State Supplement to Privacy Statement

PLEASE READ AND REVIEW THE FOLLOWING STATEMENT CAREFULLY BEFORE USING THIS WEBSITE

This document supplements Cencora Inc.’s and its subsidiaries’ and affiliates’ (“Cencora”) Privacy Statement (“State Supplement”) and applies solely to individuals who reside in the States of California, Colorado, Connecticut, Utah, and Virginia (“Applicable Individuals,” “You,” or “Your”).  It is adopted pursuant to the California Consumer Privacy Act (the “CCPA”) (as amended by the California Privacy Rights Act and any other amendments), the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, and the Virginia Consumer Data Privacy Act (collectively, the “State Privacy Laws”). Any terms that are defined in the State Privacy Laws have the same meaning here. Please read our full Privacy Statement.   carefully and completely before using the Web Site.

Information We Collect, Disclose, or Sell

Cencora has not sold or shared (as those terms are defined under applicable laws) Personal Data, including Sensitive Personal Data, to any third party in the last twelve (12) months. Where Cencora discloses Personal Data to third parties, it does so for the same business purposes described below and, where appropriate, requires that such parties maintain its confidentiality and maintain appropriate systems and processes to ensure its security and protection. The following table sets forth the categories of Personal Data Cencora has collected from Applicable Individuals within the last twelve (12) months, the source of that Personal Data, and how we have used and shared such Personal Data within the last twelve (12) months. 

Cencora does not “sell” or “share” (within the meaning of the State Privacy Laws) Personal Data about you to third parties. Relatedly, we do not sell or share Personal Data of individuals under 16 years of age. Cencora does not use or disclose sensitive Personal Data, as defined in applicable laws, for any purposes other than those permitted by applicable law. 

Cencora does not use or disclose sensitive Personal Data for any purposes other than those permitted by applicable law. 

Your Rights and Choices

You have a number of rights related to Personal Data that we process about you (this will depend on the jurisdiction where you reside and the legal basis that we use). Please refer to the state-specific sections below for more information about your rights.  

California Residents

The California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”), provides California residents with the following rights regarding their Personal Data: 

• The right to know what Personal Data we have collected, used, disclosed and sold about you, including the categories of Personal Data, the categories of sources from which the Personal Data is collected, the business or commercial purpose for collecting, selling, or sharing Personal Data, the categories of third parties to whom Cencora discloses Personal Data, and the specific pieces of Personal Data Cencora has collected about you. 
• The right to correct inaccuracies in your Personal Data, taking into account the nature of the Personal Data and the purposes of the processing. 
• The right to request deletion of Personal Data we have collected about you. 
• The right to opt out of the selling or sharing of your Personal Information, which you can exercise through the contact form available on our website or by modifying your privacy preferences (e.g., Global Privacy Control), available through certain internet browsers and extensions, that signal your preference to opt out.  Please note that clearing your cookies at any time will remove the signal of your selected privacy preferences.
• The right to limit the use of your sensitive Personal Information, which you can exercise through the contact form available on our website.

In addition to the rights listed above, California’s “Shine the Light” law (Cal. Civ. Code § 1798.83) permits users that are residents of California to request certain information regarding our disclosures of Personal Information to third parties for such third parties’ direct marketing purposes. Please email or write to us as provided below to submit your request.

Colorado Residents

Starting in July 2023, the Colorado Privacy Act (“CPA”) will provide Colorado residents with the following rights regarding their Personal Information:

• The right to confirm whether we process your Personal Information and access your Personal Information in a portable and readily usable format.
• The right to correct inaccuracies in your Personal Information, taking into account the nature of the Personal Information and the purposes of the processing.
• The right to delete Personal Information we have obtained about you.
• The right to opt out of the processing of your Personal Information for purposes of targeted advertising, the sale of Personal Information, and/or profiling in furtherance of decisions that produce legal or similarly significant effects.
• If we deny your request, the right to appeal our decision.

