WASHINGTON AND NEVADA CONSUMER HEALTH DATA PRIVACY POLICY

Effective Date: July 22, 2024

This Consumer Health Data Privacy Policy contains additional information regarding Consumer Health Data (as defined below), including the rights that may be available to residents of Washington and Nevada and individuals whose Consumer Health Data is collected in Washington or Nevada. This Consumer Health Privacy Policy does not address or apply to information or practices that are not subject to Washington’s My Health My Data Act or Nevada’s Consumer Health Data Privacy Law (SB 370)(collectively, the “Laws”); data that is not considered personal information; certain health information governed by HIPAA that is processed through our Dexcom G7^® CGM System, Dexcom G6^® CGM System, Dexcom G5^® CGM System, G6 Pro CGM System, Clarity Clinic, and our mobile apps such as Dexcom Clarity, the Dexcom G7 app, the Dexcom G6 app, the Dexcom G5 App, and Dexcom Follow (the “Products”) when those Products are provided to you directly by us or by your doctor or hospital or other healthcare provider (Healthcare Provider) as a Product reimbursable (paid for by) insurance in the United States (which is governed by our Notice of Privacy Practices found at https://www.dexcom.com/notice-of-privacy-practices) and other state and federal laws; activities covered by the Fair Credit Reporting Act; and job applicant and employment information (which are found on our careers’ page and on our Company intranet, respectively).

Our Collection and Use of Consumer Health Data:

The term “Consumer Health Data” as used in this Consumer Health Privacy Policy means any personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status as defined in the Laws. The data we collect depends on the context of your interactions with us and, in most cases, is information that you decide to share with us. Consumer Health Data does not include information that is considered deidentified under the Laws. Examples of Consumer Health Data that Dexcom may collect include:

Information you share about your health-related conditions, symptoms, experiences, diagnoses, testing, medications, or treatments.
Bodily function, vital sign, symptoms, or measurement of physical or mental health status information.
Data that identifies a consumer seeking healthcare services.
Other information that may be used to infer or derive data related to the above or other health-related information.
Information listed herein that is derived or extrapolated from information that is not Consumer Health Data, including, without limitation, proxy, derivative, inferred or emergent data derived through an algorithm, machine learning or any other means.

We may process and or use this information collected online and offline (including with your consent where required by Consumer Health Privacy Laws) for the following purposes:

in the provision of services including our websites and related services
helping to ensure security and integrity to the extent the use of Consumer Health Data is reasonably necessary and proportionate for these purposes
administrative purposes including providing customer service (including online service and virtual chatbots), verifying customer information, providing analytic services, providing storage, or providing similar services
undertaking internal research for technological development and demonstration
undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us
complying with legal and regulatory obligations
for commercial purposes such as to provide investor and investment information
communicating with you
auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards
for short-term, transient use including, but not limited to, non-personalized advertising shown as part of your current interaction with us
providing advertising and marketing services including for cross-context behavioral advertising where certain limitations are met
other purposes we may notify you about or for which you provide your consent or authorization

Sources From Which Your Consumer Health Data is Collected

The Consumer Health Data we collect depends on the context of your interactions with our services and, in most cases, is information that you directly decide to share with us. These sources further include:

you and those authorized to provide Consumer health data on your behalf, such as your caregiver or authorized representative
your personal devices
third parties that provide access to information you make available, such as social media
companies conducting non-clinical research such as market research companies
business partners or other service providers that assist us in providing and improving our Products and services

Our Disclosure of Consumer Health Data

We may share the categories of Consumer Health Data set forth above as follows:

Service Providers: We work with a variety of service providers who help us process your Consumer Health Data, such as to facilitate the provision of the service or that perform business or operational services for us or on our behalf, such as website hosting, infrastructure provisioning, IT services, payment processing services, and administrative services.
Parties with whom the Consumer has a Direct Relationship: We may share with parties with whom the consumer has a direct relationship for the purpose of providing services requested by the consumer, in circumstances, where Dexcom maintains control and ownership of the data and the party only uses the Consumer Health Data at Dexcom’s direction for the purpose for which the Consumer Health Data was collected or consented to.
Business Transactions: We may take part in or be involved with a business transaction, such as a merger. We may disclose Consumer Health Data to a third-party during the negotiation of or in connection with such a transaction but, to the extent permitted by applicable law.
Legal Obligations and Rights: We may disclose Consumer Health Data to third parties: in connection with the establishment, exercise, or defense of legal claims; to comply with laws or to respond to lawful requests and legal processes; to protect our rights and property and the rights and property of others, including to enforce our agreements and policies; to detect, suppress, or prevent fraud; to protect the health and safety of us and others; or as otherwise required by applicable law.
With Your Consent: We may disclose Consumer Health Data about you to certain other service providers or publicly with your consent or at your direction. For example, with an individual’s consent or at their direction we may post their testimonial on our Site or Service-related publications.

In the event we process deidentified data, we agree to maintaining and using deidentified data without attempting to reidentify a consumer except as permitted by law and will contractually obligate any recipients of such data to satisfy this criteria.

Exercising Your Privacy Rights

To make an access or a deletion request, please visit https://privacyrequest.dexcom.com/privacy. Before completing your request, we may need to verify your identity, your authority to make a request on behalf of another person, or if we cannot confirm that the Consumer health data relates to you. We may send you a link to verify your email address and may request additional documentation or information solely for the purpose of verifying your identity, depending on the request.

With respect to sharing identifiers, internet, network, or other electronic activity which may constitute Consumer health data relating to your interaction with our websites or advertisements, you may withdraw consent from collection and future sharing at the browser level by navigating to dexcom.com and clicking on the blue and white shield icon in the lower left-hand corner of the website. You may withdraw, update, or confirm your choices in the window that appears and click on “Confirm My Choices”.

Right to Appeal: If we decline or are unable to take action regarding your request, we will notify you by providing our reasons and will provide instructions for how you can appeal the decision. If the appeal is unsuccessful, you may raise a concern or lodge a complaint with the applicable attorney general:

• Washington: www.atg.wa.gov/file-complaint

• Nevada: ag.nv.gov/Complaints/File_Complaint/

Changes to this Consumer Health Data Privacy Policy

From time-to-time, we may change our privacy policy. We will post any changes on this page. If we change our privacy policy significantly, we will notify you by adding a prominent notice on our websites and services, by sending you an email notification, or other appropriate communication channels, as required by applicable law. To the maximum extent permitted by applicable law, any changes will become effective when we post the updated privacy policy on our website, and your use of our Products and services following these changes means that you accept the updated privacy policy. We encourage you to review our privacy policy when you use our Products and services to stay abreast on our information practices.

***********************************