Supplemental Privacy Notice for State Specific Privacy Laws

Effective Date: July 1, 2024

This supplemental notice is provided for individuals residing in states that have enacted comprehensive state privacy laws. It explains your rights regarding your personal data and how we handle your personal data. Certain terms in this supplemental notice are defined by applicable state law and their meanings may differ from the meanings applied elsewhere on our website. We may periodically update this Supplemental Privacy Notice for State Specific Privacy Laws. If we make material changes to this Supplemental Privacy Notice for State Specific Privacy Laws, we will post a notice of the material changes on our website. We encourage you to periodically review this Supplemental Privacy Notice for State Specific Privacy Laws for the latest information on our privacy practices.

Sources of Personal Data

We collect personal data from the following categories of sources:

Directly from you when you provide information
Our affiliates and business partners
Data verification services & data brokers
Marketing vendors and advertising networks
Social media
Healthcare providers

Personal Data We May Collect

We collect or process the following categories of personal data:

Identifiers, such as real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, signature, physical characteristic or description, telephone number, insurance policy numbers, employment status, or employment history
Characteristics of protected classifications, such as race, sex, disability, national origin, marital status
Commercial information, including records of personal property, products or services purchased, obtained, or considered or other purchasing histories or tendencies
Biometric information
Internet or other electronic network activity, including, but not limited to, browsing history, search history, and information regarding interactions with the site
Geolocation data
Audio, electronic, visual, thermal, olfactory, or similar information
Professional or employment-related information
Education information
Inferences drawn from any of the information identified above to create a profile about you that reflects your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligences, abilities, and aptitudes.

We collect or process the following categories of sensitive personal data:

Social security number
Driver’s license number
Passport number
State identification card
Medical information
Health insurance information
Financial information such as, bank account information, credit or debit card number, account log-in, account numbers, required security or access code, password, or credential(s) allowing access to the account
Precise geolocation
Racial or ethnic origin, religious or philosophical beliefs, or union membership
Genetic data
Biometric information, such as audio, electronic, visual, thermal, olfactory, or similar information
Personal information collected and analyzed concerning your sex life or sexual orientation
Personal information collected and analyzed concerning your health

Processing, Disclosure, and Retention of Personal Data

The categories of data collected and listed above will be processed, disclosed, sold, shared, and retained as described below:

PROCESSING PURPOSE

Business Purposes:

To perform the business services you have requested and/or to provide reasonably

expected goods

To develop new products and services
To provide personalized and non-personalized offers and services based on your interactions with our site/product or affiliated vendors utilizing your browsing history, search history, and interactions with our site products, or services
To detect security incidents that compromise the availability, integrity, authenticity, and confidentiality of stored or transmitted personal information
To prevent malicious, deceptive, fraudulent, or illegal actions and to prosecute those responsible for those actions
To protect our rights, property, and safety or the rights, property, and safety of others
To perform services, such as maintaining or servicing accounts, providing customer service, processing, or fulfilling orders and transactions, verifying information, processing payments, providing financing, providing analytic services, or providing storage
To verify, analyze, maintain, or enhance the quality or safety of our products and services
To offer or provide employee benefits and services
To comply with legal obligations

Commercial PURPOSEs

For targeted advertising. We utilize cookies, pixels, and other advertising technology to provide users personalized ads
For profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer

CATEGORIES OF THIRD PARTIES TO WHICH WE DISCLOSE THAT PERSONAL DATA

Our vendors and service providers
Healthcare providers
Advertising networks, who may use your browsing history, search history, and information regarding your interaction with the site
Our affiliates and business partners
Law enforcement, when required by law

CATEGORIES OF THIRD PARTIES TO WHICH WE “SOLD” OR “SHARED” THAT PERSONAL DATA

Our vendors and service providers
Healthcare providers
Advertising networks, who may use your browsing history, search history, and information regarding your interaction with the site
Our affiliates and business partners

We do not knowingly sell or share personal data of residents under the age of 16.

NOTICE: We may sell your sensitive personal data.

NOTICE: We may sell your biometric personal data.

