COSTCO WHOLESALE CORPORATION
CONSUMER HEALTH DATA PRIVACY NOTICE

Effective Date: March 31, 2024

This Consumer Health Data Privacy Notice (the "Notice") supplements Costco's Your Privacy Rights notice and explains our collection, use, and disclosure of personal information that may identify your past, present, or future physical or mental health status ("Consumer Health Data").

This Notice does not apply to information that would be considered "Protected Health Information" under the Health Insurance Portability and Accountability Act of 1996. Please see our Notice of Privacy Practices: Health Care Centers for a description of how we use and safeguard Protected Health Information that you disclose to us when you visit or use the products and services offered by our pharmacies, optical, and hearing aid departments.

We may collect Consumer Health Data when you browse our digital properties or engage in transactions through our Services. Examples of Consumer Health Data we may process include:

• Browsing Data. When you browse our digital properties for consumer health products, we collect information related to your browsing activities, such as the search parameters you use and the consumer health products you engage with, in order to fulfill your request.
• Transaction Information. When you make a purchase, exchange, or return a consumer health product, we collect information about these transactions, including information about the products or services you purchase.
• Incident Information. If you experience an injury or otherwise require medical services while visiting a Costco Warehouse, or report an injury incurred in connection with the use of one of our products, we collect information about the incident.

If we collect biometric information about you, we provide you with notice of that collection, and collect your consent in compliance with applicable law, prior to collecting such information. We use the Consumer Health Data we collect to provide you with products and services you request, as described in this Notice or as otherwise disclosed to you. For example, we use Consumer Health Data for the following purposes:

• Product and service delivery. To provide our products and services, including securing, troubleshooting, improving, and personalizing products and services, and processing, fulfilling, shipping, and delivering your orders.
• Business operations. To operate our business, such as: creating, maintaining, and renewing your membership, billing, accounting, improving our internal operations, securing our networks and systems, detecting fraudulent, illegal, or unauthorized activity, and monitoring trends, usage and activities in connection with our Services and warehouses.
• Legal, security and safety reasons. For legal, security and safety reasons, such as to protect our rights and the rights of our customers and members, protect the security of our systems and networks, enforce our policies, communicate product recalls or safety notices, or address legal and regulatory compliance obligations.

While personal information that is not Consumer Health Data may be disclosed as provided in the "Our Disclosure of Personal Information" section of Your Privacy Rights, our disclosure of Consumer Health Data is limited to the following situations.

• Service Providers. We may share your information with service providers that we believe need the information to perform a technology, business, or other professional function for us such as IT services, maintenance and hosting of our Services, accounting, auditing, and other professional services.
• Suppliers. If you submit a complaint to us about a product or service, we will disclose information regarding your complaint to the supplier of that product or service to the extent necessary to resolve your complaint or provide you with other customer service support you request.
• Corporate Event. We reserve the right to transfer to another entity or its affiliates or service providers some or all information about you in connection with or during negotiations of, any merger, acquisition, sale of assets or any line of business, change in ownership control, or financing transaction. We cannot promise that an acquiring party or the merged entity will have the same privacy practices or treat your information the same as described in this Notice.
• Legal. We share information where necessary to comply with applicable law, to respond to requests from law enforcement agencies or other government authorities or third parties, as permitted by law and without your consent when it is necessary to protect our members, employees, or property; in emergency situations; or to enforce our rights under our terms of service and policies.

Costco does not sell or share Consumer Health Data.

Residents of Washington, Nevada, and Connecticut have the right to access, delete, and correct certain Consumer Health Data we collect about them. Visit our Data Rights Request webpage or call 1-800-605-3364 to submit a request. If your request to exercise your rights is denied, you may appeal that decision through the Data Rights Request portal. You will need your case number to submit your appeal.

For your security and to ensure unauthorized third parties do not access your Consumer Health Data, we will require you to verify your identity before we can act on your request. If you are a current Costco member, you will be required to provide your membership number. If you are not a Costco member, you will be required to provide an email address and phone number to start the verification process. For requests to make changes to inaccurate information, we may ask you to provide documentation that demonstrates why or how the existing information is inaccurate.

Your state may also provide you with the right to revoke your consent for the processing of Consumer Health Data or to request that Costco stop processing your Consumer Health Data. As described in this Notice, Costco does not process Consumer Health Data except as reasonably necessary to provide goods or services that you have requested. As a result, we do not offer a generally applicable option to revoke consent or stop processing Consumer Health Data. If consent is required for Costco to process your Consumer Health Data, you will be provided with a separate notice that describes how you may revoke your consent at the time your consent is obtained.

Depending on your state of residence, you may have additional privacy rights. These rights may include rights to access and control sensitive personal information, which may include Consumer Health Data. For more information, please see Your Privacy Rights.

We will update this Notice when necessary to reflect changes in how we use Consumer Health Data or the applicable law. When we post changes to this Notice, we will revise the "Effective Date" at the top of the Notice.

If you have a privacy concern, complaint, or a question, please contact us at US_Privacy@costco.com or write to us at PO Box 35128, Seattle, WA 98124.