Consumer health data privacy notice (“CHD Privacy Notice”)

Effective Date: March 31, 2024

This CHD Privacy Notice supplements the J&J Privacy Policy and applies specifically to “Consumers” as defined under Washington’s My Health My Data Act (“MHMDA”).

This CHD Privacy Notice describes Johnson & Johnson Services Inc’s (“we”, “us”, or “our”) practices regarding the collection, use, sharing and disclosure of Consumer Health Data. Any capitalized terms not defined in this CHD Privacy Notice shall have the meanings given to them in the J&J Privacy Policy. Importantly, this CHD Privacy Notice does not supersede, replace, or otherwise amend the J&J Privacy Policy.

1. Consumer Health Data Collected

For purposes of this CHD Privacy Notice, Consumer Health Data (“CHD”) is defined as under the MHMDA. Generally, CHD includes personal information that is linked or reasonably linkable to a Consumer and that identifies the Consumer’s past, present, or future physical or mental health status. Importantly, CHD does not include information that does not qualify as CHD under the MHMDA. For example, CHD does not include protected health information subject to the federal Health Insurance Portability and Accountability Act and its related regulations (“HIPAA”).

We may collect the following categories of CHD and share these categories of CHD with Third Parties and Affiliates, as described below in the Section of this Policy called “Our Sharing of CHD”:

• Individual health conditions, treatment, diseases, or diagnosis;
• Social, psychological, behavioral, and medical interventions;
• Health-related surgeries or procedures;
• Use or purchase of prescribed medication;
• Bodily functions, vital signs, symptoms, or measurements of other types of consumer health data;
• Diagnoses or diagnostic testing, treatment, or medication;
• Gender-affirming care information;
• Reproductive or sexual health information;
• Biometric data;
• Genetic data;
• Precise location information that could reasonably indicate a consumer’s attempt to acquire or receive health services or supplies;
• Data that identifies a consumer seeking health care services; or
• Other information that may be used to infer or derive data related to the above or other health information.

2. Sources of CHD

We may collect this information from you directly, such as through your use of our websites and services. Similarly, we may collect certain information about you when you interact with our advertisements on third-party websites.

We may also collect CHD from our Affiliates, business partners, joint marketing partners, public databases, providers of demographic data, publications, professional organizations, social media platforms, caregivers, third party information providers, service providers with which we have a contractual relationship and to which you have provided your personal information, and cookies and other tracking technologies.

3. Why Consumer Health Data is Collected & How it is Used

We—and our service providers—may collect, process and use the CHD described in this CHD Privacy Notice for the following purposes:

• Providing our products or services as may be reasonably expected by an average consumer who requests those products or services;
• Maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing analytic services, providing storage, or providing similar services on our behalf;
• Ensuring security and integrity of our websites and services to the extent the use of the consumer’s CHD is reasonably necessary and proportionate for these purposes;
• Undertaking activities to verify or maintain the quality or safety of our products or services, or to improve, upgrade, or enhance our websites, products or services;
• Personalizing, advertising, and marketing our products and services;
• Conducting research, analytics, and data analysis;
• Performing accounting, audit, and other internal functions, such as internal investigations;
• Complying with law, legal process, and internal policies;
• Maintaining business records;
• Exercising and defending legal claims; and
• Otherwise accomplishing our business purposes and objectives.

4. Our Sharing of CHD

Affiliates. We may disclose your CHD to our affiliates for the purposes described in this CHD Privacy Notice. These affiliates include those listed in our 10-K here (“Affiliates”).

Service Providers. We may disclose CHD to our service providers in order to enable them to provide us with products and services, such as web hosting, mobile application hosting, data analysis, payment processing, customer service, infrastructure provisioning, IT services, email and direct mail delivery services, auditing, legal services, and other similar services that are essential to our provision of our websites, products and services.

Third Parties. We may disclose your CHD to the following categories of third parties (“Third Parties”):

• Third Party Co-Branding and Co-Marketing Partners. We may share your CHD with our third-party partners with whom we offer a co-branded or co-marketed promotion.
• Third Party Advertising Partners. To improve the effectiveness of our communication with you and our marketing campaigns, we may share your CHD with our third-party advertising partners, including social media platforms, medical journals and publishers.
• Business Transfers or Assignments. We may disclose your CHD to other entities as reasonably necessary to facilitate a reorganization, merger, sale, joint venture or collaboration, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).
• Legal and Regulatory. We may disclose your CHD to government authorities, law enforcement, courts, or similarly situated third parties for our business operational purposes, to assert and defend legal claims, and otherwise as permitted or required by law.
• Other Third Parties at Your Direction. We may disclose your CHD to any third party with your consent or at your direction.

5. Our Sale of CHD

Unless specifically stated, we do not sell or share Personal Information to Third Parties for their own use. However, we may share or process CHD as defined in this notice with our affiliates and trusted partners in arrangements for purposes of targeted advertising, as the terms “sell,” “share,” “process,” and “targeted advertising” are defined in the MHMDA. In these arrangements, use of the information we share is limited by policies, contracts or similar restrictions.

6. Exercising Consumer Data Rights

Washington residents have certain rights under the MHMDA with respect to the collection and use of their CHD. These rights include:

• The right to confirm whether we collect, share or sell your CHD;
• The right to access such CHD, including a list of the third parties and affiliates to whom the information may have been sold or shared;
• The right to withdraw consent from our collection and sharing of CHD;
• The right to withdraw consent from our sale of CHD; and
• The right to delete your CHD.

Washington residents may exercise any of these by submitting a request here or by referring the “Contact Us” section below.

7. Changes to this CHD Privacy Notice

We reserve the right to amend this CHD Privacy Notice at our discretion and at any time. When we make material changes to this CHD Privacy Notice, we will notify you by posting an updated CHD Privacy Notice on our websites, including the effective date of such updates.

Contact Us

If you have any questions or concerns about this CHD Privacy Notice, please contact us here: