US State Privacy Rights Disclosure

YOUR US STATE PRIVACY RIGHTS/CHOICES

Effective: July 1, 2023

This section contains additional information relevant to residents of certain US states that have their own laws and regulations regarding data privacy, including the rights that may be available to residents of these states upon the effective dates of the state laws and regulations. This content supplements our Privacy Notice and includes our Notice at Collection under California law.

This notice does not address or apply to information or practices that are not subject to the CCPA or other similarly situated state laws, such as publicly available information; data that is not considered personal information; certain health information governed by HIPAA (which is governed by our Notice of Privacy Practices found at https://www.dexcom.com/notice-of-privacy-practices) and other state and federal laws; activities covered by the Fair Credit Reporting Act; and job applicant and employment information (which are found on our careers’ page and on our Company intranet, respectively).

CALIFORNIA NOTICE OF COLLECTION OF PERSONAL INFORMATION

Categories of Personal Information We Collect

We may collect the following categories of personal information via our Services (and have done so within the last 12 months):

Identifiers such as name, postal address, phone number, email address, online identifiers;
Internet, network or other electronic activity information relating to your interaction with our websites or advertisements;
Audio, electronic, visual or similar information (such as CCTV or video information if you visit a physical site or event);
Inferences drawn from any of the information above to create a profile about a consumer reflecting the consumer’s preferences and characteristics.

Retention. We will retain and use your personal information as long as is necessary for the purposes described herein or otherwise disclosed to you at the time of collection, to comply with our legal obligations and requirements, resolve disputes, and enforce our terms and agreements.

Purposes for Which We Use Your Personal Information

The purposes of collecting personal information are as summarized in our Privacy Policy and include:

communicating with you
auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards
verifying your identify and/or authenticating you
helping to ensure security and integrity to the extent the use of personal information is reasonably necessary and proportionate for these purposes
for short-term, transient use including, but not limited to, nonpersonalized advertising shown as part of your current interaction with us, provided that your personal information is not disclosed to another third party and is not used to build a profile about you or otherwise alter your experience outside the current interaction with us
conducting administrative purposes including providing customer service, verifying customer information, providing analytic services, providing storage, or providing similar services
providing advertising and marketing services, except for cross-context behavioral advertising, to you provided that certain limitations are met
undertaking internal research for technological development and demonstration
undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us
advertising and promotion, including to contact you regarding programs, events, and topics that may be of interest or useful to you
complying with legal and regulatory obligations
for commercial purposes such as to provide investor and investment information
other purposes we may notify you about or for which you provide your consent

We disclosed the following categories of personal information for a business purpose in the last 12 months: identifiers/contact information, Internet, network or other electronic activity information, inferences, and sensitive personal information.

Categories of Third Parties

We disclosed each category of personal information to the following categories of third parties including advertising networks, internet service providers, data analytics providers, government entities, operating systems and platforms, social networks, and data brokers.

Sources of Personal Information

The sources of personal information from whom we collected personal information are from you directly, data analytics providers, social networks, advertising networks, internet service providers, and data brokers that update or supplement information we hold about you.

Categories of Personal Information which We “Sell” or “Share”

We do not “sell” your information as most people would typically understand the term. However, we do allow certain third parties to collect information about visitors to our non-HIPAA covered, educational webpages to provide fraud detection and reporting and analytics and advertising services, including cross-contextual behavioral advertising. This may include sharing information about your interactions with videos you may watch and other information searched for or viewed for the purposes of providing you with information and advertising related to your searches, queries, or other interactions with us. These activities may be considered a “sale” or “sharing” under some laws. To opt-out of any sale or sharing of Personal Data, please contact us.

As defined by applicable law, we “sold” or “shared” the following categories of personal information in the last 12 months: identifiers (as listed above), Internet, network or other electronic activity information. We “sold” or “shared” each category to or with advertising networks, advertising, internet service providers, data analytics providers, operating systems and platforms, social networks, and data brokers.

