Contractor privacy notice

At Solventum our affiliates, and subsidiaries (collectively “Solventum”, “we”, “our” or “us”), are committed to ensuring the privacy and security of your personal and sensitive information in accordance with applicable data privacy and cybersecurity laws and regulations. This Contractor Privacy Notice (“Contractor Notice”) describes how we collect, use, store, process and protect (collectively “process”) Personal Data relating to independent contractors that have engagements with Solventum (each a “Contractor” or “you”). Where required by applicable law, we will not collect, use, or disclose your Personal Data without first obtaining your consent. For a list of Solventum data controllers and contact details by country, please click here

In this Contractor Notice, when we use the term “Personal Data,” we mean any information relating to an identified or identifiable individual, or as related terms, such as "personal information," are defined under applicable law.

Scope

This Contractor Notice applies to Personal Data that we process to manage our engagements with Contractors, including related to granting access to our systems and assets, engagement onboarding and termination, and Personal Data we receive related to emergency contacts. If required under applicable law, we may provide Contractors with additional privacy notices about other relevant data processing activities. We encourage you to carefully read this Contractor Notice, together with any other privacy notice we may provide to you.

Personal Data We Collect

We may collect various types of Personal Data from you including, but not limited to:

• Contact Information, including your full name, residential address, personal e-mail address, and phone number.
• Other Unique Identifiers, including company-issued ID number and system identifiers (e.g. usernames or online credentials).
• Contractor Information, including biographical data, CV; data from your public LinkedIn profiles and similar platforms; education and degree information; professional licences, certifications and memberships and affiliations.
• Engagement Information, including dates of engagement; position, job title, and reporting information; work history information; time and attendance, leave and absence records; travel and expense records; training plan records; performance records and reviews, commendations, disciplinary records.
• Compliance Data, including independent contractor eligibility verification records, and other records maintained to demonstrate compliance with applicable laws, such as tax laws, right to work laws and privacy laws; occupational safety records; records relating to internal investigations, including compliance hotline reports; security clearance information; records of privacy and security incidents involving independent contractor records, including any security breach notifications.

Sources of Personal Data

In general, we may collect the categories of Personal Data identified above from the following categories of sources:

• Directly from you;
• Recruiters and recruiting platforms;
• Referrals and references;
• Employers;
• Our employees and other contractors
• Publicly available information and sources;
• Governmental authorities;
• Customers;
• Service providers, representatives and agents; and
• Affiliates and subsidiaries.

How We Use Your Personal Data

We use your Personal Data as necessary for compliance with a legal obligation, for entering into or performance of a contract, and/or for legitimate business purposes, including:

Management of Contractor Relationship. To manage our relationship with Contractors, including related to:

• Scheduling and conducting interviews;
• Identifying Contractors, including by working with external recruiters;
• Verifying information provided, and otherwise evaluating Contractors’ suitability; · Administering and monitoring compliance with our policies, procedures, and Code of Conduct, where applicable;
• Maintaining records of emergency contact information for use in the event of an emergency;
• Facilitating Contractor communication and collaboration, such as through the corporate directory, Contractor bios; and
• Providing you with access to equipment, computer systems, applications and networks.

Business Operations and Customer Services. Related to our business operations and customer services, including related to:

• Organisational administration and planning, such as staffing;
• Operating our business by developing, producing, marketing, and providing goods and services;
• Quality control; and
• Facilitating communications in furtherance of the foregoing.

Security and Monitoring. To monitor and secure our resources, network, premises and assets, including:

• Monitoring for, preventing and investigating suspected or alleged misconduct or violations of law (including criminal offences), work rules and Solventum policies; monitoring for, preventing, investigating, and responding to security and privacy threats and incidents;
• Providing and managing access to physical and technical access controls;
• Monitoring to protect the safety and security of our and our customers’ systems and assets;
• Monitoring access and use to ensure the security and functioning of our systems and assets; and
• Securing our offices, premises and physical assets, including through the use of electronic access systems and video monitoring.

