Last Updated: September 2, 2026

This Washington Consumer Health Data Privacy Policy supplements the Kroger Family of Companies Privacy Policy and applies to “consumer health data” subject to Washington State’s My Health My Data Act (MHMDA).

Some of the products we sell and services we provide may result in the collection of information that qualifies as consumer health data under Washington law. Consumer health data is personal information that is linked or reasonably linkable to you and that identifies or may reveal your past, present, or future physical or mental health status. For example, purchases of certain products or use of certain services may reveal information about health conditions, diagnoses, treatments, medications, bodily functions, symptoms, diagnostic testing, or reproductive or sexual health.

We do not analyze customer data to make inferences about our customers’ past, present, or future physical or mental health status.

We may use consumer health data described above:

• provide, maintain, and improve our products and services;
• process and fulfill your purchases, transactions, and requests;
• personalize your experience and help you find relevant products and services;
• communicate with you, including providing account, order, and product-related notifications;
• conduct research, analytics, forecasting, and business planning;
• maintain the safety, security, and integrity of our systems, products, services, customers, associates, and business operations;
• detect, investigate, and prevent fraud, theft, and other unlawful activity;
• comply with legal obligations and manage legal, regulatory, compliance, auditing, and risk management activities;
• facilitate mergers, acquisitions, divestitures, and other corporate transactions;
• create aggregated or deidentified information; and
• carry out other purposes disclosed to you at the time of collection or with your consent, where required by law

Creating Aggregated or Deidentified Information. When we create aggregated or deidentified information, we do so in a manner such that it is no longer considered personal information under applicable law. We may use aggregated or deidentified information to analyze general trends in our business and to provide trends and insights in aggregated form.

As described in the "How We Collect Your Information" section of our Privacy Policy, we may collect consumer health data:

• directly from you;
• from your interactions with our stores, websites, mobile applications, products, and services;
• from other companies within The Kroger Family of Companies;
• from publicly available sources; and
• from third parties and our service providers.

As defined by MHMDA, we share consumer health data with the categories of affiliates and third parties. When we share consumer health data, we do so in accordance with applicable law.

Affiliates. We may share consumer health data with The Kroger Co. and its subsidiary 84.51 LLC. 

Government Authorities and Other Parties for Legal, Security, and Safety Purposes. We may share consumer health data with governmental authorities, law enforcement, regulators, courts, or other parties when necessary to:

• comply with applicable law, legal process, or regulatory obligations;
• respond to subpoenas, court orders, or other lawful requests;
• protect the rights, safety, and security of our customers, associates, business, or others; or
• detect, investigate, prevent, or address fraud, theft, security incidents, or other unlawful activity.

Parties Involved in Corporate Transactions. We may share consumer health data in connection with a merger, acquisition, divestiture, bankruptcy, reorganization, or other corporate transactions.

Aggregated and Deidentified Information. We may share information that has been aggregated or deidentified in a manner such that it is no longer considered personal information under applicable law. When we share deidentified information, we require recipients to comply with applicable restrictions on reidentification.

MHMDA provides covered individuals with certain rights to access, delete, and, to the extent applicable, withdraw consent relating to their consumer health data, subject to certain exceptions. 

We do not currently use consumer health data in a manner that requires us to first obtain consent, so we do not provide individuals with a right to withdraw consent.

If you would like to exercise the rights outlined above, please submit a request by either:

• Selecting the privacy right you wish to exercise on our Privacy Preference Center
• Calling us at 1-800-KROGERS (1-800-576-4377)

We may take steps to authenticate your identity before responding to your request by asking you a series of questions about your previous interactions with us or ask you to provide other knowledge-based qualifiers.

If your request to exercise a right under the MHMDA is denied, you may appeal that decision by following the instructions that we provide when we deny your request. If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.

This policy is subject to change at our discretion. We will indicate changes to the policy by updating the “Last Updated” date at the beginning of the notice. We will communicate material changes to you in accordance with applicable law, which may include through a notice on a printed receipt, the website home page, or a notice to the email address specified in your account (if you have provided one to us). Your continued use of our websites or our other services after any update to this notice will constitute your acceptance of our changes.

If you have any questions or concerns about this policy or the practices described herein, you may contact us via email at KrogerPrivacyOffice@Kroger.com or by telephone at 1-800-KROGERS (1-800-576-4377)