Washington Consumer Health Data Privacy Policy
Last updated: March 31, 2024

1.

INTRODUCTION | HOW THIS NOTICE APPLIES TO YOU

This Washington Consumer Health Data Privacy Policy (“WA Health Policy” and “Policy”) applies to
Washington Consumer Health Data that BMS and its affiliates (“BMS”, “we”, “our”) collect about
Washington state residents and other individuals whose Consumer Health Data is collected in
Washington (collectively, “Washington Consumers”) who may be subject to the Washington My
Health My Data law (“Washington MHMD Act”).
“Consumer Health Data” as used in this Policy means personal information that is linked orreasonably linkable to a Washington Consumer and that identifies the Washington Consumer’s past,present, or future physical or mental health status.
This Policy does not apply to information we may collect about you that is exempt from theWashington MHMD Act which includes, without limitation, the following:▪

Information that is “protected health information” or “PHI” under HIPAA, which includes
health information▪

Personal information intermingled with PHI that is subject to HIPAA that we maintain inour capacity as a health care provider under HIPAA▪

Personal information collected in connection with our recruitment and pre-screening ofclinical trial participants and in the operation of clinical trials and related research efforts,including the provision of expanded access to drugs that are the subject of clinical trials▪

Information we create and maintain in our role as a manufacturer under applicable laws▪

Personal information used only for public health activities and purposes▪

Personal information subject to the Fair Credit Reporting Act▪

Information that has been deidentified in accordance with HIPAA deidentification
requirements▪

Publicly available information▪

Information collected about Washington Consumers when acting in their capacity asemployees, independent contractors, or job applicants

When we refer to “Consumer Health Data” in this Policy, it does not include any of the categories
of personal information listed above.

2.

WHAT CONSUMER HEALTH DATA DO WE COLLECT ABOUT YOU

We collect the following categories of Washington Consumer Health Data:▪

Information about health-related conditions, treatment, diseases, or diagnoses▪

Social interventions, such as interest in support groups▪

Medical interventions, treatments, and medication obtained or prescribed▪

Bodily functions, vital signs, symptoms, or measurements of other types of consumer
health data▪

Diagnoses or diagnostic testing, treatment, or medication▪

Data that identifies individuals seeking health care services▪

Reproductive or sexual health information

1|3

▪

Biometric data▪

Any inferences of the above categories of health information derived or extrapolated from
non-health information▪

Other information that may be used to identify your health condition

3.

FOR WHAT PURPOSES DOES BMS COLLECT YOUR CONSUMER HEALTH DATA

We collect and use Consumer Health Data for the following purposes:

4.

▪

To provide information about and provide our products, services and programs, including
patient support programs▪

To manage our relationship with you, including customer service or to respond to yourinquiries about our products and services▪

To undertake activities to verify or maintain the quality or safety of a product, service, ordevice that is owned, manufactured by, manufactured for, or controlled by us, and toimprove, upgrade, or enhance the service or device that is owned, manufactured,manufactured for, or controlled by us▪

For advertising and marketing purposes, including measurement of the effectiveness ofour advertisements and marketing programs▪

To provide accommodations, including with respect to food allergies, at our events▪

To monitor and improve our websites and for internal business analysis▪

To comply with the law and our legal obligations, to respond to legal process and related
legal proceedings▪

To prevent fraud and provide security, including preventing activities that violate ourTerms of Service or that are illegal, and to protect our rights and the rights and safety of
our users and others
WHAT ARE THE SOURCES OF CONSUMER HEALTH DATA

We collect your Consumer Health Data from the following sources:▪

Consumer Health Data that we collect from you directly, including:o participation in promotions or rewards, attendance at BMS programs and eventso data from connected devices or profiles, with permission
o data submitted through interactive features such as surveys or chat services▪ Consumer Health Data from third party sources, including:o industry groups and patient associations
o healthcare providers, insurance companies, third parties for benefit verification andprogram enrollment and product fulfillment services in connection with our products andservices
o authorized/legal representatives, family members, and caregivers
o advertising partners and data brokers for digital marketing services and analytics
o third parties and processors for providing security services and fraud prevention▪ Consumer Health Data collected from devices, including:o data collected through websites and apps
o data from mobile and internet-connected devices with permission
o data automatically collected when contacting or visiting BMS, such as call recordings orCCTV footage
o data from cookies, web beacons, and similar technologies on websites or third-party
websites▪ Drawn from other information we collect to provide inferences about preferences,characteristics, attributes, and abilities drawn from collected data

2|3

5.

CONSUMER HEALTH DATA WE MAY SHARE WITH THIRD PARTIES OR AFFILIATES

We may share Consumer Health Data:▪ as required or permitted by law to comply with a subpoena or similar legal process or
government request, or when we believe in good faith that disclosure is legally required orotherwise necessary to protect our rights and property or the rights, property or safety ofothers, including to law enforcement agencies, and judicial and regulatory authorities, toprivate attorneys who issue subpoenas or otherwise serve us with legal process and, to theextent required, the individuals or entities they represent▪ with authorized representatives, including family members, caregivers, andrepresentatives

legal▪ with our affiliates for the purposes described in this Policy. Our affiliates are listed in our
10-K here

6.

WHAT ARE MY CONSUMER RIGHTS UNDER WASHINGTON MHMD ACT AND HOW DO I EXERCISE
THEM?

Washington Consumers as defined above have the following rights with respect to their Consumer
Health Data:▪ Right to Know: The right to confirm whether we are collecting, sharing, or selling theirConsumer Health Data
▪ Right to Access: The right to a copy of the Consumer Health Data we have about them
▪ Right to Know Third Parties: The right to obtain a list of all third parties and/or affiliates withwhom we have shared or sold their Consumer Health Data
▪ Right to Delete: The right to request that we delete their Consumer Health Data
Additionally, to the extent consent has been obtained to collect or share Consumer Health Data,the right to withdraw consent.
To exercise these rights, please contact BMS at dpo@bms.com or via this form. We may require
additional information to authenticate that you made the request(s). If we are unable toauthenticate the request(s) using commercially reasonable efforts and asking for additional
information, we will not be able to comply with the request.
We will respond to such requests within 45 days from when we receive your request. In somecircumstances, we may need additional time to process your request. If we expect your request isgoing to take us longer than normal to fulfill, we will let you know.
If your request is denied, you may appeal that decision as specified in our letter or denial. We willprocess and respond to your appeal within the time permitted by the Washington MHMD Act.

7.

CONTACT US

If you have questions about this Notice or want to obtain more information about our privacy
practices, please contact us at dpo@bms.com.

8.

MATERIAL CHANGES TO THIS POLICY

We may change this Policy from time to time and will notify you by a notice on our website andin this Policy of material changes.

3|3