BMS HEALTHCARE PROFESSIONALS PRIVACY NOTICEClick here to download or print a copy of this BMS general privacy notice.
If you are not a healthcare professional, or if you want to read additional information about our generalprocessing activities, you can access our General Privacy Notice (https://www.bms.com/privacypolicy.html).
If you reside in California, please find additional information in our section on 14.

Our Commitment
At Bristol Myers Squibb (BMS), your privacy matters to us. For us, data privacy goes beyond merecompliance with the law. BMS aims to collect, use, and share information that we obtain about you in amanner consistent with our company values, including high ethical standards, integrity, inclusion, fairness,and transparency. We have a dedicated internal team that reviews how BMS accesses, collects, uses, shares,
stores, transfers, deletes and protects information about you. To safeguard your data, BMS employs
reasonable and appropriate security measures. When upholding your rights as a data subject, you cancontact us to respond to any questions you might have that are not answered in this Notice at dpo@bms.com
or as described below.

1.

WHO WE ARE

We are Bristol-Myers Squibb Company (BMS), a company member of the Bristol Myers Squibb group. In
addition to this Notice, our details (name, address, etc.) may have been given to you separately at the timeof the collection of information about you, for example, in a form, a notice on an app or a website, or in an email, containing a link to this Notice. Together with our worldwide affiliates and other entities thatare part of

the

BMS

group whichhave arelationshipwithyou, we arethecontrollersofyour Personal Information. We refer to these entities as “BMS”, “we”, “us” or “our”.
You can access the main locations of our entities and facilities, and the markets where we distribute our
products and the countries where we operate on www.bms.com.

2.

INTRODUCTION - HOW THIS NOTICE APPLIES TO YOU

This privacy notice (“Notice”) is a global Notice. It describes how Bristol Myers Squibb may Use information
about you (“Personal Data” or “Personal Information”) as a healthcare professionals, medical
professional, personnel and staff of healthcare institutions (such as statisticians, pharmacists,
representatives of hospitals, clinicals, universities), government authorities, non-profit organisations, key
opinion leaders or influencers, with whom we interact (altogether “HCPs”, “you”, “your”). This Notice
applies when you interact with our company, in connection with your use of BMS websites, mobile
applications, devices and platforms, when we communicate with you and in the context of our businessactivities. It also informs you about your privacy rights and the measures and processes we put in place to2021 – JULY - 1

1 | 26

protect your data. We use the term “Processing” or “Use” when we refer to the access, collection, recording,organisation, structuring, retrieval, disclosure, storage, transfer, deletion or otherwise use of your Personal
Information.
In some instances, we may use your Personal Information in ways that are not described in this Notice. Where
this is the case, we will provide a supplemental or just-in-time Privacy Notice that explains such Use. You
should read any supplemental explanation in conjunction with this Notice.

Compliance with applicable laws
When Using your Personal Information in the context of our activities, we will do so in compliance with
relevant data privacy and data protection laws, which includes regulatory and national law requirementsthat may apply to such Use and, where applicable, giving you the specific rights that apply in the country
where you reside (altogether “Applicable Data Protection Law”).

3.

HOW WE USE YOUR INFORMATION ONLINE

We may collect your Personal Information online when you use BMS or third-party operated websites andother online resources, including mobile applications, other digital means or platforms. This may also
happen through collaborations that we have in place with third parties or companies that host websites for
us or with whom we have partnerships for our products, services, or activities. Below, we give you additional
information about how we use your information online.
You may interact with BMS or our partners’ websites and platforms that relate to BMS products and services,
job application, patient recruitment, disease awareness, scientific research, alliance websites, orapplications used in the context of patient support or management programs.
We enter into arrangements for those collaborations to require an appropriate protection of your Personal
Information. Some area of our websites and platforms may require you to submit information in order for
BMS to respond to your request, permit you to access specific areas or participate in a particular activity.
When visiting our websites, please also read our Legal Notice (https://www.bms.com/legal-notice.html) and
if you are visiting our website for safety reasons, our page on Pharmacovigilance Notice(https://www.bmsmedinfo.com).
We have identified examples where we Use your Personal Information online in the table below.
Online Information that we may collect when you use our websites
Contact information

If you communicate with us through the "contact us" link on our websites,
we may ask you for your Personal Information, such as your name, telephone
number, professional information and e-mail address so that we can verify
your identity or respond to your questions and comments.

2021 – JULY - 1

2 | 26

Website features

Our website offers various features, which we may change from time to time.
We may ask you to submit certain Personal Information so we cancommunicate with you about these features and manage them properly.

Contacting Medical

If you contact our medical information team (medinfo) or report an adverse

Information or

event in relation to a BMS product, the information you provide (including

reporting an adverse

your name, contact details, professional information and your questions) will

event

be documented and retained on our databases for purposes of dealing withyour enquiry and to comply with the law.

Connections andSome areas of our websites and platforms can be restricted. It may requireauthentication

you to log in with usernames, passwords and other authentication
mechanisms that belong to you, that you create or that we provide you. Whenusing such features, this may automatically allow us to access certain of youraccount credentials or other personal user account details to verify youridentity or that you have a valid license to practice as a professional.

Other uses of

We may Use the Personal Information you provide through BMS websites orinformation

platforms for our internal purposes. These purposes include administrationof the website, data analytics, compliance with our legal obligations or ourinternal policies and procedures.

Cookies and similar

When connecting to our various websites, applications, and other digitaltracking technologies

platforms, we may use cookies and other similar technologies that may allow
us or third parties to collect Personal Information about you. Depending on
the country where you reside, you may opt-in or opt-out from options or
technologies that we use and display. Please read our cookie section below
for more information.

Interest-BasedWe may use 3rd party advertising companies to tailor online and mobile

Advertising (IBA).

advertisements to you based on predictions about your interests. We explain
how we may Use your Personal Information in this context in our section
about cookies.

Links to other third-party websites
As a convenience to users, our websites contain links to other third-party websites that may offer additional
information, such as educational or professional materials, services and contacts. This Notice does not apply
to your use of those other websites. Before using the linked websites, please review their privacy notices tounderstand how they use and protect your Personal Information.