Health and Safety. For health and safety purposes, such as to comply with Solventum’s health and safety programmes; to determine accommodation for disabilities; to monitor environmental health and safety; for contact tracing; to conduct appropriate screenings of Contractors; to respond to and manage medical and other emergencies and work-related accidents and illnesses; and to meet related regulatory requirements.

Auditing, Accounting, Reporting and Corporate Governance. Relating to financial, tax, accounting and other audits and assessments of our business operations; problem resolution (e.g. internal reviews and grievances); management of whistleblowing channels, internal investigations, compliance, risk management and security purposes, financial controls or compliance with legal obligations; and for other internal business purposes such as administering our records retention programme.

Mergers & Acquisitions and Other Business Transactions. To facilitate a merger, acquisition, asset sale or transfer, joint venture or collaboration, assignment, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy, reorganisation or other similar business transaction or proceeding) or similar transaction, including, but not limited to the planning, due diligence and implementation of such business transactions.

Defending and Protecting Rights. To protect and defend our rights and interests and those of third parties; to respond to legal claims or disputes, including in the context of anticipated or actual litigation with third parties.

Compliance with Legal Obligations. Related to our compliance with applicable legal obligations or to perform a contract with or relating to you, as well as assessments, reviews and reporting relating to such legal obligations, including those related to engagements with independent contractors, labour laws and other applicable laws, regulations and legal requirements.

Disclosures to Services Providers and Other Entities

We may disclose your Personal Data to the following recipients and for the purposes described above. In each case, we will take appropriate steps (including obtaining your consent where required by applicable law) to protect your Personal Data.

Solventum Affiliates. Our Solventum affiliates will use your Personal Data in a manner consistent with this Contractor Notice and all applicable laws.

Service Providers. We may disclose your Personal Data to service providers and other third parties we engage to perform support services for us, such as hosting providers, health and safety consultants and IT and security services providers. These companies may only use the data as permitted by our contracts with them.

Business Partners. We may disclose your Personal Data with third parties who partner with us to provide you with products or services. For example, we may pass your contact details to a partner Hospital in which you will be conducting research, incident investigations or complaints resolution on our behalf. Your details and contact information may be necessary in order for you to gain access to the hospital premises or equipment.

With your consent. We may disclose your Personal Data with your permission or at your request.

To comply with law or to protect you and/or your rights. We may disclose your Personal Data to others when we have a good faith belief that disclosure is necessary:

• To comply with a law, regulation, court order, or other legal process;
• To detect, prevent, and respond to fraud, intellectual property infringement, violation of our contracts or agreements, violation of law, or other misuse of Solventum websites, apps, products or services;
• to protect the health, safety, welfare, rights, or property of you, our customers, the public, Solventum or others; or
• Under similar circumstances.

In aggregate/de-identified format. To the extent permitted by applicable law, Solventum may share anonymised, aggregated or de-identified information internally and with third parties for any purpose. Such information will not identify you individually or directly.

Your Rights

Depending on applicable law and subject to certain conditions and exceptions, you may have certain rights with respect to your Personal Data. We will not discriminate against you for exercising any of your rights.

• The right to access, correct, update, or request deletion of your Personal Data.
• The right to know certain information about the Personal Data that we process about you, including specific pieces of your Personal Data that we collect.
• The right to object to, limit or restrict our processing of your Personal Data.
• If we are processing your Personal Data based on your consent, you may withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of our processing before your withdrawal.
• The right to request a copy of the Personal Data in a portable (i.e. structured, commonly used, machine-readable, user-friendly) format.
• The right to complain to us or a data protection authority about our collection and use of your Personal Data.

You (or your authorised agent) may exercise your rights by completing our request form. We may, after receiving your request, require additional information from you (or your authorised agent) to honour your request and verify your identity.

