This Consumer Health Data Privacy Notice supplements the Novo Nordisk US Privacy Notice and applies to personal data defined as “consumer health data” by the Washington State My Health My Data Act (MHMDA) and Nevada Consumer Health Data Privacy Law. It provides information about how Novo Nordisk and its Affiliates (“Novo Nordisk” or “we”) may collect, use, disclose or otherwise process your health information, how we protect it, and your rights and choices with respect to your health information.

This Notice applies to all Novo Nordisk operations in the US as well as websites, mobile applications and digital services (“Services”) that link to or post it.

We Collect the following categories of Consumer Health Data from Consumers:

• Individual health conditions, treatment, diseases, or diagnosis;
• Social, psychological, behavioral, and medical interventions;
• Health-related surgeries or procedures;
• Use or purchase of prescribed medication;
• Bodily functions, vital signs, symptoms, or measurements related to health;
• Diagnoses or diagnostic testing, treatment, or medication;
• Reproductive or sexual health information;
• Biometric data;
• Genetic data;
• Precise location information that could reasonably indicate a Consumer's attempt to acquire or receive health services or supplies;
• Data that identifies a Consumer seeking health care services;
• Health-related data that have been derived or inferred from the above. 

We use the above-mentioned categories of Consumer Health Data for the following purposes:

• Performing the services or providing the goods reasonably expected by an average Consumer who requests those goods or services;
• Ensuring security and integrity to the extent the use of the Consumer's Personal Information is reasonably necessary and proportionate for these purposes;
• Preventing, detecting, and investigating security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted Personal Information;
• Resisting malicious, deceptive, fraudulent, or illegal actions directed at the business and prosecuting those response for those actions;
• Ensuring the physical safety of natural persons;
• Short-term, transient use, including, but not limited to, non-personalized advertising shown as part of a Consumer's current interaction with us; provided that we will not disclose the Consumer's Personal Information to a Third Party and or build a profile about the Consumer or otherwise alter the Consumer's experience outside the current interaction with the business;
• Performing services on our behalf, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on our behalf;
• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured by, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us; and
• Collecting or processing Sensitive Personal Information where such collection or processing is not for the purpose of inferring characteristics about a consumer.

We Collect Consumer Health Data directly from Consumers and from the following sources:

As described further in the Personal Information we collect section of our State-Specific Supplemental Privacy Notice, we may Collect Consumer Health Data about patients and caregivers directly from patients and caregivers, as well as from healthcare providers, and health insurance providers. We may also collect Consumer Health Data about patients and caregivers from publicly available sources and from commercial sources, including third parties that aggregate and sell data. Further, we collect Consumer Health Data from website viewers directly from these Consumers, including via cookies and similar technologies on our websites and apps.

We Share all of the categories of Consumer Health Data listed in Section 1. 

We Share Consumer Health Data with the following Third Parties:

• At Your Direction. Disclosure to third parties at your direction and with your consent. In the case of marketing materials or events in or at which you have consented to appear, this includes disclosure of your Consumer Health Data to the public.
• Marketing Vendors. Third Parties to provide marketing services to serve Consumers with online advertising that is more relevant to them based on their network activity data, IP addresses, other online identifiers, and similar information and inferences derived therefrom.
• Healthcare & Insurance Providers. To your healthcare provider, pharmacy, and health insurance provider or administrator.
• Business Transfers or Assignments. To other entities as reasonably necessary to facilitate a merger, sale, joint venture or collaboration, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).
• Legal and Regulatory. We may disclose your Consumer Health Data to government authorities, including regulatory agencies and courts, as reasonably necessary for our business operational purposes, to assert and defend legal claims, and otherwise as permitted or required by law.
• Enhancing Website Experience. We may utilize your Consumer Health Data to draw inferences to tailor your website experience and identify products you may be interested in.
• Affiliates. As noted below, we enable access to data across our subsidiaries, affiliates, and related companies, for example, where we share common data systems or where access helps us to provide our services and operate our business. 

We Share Consumer Health Data with the following Affiliates:

• Novo Nordisk Inc.
• Novo Nordisk A/S
• Novo Nordisk Health Care AG
• Novo Nordisk US Research & Development