2021 – JULY - 1

3 | 26

4.

WHAT INFORMATION WE MAY PROCESS ABOUT YOU

We interact with you as an HCP and Use information about you during our activities, such as to conductclinical trials, for collaborations or commercial activities, for scientific projects, to understand the market or
improve our medicines and products. When doing so we may Process various categories of Personal
Information depending on your interactions with BMS or third parties with whom we collaborate, or externalsources from where we obtain your Personal Data. We have outlined below the main categories of Personal
Information and, where applicable categories of sensitive Personal Information that we may collect aboutyou.

Examples of general categories of Personal Information
Full name, personal or professional postal and/or email address, phone number
and other contact details about you, your organisation, or staff.
Contact
information

Examples: We may use your contact details, in particular when you interact orwork with us, when we communicate with you or share news, materials or invite
you to participate in our activities.
Full name, initials, date of birth, photographs, or government-issued
identification, such as driving licence, passport, professional licence number, or

Identification

government ID number.

information

Examples: To provide you with information on our products or diseases, we may
verify your license to practice in your specialisation area (for example throughour internal platforms or third-party services.
Payment-related information, such as your bank address or account details andnumber, tax-related information for business purposes, or other information

Financialabout you, your relatives, connections, your suppliers or third parties.

information

Examples: We Use such data to verify the absence of conflicts of interest, conduct
due diligence, to comply with anti-bribery laws, for billing purposes when you
collaborate with us, participate in advisory boards or render services to us.
Such information may include for example your:Your professional• Job title, position, educational information, professional qualifications,and backgroundreferrals, prescribing history, work experience, professional licenses orinformation

medical ID number, networks and affiliates, programs and activities you
participated in, resume; or2021 – JULY - 1

4 | 26• publications authored or co-authored, awards, board memberships,
professional conference and events, employment status, influence rankings,
individual travel and expense information and other information needed,such as to evaluate or initiate collaborations with you.
Examples: We Use such information to engage or work with you when BMS
evaluates the feasibility of a clinical study in a healthcare organisation where you
work or with whom you collaborate, when we use your publications, organise or
invite you to expert panels and advisory boards or when we get your data fromdatabases or other available sources.
Such information may include:• city and country where you practice;• date, nature and the value of the payment we have made to you or yourorganisation, which includes amounts and other advantages that you may
Spend transparency
information(Transfer of Value)

receive in the context of your services or collaborations with us;• information related to your organisation and your staff; or• information about payments and services you provided to BMS, including
invoices and other tax-related information, or VAT number.
Depending on the country where you reside, BMS Uses and discloses suchinformation based on your consent, transparency codes, the law or ourlegitimate interest to conduct our regular business activities. This information is
generally made publicly available on our official BMS websites.
In some cases, we may Use your Personal Information in order to classify,organise, rank or otherwise create profiles relating to you as a healthcare
professional, key opinion leader or as an influencer. This activity may include
collecting data about:

Categorization andclassification data

• your professional history, background, recognitions, number of publications;or• other information that we may collect from you or obtain from third-party
databases or other sources.
Example: We may process such information via certain software, our customer
relationship management system (CRM) or other analytics tools. You can readmore about this activity in section 10 below.

Publicly available

We may obtain information about you from publicly available sources, public ordata or data

private registries, or third-party databases. When obtaining such information, we

2021 – JULY - 1

5 | 26accessible frommay Use your professional contact, identification information and otherdatabases

professional and background information for pharmacovigilance reporting
purposes and, for example, to create categories or classifications based on yourarea of specialization, assess if your institution is qualified for a clinical study, topersonalize your e-mails and provide relevant scientific or interact with you in themost efficient and relevant manner.
We may Use media content, that may include Personal Information about you,Media data and yoursuch as your pictures, photographs, audio or video recordings.

image rights

Examples: Such content may originate from events, programs, interviews or otherinitiatives that we organise.
When using the internet, websites, devices or platforms, we may collect data,
including metadata, that originates from your use of BMS’s websites, websites,
mobile applications, social media channels and other connected devices (such as
medical devices and Apps). This may include:

Information
technology-related
data• Internet Protocol (IP) address, geolocation data, your information about yourdevice, browser, operating system, or device ID;• data captured through the use of cookies and similar tracking technologies,
which may include analytics information; or• information about the date and time of your request.
To read more about our Use of such information, read our cookie section.

Special category /In limited circumstances, we may collect data concerning your health or

sensitive Personalsensitive Personal Information about you, such as:

Data

•

health data that relates to special conditions, dietary preferences or(where permitted or

restrictions (such as food allergies) or disabilities when attending an

required by law)

event or when you visit our offices;•aggregate and/or de-identify information about you; or•driver’s licence number, or where permitted or required, your social
security number or bank account number;for example where needed for identification, accessibility and safety
purposes for visitors to BMS facilities and manufacturing sites or
institution, or for security, fraud prevention or detection purposes;•

use suggestions, comments, and ideas that are not personallyidentifiable. depending on the law of your country, text messages or
e-mail content (such as unsolicited communications), your precise

2021 – JULY - 1

6 | 26

geolocation, when using our applications, software, devices or
through the use of tracking technologies, your driving licence, bankaccount details.
Other categories ofFor more categories of Personal Data that we may collect about you, you can read

Personal Data

our BMS general privacy notice (https://www.bms.com/privacy-policy.html).

Please note: The categories of Personal Data listed above are not exhaustive and may vary depending on
the way that you interact with us or the type of Personal Data that BMS needs to Process for particular
activities. In the event that BMS Uses Personal Data about you which is not listed in this Notice, we will informyou of the information that we will Use at the time of collection or when we communicate with you.

5.

