US Consumer Health Data Privacy Policy

• Introduction
• Categories of Consumer Health Data We Collect
• Purposes for Collecting Consumer Health Data and How We Use It
• Sources of Consumer Health Data
• Third Parties and Affiliates Whom We Share Consumer Health Data
• Your Privacy Rights
• Contact Us
• Policy Revisions
• Effective Date
• Supplement to Consumer Health Data Privacy Policy for Nevada Consumers

This US Consumer Health Data Privacy Policy (“Policy”) pertains to the collection of Consumer Health Data by MilliporeSigma, the Life Sciences business of Merck KGaA, Darmstadt, Germany, in the United States and Canada (“MilliporeSigma”, “We”, or “Us””). Safeguarding your privacy is a fundamental aspect of our commitment to you. This Policy is designed to provide transparency and clarity about our practices related to "Consumer Health Data" as defined by applicable laws, such as the Washington My Health My Data Act, the Nevada Consumer Health Data Privacy Law, and the Connecticut Data Privacy Act, along with other U.S. health privacy laws, as amended and including any regulations thereunder (“U.S. Health Privacy Laws”). Any term(s) appearing in this Policy defined under Washington’s My Health My Data Act will have the same meaning.

This Policy does not apply to information We collect and process about our employees in the United States, including job applicants; active and inactive employees; former employees; retirees; dependents; beneficiaries; employees of our third-party vendors and partners, such as contractors on assignment with Us; and other individuals about whom We collect information for HR related purposes. Further, this policy does not apply to health information used to engage in public or peer-reviewed scientific, historical, or statistical research adhering to applicable ethics and privacy laws.

Categories of Consumer Health Data We Collect

While not all products or services we utilize internally, in collaboration with partners, or which are provided to our customers will include Consumer Health Data, when applicable we may collect the following categories of Consumer Health Data:

• Health and Medical Information such a diagnosis details of diseases or medical conditions.
• Testing of, and measurement of specific types of symptoms, or presence of specific biological materials
• Genetic data, including complete and partial DNA sequence data, the genotypic and phenotypic information generated from analysis, and health data submitted for analysis in connection with raw sequence data.
• Internet and other electronic network Data derived by automated means from interaction with us to the extent such data may identifies your past, present or future health status in a customer profile.
• Other information that may be used to infer or derive data related to the above or other categories of Consumer Health Data.

Purposes for Collecting Consumer Health Data and How We Use It

We collect, use, and disclose Consumer Health Data for the purposes of supporting research, manufacturing of and development of our products and services, and/or to provide our customers with the products or services they have contracted for. As such, We may obtain and process Consumer Health Data for various purposes including:

• Providing our products and services, including performing customized services, and/or sending customized products as requested;
• Responding to customer service communications, questions, and/or requests for additional information;
• Providing support documentation about our products or services;
• Supporting security, including preventing, detecting, and investigating threats and protecting against malicious, fraudulent or other illegal activity;
• Complying with legal and regulatory requirements, such as audits, investigations, and data governance; and
• Advancing research and development, through both internal and collaborative research into the design and development of new products, services, and programs.

Sources of Consumer Health Data

We may collect Consumer Health Data from various sources, including:

• From healthcare providers, healthcare facilities, and health insurance providers;
• From publicly available sources and from commercial sources, including third parties who aggregate and sell Consumer Health Data or materials and derived information;
• From our Customers in connection with the services that we perform at their request and per their instructions;
• From third parties in connection with the services and research which they perform at our request;
• From third parties in accordance with recognized Medical Waste disposal and research usage standards; and
• From website visitors utilizing cookies and similar technologies on our websites and applications.

Third Parties and Affiliates Whom We Share Consumer Health Data

We share Consumer Health Data between our Subsidiaries, Affiliates, and related companies worldwide to support our ability to provide our products and services and operate our businesses. Affiliates Information

We may also share with the following Third Parties:

• Individuals or other entities at your direction, including disclosure to the public in marketing or promotional materials;
• Data processors, service providers, and contractors who assist us in providing our products and services who may only use the data as instructed and under obligation to maintain appropriate security measures;
• Government authorities, including regulatory agencies and courts, as required for our business operation, preserving or defending our legal claims, or as permitted by law;
• Other entities if We are involved in a merger, sale, joint venture or collaboration, assignment or a transfer of all or any portion of our business, or its assets;
• A Reseller or Distributor of our products and services, as reviewed and approved in accordance with local laws; or
• Our Customers who have purchased a product or service containing or utilizing Consumer Health Information linkable to a specific Individual or Consumer.

Your Privacy Rights

Subject to legal exceptions and limitations, you have specific rights with respect to your Consumer Health Data, including the right to:

• Know if we are collecting, using, or disclosing your Consumer Health Data, and to access that data, including receiving a list of the entities and affiliates with whom we have shared or sold your information.
• Request that we delete your Consumer Health Data.
• Withdraw your consent if we are processing your Consumer Health Data based upon your consent.

We will not discriminate or retaliate against any Individual for exercising their legal rights by submitting a request. However, upon receipt of a request We will validate the request and the requestor’s identity as part of processing the request in accordance with applicable U.S. Health Privacy Laws. If your request to exercise a right is denied, you may appeal that decision by contacting our Group Data Privacy Officer. If you are not satisfied with the result of your appeal residents of certain states may raise their concerns or lodge a complaint with their State Attorney General.

To exercise your request rights, you may visit our Privacy Rights Request Portal, call our Toll-Free Telephone Number at: +1 (888) 914-9661 (PIN 659429), or write to us.

Contact Us

For any questions or concerns about your Consumer Health Data privacy or this policy, you may contact us directly either via email to our Group Data Privacy Officer privacy@emdgroup.com, or write to Us at:

Group Data Privacy Officer
MilliporeSigma
400 Summit Drive
Burlington, MA 01803 USA

Policy Revisions

Our Policy may be revised from time to time. When a substantive change to this policy is made regarding the use or disclosure of Consumer Health Data, we will provide notice on our websites. Small changes or changes that do not significantly affect individual’s privacy interests may be made at any time and without prior notice.

Effective Date

The effective date of this Consumer Health Data Privacy Policy is June 30th, 2024. Implementation of this Policy, and any subsequent revisions made will not affect our prior use of Consumer Health Data.

Supplement to Consumer Health Data Privacy Policy for Nevada Consumers

This Supplement applies to Nevada Consumers for purposes of providing additional disclosures required by Nevada’s Consumer Health Data privacy law. Capitalized terms used in this Supplement are defined terms under Nevada’s Consumer Health Data privacy law and shall have the meanings set forth therein.

1. Purposes & Manner of Processing.
   We Collect, Use, Process, and Share Consumer Health Data for the purposes and in the manners described in our US Consumer Health Data Privacy Policy, which also provides additional disclosures relevant to Nevada Consumers.
2. Review & Revision of Consumer Health Data.
   If you would like to review and/or revise your Consumer Health Data, you may submit a request to us via the methods listed in our US Consumer Health Data Privacy Policy. We will respond to your requests to exercise your rights in accordance with applicable law, but in any case no later than 45 days after receiving your request. We may extend this period up to 45 days only where doing so is permitted under applicable law.
3. Changes to this Supplement.
   We will notify you before making any changes to our privacy practices with respect to your Consumer Health Data by posting an updated notice on this page, with an updated effective date.
4. Third Party Collection of Consumer Health Data.
   Please note that some Third Parties may collect Consumer Health Data about you over time and across different websites or online services you may visit.
   
   Effective Date June 30^th, 2024
   
   Version 2024-06 1.0