State Supplement to Privacy Statement

PLEASE READ AND REVIEW THE FOLLOWING STATEMENT CAREFULLY BEFORE USING THIS WEBSITE

This document supplements Cencora Inc.’s and its subsidiaries’ and affiliates’ (“Cencora”) Privacy Statement (“State Supplement”) and applies solely to individuals who reside in the States of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Montana, Nebraska, Nevada, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia (“Applicable Individuals,” “You,” or “Your”). Please read our full Privacy Statement carefully and completely before using the Web Site.

Information We Collect, Disclose, Sell, or Share

Where Cencora discloses Personal Data to third parties, it does so for the same business purposes described below and, where appropriate, requires that such parties maintain its confidentiality and maintain appropriate systems and processes to protect its security and protection. The following table sets forth the categories of Personal Data Cencora has collected from Applicable Individuals within the last twelve (12) months, the source of that Personal Data, and examples of how we have used and disclosed such Personal Data within the last twelve (12) months. For a full list of our business purposes for using and disclosing Personal Data, please see “Use of Personal Data” in the Privacy Statement. For a full list of the categories of parties to whom we may disclose Personal Data, please see “Disclosing Your Personal Data” in the Privacy Statement.

Category	Sources of Personal Data	Purpose for Collection Examples	Categories of Recipients Examples
A. Identifiers, such as real name, postal address, email address, telephone numbers, or other similar identifiers.	From you. From you, our business partners, service providers, and third parties like data analytics and information providers.	To fulfill our obligations arising from any contracts entered between you and us and provide you with the information, product or service you request; to provide you with other services that we have offered to you; to create and manage your account; and to send you service-related communications.	Our affiliates and service providers, if applicable and necessary for the business purpose of supporting our relationship with you.
B. Payment information, such as name, routing number, account number, billing address, and records of payment.	From you and relevant third parties who assist with or are part of payment or billing processing.	To accept payment for services provided to you or to provide reimbursements where appropriate.	Our service providers who process payments for us and who are contractually required to comply with laws and requirements applicable to payment processing.
C. Sensitive Personal Data, insofar as necessary and legally permitted, such as (1) Social Security, driver’s license, state identification card, or passport number, (2) precise geolocation (3) the processing of biometric information for the purpose of uniquely identifying a consumer; and/or (4) Personal Data collected and analyzed concerning your health.	From you, with your consent where required.	To fulfill our obligations arising from any contracts entered between you and us and provide you with the information, product or service you request; to provide you with other services that we have offered to you.	Our service providers, if applicable and necessary for the business purpose of supporting our relationship with you.
D. Other protected classification characteristics under California or federal law, including age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, or genetic information (including familial genetic information).	From you.	To fulfill our obligations arising from any contracts entered between you and us and provide you with the information, product or service you request; to provide you with other services that we have offered to you.	Our service providers, if applicable and necessary for the business purpose of supporting our relationship with you.
E. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	From you and from our Web Site’s interaction with your browser or devices. We also collect this information from our business partners, service providers, and third parties like data analytics and information providers.	To analyze the use of our products and services; to measure the effectiveness of the advertising we serve to you and others; or to make suggestions and recommendations to you and other users of the Web Site about goods and/or services that may interest you or them.	Our affiliates and third-party vendors and other service providers that perform website analytic services for us.
F. Device information, such as IP address, internet provider, device cookie settings and other device details	From you and from our Web Site’s interaction with your browser or devices. We also collect this information from our business partners, service providers, and third parties like data analytics and information providers.	To administer and improve the Web Site, including troubleshooting, data analysis, testing, research, statistical and survey purposes; to protect the security and integrity of the Web Site and our business, such as by protecting against and preventing fraud and managing risk exposure, including by identifying potential unauthorized users.	Thirdparty vendors and other service providers that perform website analytic services for us.
G. Internet or other electronic network activity information, such as your browser type, operating system type or mobile device model, viewed webpages, links that are clicked, IP address, mobile device identifier or other unique identifier, websites visited before coming to our Web Site, the amount of time you spend viewing or singvisiting the Web Site, the number of times you return, or other clickstream or Web Site usage data and device details. Internet or other similar network activity, such as IP address, internet provider, operating system and browser used, type of device (such as laptop or smart phone), device cookie settings, and other device details	From you and from our Web Site’s interaction with your browser or devices. We also collect this information from our business partners, service providers, and third parties like data analytics and information providers.	To administer and improve the Web Site, including troubleshooting, data analysis, testing, research, statistical and survey purposes; to protect the security and integrity of the Web Site and our business, such as by protecting against and preventing fraud and managing risk exposure, including by identifying potential unauthorized users.	Third party vendors and other service providers that perform website analytic services for us.
H. Inferences drawn from any of the Personal Data identified in this chart to create a profile about you reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. From you; from our website technology interaction with your browser/devices; from cookies and other similar technologies tracking the pages you visit, the marketing messages you open and the links you follow. We also collect this information from our business partners, service providers, and third parties like data analytics and information providers.	From you; from our website technology interaction with your browser/devices; from cookies and other similar technologies tracking the pages you visit, the marketing messages you open and the links you follow. We also collect this information from our business partners, service providers, and third parties like data analytics and information providers.	To enhance your online experience, including as a way to recognize you or provide you with customized content.	Our affiliates and third-party vendors and other service providers that perform website analytic services for us.
I. Communications we have with you. Please note that we record calls to our customer service team	From you and our relevant service providers who may assist with customer service.	To handle your requests, to contact you when necessary or requested, including responding to your questions and comments and providing customer support, and to obtain customer feedback and improve our customer service and Web Site user experience	Our service providers who assist us with customer service
J. Professional or Employment-Related Information, such as business contact information, occupation or job title, professional licenses, or other industry affiliations.	From you, our business partners, service providers, and third parties like data analytics and information providers	To analyze the use of our products and services; to respond to your requests; to make suggestions and recommendations to you and other users of the Web Site about goods and/or services that may interest you or them.	Our affiliates and third-party vendors and other service providers that perform business analytics and marketing for us.

