Privacy Notice

This Privacy Notice ("Notice") is designed to inform you about how we collect, use, and share your personal data through our website(s) (our "Site"), related applications, products, services, and web-based and mobile applications (collectively, the "Services") operated by Omnicell, or when you interact with us online.

By accessing or using our Site or our Services, you hereby consent to our collection, use, sharing, and disclosure of your personal data as described in this Notice and in our Terms and Conditions ("Terms and Conditions").

If you are an Indian resident, by accessing or using our Site or our Services or by otherwise giving us your information, you confirm that you have the capacity to enter into a legally binding contract under Indian Laws, in particular, the Indian Contract Act, 1872, and have read, understood and agreed to the practices and policies outlined in this Notice and agree to be bound by the Notice.

Francais, Deutsch, Italiano

Information You Provide to Us Directly

We collect personal data you provide to us in the following instances:

• If you provide us feedback or contact us via email, we will collect your name and email address, as well as any other content included in the email, in order to send you a reply.
• We also collect personal data at such other points on our site and applications that expressly state that personal data is being collected.

We also collect personal data including sensitive personal data or information ("SPDI") from our employees. This includes your name, physical address, email address, contact number, gender, nationality, date of birth, details of government identification, financial information such as bank account details (which is SPDI) and any other information as may be required for payroll purposes.

Information About You Collected Via Technology

When you visit our Sites, some information is automatically collected.

Log Files. We gather certain information automatically and store it in log files. This information includes IP addresses, browser type, Internet service provider (" ISP") data, referring/exit pages, operating system, date/time stamp, and clickstream data. We use this information for purposes including analyzing trends, Site administration, tracking users' movements around the Site and tailoring our Services to our users' needs. Except as noted in this Notice, we do not link this automatically collected data to other personal data we have collected from you.

Cookies. Like many online services, we use cookies to collect information. " Cookies" are small pieces of information that a website sends to your computer's hard drive while you are viewing the website. We may use both session Cookies (which expire once you close your web browser) and persistent Cookies (which stay on your computer until you delete them) to provide you with a more personal and interactive experience on our Site. This type of information is collected to improve Omnicell's overall customer experience and tailor your customer experience to meet your special interests and needs. Performance and functionality Cookies will only be activated upon providing your consent. Moreover, you can typically choose to set your browser to remove Cookies and to reject Cookies. If you choose to remove Cookies or reject Cookies, please be aware that this could affect certain features or services of our site.

Google Analytics. We use Google Analytics to help analyze how users use the Site. Google Analytics uses Cookies to collect information such as how often users visit the Site, what pages they visit, and what other sites they used prior to coming to the Site. We use the information we get from Google Analytics only to improve our Site and Services. Google Analytics collects only the IP address assigned to you on the date you visit the Site, rather than your name or other personally identifying information. We do not link the information generated through the use of Google Analytics to your other personal data. Although Google Analytics plants a persistent Cookie on your web browser to identify you as a unique user the next time you visit the Site, the Cookie cannot be used by anyone but Google. Google's ability to use and share information collected by Google Analytics about your visits to the Site is restricted by the data processing agreement which we have concluded with Google. You can prevent your personal data from being used by Google Analytics by downloading and installing Google Analytics Opt-Out Browser Add-on, accessible through the following link: https://tools.google.com/dlpage/gaoptout?hl=en.

We use, collect, share, and otherwise process personal data for the purposes described in this Notice or as disclosed to you on our Sites or in connection with our services. We only collect the minimum amount of personal data needed to perform the specific processing activity for which the personal data was collected.

