Blueprint Medicines Consumer Health Data Privacy Notice Supplement

Effective March 31, 2024

Please refer to our Privacy Notice for full details about how Company collects, uses, shares or otherwise processes your Personal Information.

This Consumer Health Data Privacy Notice Supplement provides additional details about how Company may process Personal Information defined as Consumer Health Data under certain U.S. state laws, such as:  Washington’s My Health My Data Act (MHMDA), Nevada’s Consumer Health Data Privacy Law (NV CHDP) and Connecticut’s Data Privacy Act (CTDPA – SB 3).

This Consumer Health Data Privacy Notice applies to Consumer Health Data as that term has been defined by applicable laws, and will prevail over any conflicting provisions in our Privacy Notice for residents of Washington, Nevada or Connecticut.

• Personal identifiers (e.g. first and last name, email address;)
• Contact information (e.g. address, email address;)
• Demographic information (e.g. age, gender, ethnicity;)
• Information about health-related conditions, symptoms, status, diagnoses and medications;
• Health-related surgeries or procedures;
• The use or purchase of prescribed medications;
• Social, psychological, behavioral, or medical interventions;
• Diagnostic testing or treatments;
• Reproductive or sexual health information;
• Biometric data;
• Genetic data;
• Information that could identify your attempt to seek health care services or information, including services that allow you to assess, measure, improve, or learn about your or another person’s health;
• Other information that may be used to infer or derive data related to the above or other health information.

Consumer Health Data may be collected directly from you, from your interactions with our Products and Services, from information we lawfully obtain from other sources, such as public records or websites, or other third parties, as described in the Collecting and Using your Personal Information section of our Privacy Notice. These sources include but are not limited to:

• Healthcare Providers (including specialty pharmacies;)
• Health Insurance Companies and other payors;
• Authorized legal representatives, family members and caregivers;
• Payment processors and other financial institutions
• Consumer reporting agencies and other Third Parties to verify information you provide;
• Mobile devices or other internet-connected devices with your permission upon interacting with our websites;
• Cookies, pixels and web beacons (tracking technology) when you visit our or related Third-Party websites;
• Third Parties who provide services to us, including patient support programs, product fulfillment, online security services, digital marketing any analytics;

We collect and use Consumer Health Data as reasonably necessary to provide you with the Products or Services you have requested or authorized, to provide and manage clinical research opportunities, patient support programs and other Services we offer, to process and manage safety and quality concerns and to conduct other legitimate business activities, as allowed by applicable law.

With your consent, and based on your choices, we may use your Consumer Health Data for other purposes – for example, for advertising or marketing purposes. See the How to Exercise Your Rights section below for more details on the controls and choices you may have.

Company will not transfer or allow access to your Personal Information or Consumer Health Data to non-affiliated parties without your consent, except: (i) to service providers who provide services to us (e.g., market research) or who assist us in providing service to you (e.g. a fulfillment company for processing and mailing purposes); (ii) in connection with security related or law enforcement investigations or in the course of cooperating with authorities; (iii) to comply with legal requirements or to establish or exercise our legal rights or defend against legal claims; (iv) when we believe it is necessary to share information in order to assist in an investigation regarding, or to prevent, illegal activities, suspected fraud, or situations involving potential threats to the safety of any person; (iv) upon a sale, merger, assignment or transfer of the business of the website to which the information relates; and (v) to non-affiliated parties with whom Company is jointly marketing a product or service or jointly conducting a program or activity. Any affiliated entity, vendor or service provider, or other non-affiliated party who is permitted access to, or to whom we transfer, Personal Information is required to keep your Personal Information confidential.

In the last twelve months we may have disclosed or shared the same categories of information listed above to:

• Perform the services or provide goods reasonably expected by a Consumer who requests such goods or services;
• Prevent, detect, and investigate potential security incidents that may compromise the confidentiality, integrity or availability of processed Personal Information;
• Verify or maintain the quality of a product or service that is owned, manufactured for, or controlled by us, and improving, upgrading or enhancing the service or product;
• Perform services on our behalf, including maintain or service accounts, provide customer service, process orders, verify information, process payments, provide analytic services, provide storage, or other similar services on our behalf;
• Targeted advertising.

You may have certain rights with respect to your Consumer Health Data, including rights to access, delete, or withdraw consent relating to such data, subject to certain exceptions. You can request to exercise these rights by contacting us at privacy@blueprintmedicines.com or as described in the Exercising your Rights section of our Privacy Notice.

If your request to exercise a right you may have under applicable law is denied, you may appeal that decision by contacting us at privacy@blueprintmedicines.com. If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the applicable U.S. state regulator.

Our business, Websites and Services may change from time to time. As a result, we may make changes to our Privacy Notice or this Supplement at any time. If we do make such changes, we will post an updated version on this page, unless another type of notice is required by the applicable law. Additionally, when required under applicable law, we will request additional consent to collect and process your Personal and Consumer Health Data.  We encourage you to visit this page periodically and to review our most current Privacy Notice and applicable effective date.