Connecticut Residents:

Starting in July 2023, the Connecticut Data Privacy Act (“CTDPA”) will provide Connecticut residents with the following rights regarding their Personal Information:

• The right to confirm whether we process your Personal Information and access your Personal Information in a portable and, to the extent technically feasible, readily usable format.
• The right to correct inaccuracies in your Personal Information, taking into account the nature of the Personal Information and the purposes of the processing.
• The right to delete Personal Information provided by or obtained about you.
• The right to opt out of the processing of your Personal Information for purposes of targeted advertising, the sale of Personal Information, and/or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects.
• If we deny your request, the right to appeal our decision.

Utah Residents:

Starting in December 2023, the Utah Consumer Privacy Act (“UCPA”) will provide Utah residents with the following rights regarding their Personal Information:

• The right to know what Personal Information we have collected, used, or disclosed about you.
• The right to request that we delete any Personal Information we have collected from you.
• The right to obtain a copy of the Personal Information you have previously provided to us in a format that, to the extent technically feasible, is portable and readily usable.

Virginia Residents:

The Virginia Consumer Data Protection Act (“VCDPA”) provides Virginia residents with the following rights regarding their Personal Information:

• The right to confirm whether we process your Personal Information and access your Personal Information.
• The right to correct inaccuracies in your Personal Information, taking into account the nature of the Personal Information and the purposes of the processing.
• The right to delete Personal Information we have obtained about you.
• The right to opt out of the processing of your Personal Information for purposes of targeted advertising, the sale of Personal Information, and/or profiling in furtherance of decisions that produce legal or similarly significant effects.
• The right to obtain a copy of the Personal Information you have previously provided to us in a portable and, to the extent technically feasible, readily usable format.
• If we deny your request, the right to appeal our decision.

How to Make a Request

To make any of the requests described above, you may contact us at 1-800-829-3132 or submit the request using the Data Subject Request form provided available on our website. 

Residents of California may also designate an authorized agent to make a request on their behalf.  Parents may also make verifiable requests on behalf of their minor children.

The verifiable request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a verifiable request does not require you to create an account with us, but we may treat requests made through your password-protected account as sufficiently verified when the request relates to Personal Information associated with your specific account. We will use Personal Information provided in a verifiable request only to verify the requestor’s identity or authority to make the request.

Verifiable Request Response Timing and Format

We endeavor to respond to a verifiable request within forty‑five (45) days of its receipt. If we require more time (up to forty‑five (45) days), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. With the exception of disclosures to California residents, any disclosures we provide will cover only the twelve (12) month period preceding the verifiable request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance. We do not charge a fee to process or respond to your verifiable request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Verification of Requests

As required under applicable laws, we must take steps to verify your request before we can process your request.  To verify your request, we will ask you to provide your name, email address, telephone number, and state of residence.  If we believe we need further information to verify your request as required by law, we may request additional information from you.

Appeal of Verifiable Request Response

Residents of Colorado, Connecticut, and Virginia have the right to appeal a decision we make regarding their requests.  To appeal a decision we make regarding your request, please contact us as described under Contact Information below. 

Retention Period

We will retain your Personal Information for as long as needed or permitted for the purpose(s) for which it was obtained. The criteria to determine retention periods include: (i) length of time of ongoing relationship with you, (ii) legal obligation to which we are subject or industry standards; (iii) quantity, nature and sensitivity of Personal Information; (iv) potential risk of harm in the event of unauthorized use or disclosure; and (v) the purpose of the processing and whether or not these purposes can be achieved by other means.

Non-Discrimination

We will not discriminate against you for exercising any of your rights related to your Personal Information. Unless permitted by applicable laws, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Contact Information

If you have any questions about the Privacy Statement or this Supplement or the use of your Personal Information, please contact us by sending an email to privacy@amerisourcebergen.com, calling us at 1-800-829-3132, or writing to the following address:

Cencora, Inc. 
Corporate Headquarters 
1 West First Avenue 
Conshohocken, PA 19428 
Attention: Amy Huffman, Vice President, Global Privacy Operations
 privacy@amerisourcebergen.com
 
Changes to This Supplement
Cencora reserves the right to amend the Privacy Statement or this Supplement at our discretion and at any time. When we make changes to this the Privacy Statement or this Supplement, we will post the updates on the Website and update the Privacy Statement’s effective date. Your continued use of the Website following the posting of changes constitutes your acceptance of such changes.