WHERE DO WE GET YOUR INFORMATION FROM

In most cases, BMS will collect Personal Information directly from you (such as when we collaborate withyou) although sometimes we will obtain information about you indirectly from public or third-party
information sources, databases or from use of web-based, devices or other technologies which
automatically generate such information. We have outlined below the main ways BMS collects and Processes
Personal Data when interacting directly or indirectly with you.
We may collect information from you directly:
Such as when:•

we conduct clinical trials, studies, research projects;•

we enable early access programs to patients or when you request us to provide patients with a BMS
product at an early stage, or for compassionate use;•

we provide innovative products or devices to patients, such as cell therapies or personalized medicines;•

you use or visit about offices and facilities;•

you connect to or use our websites, applications, devices or other digital platforms in the context ofclinical or commercial activities;•

you contact us through our different means of communication (email, call centers, medical
information), such as to obtain information about BMS products, diseases or treatments;•

you notify, or report medical information to, BMS that may relate to adverse events or incidents, in thecontext of pharmacovigilance or risk management programs via other similar channels (viapharmacovigilance or risk management touch points), which may include incidents or other postmarket surveillance obligation;•

we exchange or when you request, information before entering into a contract with you, and thereafter
during the term of such arrangement;•

we conduct due diligence, assessments, or when we evaluate your institutions’ eligibility to conduct a
clinical study and thereafter if we select your institution;

2021 – JULY - 1

7 | 26•

you interact with our BMS representatives in the course of our activities and interactions with you;•

you subscribe to our newsletters or want to remain informed about our activities or collaboration
opportunities or where the law requires it, you agree to receive promotional materials; or•

we conduct in-person or remote visits or exchange information with you about our products andactivities.

We may collect Information about you indirectly:•

when obtaining it from, or when you make your Personal Information available on, the website of yourinstitution or your office, the Internet, social media, and other digital platforms;•

when we access public or private registries, or publication databases, journals, societies, editorial
board websites, national registries, professional directories and third-party HCP databases;•

when conducting pharmacovigilance, incident management, risk management, monitoring activities,or, investigation, or litigation purposes;•

when we need to verify or obtain verification from third parties about your professional status, medical
licence, such as by accessing publicly accessible information, national registries or third-party
databases) or your identity for compliance, security or ID verification purposes;•

when you make public posts on social media platforms that we follow (for example, so that we canunderstand public opinions).

We may also collect information about you automatically, such as for security and systems monitoring (e.g.
through video (CCTV) recording) and building access control logs when you visit our offices or in othercontexts made apparent to you at the time.

6.

DATA MINIMIZATION

Where permitted and feasible, and to protect your right to privacy, BMS will take reasonable steps to remove,de-identify or anonymize information that may directly or indirectly identify you and restrict to the minimum
the amount of Personal Information that BMS Uses, submits or transfers to third parties, courts, orgovernmental bodies.

7.

FOR WHAT PURPOSES DOES BMS PROCESS YOUR INFORMATIONThis is a global Notice. BMS Processes your information in the context of our regular activities, and inaccordance with the purposes as set out in this Notice, a separate notice, or when Applicable Data Protection
Laws either permit or require us to do so. These purposes may vary depending on where you live and where
BMS operates. Where the laws of a country restrict or prohibit certain activities described in this Notice, wewill comply with such requirements. This may include refraining or not Using your Information for those
purposes restricted or prohibited in that country. Below, we list some of the main, but not all, of our purposes
for which we may Use Personal Information about you.

2021 – JULY - 1

8 | 26

Main purposes for which BMS may Use your Personal Information
We may Use your Personal Information in that context for example:•

to enable BMS to make more informed and objective decisions
when identifying and engaging with healthcare professionals andkey opinion leaders or influencers or managing the collaboration
relationship with you, your organisation or your staff;

For collaborations andresearch purposes•

to partner with other organisations including private or publicalliances, institutions, regional or local discussions, life science
industry groups, associations and consortiums; or•when obtaining and assessing feasibility, capability andperformance data from you, your institution and your staff, toconduct clinical trials or studies with your institution.
•

to engage with you about sciences and our activities;

To manage our relationship•respond to questions and comments; orwith you as an HCP•

to manage our client contractual relationship, including ourcollaborations or payments we make to you.

We Use your Personal Data for events and congresses, in particular:•

to invite you to our events or to participate in our congresses oradvisory boards; or•

to manage international or business travel, hotel reservations
and other arrangements necessary for organisational purposes;•

when we ask you to participate in interviews, panel discussions,to act as an ambassador or as speaker in a particular area; or

In the context of events andcongresses•

when using media content (i) internally for educational andcompliance purposes, to promote public health, diseaseawareness, (ii) externally on our company websites, social
media, or on external documentation that we may use as
testimony, ambassadorship, advisory or support to our brands,
products or other initiatives.

When conducting these activities, we comply with applicable codes ofconducts, laws and regulations that may prohibit certain types ofpromotional activities.

2021 – JULY - 1

9 | 26

Those activities may include when we:•

conduct patient support or management programs;•

send you links to surveys, questionnaires or studies;•

conduct specific market researches activities;•

collaborate with other companies, industry associations,authorities, patient advocacy organisations, for example

To support and improve ourcreating databases or when conducting research activities,

products and medicines or

including on real-world evidence studies; or

how you deliver healthcare•

propose, fund, offer grants or donation, or otherwise make theuse of medical devices or digital health capabilities available tohelp you better treat patients;

These activities allow us to better understand how to improve thesafety and quality of our products, the way you provide healthcare toyour patients.
Our clinical activities may include:•advising on activities involving you, healthcare organisations(HCOs) or patient organisations;

Using your data in the•

involving patients and clinical studies organisations;context of our clinical•engaging, assessing, and contracting with, your institution tooperations

conduct scientific research and clinical trials;•

providing you with literature required to decide on treatment; or•engaging in other commercial activities such as but not limited
to the provision of scientific information.

We conduct this activity when BMS or other third parties engage withyou remotely or via digital means, in-person or through newsletterson:Marketing, commercial and•information; orinterest-based
communications

content that relates to healthcare, medical and scientific•invitations to events or to participate in other initiatives that may
include market research, patient support programs or surveys);

When sending such communication to you, we may personalize suchcontent to your professional area and interests. You can read more in
our cookies section.

