs, unauthorized controlled substances, weapons, explosives, hazardous chemicals, infectious or biological hazards, flammable materials, contraband, stolen property, fraudulent materials, or other prohibited materials. PharmDL may refuse or cancel any delivery when it reasonably believes that accepting or transporting the package would violate applicable law or create an unreasonable safety risk.

Customers must not knowingly submit packages that could endanger drivers, employees, or the public, damage vehicles or property, expose personnel to hazardous substances, or create unreasonable biological, chemical, fire, or explosion hazards. PharmDL may refuse a delivery when necessary to protect its personnel, contractors, customers, property, vehicles, or the public.

PharmDL is committed to protecting confidential information and Protected Health Information (PHI) when applicable. HIPAA applies to covered entities and, in specified circumstances, business associates. PharmDL will determine its HIPAA obligations based upon its actual services, access to PHI, contractual relationships, and applicable law. Where PharmDL is a business associate, applicable Business Associate Agreements and HIPAA obligations will be followed. Where PharmDL qualifies for a lawful HIPAA exception, it will maintain appropriate privacy and security practices consistent with its obligations.

Where applicable, PharmDL will comply with California privacy requirements, including CMIA and CCPA/CPRA. PharmDL intends to collect only information reasonably necessary for its services, limit access to authorized personnel, protect information using appropriate safeguards, avoid unnecessary collection of medication information, use information only for legitimate business, service, security, legal, and compliance purposes, maintain appropriate retention and deletion procedures, and respond to applicable privacy rights requests as required by law.

PharmDL may use reasonable technical and administrative measures to protect customer accounts and prevent fraud, abuse, unauthorized access, and automated attacks. Security information may include name, email, telephone, account and device information, IP address, login and transaction information, security events, and authentication information. IP address and other security information must be handled according to PharmDL's Privacy Policy and applicable law, and should not be treated as proof of a person's identity by itself. Security information should be used for legitimate purposes such as account security, fraud prevention, rate limiting, authentication, investigation of suspicious activity, system protection, and compliance. PharmDL should not use security information to shame, threaten, or improperly intimidate customers.

PharmDL may use electronic records, electronic acknowledgments, and electronic signatures where permitted by applicable law, under California UETA and the federal E-SIGN Act. The system maintains an auditable record showing customer identity/account, policy version, date/time of acceptance, required acknowledgments, electronic signature, order ID, recipient designation (where applicable), relevant security/audit information, and other information required for legitimate compliance and recordkeeping.

To the maximum extent permitted by applicable law, PharmDL's responsibility is limited to the delivery and logistics services it has agreed to provide. PharmDL does not assume responsibility for medical diagnosis or treatment, medication selection or appropriateness, dosage, medication interactions, clinical outcomes, prescription validity, actions of healthcare providers or pharmacies, actions of the patient or recipient after delivery, unauthorized misuse after delivery, or matters outside PharmDL's reasonable control. Nothing in this Policy shall be construed as excluding or limiting liability that applicable law prohibits PharmDL from excluding or limiting.

To the maximum extent permitted by applicable law, the Ordering Party agrees to indemnify and hold harmless PharmDL LLC and its owners, officers, employees, drivers, contractors, and authorized representatives from claims, losses, damages, liabilities, costs, or expenses arising from materially false information, unauthorized recipient designation, misrepresentation of authority, illegal package contents, improper packaging, misuse after delivery, unauthorized access after delivery, violation of applicable law by the Ordering Party or recipient, or other acts or omissions of the Ordering Party or recipient, except to the extent caused by conduct for which PharmDL cannot legally disclaim responsibility.

PharmDL may refuse, suspend, delay, or cancel a delivery when required information is incomplete, required authorization cannot reasonably be established, payment fails, the package appears prohibited, a safety risk exists, the delivery may violate applicable law, the pickup or delivery location is unsafe, materially false information has been supplied, fraud or abuse is reasonably suspected, or completing the delivery would create unreasonable risk.

Customers may not use PharmDL to obtain medications unlawfully, divert medications, commit prescription fraud, transport stolen medication or prohibited controlled substances, misrepresent a recipient, circumvent pharmacy or legal requirements, transport dangerous materials, or facilitate unlawful activity. PharmDL may cooperate with law enforcement or regulatory authorities when legally required or permitted.

Before booking an order, the customer must be presented with required acknowledgments and a master SELECT ALL checkbox. When SELECT ALL is selected, all mandatory acknowledgment boxes are selected automatically. If the customer intentionally deselects any mandatory acknowledgment, the system automatically deselects SELECT ALL and the other mandatory acknowledgments, displays a clear warning, prevents the customer from signing and completing the order, and requires the customer to affirmatively select SELECT ALL again.

