Merck and Co., Inc., Rahway, NJ, USA, which has a tradename of MSD outside of the U.S. and Canada (“Merck”), makes available our Global Cross Border Privacy Rules Policy to describe our collection, use, and disclosure of personal information. Our Global Internet Privacy Policy (“GIPP”) also has important information about our privacy practices when you use the online resources that display it Please see our GIPP and Global Cross Border Privacy Rules Policy for more information about our privacy practices and your privacy rights.
Merck provides this Supplemental Notice (“Supplement”) to provide information to residents whose personal information is controlled or processed by Merck pursuant to the California Consumer Privacy Act (“CCPA”) Virginia Consumer Data Protection Act (“VCDPA”), Colorado Privacy Act (“ColoPA”), Utah Consumer Privacy Act (“UCPA”), Connecticut Personal Data Privacy and Online Monitoring Act (“CPDPOMA”) and Nevada Revised Statues Chapter 603A (“NRS”)( collectively, the “State Acts”).
Categories of Personal Information Collected and Disclosed
During the preceding 12 months, Merck has collected and/or disclosed for our business purposes the following categories of personal information:
- Identifiers, such as your name, contact information and online identifiers.
- Medical, health, and biometric information, where that information is processed in those situations outside the scope of either the Health Insurance Portability and Accountability Act or other applicable state laws.
- Internet and electronic network activity information, such as information about your interactions with our online resources.
- Audio, electronic and visual information, such as video testimonials.
- Professional information and education information, such as information about medical specialty.
- Inferences we derive from the information that we collect.
- Other information that we collect when you provide it or as disclosed to you, such as in our GIPP.
Please see the GIPP for more information about the information we collect, how we collect it, and how we use and disclose that information. In particular, we describe:
- “How do we collect personal information online?“
- “Why do we collect, use, and disclose personal information?“
As set forth in the GIPP, we disclose personal information to third parties for various business purposes, including for purposes of advertising, marketing, and other services performed on our behalf, to protect against fraud and malicious activity, and for other business purposes described in the GIPP and Global Cross Border Privacy Rules Policy. In addition, we and the third parties that provide content, functionality, or services on our website may collect information about you and/or your device(s) via cookies and similar tracking technologies, including to provide you with more relevant content and promotional materials, on and off the website, and to help us understand your interests and improve the website. Please visit our Global Online Tracking Policy for more information, and for information about the choices you have regarding our use of cookies and similar tracking technologies.
We neither disclose your personal information to third parties for money or other valuable consideration (other than as part of a contract where they provide a service to us) nor sell your information for money or other valuable consideration. Moreover, Merck does not share your personal information with third parties for targeted or cross-context behavioral advertising.
We may disclose your personal information with other entities for purposes of a sale, merger, or other related corporate event. An entity that buys Merck or a part of Merck’s business may continue to use your personal information in accordance with our Global Cross Border Privacy Rules Policy and this Supplemental Notice. We may also disclose your personal information to third parties, to the extent necessary to: (1) cooperate with law enforcement or a government agency; (2) exercise or defend legal claims; or (3) as otherwise required by federal, state, or local laws.
Your Choices and Rights
Data Subject Rights. Under the State Acts, you also may have the right to request access to certain information, such as the specific pieces and categories of personal information that we have collected about you, the categories of sources for that information, the business or commercial purposes for collecting the information, and the categories of third parties with which the information has been shared. The State Acts may also give you the right to request correction, deletion, and portability of your information under certain circumstances. Consistent with the State Acts, if you choose to exercise any of these rights, or other rights afforded under the State Acts, we will not charge you different prices or provide different quality of services unless those differences are related to your information.
If you would like to access, correct, or delete information, or otherwise exercise your rights under the State Acts, you may exercise your Data Subject Rights here.
Any such request may be manually or electronically signed (in the case you are a resident of California, by any process that satisfies the California Uniform Electronic Transactions Act). These rights are not absolute, and we will respond in accordance with the applicable State Act. For example, once we receive your request, we may verify it by requesting information sufficient to confirm your identity. If you are a resident of California or Colorado and would like to use an agent registered with the relevant Secretary of State to exercise your rights, we may request evidence that you have provided such agent with power of attorney or that the agent otherwise has valid written authority to submit requests to exercise rights on your behalf. In addition, you may have the right to appeal any refusal by us to take any action upon your request under any of the above rights provided by the State Acts. Information on how to exercise this right of appeal will be provided to you in any applicable response to the exercise of your Data Subject Rights.
Opt Out Rights. Merck does not sell your personal information. Under the State Acts, you may have the right to opt-out of certain targeted advertising activities, including the sharing of your information for targeted advertising. We do not engage in these activities if we know a user is under 16 years of age. To exercise these rights online, please click here: “Do Not Sell or Share My Personal Information.” You may also opt-out by contacting Merck at: Merck Privacy Office, UG4B-24, 351 N. Sumneytown Pike, North Wales, PA 19454.
While some of the information that we collect may be considered sensitive personal information, we do not use and disclose sensitive personal information except as allowed by the applicable State Act.
Do Not Track
Some internet browsers have incorporated “Do Not Track” features. Most of these features, when turned on, send a signal or preference to the web sites you visit indicating that you do not wish to be tracked (“DNT-signal”). As reflected in the Policies above, we are committed to providing you with meaningful choices about the information collected on our website for third party purposes, and that is why we provide the variety of opt-out mechanisms described in our cookie panel, where deployed. In addition, where we deploy a cookie panel, it is designed to identify a browser-initiated DNT-signal and apply it to the cookie settings per your preferences. However, despite our best efforts, this may not function for all browsers. Using the cookie banner settings will ensure that your preferences are appropriately reflected. Despite the protections described above, whether we deploy a cookie panel or not in your market, we do not currently recognize or respond directly to browser initiated DNT signals.
Calendar Year 2022 Metrics (including newly acquired Imago BioSciences, Inc.)
Requests to Know:
Number received: 19
Number complied with in whole or in part: 19
Number denied: 0
Requests to Delete:
Number received: 31
Number complied with in whole or in part: 31
Number denied: 0
Requests to Opt-Out:
Number received: 73
Number complied with in whole or in part: 73
Number denied: 0
The median number of days within which we substantively responded to Requests to Know, Requests to Delete, and Requests to Opt-out: 6.9 days
Effective date: 23 March 2023