Simon Consumer Health Data Privacy Policy

Collection of Consumer Health Data

"Consumer Health Data" means personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status. Consumer Health Data does not include information that is publicly available, de-identified, or aggregated. What Consumer Health Data we collect may differ depending on how you interact with us.

Categories of Consumer Health Data We Collect

The Consumer Health Data we collect may include:

• Individual health conditions, treatment, diseases, or diagnosis;
• Social, psychological, behavioral, and medical interventions;
• Use or purchase of prescribed medication;
• Diagnoses or diagnostic testing, treatment, or medication; or
• Voice recording data.

Categories of Sources of Consumer Health Data

As described in the Categories of Sources of Personal Data section of the Simon Privacy Policy, we may collect Personal Data, including Consumer Health Data, directly from you, from when you use our products and services, or from third parties.

Our Purposes for Collecting and Using Consumer Health Data

We collect, use, disclose, or otherwise process your Consumer Health Data as reasonably necessary for various purposes as described in the Our Commercial and Business Purposes for Collecting Personal Data and Other Permitted Purposes for Processing Personal Data but primarily to provide you with products and services as you have requested or authorized.

We do not engaged in geofencing around our stores that provides in-person health care services to either: (1) identify or track you when seeking health care services; (2) collect your Consumer Health Data; or (3) send notifications, messages, or advertisements to you related to your Consumer Health Data or health care services.

How We Disclose Your Consumer Health Data

We disclose your Consumer Health Data as reasonably necessary to Third Parties and Affiliates, which may include:

• Vendors. We may disclose your Consumer Health Data to contractors, analytics partners, business partners, and vendors to provide and improve our Services to you.
• Other Parties. We may disclose your Consumer Health Data to other parties that your explicitly gave us consent to do so.

Washington Consumer Health Data Rights

If you are a Washington resident or we have collected your Consumer Health Data in Washington, you have rights set forth in this section subject to certain exceptions.

• Access: You have the right to request confirmation of or access to the Consumer Health Data that we process about you, including a list of all third parties and affiliates with whom we have disclosed or sold your Consumer Health Data and their contact information.
• Deletion: You have the right to request that we delete the Consumer Health Data that we have collected about you.
• Withdraw Consent: You have the right to withdraw consent from us collecting and disclosing your Consumer Health Data.
• Appeal: If we refuse to take action on your request within a reasonable period of time after receiving your request in accordance, you may appeal our decision. If we deny your appeal, you have the right to contact the Washington Attorney General at www.atg.wa.gov/file-complaint.

To exercise your rights, you must send us a request that (1) provides sufficient information to allow us to verify that you are the person about whom we have collected Personal Data, and (2) describes your request in sufficient detail to allow us to understand, evaluate and respond to it. Each request that meets both of these criteria will be considered a "Valid Request." We may not respond to requests that do not meet these criteria.

You may submit a Valid Request by emailing us at [email protected]. If you have any questions about this section or whether any of the following rights apply to you, please contact us at [email protected]. We will not discriminate against you for exercising your rights under applicable law.