Privacy Notice – Sarah Cannon Research Institute

At McKesson Corporation (“McKesson”, “our”, “us”, or “we”), we value the trust that patients, healthcare providers and pharmaceutical or drug manufacturers place in us to appropriately use and protect personal information.

This Privacy Notice applies to our use of personal information we collect in connection with your use of our website or in the ordinary course of business. For the purposes of this Privacy Notice, “personal data” means any information relating to an identified or identifiable individual. It also informs how McKesson will use, share and protect personal information about you. By using scri.com or providing personal information, you accept the privacy practices in this Privacy Notice. Please read this Privacy Notice in full to understand our privacy practices before using scri.com or submitting any personal information.

Scope

This Privacy Notice applies to Sarah Cannon Research Institute (www.scri.com) and our use of information we collect in connection with your use of the website.

The Privacy Notice does not apply to:

• McKesson affiliates and subsidiaries that may have separate websites, subdomains, and applications through other web, mobile, cloud or SaaS platforms which are not subject to this Privacy Notice.
• McKesson busines partners, ad networks and other third parties that may have their own websites and services with separate privacy practices.

We encourage you to read the privacy notices of all websites and applications that you visit and understand their privacy practices.

Information We Collect

• In connection with your use of scri.com, we may source information about you such as: Information you provide directly to us:
• When you use the website.
• When you use offline features related to the site, such as communicating with us by phone, e-mail, or in person.
• When you interact with us in the ordinary course of business.
• Our affiliates and business partners
• Data verification services and data brokers
• Marketing vendors and advertising networks
• Healthcare providers

We may also process the following categories of personal data:

• Identifiers, such as real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, signature, physical characteristic or description, telephone number, insurance policy numbers, employment status, or employment history
• Characteristics of protected classifications, such as race, sex, disability, national origin, marital status
• Commercial information, including records of personal property, products or services purchased, obtained, or considered or other purchasing histories or tendencies
• Biometric information
• Internet or other electronic network activity, including, but not limited to, browsing history, search history, and information regarding interactions with the site
• Geolocation data
• Audio, electronic, visual, thermal, olfactory, or similar information
• Professional or employment-related information
• Education information
• Inferences drawn from any of the information identified above to create a profile about you that reflects your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligences, abilities, and aptitudes

We may process the following categories of sensitive personal data:

• Social security number
• Driver’s license number
• Passport number
• State identification card
• Medical information
• Health insurance information
• Financial information such as, bank account information, credit or debit card number, account log-in, account numbers, required security or access code, password, or credential(s) allowing access to the account
• Precise geolocation
• Racial or ethnic origin, religious or philosophical beliefs, or union membership
• Genetic data
• Biometric information, such as audio, electronic, visual, thermal, olfactory, or similar information
• Personal information collected and analyzed concerning your sex life or sexual orientation
• Personal information collected and analyzed concerning your health

Personal information may be aggregated with other information that may not be considered personal information. If we combine your non-personal information with personal information, the combined information will be treated as personal information.

Tracking Technologies We Use

We use various technologies to collect personal information. These technologies include but are not limited to the following:

• Web server logs
• As is true of most websites, we gather certain information automatically and store it in log files. This information may include IP addresses, browser type, internet service provider, referring/exit pages, operating system, date/time stamp and/or clickstream data.
• Cookies
• We and our subsidiaries, business partners, marketing partners, affiliates, or other vendors may use cookies. Cookies uniquely identify the device or user account you use for this site. You can control the use of cookies by adjusting your browser preferences at any time. If you reject cookies, you may still use our site. However, rejecting cookies may limit your ability to use some parts of our site.
• Geo-location Services
• When you allow us to track your location, we may collect information about your location. We use various technologies to determine location, such as sensor data from your device that may provide information on nearby Wi-Fi access points and cell towers. We do not collect precise information (e.g., GPS data; latitude and longitude) concerning the location from which you access the Services, but we collect information on your region or postal code to help us gather information useful for improving the relevance of our content and securing our Services
• Other Tracking Technologies
• We also use local storage such as HTML5 to collect and store content information and preferences. Our third-party partners who provide certain features or display advertising on our site may do the same. Your browser may offer tools for removing HTML5 local storage.