2021 – JULY - 1

10 | 26

Categorisation and classification enable us to engage with you, provide
you with more relevant information and news, invite you to speak to
ad-boards or propose collaborations with us. This may include:• conducting internal assessments or analytics about you that are
based on your feedback, evaluations, classifications, what you
publish on social media, or performance ratings of yourCategorization andclassification purposes

professional activities and outcomes;• creating professional profiles based on your publications,expertise and scientific recognition in your community; or• making classification or other rankings about you among otherprofessionals in your area of specialisation.
You can read more information in our section 10 below or read ourgeneral privacy notice (https://www.bms.com/privacy-policy.html)
for more information on data we collect on social media.
Using Personal Information about you when we:•

disclose to authorities how much we pay you (spendtransparency / Transfer of Value) or what advantages or benefit
that you may receive when collaborating with us;•

enforce our terms of use or other legal rights;

We comply with legal,•

conduct pharmacovigilance monitoring and reporting activities;

industry best practices and•comply with requests from governmental agencies, such as for

ethical obligations or codes

pharmacovigilance and reporting purposes, or risk managementof conducts

programs;•

have to comply with industry standards, our internal policies oranti-bribery or corruption laws; or•conduct due diligence, avoid conflict of interests or perform
audit, to detect, prevent, investigate misconduct, or in case ofinvestigations or disputes.

Achieve strategic andresearch purposes

For example, when we engage with Key Opinion Leaders or influencers
to enable us to make more informed and objective decisions or in thecontext of scientific research.

Communicate with you in

For example, communications, with the individuals, entities, andthe context of our businessinstitutions in the context of our business activities, including tooperations

provide training courses and awareness about our products.

2021 – JULY - 1

11 | 26

Conduct security, fraud or

For example, to ensure security and confidentiality of your data,crime detection andensuring a safe environment at our events, facilities, or networks.

prevention programs
When keeping and preserving information about you in order toInvestigations,protect our rights, or for the protection of third-party rights. In certain

prosecutions, or defence ofsituations, we may have to submit or transfer such information tolegal claims

third parties, courts, or governmental bodies.

Any other purpose that is relevant in the relationship between Bristol Myers Squibb and HCPs.

8.

HOW BMS JUSTIFIES USING YOUR INFORMATIONIn this section, we describe our legal justifications (commonly referred to as “legal basis”) for the Use of your
Personal Information related to each of our main Processing activities. We will use the legal basis that is mostappropriate for the purpose and circumstances related to such Processing. Below, we have explained which
legal bases we may choose or have to use when Using your Personal Information.
There may be times where we must use your consent to Process your Personal Information. We may alsodecide to ask your permission to Process your Personal Data, such as in the context of voluntary initiatives
or activities.
Please note: depending on the country where you reside, the law of your country may not require that BMS
use a specific legal basis to justify Using your Personal Information, including transfers of your Personal
Information outside your country (for example in the United States). However, when Applicable Data
Protection Law requires a legal basis, we will inform you about what legal basis we use at the time of thecollection or when we communicate with you. If your jurisdiction requires consent to Process your Personal
Information when you interact with us, we will obtain your consent prior to the Use of such Information.
In the following table, you can read more details about what applicable legal basis or combination of legal
bases we may use when Processing your Personal Information.
Our legal bases

Examples of activities that we conduct with your Personal Informationin the context of our clinical and commercial activities, and depending on

We may use ourthe law of your country of residence, we may rely on this legal basis:

legitimate business•interest to Process your
Personal Information

to conduct our commercial activities, business relationships andoperations;•where necessary for our, or a third party's, scientific and statisticalresearch purposes;

2021 – JULY - 1

12 | 26•

to interact with you (whether in-person or remotely) to present to you
our products or research, send you educational or promotional
materials, engage with you for market research, invite you to events,
send you surveys, run patient support or management programs, or
attend advisory boards meetings.

•

to assess and understand how you are positioned within your field ofspecialization in comparison to other healthcare professionals,
understanding your opinions about our brands, products andinitiatives;•

for remote and in-person interactions, including for electronic
marketing purposes (opt-out) and to maintain our databases whichcontain information about you; or•where permitted, to conduct analytics, categorize or classify
information about you.

We Use and keep your Personal Information for example:•

when we assess the feasibility and evaluate the performance of yourinstitution to conduct a study;

Based on the contractual•

when we grant permissions to access our systems;

relationship with you•

when we collaborate with you on projects and our clinical orcommercial activities;•

for billing purposes, audit, or due diligence purposes; or•for other purposes that relate to our contractual relationship with you.

We may Use your Personal Information, including keeping or sharing it withauthorities when permitted or as required by Applicable Data Protection
Laws, such as:•

to respond to or notify authorities about pharmacovigilancemonitoring

activities,

incidents,

or

other

post-market

surveillance obligations;
To comply with•in the context of clinical studies and clinical research;

applicable laws•

when you contact us for medical information inquiries;•

when disclosing how much we pay you for spend transparency incompliance with applicable laws or industry codes of conduct; or•to comply with industry standards, our internal policies or antibribery or corruption laws;

2021 – JULY - 1•

to conduct due diligence activities, avoid conflict of interests;•

to perform audits, or for tax and accounting purposes

13 | 26•

to detect, prevent, or investigate misconducts; or•to respond to government regulators, agencies, courts, or otherthird parties in legal proceedings, such as in case of investigations
or disputes.

We may use your prior permission when the law of your country requires us
to do so, for example to Use your Personal Information, disclose it, transfer
it to, or share it with, third parties, including outside your country ofresidence. In other instances, we may require your prior consent, or provide
you with a right to object for example when:•engaging with you, remotely or in-person, to send you commercial
communications electronically (via an opt-in or a right to opt-out),

With your consent

such as for direct marketing, market research, surveys, propose
collaborations, or for general interactions with you;•inviting you to events, which may require us to collect certain
health information, including special conditions, allergies or
dietary preferences about you; or•using media content containing your images (photographs, audio,or video) for interviews, events or other BMS initiatives.

When you consent to the Processing of your Personal Information, you may have the right to withdraw
that permission at any time. In such case, we will cease to Use your information in the future and, unless
BMS has an obligation to keep it for a longer period, we will employ reasonable measures to limit orprevent further Use of it. This includes archiving, blocking, or employing encryption, de-identification,
anonymization, or erasure techniques.

9.

WITH WHOM DO WE SHARE YOUR INFORMATIONAs a multinational company operating worldwide, your Personal Information may be shared with, oraccessed by, parties located outside your country of residence. If you are located outside of the UnitedStates, BMS may share your Personal Information with parties located in countries that provide lessprotection than in your country, which includes the United States. We may also Process and share your
Personal Information with some of our affiliates and other members of the BMS group including selected andapproved third parties (vendors and business partners) that help us operate worldwide. When doing so, we
implement appropriate measures to prevent unauthorized access or Use of your Personal Information.
Below you can find more information about how BMS shares your Personal Information within its group ofentities and with third parties.

2021 – JULY - 1

14 | 26

Sharing your Personal Information within the BMS group
Often, we share your Personal Information within the BMS group of companies (“BMS Group”). This may
include the Bristol Myers Squibb Company headquarters in the United States and all of its current and futuresubsidiaries, branch offices, affiliates, entities and other companies that are part of, owned or controlled by,
the BMS Group. When exchanging information internally, we rely on appropriate arrangements andmechanisms to cover any transfer of your Personal Information within our corporate structure, such as
binding corporate rules (BCRs), contractual arrangements approved by authorities or based on consent.

Sharing your Personal Information with third parties
To conduct our business, we share with, or disclose Personal Information to, third parties, such as:•

Third-party service providers for the purpose of outsourcing specific business activities to request
external support and resources. This may include companies that provide information technology
services, clinical trials and studies support, marketing or market research services, events, meetingand planning services, or services related to talent acquisition or consultancy;•

business partners such as external scientists and healthcare professionals to review and assist us
with healthcare compliance activities and institutions and other organizations with whom wecollaborate to support our clinical or commercial activities (such as for clinical studies, patient
support programs, and so on);•Regulatory and health authorities including governmental bodies (such as the FDA, EMA, NHS), dataprotection authorities, tax authorities, or courts in case of disputes, when permitted or required by
Applicable Data Protection Law; and•third parties to whom BMS is legally obligated to provide such information, such as other parties
in litigation or legal disputes, guardians, conservators, or individuals with powers of attorney.

When engaging with third parties, we enter into agreements with them for the Processing of Personal Dataso that such Processing is carried out in accordance with our instructions, in a confidential, secure, andtransparent manner in order to protect your privacy rights. When it is not possible to enter into an agreementwith a third party, such as when engaging, reporting or interacting with regulatory or health authorities orcourts, and when legally possible, we will use our best efforts to implement appropriate security measuresand controls (such as pseudonymisation) to protect your Personal Information.

Data sharing in connection with a transfer of control
Circumstances may arise where we decide to reorganize or divest part or all of our business or a line of ourbusiness (or any portion of our assets), including our information databases and websites, through a sale,divestiture, merger, acquisition, in the event of a bankruptcy, or other means of transfer. In any suchcircumstance, your Personal Information may be shared with, sold, transferred, rented, licensed, orotherwise provided or made available by us or on our behalf to actual or potential parties to, and in

2021 – JULY - 1

15 | 26connection with, the contemplated transaction (without your consent or any further notice to you). In suchcircumstances, we will seek written assurances that Personal Information about you submitted through thisWebsite will be protected appropriately.

If you are in the European Economic Area (“EEA”), Switzerland and the United Kingdom
Whenever we transfer your Personal Information within the EEA, Switzerland or to countries that are deemed“adequate”, such countries are deemed to offer the same level of protection as given by the law of yourcountry. When accessing your Personal Data from, or transferring it, outside of the EEA or Switzerland tocountries that may not provide the same level of protection as your own country, we will use appropriate
safeguards to protect your right to privacy. For example, such safeguards may consist of using Standard
Contractual Clauses (to exchange information with third parties outside of the EEA, Switzerland and theUnited Kingdom), Binding Corporate Rules (for data transfer within the BMS group of companies) as
approved by the European Commission or the competent authority, data transfer agreements or yourconsent.

If you are outside the EEA, Switzerland and the United Kingdom
Where possible, we will allow access to or the transfer of your Personal Information outside your country ofresidence:•

to countries that provide a reasonable high level of data protection;•using the most appropriate data transfer mechanisms available to BMS; or•

where required by Applicable Data Protection Laws, after we get your prior permission, for thecollection, disclosure to third parties and the transfer of your Personal Information to a country
which does not provide an adequate protection equivalent to the laws of your country of residence.

10.

CLASSIFICATION, AUTOMATED DECISION MAKING AND INDIVIDUALS’ RIGHTS

BMS may combine your Personal Data with other information we may already have about you or obtained
through public means such as scientific and medical publications, national registries, software, databases,or the Internet. We may also carry out internal assessments, evaluations, categorization, classification,
raking or ratings of your activities, and/or your institution or site’s performance, including analytics (whereapplicable). Below, we provide you with additional information about how we categorize or classify your
Personal Data.
We may use algorithms or third-party data sources to tier HCPs according to your research activity (including
publications) and skills (such as years of experience and qualifications). Where permitted by Applicable Data
Protection Law, applicable rates for speaking and event participation are set according to the tiering of HCPs.
Unless permitted by law, BMS does not make decisions based solely on automated Processing (including
profiling) of individual data unless we inform you otherwise prior to the Processing. This means that2021 – JULY - 1

16 | 26

when we use certain technologies, software, or algorithms, which may allow us to create profiles, tiering or
further understand trends and statistics, or use other advanced technologies or automated processing,
someone will be involved to validate decisions resulting from such use.
As the use of such technologies evolves, we may use algorithms without a person involved in the decision. In
this case, if this activity requires us to Process your Personal Information that is not anonymized, we willcomply with any applicable legal requirements, such as to draw this to your attention and provide you withinformation about the logic involved in the decision, as well as the significance and the envisaged
consequences for you of such Use of your Personal Information. Depending on your country of residence,
you will have the right to ask that such decision is taken by an individual.
WHAT ARE MY RIGHTS AND HOW TO EXERCISE THEM

11.

