The Estée Lauder Companies: Consumer Health Data Privacy Statement

Effective Date: March 31, 2024

Last Updated: July 1, 2024

This Consumer Health Data Privacy Statement (the “Statement”) supplements the Estée Lauder Companies’ (“ELC”, “we”, “us”, “our”) United States Privacy Policy. It applies to Nevada and Washington consumers and consumer health data collected in the States of Nevada and Washington, respectively. This Statement uses certain terms that have the meaning given to them in Nevada S.B. 370 and/or the Washington My Health My Data Act.

1. Collection and Use of Consumer Health Data

We may collect the following categories of consumer health data about you, including information about your:

• reactions;
• allergies
• conditions or diagnoses;
• medications and treatments;
• medical tests; and
• medical records.

We may collect and use consumer health data for the following purposes:

• recommending products to you;
• obtaining product feedback from you;
• investigating your concerns;
• analyzing the cause of your concern;
• evaluating and improving the safety of our products; and
• complying with internal and regulatory reporting or audit requirements.

Where required by applicable law, we will obtain your consent to collect and use your consumer health data.

2. Sources of Consumer Health Data

We may collect consumer health data about you from:

• You, such as when you complete adverse event reporting questionnaires and/or in-store incident reports, interact with our online skin diagnostic tools and/or skincare quizzes, and complete product reviews.

3. Sharing of Consumer Health Data

We may share the categories of consumer health data described in Section 2 of this Statement with the following entities:

• Government entities, where required to meet regulatory reporting or audit requirements.
• Service Providers, who perform services on our behalf based on our instructions.

Where required by applicable law, we will obtain your consent to share your consumer health data.

4. Nevada and Washington Consumer Rights

You have certain rights and choices regarding our use and disclosure of your consumer health data, as described below.

• Confirm: You have the right to request that we disclose to you whether we collect, share, or sell your consumer health data.
• Access: You have the right to request access to, and information about, the consumer health data we have collected, shared, or sold about you.
• Delete: You have the right to request that we delete your consumer health data.
• Withdraw: If, where required under applicable law, you have provided your consent to ELC to collect, use and share your consumer health data, you have the right to withdraw your consent and request that ELC cease collecting and/or sharing your consumer health data.

How to Submit a Request: To submit a request to exercise the rights and choices set forth above, please visit our Privacy Request Portal