When we engage in certain digital advertising, we may “sell” or “share” for purposes of cross-context behavioral advertising (as those terms are broadly defined under applicable state privacy laws) the following categories of Personal Data: personal identifiers (IP address), commercial information, and internet or other electronic activity information. These categories of Personal Data are sold to or shared for cross-context behavioral advertising with advertising networks and other companies that facilitate digital advertising. We engage in such sales and sharing to facilitate digital advertising that is able to reach people that are most likely to be interested in the services we provide. We do so by allowing third parties to place cookies or other tracking technologies on our website that may collect information about your online activities over time and across different websites or applications. For more information about the use of cookies and other tracking technologies, see the section “Cookies, Web Beacons and Other Technologies” in the Privacy Statement.

We do not have actual knowledge that we “sell” or “share” Personal Data of individuals under sixteen (16) years of age.

Cencora does not use or disclose “sensitive” Personal Data, as defined in the California Consumer Privacy Act (“CCPA”), for any purposes other than those permitted by the CCPA.

Your Privacy Rights and Choices

You may have a number of rights related to Personal Data that we process about you. These rights depend on the jurisdiction where you reside, including California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Montana, Nebraska, Nevada, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia. Please note that these rights may be subject to allowable exceptions and limitations, and we reserve our right to process your request to exercise these rights (“Data Subject Request”) in accordance with applicable law.