You have a number of rights related to the Personal Data that we Process about you (this will depend on thejurisdiction where you reside and the legal basis that we use). Most often, exercising your right is free ofcharge. We may also have to clarify your request and explain if we can comply with it or if this is restricted inyour situation. You can always contact BMS at dpo@bms.com or via this form (https://www.bms.com/
dpo/request.html) to find out more about your rights and how best to exercise them.
Below we have listed individual rights that may apply depending on your jurisdiction.
You may have the right to:•receive a copy of your Personal Data we hold about you;•correct your Personal Data we hold about you;•where applicable, receive a machine-readable copy of your Personal Data (portability);•

ask us to delete your Personal Data or restrict how it is used;•

where applicable, object to Processing of your Personal Data for certain purposes, such as when weuse it for marketing purposes (opt-out); and•where you have provided us with your consent to Use your Personal Data, you can withdraw yourconsent at any time without affecting BMS’ Use of such information before your withdrawal ofconsent.

Exceptions to your rights
There may be exceptions to your privacy rights described in this Notice. This depends on the country where
you reside, why we are Processing your Personal Data and if your request may impair the rights of others. If
we cannot comply with your request to exercise your privacy rights, for example when we keep yourinformation for regulatory purposes or for the investigation, prosecution, or defence of a legal claim, we will
explain this to you when you contact us.

2021 – JULY - 1

17 | 26

ExampleIf you ask BMS to stop sending you marketing communications by e-mail, we may keep your e-mail address
and other contact details in case we conduct other activities with you, such as when we have a contract withyou or if we have a legal or a regulatory obligation to keep your contact details.

How to contact us
If you have any questions about how we Use your Personal Information, please contact our Data Protection
Office at dpo@bms.com.

Note: We may need to request specific information from you to help us confirm your identity. If your request
is complex or if you have made a large number of requests, it may take us longer to respond to you, but wewill keep you informed of any delays. You will not have to pay a fee to obtain a copy of your Personal Data(or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly
unfounded, repetitive or excessive.

Lodging a complaint with a competent supervisory authority
In some countries, you may have the right to lodge a complaint to the relevant data protection or competentauthority if you believe that we Process your Personal Information unlawfully or are violating your rights.

12.

HOW LONG WE RETAIN YOUR INFORMATION

We aim not to retain your Personal Information for longer than necessary for the specific business purposes
for which it was collected. After that, unless we are required to continue to maintain the information by law,
we may anonymize, restrict, block or delete it.
In certain cases, BMS may retain your Personal Information for a longer period for the purpose that we have
and, in a manner, or a format, that may require BMS to keep certain identifiers. In such case, we may archive
it and apply appropriate measures which may consist of blocking, preventing, obfuscating, pseudonymizing,
key-coding, or restricting any further access and Use of Personal Information about you. When retaining andstoring information about you in our systems, we have put in place data retention schedules in accordancewith our company policy and in compliance with Applicable Data Protection Laws.
When assessing the appropriate retention period, we take into account the quantity, nature and sensitivityof Personal Data, the potential risk of harm in the event of unauthorised use or disclosure, the purposes of
the Processing and whether or not these purposes can be achieved by other means, as well as applicablelegal obligations.

2021 – JULY - 1

18 | 26

13.

HOW DO WE PROTECT INFORMATION ABOUT YOU

We implement appropriate technical and organizational controls to protect your Personal Information that
we hold to prevent unauthorized Processing, loss of data, disclosure, use, alteration, or destruction. Where
appropriate, we use encryption, pseudonymisation (such as key coding), de-identification and othertechnologies that can assist us in securing the information about you, including measures to restore accessto your information. We also require our service providers to comply with reasonable and recognized data
privacy and security requirements.
We conduct tests and reviews of our technologies and processes, including a review of our business partners
and vendors, so that our security controls remain effective. Also, we may further anonymize your Personal
Information when it is no longer needed for the purpose for which BMS originally collected such Information.

14.

STATE PRIVACY RIGHTSThis section applies to data subjects located in States which have implemented privacy laws (e.g. California).
Depending on the State where you reside or from which you originate, you may have certain specific rights(e.g., access and deletion) that apply to you. These rights are not absolute and only apply in certain
circumstances. This means that we may be unable (e.g., due to legal requirements), or not obligated, tosatisfy your request. In some cases, we may need to collect additional Personal Information from you toverify your identity before we provide access or delete your information, such as government-issued
identification. BMS will not discriminate against you for exercising your rights but may not be able to provide
you with services or programs that you have requested if we are not able to use your Personal Information.
To submit requests, please call 855-961-0474 or complete the online form at www.bms.com/dpo/us/request.
Below, you will find more information about State privacy laws.
CALIFORNIA
Under the California Consumer Privacy Act of 2018 (CCPA), its further amendments and related legal acts
(such as the California Privacy Rights Act of 2020), California residents may have specific rights regarding
their Personal Information held by private companies. The information in this section applies solely tovisitors, users, and others who reside in the State of California (“consumers,” “you”).

Your rights under Californian data privacy law

You have the right to ask us to disclose to you any Personal Information we
Disclosure

have collected about you in the last 12 months. In order to exercise this right,
BMS must first verify your identity to ensure it is a legitimate request, and thendisclose to you:2021 – JULY - 1

19 | 26

•The categories of Personal Information we have collected about you;•

The types of sources used to collect Personal Information about you;•

The types of third parties with which we have shared any of your
Personal Information (if applicable); and•The purpose(s) of collecting your Personal Information.

You have the right to request that we delete the Personal Information we have
Deletioncollected from and about you. In order to exercise this right, BMS must first
verify your identity to ensure it is a legitimate request, we will then delete therelevant information unless an exemption applies.

You have the right to designate an authorized agent to act on your behalf toexercise your rights under the CCPA. In order to do so, BMS must verify your
Authorized Agents

identity, and your authorized agent must have written permission from you.
We reserve the right to deny a request from an agent that does not submit
proof that they are authorized to act on your behalf.

