Nevada Consumer Health Data Privacy Policy
Last Updated: March 31, 2024

1.

INTRODUCTION | HOW THIS NOTICE APPLIES TO YOU

This Nevada Consumer Health Data Privacy Policy (“NV Health Policy” and “Policy”) applies toNevada Consumer Health Data that BMS and its affiliates (“BMS”, “we”, “our”) collects about
Nevada state residents (“Nevada Consumers”) who are subject to Nevada law, NRS Chapter 603A,
pertaining to consumer health data (“Nevada Consumer Health Data Act”).
“Consumer Health Data” as used in this Policy means personal information that is linked orreasonably linkable to a Nevada Consumer that BMS uses to identify that individual’s past, present,or future physical or mental health status.
This Policy does not apply to information we may collect about you that is exempt from the Nevada
Consumer Health Data Act which includes, without limitation, the following:▪

Information that is “protected health information” or “PHI” under HIPAA, which includes
health information▪

Personal information intermingled with PHI that is subject to HIPAA that we maintain in
our capacity as a health care provider under HIPAA▪

Personal information collected in connection with our recruitment and pre-screening ofclinical trial participants and in the operation of clinical trials and related research efforts,including the provision of expanded access to drugs that are the subject of clinical trials▪

Personal information used only for public health activities and purposes▪

Personal information subject to the Fair Credit Reporting Act▪

Personal information that federal or Nevada law expressly authorizes use to collect orshare, including when we function as a manufacturer under FDA regulations▪

Information that has been deidentified in accordance with HIPAA deidentificationrequirements▪

Publicly available information▪

Information collected about Nevada Consumers when acting in their capacity asemployees, independent contractors, or job applicants

When we refer to “Consumer Health Data” in this Policy, it does not include any of the categories
of personal information listed above.

2.

WHAT CONSUMER HEALTH DATA DO WE COLLECT ABOUT YOU

We collect the following categories of Consumer Health Data:▪

Information about health-related conditions, treatment, diseases, or diagnoses▪

Social interventions, such as interest in support groups▪

Medical interventions, treatments, and medication obtained or prescribed▪

Bodily functions, vital signs, symptoms, or measurements of other types of consumer
health data▪

Diagnoses or diagnostic testing, treatment, or medication

1|3

▪

Data that identifies individuals seeking health care services▪

Reproductive or sexual health information▪

Any inferences of the above categories of health information derived or extrapolated from
non-health information▪

Other information that may be used to identify your health condition

3.

FOR WHAT PURPOSES DOES BMS COLLECT YOUR CONSUMER HEALTH DATA

We collect and use Nevada Consumer Health Data for the following purposes:

4.

▪

To provide information about and provide our products, services and programs, including
patient support programs▪

To manage our relationship with you, including customer service or to respond to yourinquiries about our products and services▪

Undertake activities to verify or maintain the quality or safety of a product, service, ordevice that is owned, manufactured by, manufactured for, or controlled by us, and toimprove, upgrade, or enhance the service or device that is owned, manufactured,manufactured for, or controlled by us▪

For advertising and marketing purposes, including measurement of the effectiveness ofour advertisements and marketing programs▪

To comply with the law and our legal obligations, to respond to legal process and related
legal proceedings
WHAT ARE THE SOURCES OF CONSUMER HEALTH DATA

We collect your Consumer Health Data from the following sources:▪

Consumer Health Data that we collect from you directly, including:o participation in promotions or rewards, attendance at BMS programs and eventso data from connected devices or profiles, with permission
o data submitted through interactive features such as surveys or chat services▪ Consumer Health Data from third party sources, including:o industry groups and patient associations
o healthcare providers, insurance companies, third parties for benefit verification andprogram enrollment and product fulfillment services in connection with our products andservices
o authorized/legal representatives, family members, and caregivers
o advertising partners and data brokers for digital marketing services and analytics▪ Consumer Health Data collected from devices, including:o data collected through websites and apps
o data from mobile and internet-connected devices with permission
o data collected when contacting or visiting BMS, such as call recordings
o data from cookies, web beacons, and similar technologies on websites or third-partywebsites▪ Drawn from other information we collect to provide inferences about preferences,characteristics, attributes, and abilities drawn from collected data

2|3

5.

CONSUMER HEALTH DATA WE MAY SHARE WITH THIRD PARTIES OR AFFILIATES

We may share Consumer Health Data:▪ as required or permitted by law to comply with a subpoena or similar legal process orgovernment request, or when we believe in good faith that disclosure is legally required orotherwise necessary to protect our rights and property or the rights, property or safety ofothers, including to law enforcement agencies, and judicial and regulatory authorities, toprivate attorneys who issue subpoenas or otherwise serve us with legal process and, to theextent required, the individuals or entities they represent▪ with authorized representatives, including family members, caregivers, and legal
representatives▪ with our affiliates for the purposes described in this Policy. Our affiliates are listed in our 10K here.
We do not allow third parties to collect Consumer Health Data over time and across different
Internet websites or online services when you use our websites or online services

6.

WHAT ARE MY CONSUMER RIGHTS AND HOW DO I EXERCISE THEM?

Nevada Consumers as defined above have the following rights with respect to their Consumer
Health Data:▪ Right to Know: The right to confirm whether we are collecting, sharing, or selling theirConsumer Health Data
▪ Right to Know Third Parties: The right to obtain a list of all third parties with whom we haveshared or sold their Consumer Health Data
▪ Right to Delete: The right to request that we delete their Consumer Health Data
Additionally, Nevada Consumers have a right to request that we stop collecting, sharing, or selling
Consumer Health Data.
To exercise these rights, please contact BMS at dpo@bms.com or via this form. We may require
additional information to authenticate that you made the request(s). If we are unable toauthenticate the request(s) using commercially reasonable efforts and asking for additional
information, we will not be able to comply with the request.
We will respond to deletion requests within 30 days from when we receive your request and will
respond to other requests within 45 days. In some circumstances, we may need additional time toprocess your request. If we expect your request is going to take us longer than normal to fulfill,
we will let you know.
If your request is denied, you may appeal that decision as specified in our letter or denial. We willprocess and respond to your appeal within the time permitted by the Nevada Consumer Health
Data Act.

7.

CONTACT US

If you have questions about this Notice or want to obtain more information about our privacy
practices, please contact us at dpo@bms.com.

8.

MATERIAL CHANGES TO THIS POLICY

We may change this Policy from time to time and will notify you by a notice on our website andin this Policy of material changes.
3|3