How We Respond to “Do Not Track” Signals

Some web browsers have a ''Do Not Track'' feature. This feature allows you to tell websites you visit that you do not want to have your online activity tracked over time and across websites. These features are not yet uniform across browsers and not broadly supported. This site is currently set up to respond to those signals.

How We Use the Personal Information Collected

If you submit or we collect personal information through our services, then such personal information may be used in the following ways:

• To verify, analyze, maintain or enhance quality or safety
• To provide customer and troubleshooting support
• To provide data analytics and reporting
• To comply with legal obligations

How We Share Personal Information

We do not sell or otherwise disclose personal information collected as set out above, except as described in this Privacy Notice. The information may also be shared with third-party service providers who perform services for SCRI.

McKesson may need to share information with third-party service providers who perform services for SCRI, other healthcare providers, advertising networks, who may use your browsing history, search history, and information regarding your interactions with this site or to individuals and companies outside of McKesson if we have a good faith belief that access, use, preservation, or disclosure of that information is reasonably necessary to:

• Perform a service on behalf of SCRI
• Meet applicable laws, regulations, legal processes, or enforceable governmental requests
• Enforce applicable Terms of Service, including investigation of potential violations
• Detect, prevent, or otherwise address fraud, security or technical issues
• Protect against harm to the rights, property or safety of our users, McKesson, or the public as required or permitted by law
• Engage in a merger, acquisition, reorganization, or sale of all or a portion of McKesson assets.

Rights to Specific to UK and EU Residents

The European Union and the United Kingdom provide specific privacy rights to their residents. These rights may differ from those provided under current U.S. laws. If you or your authorized representative would like to exercise one of your rights, please contact Privacy@McKesson.com.

Should you exercise one of your rights, we may require certain identifying data from you or your authorized representative to verify your request.

• The right to request access to your personal information, which includes categories of our sources from which the personal data is collected, and if applicable, whether it came from publicly accessible sources.
• The right to request rectification of your personal data.
• The right to request erasure of your personal data.
• The right to request correction of inaccurate personal information we maintain about you.
• The right to request restriction of processing of your personal information or limit the use or disclosure of sensitive personal information, subject to certain exceptions.
• The right to object to processing of your personal data.
• The right to lodge a complaint with a supervisory authority.

Your Choices

You can limit the personal information you disclose to us by choosing not to provide it within the site or by failing to provide information through any offline features or in the ordinary course of business.

Retention

We will retain your personal information as long as you use the site, your account is active, as necessary to comply with our legal obligations, resolve disputes or enforce our agreements.

Children’s Privacy

Rx Savings Solutions is not intended for users under the age of 13. We do not knowingly collect personal information from children under the age of 13. Users under the age of 13 should not submit any personal information or use Rx Savings Solutions.

How We Protect Your Information

We protect the information we collect with appropriate technical and organizational safeguards including physical, electronic and administrative safeguards. We only allow our employees, contractors, and agents to access personal information if their designated position allows access to need access to perform services on McKesson’s behalf. They are also subject to confidentiality obligations.

Even though we have security safeguards, it is impossible to guarantee 100% security. If you have any questions about security or believe that your interactions with us are no longer secure (for example, you feel that your account with us has been compromised), you must immediately notify us by contacting McKesson at Privacy@McKesson.com.

Changes to this Privacy Notice

We may update this Privacy Notice from time to time. Updates may describe new features, products or services. Updates may also describe changes in how we use your personal information. We will not apply changes to this Privacy Notice retroactively to personal information we have previously collected. Since we may make changes, we recommend that you read the current version of this Privacy Notice from time to time. If we make changes to this notice, we will update the “Effective Date” at the beginning of this notice.

Contact Information

If you have questions or concerns about this Privacy Notice, our information handling practices, or any other aspect of privacy and security of your personal information, please contact us at: Privacy@McKesson.com.

You may also write to us at:

McKesson Corporation
ATTN: Privacy Officer (Privacy Notice, Sarah Cannon Research Institute)
2 National Data Plaza NE, 3^rd Floor
Atlanta, GA 30329