Non-discrimination

Consumers with
Disabilities

You have the right to be free from unlawful discrimination for exercising yourrights under the CCPA.

BMS strives to accommodate all customers regardless of disabilities. If you
need to receive the information contained in this document in a different
format, please contact us using the contact information listed below.

To make a request please follow the link here (or here: www.bms.com/dpo/us/request.html) to our online form or contact us at the phone number below
Submitting a
Requestin the “Contact Information” section of this Privacy Notice statement. As
outlined above, BMS will need to verify your identity before we provide accessor delete your Personal Information and BMS may be unable (e.g., due to legal
requirements), or not obligated (e.g., due to applicable exemptions) to fulfill
your request (e.g., due to applicable exemptions) to satisfy your request.

Information BMS Collects
Personal Data, or Personal Information, means any information about an identifiable individual. BMS maycollect Personal Information directly from you (in person, through online forms, and other interactions withBMS employees, websites, and systems), or from other third parties.

2021 – JULY - 1

20 | 26

Please note: BMS does not “sell” your Personal Information. For purposes of this Disclosure, “sell” or “sold”
means the disclosure of Personal Information for monetary or other valuable consideration.

How BMS Uses Personal Information
The purposes for which BMS Uses Personal Information depends on the relationship or interaction with a
specific California resident, and we only Process your information for purposes permitted by Applicable Data
Protection Laws. BMS may Use Personal Information to operate, manage, and maintain our business, toprovide products and services, and to accomplish business purposes and objectives.
For more information about the purposes for which we Use your Personal Information please refer to section
7 of this Notice.

15.

COOKIES AND TRACKING TECHNOLOGIES

Depending on the country where you reside, you may manage your preferences on cookies and similar
tracking technologies through the use of consent management tools that are available on our websites. Thissection applies to cookies and similar tracking technologies and we explain what our use of cookies andsimilar tracking technologies means to you and how to disable tracking (such as using opt-in or opt-out
preferences). When we collect information that may enable us to identify you, the other sections of thisNotice will apply.

What are cookies?
A cookie is a small piece of data that a website asks your browser to store on your device in order toremember information about you, such as your language preference or login information. Such cookies
when set by us are called first-party cookies. We may also use third-party cookies – which are cookies from adomain different than the domain of the website you are visiting (for example, those used by social media,
instant messaging, CRM or marketing platforms, or advertising companies). For more information aboutcookies, types of cookies and how to manage cookies, including how to block them and delete them, please
visit http://www.allaboutcookies.org.
Below, we list the main categories of cookies and similar tracking technologies that we may use when you
connect to our websites, use our web-based platforms, applications, devices, or when you interact with us
electronically or when you receive electronic communications from us (“Online Use”). You can learn more
about the purposes for which BMS may use such technologies for your Online Use.

What categories of cookies may BMS use?
We generally use certain types of cookies during your session on our website (“session cookies”). To improveyour experience or remember your preferences or choices, we may use cookies that will remain on your2021 – JULY - 1

21 | 26

device unless you remove them (“persistent cookies”). When using cookies on our websites and other digital
services, such technology may include:

Categories of cookies and tracking technologies that BMS may use
Strictly necessary

Those cookies and tracking technologies enable our websites to operate andcookies

to improve the security of our website for your Online use, such as when you
have to authenticate or use login functionalities to access restricted parts of
our websites (such as using patient or physician login or page selection to
restricted pages or areas of a website or application).

Performance andanalytics cookies

Those cookies may allow BMS to:•

improve our websites;•

understand trends, statistics, capture audience metrics or other website
usage about the use of the website or other platform that we may use(such as for analytics purposes);•remember language or other preferences when you navigate; or•

use other features on our websites, applications, platforms and devices
to improve your Online Use.

These cookies enable us to better know the use of our websites, establish
statistics on their uses and visits (e.g. information on each visited page, howlong a user navigates on a specific page, how long it takes to download a
specific page, what are the users’ actions on each page (click, selection, etc.).
Social media cookies

On certain BMS websites, we may use social media plugins for you to shareinteresting content or to connect to certain accounts to share your Personal
Information with us. Such platforms may access your history of navigation andcollect information about your browsing journey under their own terms. You
can access more information when connecting to our websites.

Web server data and

BMS and 3rd parties we work with may also collect usage data from ourother technologies

Website, such as:

2021 – JULY - 1•

the source address that a page request is coming from (e.g. IP address);•domain name, date and time of the page request;•

the referring Website (if any); or•

other parameters in the URL (e.g., search criteria).

22 | 26

We use the above-mentioned data to better understand Website usage as awhole and to determine which areas of our Website users prefer (e.g., basedon the number of visits to those areas). BMS and 3rd parties we work with store
and use this information for statistical reporting.
Advertising cookies

Cookies classified as advertising cookies are specifically designed to gather
information from you on your device to display advertisements to you basedon relevant topics that interest you. To the extent BMS can use such cookies
and where relevant to the interaction with you, advertisers will place thesecookies on a website with the website operator's permission or inform you ina notice about the use of such advertising features. Read more information
about interest-based advertising below.

Other tracking

When using third-party software or websites, mobile applications, devices,

technologies

web-based platforms or through other Online use, the technology may involvecertain built-in tracking technologies. This may include:•

web beacons, web server data and similar technologies (in order toimprove user experience for our website visitors);•

tracking pixels, which we may include as an image in ourcommunications to you. This may allow us to understand when you readelectronic communications that we send you, to send you more accurate
and relevant content and improve our communications to you;•other trackers that enable functionalities such as remote interactions
with you through chatbots, instant messaging; or•

cookies used for authentication purposes (such as using physician login
to restricted pages or areas).

Why do we use cookies on our website?
In addition to the explanation provided in this Notice and the section above, we use cookies or similar
tracking technologies in various instances, such as for the following purposes:•

Making your experience more efficient, faster and easier: by remembering your preferences, likepreferred language, display and other settings, maintaining your session, and for authentication
purposes. This helps us to provide you with a better user experience. These cookies are also referred
to as Session-Id cookies, authentication cookies, and User Interface customization cookies.