Right to Confirm Processing, Access, and/or Obtain a Copy: If you ask us, we will confirm whether we are processing your Personal Data. Additionally, upon request, we will provide you with a copy of all Personal Data you are lawfully entitled to receive, potentially including specific pieces of information, along with certain other details.
Right to Amend: If you believe your Personal Data is inaccurate or incomplete, you may request that we correct it.
Right to Delete: You may request that we delete your Personal Data but you should note that this right is limited and subject to certain exceptions as prescribed by applicable law.
Right of Portability: You may request that we move, copy, or transfer the electronic Personal Data that we hold about you to another organization.
Right to Revoke Consent and/or Opt Out of Certain Processing Activities: You may ask us to restrict or stop the processing of your Personal Data in specific contexts, such as if we process Personal Data that is considered “sensitive” under applicable U.S. state laws or engage in certain automated decision-making activities.
Right to Opt Out of Targeted Advertising: Targeted advertising is the practice of serving you tailored advertisements based your Personal Data gathered over time and across other businesses, websites, applications, or services. You have the right to opt out of this practice.
Right to Opt Out of Sales: Some U.S. states may consider targeted advertising a “sale” of Personal Data. You may request that we not “sell” your Personal Data.
Right to Non-Discrimination: We will not discriminate against you for submitting a Data Subject Request, but we may charge a reasonable fee as permitted by law in fulfilling these rights, such as if you request multiple copies of your Personal Data.
Right to Appeal: If we deny your Data Subject Request, you may have the right to appeal the decision with us. If we deny your Data Subject Request, you may have the right to submit a complaint to your state attorney general or other authorities. Below are links to the websites of some state authorities, for your reference.

Contact the Colorado Attorney General Office here.
Contact the Connecticut Attorney General’s Office here.
Contact the Delaware Department of Justice Office here.
Contact the Indiana Attorney General’s Office here.
Contact the Iowa Attorney General’s Office here.
Contact the Kentucky Attorney General’s Office here.
Contact the Maryland Consumer Protection Division Office here.
Contact the Montana Attorney General’s Office here.
Contact the Nebraska Attorney General’s Office here.
Contact the New Hampshire Attorney General’s Office here.
Contact the New Jersey Division of Consumer Affairs here.
Contact the Oregon Attorney General’s Office here.
Contact the Tennessee Attorney General’s Office here.
Contact the Texas Attorney General’s Office here.
Contact the Virginia Attorney General’s Office here.

In addition to the rights listed above, California’s “Shine the Light” law (Cal. Civ. Code § 1798.83) permits users that are residents of California to request certain information regarding our disclosures of Personal Data to third parties for such third parties’ direct marketing purposes. Please email or write to us as provided below to submit your request.

The “Oregon Consumer Privacy Act” requires disclosure of the controller and any registered business names that the controller uses in Oregon. That information can be found here.

How to Submit a Data Subject Request

To make any of the requests described above, you may contact us at 1-800-829-3132 or submit the request using the Data Subject Request form provided available on our website.

You may also designate an authorized agent to make a request on your behalf. Parents may also make verifiable requests on behalf of their minor children. For requests made through authorized agents, please be prepared to provide a letter, signed by you, granting the authorized agent authority to act on your behalf. As permitted by law, we may also request to verify your identity directly with you.

Before processing your request, including requests submitted through an authorized agent, we may ask you to verify your identity by confirming your name, email address, telephone number, and state of residence. If we believe we need further information to verify or process your request, we may request additional information from you as permitted by law. Making a verifiable request does not require you to create an account with us, but we may treat requests made through your password-protected account as sufficiently verified when the request relates to Personal Data associated with your specific account. We will use Personal Data provided in a verifiable request only to verify the requestor’s identity or authority to make the request.

Appeal of Data Subject Request

Depending on your state of residence, you may have the right to appeal a decision we make regarding your Data Subject Request. To appeal a prior decision, you must email us at privacy@cencora.com and (a) in the email subject line include your state of residence and the words “Appealing Rights Decision”, and (b) in the email body provide an explanation of the basis of your appeal.

Contact Information

If you have any questions about the Privacy Statement or this Supplement or the use of your Personal Data, please contact us by sending an email to privacy@cencora.com, calling us at 1-800-829-3132, or writing to the following address:

Cencora, Inc.

Corporate Headquarters

1 West First Avenue

Conshohocken, PA 19428

Attention: Amy Huffman, Vice President, Global Privacy Operations

privacy@cencora.com

Additionally, if you would like to submit a Data Subject Request form provided on our website.

Changes to This Supplement

Cencora reserves the right to amend the Privacy Statement or this Supplement at our discretion and at any time. When we make changes to the Privacy Statement or this Supplement, we will post the updates on the Website and update the Privacy Statement’s effective date. Your continued use of the Website following the posting of changes constitutes your acceptance of such changes.