Consumer Health Privacy Notice
This Consumer Health Privacy Notice (“Notice”) is intended to supplement the Eli Lilly and Company Privacy Statement and other applicable privacy notices (“privacy statements”) to provide additional notices related to health information or health data (“health information”) as defined by Washington and Nevada law. Washington and Nevada require Eli Lilly and Company and its wholly owned subsidiaries ("Lilly" or "we") to provide you with additional information about how we may collect, use, disclose or otherwise process your health information, how we protect it, and your rights and choices with respect to your health information.
This Notice applies to all Lilly operations as well as websites, mobile applications and digital services ("Services") that link to or post it.
Scope
Health information for purposes of this Notice has the definition given in Washington or Nevada law, including information that identifies or is reasonably capable of being associated or linked, directly or indirectly, with a particular consumer and that identifies the consumer’s past, present, or future physical or mental health status. This Notice applies only to residents of Washington and Nevada and individuals whose information is processed in Washington or Nevada.
This Notice does not apply to the personal information that we collect and process about Lilly workforce members, including job applicants; active and inactive Lilly employees; former employees; retirees; dependents; beneficiaries; employees of Lilly’s third-party vendors and partners, such as contractors on assignment at Lilly; and other individuals about whom Lilly collects PI for HR-related purposes. It does not apply to health information that is used to engage in public or peer-reviewed scientific, historical, or statistical research that adheres to all other applicable ethics and privacy laws.
In certain circumstances, we may collect or use your information through our Services while acting as a “business associate” under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), and your information may constitute “Protected Health Information.” This Notice does not apply to Protected Health Information or any health information processed in circumstances where Lilly is acting as a business associate under HIPAA.
Health Information Practices
Categories of Health Information
The categories of health information we collect will depend on how you interact with Lilly Services and the information you choose to provide. We may collect:
- Health conditions, treatments, diseases, or diagnosis
- Social, psychological, behavioral, and medical interventions
- Health-related surgeries or procedures
- Use or purchase of prescribed medication
- Bodily functions, vital signs, symptoms, or measurements of other types of consumer health data
- Diagnoses or diagnostic testing, treatment, or medication
- Reproductive or sexual health information
- Biometric data
- Genetic data
- Data that identifies a consumer seeking health care services
- Other information that may be used to infer or derive data related to the above or other health information.
Purposes for Collection
With your consent, we may use the health information we collect for the following purposes, as further described in our privacy statements:
- Providing Services and support. To provide and operate our Services; communicate with you about your use of our products and Services (e.g., through newsletters and emails), including through the use of our AI tools that assist our support centers; fulfill product orders or requests for samples; provide troubleshooting and technical support; respond to your inquiries; gather customer feedback; fulfill your requests; process your payments; communicate with you; and for similar Service and support purposes.
- Analytics and improvement. To better understand how users access and use our Services, products, and offerings, and for other research and analytical purposes, such as to evaluate and improve our Services and business operations, to develop Services and features, and for internal quality control and training purposes.
- Customization and personalization. To tailor the content that we may send you and that we may display on the Services, including to offer personalized help and instructions, and to otherwise personalize your experience.
- Marketing and advertising. For example, to send you information about our Services, such as newsletters, and other marketing content, including about third-party products and services we think may interest you, as well as any other information that you sign up to receive. We also may use certain health information that we collect to manage and improve our advertising campaigns so that we can better reach individuals with relevant content.
- Security and protection of rights. To protect our Services and our business operations; to prevent and detect fraud, unauthorized activities and access, and other misuse; where we believe necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety or legal rights of any person or third party, or violations of our Privacy statements.
- Legal proceedings and obligations. To comply with the law and our legal obligations, to respond to legal process and related legal proceedings.
- General business and operational support. To consider and implement mergers, acquisitions, reorganizations, bankruptcies, and other business transactions, and related to the administration of our general business, accounting, auditing, compliance, recordkeeping, and legal functions.
Sources of Health Information
As described further in the Personal Information Collected section of the privacy statements, we collect personal data (which may include health information) directly from you, from your interactions with our products and Services, from third parties, and from publicly available sources:
- We may collect additional information such as health information related to your interactions with our products and Services.
- We may collect health information about you from third-party sources, such as public databases, joint marketing partners, social media platforms, government sources, or other third parties.
Lilly does not sell or share your health information with third parties. We may disclose health information to our processors for our business purposes or at your direction to provide you with products and Services that you request.
Your Rights and Choices
You have the following rights with respect to your health information:
- The right to confirm whether we are collecting, selling or sharing your health information
- The right to withdraw consent for us to collect or share your health information
- The right to request that we delete your health information
- The right to correct your health information
There may be certain exceptions that apply to your request. To exercise your rights, you or your authorized representative may submit a request to [email protected] or 1-800-Lilly-Rx (1-800-545-5979). You may be entitled, in accordance with applicable law, to appeal a refusal to take action on your request. To do so, please contact us by using one of the methods listed in the "How to Contact Us" section in our privacy statements. You will not be discriminated against for exercising any of your rights.
We may update this Consumer Health Privacy Notice from time to time. When we do update it, for your convenience, we will make the updated statement available on this page. We will always handle your health information in accordance with this Notice in effect at the time it was collected unless we provide you with the new notice and/or obtain your consent or authorization, as appropriate.
Effective Date: March 31, 2024
Last Updated: March 6, 2024
PP-LU-US-1132