Required Individual Acknowledgments:

• PharmDL LLC is a delivery and logistics service and is not my prescribing physician, pharmacist, pharmacy, or medical provider.
• PharmDL does not prescribe, dispense, select, or clinically evaluate medications or medical treatment.
• I am responsible for providing accurate customer, patient, recipient, pickup, and delivery information.
• I am responsible for ensuring that the package submitted for delivery is lawful and safe to transport.
• If someone other than the patient receives the delivery, I am responsible for identifying and authorizing that person.
• I understand that PharmDL may require identification, recipient confirmation, and a signature as proof of delivery.
• I understand that PharmDL does not assume responsibility for the medical appropriateness, dosage, effectiveness, or clinical use of medication or healthcare items.
• I will not use PharmDL services for unlawful, dangerous, fraudulent, or prohibited purposes.
• I understand that PharmDL protects PHI and other sensitive information in accordance with applicable legal and contractual requirements.
• I understand that PharmDL's responsibility is limited to the delivery services it provides, subject to applicable law.
• I certify that the information I have provided is accurate and complete.

The SIGN & CONTINUE button remains disabled unless all required acknowledgments are selected, SELECT ALL is active, the required signature is completed, required customer information is complete, required recipient information is complete where applicable, payment requirements are satisfied, and no applicable compliance or safety block exists.

If a customer previously began an order but did not complete the required acknowledgment, the system may recognize the returning account using information reasonably necessary for authentication and fraud prevention. An IP address alone must never be treated as definitive proof of identity. When a previously authenticated customer returns to complete an incomplete order, the system displays a "Welcome Back" message inviting them to review the required acknowledgments and select SELECT ALL. If the system detects repeated automated attempts, abnormal activity, or manipulation of the acknowledgment process, it may temporarily restrict the session or require additional verification.

The PharmDL AI Assistant uses this Policy as part of its customer-service knowledge base. Key FAQs: PharmDL does not verify medications; customers generally do not need to provide medication-specific information; the patient or authorized Ordering Party should receive the delivery whenever possible; an appropriately authorized person may receive it when the patient cannot; the required acknowledgment ensures customers understand the nature and limitations of PharmDL's service; a customer who does not complete the acknowledgment may return later.

The PharmDL AI Assistant must not diagnose, prescribe, recommend medication, change dosage, tell a customer to stop medication, provide pharmaceutical advice, determine legal capacity, determine POA validity or guardianship, make definitive legal conclusions, or promise absolute immunity from liability. Medical questions must be referred to the appropriate healthcare professional. Legal questions must be referred to qualified legal counsel or the appropriate authority.

PHARMDL LLC IS HERE TO HELP — NOT TO PRACTICE MEDICINE.

PharmDL facilitates the safe, lawful, secure, and professional transportation and delivery of authorized packages so that patients, families, caregivers, healthcare organizations, and communities can experience a more convenient and reliable delivery process. PharmDL intends to operate with integrity, professionalism, respect for human dignity, respect for privacy, and compliance with applicable law. PharmDL will not knowingly participate in illegal activity or knowingly facilitate conduct that compromises the health, safety, privacy, or wellbeing of its customers, employees, contractors, or community. PharmDL does not assume responsibility for matters outside the lawful scope of its delivery services, including prescribing, dispensing, clinical decisions, medication appropriateness, or the independent actions of customers, recipients, healthcare providers, pharmacies, or other third parties.

All provisions of this Policy shall be implemented consistently throughout the PharmDL ecosystem, including the website, customer registration, subscription enrollment, checkout, order booking, customer dashboard, order history, recipient authorization, electronic acknowledgment, electronic signature, SELECT ALL functionality, payment processing, order confirmation, order tracking, proof of delivery, driver application, dispatcher dashboard, admin dashboard, support dashboard, customer email and SMS, internal notifications, AI Customer Assistant, AI FAQ knowledge base, Terms of Service, Privacy Policy, Delivery Policy, Recipient Authorization Policy, Safety Policy, Prohibited Items Policy, audit logging, security monitoring, policy version control, and customer acknowledgment records.

The system maintains, where legally and operationally appropriate: policy version, effective date, customer/account identifier, date and time of acceptance, acknowledgment status, electronic signature, order ID, recipient designation, relevant audit events, and applicable security records. Where a material policy change requires renewed acceptance, the system requires the customer to review and accept the updated policy before placing a subsequent order.