The business or commercial purpose of “selling” or “sharing” personal information is to assist us with marketing, advertising, and audience measurement.

We do not “sell” or “share” the personal information of known minors under 16 years of age.

California Consumer Rights Under the CCPA

This section describes your rights in relation to your personal information under the CCPA, subject to certain exceptions and limitations.

Right to Know

You have the right to request that we disclose personal information about you that we collected, sold and shared. It includes a request for any or all of the following: (1) Specific pieces of personal information that we collected about you; (2) Categories of personal information we collected about you; (3) Categories of sources from which the personal information is collected; (4) Categories of personal information that we sold or disclosed for a business purpose about the consumer; (5) Categories of third parties to whom the personal information was sold or disclosed for a business purpose; and (6) The business or commercial purpose for collecting or selling personal information.

Right to Delete

You have the right to request that we delete personal information that we collect.

Right to Correct

You have the right to request that we correct inaccurate personal information that we maintain about you.

Right to Request the Opt-Out of the “Sale” and “Sharing” of Your Personal Information

California residents also have the right to “opt out” of the “sale” or “sharing” of their “personal information” to or with “third parties” (as those terms are defined under law). Certain data collection on our sites and applications for purposes of interest-based advertising and social media tools may be a “sale” or “sharing” under California privacy law. Instructions for how you can exercise these rights are set forth below in the “Exercising Your California Privacy Rights” section.

Right to Limit Use and Disclosure of Sensitive Personal Information

The CCPA allows California residents to limit our uses and disclosure of sensitive personal information, if any, to certain reserved purposes. We do not use or disclose sensitive personal information that allows for you to opt-out of such uses or disclosures under the California Consumer Privacy Act.

Right of Non-Discrimination

You have the right to not receive discriminatory adverse treatment for exercising any of your CCPA rights.

EXERCISING YOUR CALIFORNIA PRIVACY RIGHTS

Making Access, Deletion, and Correction Requests

To make an access, deletion, or correction request, please visit https://privacyrequest.dexcom.com/privacy. Before completing your request, we may need to verify your identity, your authority to make a request on behalf of another person, or if we cannot confirm that the personal information relates to you. We may send you a link to verify your email address and may request additional documentation or information solely for the purpose of verifying your identity, depending on the request.

Making Requests to Opt Out of the “Sale” or “Sharing” of Personal Information

To submit a request to opt out of the sale or sharing of your personal information, you may click on the link “Your Privacy Choices” (found here and at the bottom of our website homepage) or you may choose to enable online a universal tool that automatically communicates your opt-out choice, such as the Global Privacy Control (“GPC”). We will process the GPC signal as a request to opt out. To learn more about and enable GPC, you can visit the Global Privacy Control page at https://globalprivacycontrol.org. If you visit our Website from a different device or from a different browser on the same device, you will need to opt-out, or use an opt-out preference signal, for that browser and/or device.

Instructions for Authorized Agents Making Requests

You may also use an authorized agent to submit requests on your behalf. Authorized agents may submit such requests at https://privacyrequest.dexcom.com/privacy. An authorized agent must have your signed permission to submit a request on your behalf. Before completing requests from authorized agents, we may contact you directly to confirm you’ve given your permission and/or to verify your identity.

No Financial Incentives

Under the CCPA, the purpose of the Notice of Financial Incentive is to explain the material terms of a financial incentive or price or service difference the business is offering so that the consumer may make an informed decision about whether to participate. We do not offer any financial incentives or price or service difference at this time.

CONTACT INFORMATION

If you have a question about our privacy policies, please send an email to [email protected] or write us at:

Dexcom, Inc.