We sell or share de-identified information. De-identified information is data that is no longer considered individually identifiable, cannot be reasonably linked to an identified or identifiable person or a device linked to that individual, and has been deidentified in compliance with either the HIPAA expert determination method or the HIPAA safe harbor method as described in Sections 164.514(b)(1) and (2) of the Code of Federal Regulations.

Retention

We retain your data in accordance with applicable contracts, Terms of Service, regulatory/legal obligations, or as otherwise allowed.

There are times when personal data is disclosed externally with other companies, organizations, or individuals when we have a good faith belief that access, use, preservation, or disclosure of that data is reasonably necessary to:

Meet applicable laws, regulations, legal processes, or enforceable governmental requests
Enforce applicable Terms of Service, including investigation of potential violations
Detect, prevent, or otherwise address fraud, security, or technical issues
Protect against harm to the rights, property or safety of our users, McKesson, or the public as required or permitted by law
Engage in a merger, acquisition, reorganization, or sale of all or a portion of the business’s assets
Or fulfill other lawful purposes

Your Rights

The states hyperlinked in blue below provide privacy rights to their residents. If you or your authorized representative would like to exercise one of your rights, please use the applicable link below or call 1-833-925-0545. Should you exercise one of your rights, we may require certain identifying data from you or your authorized representative to verify your request. We will honor your request if it complies with applicable state privacy laws. Please note that these rights may not be absolute and exceptions to these rights may apply. Questions and concerns can be emailed to Privacy@McKesson.com.

Alabama (AL)
Alaska (AK)
Arizona (AZ)
Arkansas (AR)
California (CA)
Colorado (CO)
Connecticut (CT)
Delaware (DE)
Florida (FL)
Georgia (GA)
Hawaii (HI)
Idaho (ID)
Illinois (IL)
Indiana (IN)
Iowa (IA)
Kansas (KS)
Kentucky (KY)

Louisiana (LA)
Maine (ME)
Maryland (MD)
Massachusetts (MA)
Michigan (MI)
Minnesota (MN)
Mississippi (MS)
Missouri (MO)
Montana (MT)
Nebraska (NE)
Nevada (NV)
New Hampshire (NH)
New Jersey (NJ)
New Mexico (NM)
New York (NY)
North Carolina (NC)
North Dakota (ND)

Ohio (OH)
Oklahoma (OK)
Oregon (OR)
Pennsylvania (PA)
Rhode Island (RI)
South Carolina (SC)
South Dakota (SD)
Tennessee (TN)
Texas (TX)
Utah (UT)
Vermont (VT)
Virginia (VA)
Washington (WA)
West Virginia (WV)
Wisconsin (WI)
Wyoming (WY) District of Columbia (DC)

You will not be discriminated against in any way by virtue of your exercise of the rights listed in this Privacy Notice which means, for example, we will not deny goods or services to you, provide different prices or rates for goods or services to you, or provide a different level or quality of goods or services to you.

CALIFORNIA (Effective: July 1, 2023)

The right to know what specific elements of personal data we collect about you, which includes the following. You can exercise your right to know by clicking HERE.

The right to know the categories of personal data we have collected.
The categories of our sources from which the personal data is collected.
The categories of third parties to whom we disclose personal data to.
The specific elements of personal data we have collected about you.
The categories of personal information we sold or shared.
The categories of personal information we disclosed for a business purpose.
Our business or commercial purpose for collecting, selling, or sharing your personal data.

The right to delete personal data that we have collected from you, subject to certain exceptions.  You can exercise your right to delete by clicking HERE.

The right to correct inaccurate personal data we maintain about you. You can exercise your right to correct by clicking HERE.

The right to limit the use or disclosure of sensitive personal data. Subject to certain exceptions, you have the right to limit our use or disclose of your sensitive personal data by clicking HERE.

The right to opt-out of the sale or sharing of your personal data with other parties. You can exercise your right to opt-out by clicking Do Not Sell or Share My Personal Information link. We recognize Global Privacy Control (GPC) signals, and if your web browser utilizes GPC, your opt-out preferences over the use of your cookie data will be honored in compliance with state law.

COLORADO (Effective: July 1, 2023)

The right to opt-out of the sale of your personal data: You can exercise your right to opt-out by clicking HERE. We recognize Global Privacy Control (GPC) signals, and if your web browser utilizes GPC, your opt-out preferences over the use of your cookie data will be honored in compliance with state law.

