US CONSUMER HEALTH DATA PRIVACY POLICY

Effective Date: September 2026

This Consumer Health Privacy Policy (the “Privacy Policy”) applies to “Consumer Health Data,” as that term has been defined under United States applicable law, and that Baxter (“we,” “us,” “our”) collects from Consumers (collectively referred to as “you”). We have prepared this Consumer Health Privacy Policy for our U.S. Consumers, as a supplement to our Global Privacy Policy and US Privacy Policy, to inform Consumers of the rights they may have under applicable U.S. Consumer Health Data laws. Any term appearing in this Privacy Policy that has been defined under applicable Consumer Health Data laws shall have the meaning afforded therein. If you are looking for information about how we process your protected health information (or “PHI”) when we act as a covered entity under HIPAA, please see our Notice of Privacy Practices on those applicable entities’ websites for more information.

This Privacy Policy describes the categories of Consumer Health Data we collect, the purposes for which we collect and use Consumer Health Data; the categories of sources from which we collect Consumer Health Data; the categories of Consumer Health Data we share; the third parties with whom we share Consumer Health Data; and how you can exercise your rights with respect to your Consumer Health Data.

We reserve the right to update or modify this Privacy Policy at any time, including without limitation, in order to comply with applicable law, and will post the effective date of any updates or modifications at the top of this Privacy Policy.

A. Consumer Health Data We Collect

We may collect the following Consumer Health Data from you:

• individual health conditions, treatment, diseases, or diagnosis;
• social, psychological, behavioral, and medical interventions;
• health-related surgeries or procedures;
• use or purchase of prescribed medication;
• bodily functions, vital signs, symptoms, or measurements;
• diagnoses or diagnostic testing, treatment, or medication;
• biometric data;
• genetic data;
• precise location information that could reasonably indicate your attempt to acquire or receive health services or supplies;
• data that identifies you as a consumer seeking health care services; or
• any information that we or our processor may use to associate or identify you with the data described above that is derived or extrapolated from non-health information (such as proxy, derivative, inferred, or emergent data by any means, including algorithms or machine learning).

We will obtain your consent to collect Consumer Health Data unless such collection is necessary to provide a product or service that you have requested from us or we are otherwise permitted by applicable law to collect such Consumer Health Data without your consent.

B. Purposes of Collecting and Using Consumer Health Data

We may collect and use the above-mentioned categories of Consumer Health Data for the following purposes:

• create and administer your account with us;
• manage business transaction with you, including (without limitation) obtaining or making payments for services;
• respond to your communications, inquiries, and requests about the services;
• send you marketing communications, or to enable you to participate in surveys or questionnaires;
• tailor and deliver relevant advertisements to you when you are using our services or when you are accessing a third party service;
• gather and create statistics regarding your usage of our Service;
• comply with and enforce applicable legal requirements, relevant industry standards and our contractual rights and policies;
• carry out your treatment, including treatment prescribed by a physician, and to provide you with general information about your treatment;
• where a merger, acquisition, or sale of our assets (or a portion thereof) may impact how we process your personal information; and
• where permitted by law, we may also enhance or combine information about you, including your Personal Information, with information we obtain from third parties described in our Global Privacy Policy.

We may also aggregate and/or anonymize personal information and analyze those data for statistical or any other purposes permitted by law. When we do so, we take reasonable measures to ensure that the information cannot be associated with a consumer or household, and we maintain and use the information in deidentified form. We will not attempt to reidentify the information, except that we may attempt to reidentify the information solely for the purpose of determining whether our deidentification processes satisfy applicable legal requirements. After it has been deidentified, the information is no longer personal information and is not subject to this Consumer Health Data Privacy Policy.

C. The Categories of Sources from Which We Collect Consumer Health Data

We may collect Consumer Health Data from the following sources:

• directly from you when you interact with us;
• from your devices;
• from vendors and third parties, when they provide information to us;
• passively from vendors and third-party providers of cookies and other tracking technologies used on our Services; and
• publicly available sources of Consumer Health Data.

D. Third Parties with Whom We Share Consumer Health Data

We may share Consumer Health Data with the following third parties:

• our Service Providers who have executed privacy contracts with us;
• to third-party analytics providers and advertising partners;
• to any third parties, at your direction or with your consent;
• governmental authorities, where such sharing is:
  • required by law or legal process, such as in response to a valid court order or subpoena;
  • in response to a government request or law enforcement investigation;
  • intended to exercise or defend our legal rights; or
  • necessary or appropriate to prevent physical harm or suspected or illegal activity;
• successor entities to whom we may transfer your Consumer Health Data information in the event we sell or transfer all or a portion of our business or assets (including, without limitation, in the event of a merger, acquisition, joint venture, reorganization, divestiture, dissolution, or liquidation).

We may also aggregate and/or anonymize Personal Information and analyze those data for statistical or any other purposes permitted by law. When we do so, we take reasonable measures to ensure that the information cannot be associated with a Consumer or household, and we maintain and use the information in deidentified form. We will not attempt to reidentify the information, except that we may attempt to reidentify the information solely for the purpose of determining whether our deidentification processes satisfy applicable legal requirements. After it has been deidentified, the information is no longer Personal Information and is not subject to this Notice.

We may disclose aggregated and/or anonymized data to any other entities to the extent permitted by law.

E. How to Exercise Your US Consumer Health Data Rights

To exercise your rights with respect to your Consumer Health Data, depending on your state of residence, please contact us at:

Email: [email protected]

Mail:

Baxter International Inc. and/or Baxter Healthcare Corporation
ATTN: Global Privacy Office
1 Baxter Parkway, Deerfield, IL USA 60015

Ethics and Compliance Hotline: 1-844-294-5418

SUPPLEMENT TO CONSUMER HEALTH DATA PRIVACY POLICY
FOR NEVADA CONSUMERS

This Supplement applies to Nevada Consumers for purposes of providing additional disclosures required by Nevada’s Consumer Health Data privacy law. Terms used herein that are defined terms under Nevada’s Consumer Health Data privacy law shall have the meanings afforded to them therein.

• A. Purposes & Manner of Processing. We Collect, use, Process, and Share Consumer Health Data for the purposes and in the manners described in our Consumer Health Data Privacy Policy, which also provides additional disclosures relevant to Nevada Consumers.
• B. Review & Revision of Consumer Health Data. If you would like to review and/or revise your Consumer Health Data, you may submit a request to us via the methods listed in our Consumer Health Data Privacy Policy. We will respond to your requests to exercise your rights in accordance with applicable law, but in any case no later than 45 days after receiving your request. We may extend this period up to 45 days only where doing so is permitted under applicable law.
• C. Changes to this Supplement. We will notify you before making any changes to our privacy practices with respect to your Consumer Health Data by posting an updated notice on this page, with an updated effective date.
• D. Third Party Collection of Consumer Health Data. Please note that some Third Parties may collect Consumer Health Data about you over time and across different websites or online services you may visit.

Effective Date: September, 2026