Attn: Data Privacy Officer

6340 Sequence Drive

San Diego, CA 92121

United States of America

Privacy Notices for Residents of Virginia, Colorado and Connecticut

Updated: July 1, 2023

Under the Colorado Privacy Act (“CPA” or “Colorado Privacy Law”), Connecticut Data Privacy Act (“CTDPA” or “CT Privacy Law”), and Virginia Consumer Data Protection Act (“VCDPA” or “Virginia Privacy Law”) (collectively the “Privacy Laws”), consumers in those states have the right to receive certain disclosures regarding the processing of “Personal Data” as defined under the Privacy Laws, as well as certain rights with respect to our processing of such Personal Data.

The categories of Personal Data processed by us are described under the Categories of Personal Information We Collect. To the extent that visiting an educational health website and processing personal data such as cookies or other unique identifiers for purposes of online advertising and analytics, is considered sensitive data under the Colorado and CT Privacy Laws, we collect sensitive data. We obtain consent through the online cookie banner and your continued use of the website. You can opt out of targeted advertising and/or the “sale” of personal data as described below. We do not collect sensitive data as defined under the Virginia Privacy Law.

The purposes for processing Personal Data are described above in Business or Commercial Purposes for Which We Use Your Personal Information and in the privacy policy.

The categories of third parties with whom we share Personal Data are described above in Categories of Third Parties.

You may exercise your consumer privacy rights, subject to certain exceptions, as follows:

Right to Know/Access: To confirm whether or not we are processing your Personal Data and to access it.

Right to Correction: To correct inaccuracies in your Personal Data, taking into account the nature of the Personal Data and the purposes of the processing of your Personal Data.

Right to Deletion: To delete Personal Data provided by, obtained about, or concerning you.

Right of Portability: To obtain a copy of the Personal Data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit your Personal Data to another controller or business where the processing does not disclose trade secrets.

Right to Opt-Out of Targeted Advertising: To opt-out of targeted advertising,

• Click the Your Privacy Choices link in the footer of our website or access our cookie preference manager and select your choice.

• Submit a request through our webform or write to us at Dexcom, Inc., Attn: Data Privacy Officer, 6340 Sequence Drive, San Diego, CA 92121, United States of America.

To learn more about interest-based advertising (and how to manage your preferences for interest-based ads for participating companies using industry settings, please visit the following third-party websites:

• To opt out of receiving interest-based advertisements from members of the Digital Advertising Alliance (DAA), please visit: www.aboutads.info/choices and youradchoices.com/appchoices.

Please note that these opt-in and opt-out mechanisms are browser and device specific. If you wish to opt-in and/or opt-out of interest-based advertising across browsers and devices, you need to make your choices in each browser and device you use. Please be aware that if you opt out of receiving interest-based advertising, you will still be served with advertisements, but they will no longer be targeted to your specific interests gathered across different websites over time.

Right to Opt-Out of Sale: Under Privacy Laws, residents may submit a request to opt out of sales by:

• Clicking the Your Privacy Choices link in the footer of our website or accessing our cookie preference manager and selecting your choice.

• Submitting a request through our webform.

Under the Colorado and Connecticut Privacy Laws, the “sale” of personal information is broadly defined and encompasses an exchange for valuable consideration. However, we do not "sell" any consumer data in the traditional sense for monetary compensation.

Under the Virginia Privacy Law, a “sale” includes disclosing or making available Personal Data to a third party in exchange for money. We do not “sell” Personal Data under this definition.

Right to Opt-Out of Significant Profiling: To opt out of the processing of your Personal Data by us for decisions that produce legal or similarly significant effects concerning you. We do not use your Personal Data for these reasons outside of the employment context.

Right to Appeal: If we decline or are unable to take action regarding your request, we will notify you by providing our reasons and will provide instructions for how you can appeal the decision. If the appeal is denied, we will provide a way for you contact your Attorney General to submit a complaint if you have concerns about the results of the appeal.

Deidentified Data: In the event we share deidentified data about individuals with third parties and have agreed not to reidentify such deidentified data, we commit to maintaining and using deidentified data without attempting to reidentify a consumer except as permitted by law.