; or (2) if the provider so chooses, the provider may comply with the requirement of paragraph (1) by obtaining opt-in approval from the user to use, disclose, or permit access to any such non-sensitive user information. (c) Limitations and exceptions A provider of a covered service may use, disclose, or permit access to user information without user approval for the following purposes: (1) In providing the covered service from which such information is derived, or in providing services necessary to, or used in, the provision of such service. (2) To initiate, render, bill, and collect for the covered service. (3) To protect the rights or property of the provider, or to protect users of the covered service and other service providers from fraudulent, abusive, or unlawful use of the service. (4) To provide location information or non-sensitive user information— (A) to a public safety answering point, emergency medical service provider or emergency dispatch provider, public safety, fire service, or law enforcement official, or hospital emergency or trauma care facility, in order to respond to the request of the user for emergency services; (B) to inform the legal guardian of the user, or members of the immediate family of the user, of the location of the user in an emergency situation that involves the risk of death or serious physical harm; or (C) to providers of information or database management services solely for purposes of assisting in the delivery of emergency services in response to an emergency. (5) As otherwise required or authorized by law. (d) Mechanism for exercising user approval (1) In general A provider of a covered service shall make available a simple, easy-to-use mechanism for users to grant, deny, or withdraw opt-in approval or opt-out approval at any time. (2) Form and manner The mechanism required by paragraph (1) shall be— (A) clear and conspicuous; and (B) made available— (i) at no additional cost to the user