The right to opt-out of targeted advertising: When personal data is collected and stored for purposes of serving targeted ads, you may direct us to stop using your data for such purposes by clicking HERE.

The right to opt-out of using your data for profiling purposes if the profiling produces legal or similarly significant effects for you. You may opt-out of profiling by clicking HERE.

The right to correct inaccurate personal data we maintain about you. You can exercise your right to correct by clicking HERE.

The right to delete your personal data. You may request that we delete certain personal data we have collected about you. You can exercise your right to delete by clicking HERE.

The right to confirm whether we are processing your personal data and access such data. You can exercise this right by clicking HERE.

The right to obtain a copy of your data in a portable format. You may request to receive your personal data in a readily useable format, to the extent technically feasible.  

CONNECTICUT (Effective: July 1, 2023)

The right to confirm whether we are processing your personal data and access such data. You can exercise this right by clicking HERE.

The right to correct inaccurate personal data we maintain about you. You can exercise your right to correct by clicking HERE.

The right to delete personal data provided by you or obtained about you: You may ask that we delete certain personal data we have collected about you. You can exercise your right to delete by clicking HERE.

The right to opt-out of the sale of your personal data. Subject to certain considerations for your voluntary participation in a rewards program, you can exercise your right to opt-out of a sale by clicking HERE. Where applicable, we will seek your consent before selling your consumer health data.

The right to opt-out of using your data for profiling purposes if the profiling produces legal or similarly significant effects for you. You may opt-out of profiling by clicking HERE.

The right to obtain a copy of your data in a portable format. You may request to receive your personal data in a readily useable format, to the extent technically feasible.

Delaware (Effective: January 1, 2025)

The right to confirm whether we are processing your personal data and access such data. You can exercise this right by clicking HERE.

The right to correct inaccurate personal data we maintain about you accounting for the nature and purpose for processing. You can exercise your right to correct by clicking HERE.

The right to obtain a copy of your data in a portable format. You may request to receive your personal data in a readily useable format, to the extent technically feasible.  

Right to opt-out of the sale of your personal data. Subject to certain considerations for your voluntary participation in a rewards program, you can exercise your right to opt-out of a sale by clicking HERE.

The right to opt-out of using your data for profiling purposes if the profiling produces legal or similarly significant effects for you. You may opt-out of profiling by clicking HERE.

IOWA (Effective: January 1, 2025)

The right to confirm whether we are processing your personal data and access such data. You can exercise this right by clicking HERE.

The right to obtain a copy of your data in a portable format. You may request to receive your personal data in a readily useable format, to the extent technically feasible.  

MONTANA (Effective: October 1, 2024)

The right to confirm whether we are processing your personal data and access such data. You can exercise this right by clicking HERE.

The right to correct inaccurate personal data we maintain about you considering the nature and purposes of processing. You can exercise your right to correct by clicking HERE.

The right to obtain a copy of your data in a portable format. You may request to receive your personal data in a readily useable format, to the extent technically feasible.  

The right to opt-out of using your data for profiling purposes if the profiling produces legal or similarly significant effects for you. You may opt-out of profiling by clicking HERE.

Nebraska (Effective: January 1, 2025)

The right to confirm whether we are processing your personal data and access such data. You can exercise this right by clicking HERE.

The right to correct inaccurate personal data we maintain about you considering the nature and purposes of processing. You can exercise your right to correct by clicking HERE.

The right to obtain a copy of your data in a portable format. You may request to receive your personal data in a readily useable format, to the extent technically feasible.  

The right to opt-out of using your data for profiling purposes if the profiling produces legal or similarly significant effects for you. You may opt-out of profiling by clicking HERE.

NEVADA (Effective: October 1, 2019)

The right to opt-out of sale. You may direct us to stop selling your personal data and can exercise your right to opt-out by clicking HERE.

Requests to Review and Change your personal data. You may request to review or change your personal data by clicking HERE.

New Hampshire (Effective: January 1, 2025)

The right to confirm whether we are processing your personal data and access such data. You can exercise this right by clicking HERE.