•

Gain useful knowledge about how the website is used: by collecting information about the
number of visitors and other uses. This helps us improve our websites. These cookies are also

2021 – JULY - 1

23 | 26

referred to as analytics cookies. For this purpose, we use services such as Google Analytics whichmeans that Google and similar suppliers will also have access to this information (including your IP
address and any other equipment identifiers such as the IMEI number and the MAC address).
•

Provide easy access to our websites. This helps us to direct you, share with you our content within
websites such as Facebook, Twitter, LinkedIn, YouTube or Pinterest or allow you to share content
that is of your interest. To the extent we use such technology, these ‘social media plug-ins’ may store
cookies and similar technology on your computer or other device. This means that the social media
websites may access this information (including your IP address), may identify that you interactedwith the BMS website.

•

Improve our marketing communications to you. Certain cookies, such as web beacons or tracking
pixels, may be used by third party systems, such as customer relationship management systems orother service providers who help us manage e-mail campaigns. Those trackers enable us to better
understand the success of our communications and the relevance of the content that we share withyou. This may allow us to reduce the number of e-mails that we send you and provide you with
content, scientific information, or initiatives that are more tailored to your interests.

•

Collect and analyse advertising campaigns. We use, and allow certain 3rd parties to use, othertechnologies, such as web beacons, on our Websites and in our digital communications to tailor
advertising, or to measure the effectiveness of advertising campaigns. A web beacon is a clear GIF(Graphics Interchange Format) that a company can place on a website or in digital communications
to allow it or a third party (such as an Internet advertising, audience measurement, or social media
company). As a result, we and these 3rd parties may collect and use information about your online
visits to our Websites or engagement with our digital communications.

How can you object or refuse cookies?
Subject to the law of your country, in particular in the European Union, we will either inform you, ask yourprior permission (opt-in) before placing tracking technologies on your device, or provide you with a right toobject (opt-out) for the purposes that we describe in this section. Your web browser, e-mail software (suchas Microsoft outlook, or Google Gmail) and other clients that you use can be set to manage cookies andsimilar trackers and even reject them by default. Do bear in mind that if you set your browser to automaticallyreject cookies, your user experience when visiting websites will not be the same: your preferences may not
be remembered, some functionality may be lost and you may not be able to access certain areas or featuresof the websites.

Do-Not-Track Signals
When you visit our Websites, the collection of traffic data occurs even when do-not-track signals are enabledon your internet browser. Under certain circumstances, we may be able to identify you when you visit our
websites. For example, if you register on our website, we may be able to link your Personal Information to2021 – JULY - 1

24 | 26

previous visits on our websites depending on whether our website cookies from earlier visits are still stored
on your computer. For more information about do not track signals, visit https://www.allaboutdnt.com.

Interest-Based Advertising (IBA)
We may use 3rd party advertising companies to tailor online and mobile advertisements to you based on
predictions about your interests. Your interests could come from several sources including your browsing
activity, such as visits to our websites from your browser and device or your response to online
advertisements. These 3rd parties collect and store data about your interests based on your online andmobile activity using different technologies, such as placing or recognizing cookies on your browser,
recognizing device identifiers, or using pixel tags. These 3rd parties may also use these types of technologies
to recognize you across the devices you use.
For interest-based ads, to opt-out, you may click on the "AdChoices" icon within the advertisement or
Website which will take you to a page where you can learn more about interest-based advertising andmanage or opt out of the online targeting technology from the 3rd parties that we work with. Ad Choices Optouts are browser and device-specific; therefore, you should repeat your selections across each device andbrowser on you wish to be opted out. If you opt-out, you may still see advertising from Bristol-Myers Squibb
online or in mobile applications, but the 3rd parties we work with will not serve our ads based on predictions
about your interests. Also, if you delete or remove cookies or apps, your opt-out selections will not be
stored. You should review your opt-out preferences periodically, or update your choices to include newparticipating companies. In some cases, the 3rd parties we work with may still collect data about yourbrowsing activity and mobile application activity for other purposes but will not use this information to
select our ads that you see.
More information: To learn more about interest-based advertising and how to opt out in desktop andmobile, please visit http://optout.aboutads.info/#/ and http://optout.networkadvertising.org/#/. To opt out
of interest-based ads on mobile, you can download the AppChoices app at www.aboutads.info/appchoices.
Some parties we work with, such as social media platforms or other 3rd party technology platforms, havetheir own opt-out procedure. You should review the privacy policies of those properties to learn more about
how you can opt-out of interest-based ads on those websites.

Retargeting
The data captured through the tracking technologies used by our Websites may be shared with our 3rd party
advertising technology partners in order to provide you with targeted advertising that may appear on otherwebsites you visit on the internet. These partners use technology to match cookies on your computer withcookies placed on your computer by other websites you may visit or have visited. These partners may alsouse cookies and other technologies (e.g. web beacons) to recognize you across the devices you use, such asa mobile phone or laptop.

2021 – JULY - 1

25 | 26

Below we have identified the main cookies and categories that BMS uses on our websites and platforms.
For more details on the cookies that we use, you can read our cookie table below or, where applicable, on
the website that you use by accessing the relevant cookie notice.

16.

CHANGES TO THIS PRIVACY NOTICEBMS may update this notice from time to time by posting any revisions on this website. Where any material
revisions are made, BMS may place a prominent notice on this website and when legally required to do so,will directly notify you. You are bound by any such revisions and should therefore periodically visit this page
to review the most current privacy statement.

17.

CONTACT US

If you have questions about this Notice, or want to obtain more information about our privacy practices,
please contact our Data Protection Officer at dpo@bms.com, or alternatively online via this form
(http://www.bms.com/dpo/us/request.html) or contact us by postal mail at:
Contact

Name of the affiliate

For residents in theBristol Myers Squibb Company

United States you can

P.O. Box 640

contact BMS at:Palatine, IL 60078-0640
800-332-2056
United States

2021 – JULY - 1

26 | 26