Cross-Border Data Transfers

Solventum operates in many countries and your Personal Data may be transferred across international borders to other Solventum affiliates and third parties (as described in this Contractor Notice) located outside of the country where you live. Regardless of where your Personal Data is processed, we will always take reasonable steps to protect the privacy and security of your Personal Data. This may include implementing appropriate agreements and, if required, standard contractual clauses or an alternative mechanism for the transfer of data as approved by the European Commission or other applicable regulators or legislators. Where required by applicable law, we will only share, transfer or store your Personal Data outside of your jurisdiction with your prior consent.

Protecting Personal Data

We implement appropriate technical, physical and organisational measures designed to protect the confidentiality, security, and integrity of your Personal Data. Data protection measures include, but are not limited to, adoption of encryption tools and access controls.

Retention

We retain your Personal Data for as long as reasonably necessary or permitted in light of the purposes for which it was collected, and as described in this Contractor Notice or as otherwise disclosed to you at the time of collection. The retention period varies and depends on criteria that may include:

• The dates of your engagement with Solventum and the date of your last interaction with us;
• Whether retention is necessary or advisable due to applicable statutes of limitations, litigation, or other legal, regulatory, accounting or reporting obligations; and
• Any relevant retention requirements under applicable laws or in agreements with you or others.

If your Personal Data is either (i) no longer necessary or relevant for the purposes for which it was collected, or (ii) no longer required to be retained by applicable laws, then we will take reasonable steps to have it deleted, destroyed, or, if permitted by applicable law, aggregated, made anonymous, or de-identified.

Changes to this Contractor Notice

We reserve the right to amend this Contractor Notice at any time. If we make changes to this Contractor Notice that materially affect how we process your Personal Data, we will endeavour to notify you.

Contact Us

If you have questions or concerns regarding this Contractor Notice or the handling of your Personal Data, please contact us at: Privacy@solventum.com

Addendum for Residents of the People’s Republic of China

• I acknowledge that I have read the Contractor Privacy Notice, and hereby expressly and voluntarily render my consent to Solventum for the collection, storage, use, process, transfer, disclosure, erasure as well as other processing, maintenance and protection of my Personal Data in accordance with the Notice and Solventum Privacy Policy.
  
• 我确认已阅读隐私声明，并在此明确、自愿同意舒万诺根据该声明和舒万诺隐私政策收集、存储、使用、加工、传输、公开、删除以及以其他方式处理、维护和保护我的个人信息。
• I acknowledge that I have read the Contractor Privacy Notice, and hereby render my consent to Solventum for the collection, storage, use, process, transfer, disclosure, erasure as well as other processing, maintenance and protection of my sensitive personal information in accordance with the Notice and Solventum Privacy Policy.
• 我已阅读、理解并同意舒万诺按照舒万诺隐私政策及本隐私声明收集、使用、披露、存储、管理和保护我的敏感个人信息。
• I acknowledge that I hereby render my consent to Solventum for the provision of my personal information (including sensitive personal information) to Solventum affiliated companies and other personal information processors in China in accordance with the Notice and Solventum Privacy Policy.
• 我同意舒万诺按照舒万诺隐私政策及本隐私声明所述方式向舒万诺在中国境内的关联公司或其他个人信息处理者提供我的个人信息（包括敏感个人信息）。
• I acknowledge that I hereby render my consent to Solventum for the cross-border transfer of my personal information (including sensitive personal information) to overseas Solventum affiliated companies and recipients in accordance with the Notice and Solventum Privacy Policy.
• 我同意舒万诺按照舒万诺隐私政策及本隐私声明所述方式向舒万诺在中国境外的关联公司或其他境外个人信息接收者跨境传输我的个人信息（包括敏感个人信息）。
• I confirm that I have duly provided the required personal information about my family members, and I have obtained their explicit consent, where necessary, to the processing of their personal information for the purposes and in the manner described in the Notice.
  我确认已正式提供所需的有关本人亲属的个人信息，并已在必要时获得以本隐私声明所述的方式处理其个人信息的明确同意。