California Consumer Privacy Act Notice

Pursuant to the California Consumer Privacy Act of 2018 (“CCPA”), Accredo Health Group, Inc. and its affiliates (“Accredo” or “we”) are providing the following Notice regarding the categories of Personal Information that we collect, use, and disclose about California residents. Under the CCPA, “Personal Information” is information that identifies, relates to, or could reasonably be linked with a particular California resident or household.

• Accredo Customers
• Individual Rights and Requests
• Employees, Applicants, Contractors, Owners, Directors, and Officers
• Business Partners
• Changes to this CCPA Notice      

Accredo Customers

Personal Information We Collect, Use, and Disclose

(1) We may collect, and may have collected within the preceding 12 months, the following categories of Personal Information about you:

1. 1. Identifiers, such as name, contact information, online identifiers, and governmentissued ID numbers;
   2. Personal information, as defined in the California customer records law, such as name, contact information, payment card data, medical information, insurance information, and financial information;
   3. Characteristics of protected classifications under California or federal law, such as age and medical conditions;
   4. Commercial information, such as transaction information and purchase history;
   5. Biometric information;
   6. Internet or network activity information, such as browsing history and interactions with our website;
   7. Geolocation data, such as device location;
   8. Audio, electronic, visual and similar information, such as call and video recordings
   9. Professional or employment-related information; and
   10. Inferences drawn from any of the Personal Information listed above to create a profile about, for example, an individual’s preferences and characteristics.

We may collect this Personal Information from you, and/or from our affiliates, vendors, joint marketing partners, and social media platforms).

We may use this Personal Information to operate, manage, and maintain our business, to provide our products and services, and to accomplish our business purposes and objectives, including, for example, using Personal Information to: develop, improve, repair, and maintain our products and services; fulfill your requests and transactions; process your payments and claims; provide quotes for our products; personalize, advertise, and market our products and services; conduct research, analytics, and data analysis; maintain our facilities and infrastructure; undertake quality and safety assurance measures; conduct risk and security control and monitoring; detect and prevent fraud; perform accounting, audit, and other internal functions; comply with law, legal process, and internal policies; and exercise and defend against legal claims.

(2) We have disclosed the following categories of Personal Information as listed in the CCPA to third parties for our operational business purposes within the preceding 12 months:

1. 1. Identifiers, such as name, contact information, online identifiers, and governmentissued ID numbers
   2. Personal information, as defined in the California customer records law, such as name, contact information, payment card data, medical information, insurance information, and financial information;
   3. Characteristics of protected classifications under California or federal law, such as age and medical conditions;
   4. Commercial information, such as transaction information and purchase history
   5. Biometric information;
   6. Internet or network activity information, such as browsing history and interactions with our website;
   7. Geolocation data, such as device location;
   8. Audio, electronic, visual and similar information, such as call and video recordings
   9. Professional or employment-related information; and
   10. Inferences drawn from any of the Personal Information listed above to create a profile about, for example, an individual’s preferences and characteristics.
   11.     

We may share this Personal Information with: our affiliated entities; trusted third-party service providers; third parties to permit them to send you marketing communications consistent with your choices; government or public authorities upon their request or when we choose to cooperate with such authorities pursuant to a legal matter or matter of safety; other users of social media and our services when you choose to disclose information; third parties involved litigation, investigations, or other legal matters; and your benefit plan’s plan sponsor or plan administrator to permit them to determine eligibility, qualification or confirmation of a promised incentive or reward to you.

(3) We have not sold Personal Information, as “sale” is defined in the CCPA.

Individual Rights and Requests

If you are a California resident, you may request that we:

• Disclose to you the following information covering the 12 months preceding your request:
  • The categories of Personal Information we collected about you and the categories of sources from which we collected such Personal Information;
  • The specific pieces of Personal Information we collected about you;
  • The business or commercial purpose for collecting (if applicable) Personal Information about you; and,
  • The categories of Personal Information about you that we otherwise shared or disclosed, and the categories of third parties with whom we shared or to whom we disclosed such Personal Information (if applicable).
• Delete Personal Information we collected from you.

To make a request for the disclosures or deletion described above, please Contact Us or call us toll-free at 800-234-4077 . We will respond to your request consistent with applicable law.

You have the right to be free from unlawful discrimination for exercising your rights under the CCPA

Employees, Applicants, Contractors, Owners, Directors, and Officers

For our California employees, applicants, contractors, owners, directors, and officers, we are providing the following information regarding Personal Information that we collect and use in the context of their current, former, or potential role at Accredo. We supply this information consistent with the CCPA, which has limited applicability in this context but provides for a privacy notice describing the categories of Personal Information we collect and how we use that information.

We may collect/have collected the following categories of Personal Information:

1. 1. Identifiers, such as name, contact information, online identifiers,IP address, Social Security numbers, and other government-issued IDnumbers;
   2. Personal information, as defined in the California customer recordslaw, such as name, contact information, education information,employment history, financial information, and medical and medicalinsurance information;
   3. Characteristics of protected classifications under California orfederal law, such as sex, age, race, religion, national origin,disability, medical conditions and information, citizenship,immigration status, request for leave, and marital status;
   4. Biometric information;
   5. Internet or network activity information, such as browsing historyand interactionswith our and other websites and systems;
   6. Geolocation data, such as device location and IP location;
   7. Audio, electronic, visual, and similar information, such asphotographs or audio orvideo recordings created in connection with our business activities;
   8. Professional or employment-related information, such as workhistory, prior employer, information relating to references, detailsof qualifications, skills and experience, human resources data, anddata necessary for benefits and related administration services;
   9. Education information subject to the federal Family EducationalRights and Privacy Act; and
   10. Inferences drawn from any of the Personal Information listed aboveto create a profile or summary about, for example, an individual’spreferences and characteristics.

We may use this Personal Information for the purposes of operating, managing, and maintaining our business, managing our workforce, and accomplishing our business purposes and objectives, including, for example, using Personal Information to:

• Manage workforce activities and personnel generally, including for recruitment, performance management, career development, payments administration, employee training, leaves and promotions;
• Manage wages and other awards such as stock options, stock grants and bonuses, and provide healthcare, pensions, savings plans and other benefits;
• Maintain and secure our facilities, equipment, systems, and infrastructure;
• Undertake quality and safety assurance measures, protect the health and safety of our workforce and others, and conduct risk and security control and monitoring;
• Conduct research, analytics, and data analysis to assist in planning succession and to ensure business continuity, as well as to design employee retention programs and diversity initiatives;
• Perform identity verification, accounting, audit, and other internal functions, such as internal investigations;
• Operate and manage IT and communications systems and facilities, allocate company assets and human resources, and undertake strategic planning and project management; and,
• Comply with law, legal process, internal policies and other requirements such as income tax deductions, record-keeping and reporting obligations, and exercise and defend legal claims.

Business Partners

October 11, 2019 amendments to CCPA provided a delay in implementation of CCPA requirements between business partners. We will update this Privacy Notice accordingly in time for the implementation date.

Changes to this CCPA Notice

We may change or update this CCPA Notice from time to time. When we do, we will post the revised CCPA Notice on this page with a new “Last Updated” date.