Can a pharmacy sell your personal information along with its business without your consent?