The right to correct inaccurate personal data we maintain about you considering the nature and purposes of processing. You can exercise your right to correct by clicking HERE.

The right to obtain a copy of your data in a portable format. You may request to receive your personal data in a readily useable format, to the extent technically feasible.  

The right to opt-out of using your data for profiling purposes if the profiling produces legal or similarly significant effects for you. You may opt-out of profiling by clicking HERE.

New Jersey (Effective: January 15, 2025)

The right to confirm whether we are processing your personal data and access such data. You can exercise this right by clicking HERE.

The right to correct inaccurate personal data we maintain about you considering the nature and purposes of processing. You can exercise your right to correct by clicking HERE.

The right to obtain a copy of your data in a portable format. You may request to receive your personal data in a readily useable format, to the extent technically feasible.  

The right to opt-out of using your data for profiling purposes if the profiling produces legal or similarly significant effects for you. You may opt-out of profiling by clicking HERE.

OREGON (Effective: July 1, 2024)

The right to confirm whether we are processing your personal data and access such data. You can exercise this right by clicking HERE.

The right to obtain a copy of your data in a portable format. You may request to receive your personal data in a readily useable format, to the extent technically feasible.   You can exercise your right to correct by clicking HERE.

The right to correct inaccurate personal data we maintain about you considering the nature and purposes of processing. You can exercise your right to correct by clicking HERE.

The right to opt-out of the sale of your personal data. Subject to certain considerations for your voluntary participation in a rewards program, you can exercise your right to opt-out of a sale by clicking HERE. We recognize Global Privacy Control (GPC) signals, and if your web browser utilizes GPC, your opt-out preferences over the use of your cookie data will be honored in compliance with state law.

The right to opt-out of using your data for profiling purposes if the profiling produces legal or similarly significant effects for you. You may opt-out of profiling by clicking HERE.

TEXAS (Effective: July 1, 2024)

The right to confirm whether we are processing your personal data and access such data. You can exercise this right by clicking HERE.

The right to correct inaccurate personal data we maintain about you taking into account the nature and the purpose for the processing. You can exercise your right to correct by clicking HERE.

The right to obtain a copy of your data in a portable format. You may request to receive your personal data in a readily useable format, to the extent technically feasible.  

The right to opt-out of  the sale of your personal data: You can exercise your right to opt-out by clicking HERE.

The right to opt-out of using your data for profiling purposes if the profiling produces legal or similarly significant effects for you. You may opt-out of profiling by clicking HERE.

UTAH (Effective: December 31, 2023)

The right to confirm whether we are processing your personal data and access such data. You can exercise this right by clicking HERE.

The right to delete personal data provided by you. You may ask that we delete certain personal data we have collected about you. You can exercise your right to delete by clicking HERE.

The right to opt-out of the sale of your personal data. You can exercise your right to opt-out by clicking HERE.

The right to opt-out of targeted advertising. When personal data is collected and stored for purposes of serving targeted ads, you may direct us to stop using your data for such purposes by clicking HERE.

The right to obtain a copy of your data in a portable format. You may request to receive your personal data in a readily useable format, to the extent technically feasible.  

VIRGINIA (Effective: January 1, 2023)

The right to opt-out of the sale of your personal data: You can exercise your right to opt-out of a sale by clicking HERE.

The right to opt-out of using your data for profiling purposes if the profiling produces legal or similarly significant effects for you. You may opt-out of profiling by clicking HERE.

The right to correct inaccurate personal data we maintain about you. You can exercise your right to correct by clicking HERE.

The right to delete personal data provided by or obtained about you. You may ask that we delete certain personal data we have collected about you. You can exercise your right to delete by clicking HERE.

The right to confirm whether we are processing your personal data and access such data. You can exercise this right by clicking HERE.

The right to obtain a copy of your data in a portable format. You may request to receive your personal data in a readily useable format, to the extent technically feasible.

Contact Information

If required by your state, we will provide you the opportunity to appeal certain decisions made by us related to your rights. For each request you submit, we will inform you of the action we have taken in response to your request. If your state requires it, you will be provided the opportunity to appeal our decision by following the instructions in our response.

If you have questions or concerns about this Privacy Notice, you may contact us at privacy@mckesson.com.