; or (2) make any material changes in the collection, use, retention, sharing, or sale of the individual’s personal information. (b) Rules for approval (1) Procedures A covered entity shall obtain approval under subsection (a) in accordance with the procedures for notification under section 4. (2) Manner In order to satisfy subsection (a), approval shall be freely given, specific, informed, and unambiguous. (3) Withdrawal An individual shall have the right to withdraw his or her approval at any time. (4) Means A covered entity shall seek to obtain approval through the primary medium used to offer or deliver the covered entity’s product or service. (c) Exceptions A covered entity shall not be required to obtain opt-in approval from an individual under subsection (a)— (1) if collection is necessary for the performance of a contract to which the individual is party; (2) to take steps that an individual would consider necessary in order to provide a requested product or service; or (3) to take steps at the request of the individual prior to entering into a contract to which the individual is party. (d) Emergency or exigent circumstances (1) In general Subject to paragraph (2), a covered entity shall not be required to obtain opt-in approval under subsection (a) if the covered entity, in good faith, believes danger of death or serious physical injury to any individual requires use, access, or disclosure without delay of personal information relating to the emergency. (2) Notice requirement Not later than 90 days after the date on which a covered entity uses, accesses, or discloses personal information of an individual without obtaining opt-in approval under paragraph (1), the covered entity shall inform the individual of— (A) the personal information that the covered entity used, accessed, or disclosed; (B) the details of the emergency or exigent circumstances