Performance of the Services

We process your personal data for the performance of the contractual obligations specified in our Omnicell Website Terms and Conditions and/or in order to provide the services to you. This includes, for example, using your personal data for:

• operating our Sites;
• providing and delivering the products and services you request, including payment processing;
• sending you related information, including confirmations, invoices, technical notices, updates, security alerts, and support and administrative messages;
• communicating with you regarding new contests, promotions, rewards, upcoming events, and other news about products and services offered by Omnicell and our selected partners;
• improving our Sites, products, services and the safety and security of our services, websites, and applications including facilitating identification and authentication, targeted online and offline marketing, for general research and aggregate reporting, customization of website and application customer experiences;
• understanding you and your preferences in order to enhance your experience and enjoyment using our Sites, products, and services; or
• responding to your comments and questions and providing customer service;
• linking or combining your personal data with other personal data we obtain from third parties without personally identifying you to such third parties in order to help understand your needs and provide you with better service; or
• in case you are an employee, processing your personal information including SPDI for payroll and other employment related purposes; (collectively "Purposes")

Consent

We process your personal data based on your consent for the Purposes, including communicating with you regarding new contests, promotions, rewards, upcoming events, and other news about products and services offered by Omnicell and our selected partners.

Collection, use and disclosure of your personal data and SPDI requires your express consent. You are providing us with your consent to our use, collection, and disclosure of your personal data and SPDI for the Purposes. You may choose to not provide us with personal data and SPDI, but in the event that you do so, we will be unable to provide you access to all functionalities on our Site or our Services.

Legitimate Interest

We process your personal data when we have a legitimate interest to do so. This includes, for example, processing your personal data for:

• improving our Sites, products, services and the safety and security of our services, websites, and applications including facilitating identification and authentication, targeted online and offline marketing, for general research and aggregate reporting, customization of website and application customer experiences;
• understanding you and your preferences in order to enhance your experience and enjoyment using our Sites, products, and services;
• responding to your comments and questions and providing customer service;
• linking or combining your personal data with other personal data we obtain from third parties without personally identifying you to such third parties in order to help understand your needs and provide you with better service;
• compliance with a judicial or administrative order or in the course of judicial or administrative proceedings;
• protecting the rights and property of Omnicell and our agents, customers, and third parties including, but not limited to, the right to enforce our agreements, policies, and terms and conditions.

De-Identified Information

We may create anonymized data records from personal data by rendering data anonymous in such a way that you, the data subject, are no longer identifiable. We use this anonymized data to analyze request and usage patterns so that we may enhance the content of our products and services and improve Site navigation. Omnicell reserves the right to use anonymized data for any purpose and disclose anonymized data to third parties in our sole discretion.

Legal Obligation

We process your personal data for compliance with any legal obligation to which we are subject.

We disclose your personal data as described in this Notice below. Additionally, we reserve the right to share your personal data when you have: (1) consented to such processing and have the ability to unilaterally revoke your consent at any time, or (2) have expressly made such personal data public, subject to limitations under applicable law. Personal data shared with third parties for purposes of processing will only be shared pursuant to a data processing agreement.

Service Providers, Consultants and Vendors

• performance of the contractual obligations in our Omnicell Website Terms and Conditions and in order to provide the services to you
• serving our legitimate interests and those of third-party vendors, consultants, and other service providers
• protecting the personal safety and property of Omnicell, its customers, or any other third party;
• providing or improving our services and the safety and security of our services, websites, and applications including facilitating identification and authentication, targeted online and offline marketing, for general research and aggregate reporting, customization of website and application customer experiences;
• enabling third parties to perform services on behalf of Omnicell including, but not limited to, payment processing, research, analytics, and security; or

Public Authorities, Including Courts and Law Enforcement Agencies

• compliance with a legal obligation or judicial or administrative order or in the course of judicial or administrative proceedings;
• protecting the rights and property of Omnicell and our agents, customers, and third parties including, but not limited to, the right to enforce our agreements, policies, and terms and conditions;
• We will disclose your personal data and SPDI, without seeking your consent, if legally required to do so, pursuant to an order from a governmental entity, judicial authority or in good faith. We will disclose the information to: (i) comply with a legal obligation, including sharing personal data with Government agencies mandated under the law to obtain such information for the purpose of verification of identity, or for prevention, detection, investigation including cyber incidents, prosecution, and punishment of offences; (ii) when mandated by an order under the law for the time being in force; or (iii) protect personal safety of our users or the public.

Third Parties:

• facilitating the negotiation of any merger, financing, acquisition, or dissolution, transaction, or proceeding involving sale, transfer, divestiture, or disclosure of all, or a portion of our business or assets to another company. In the event of an insolvency, bankruptcy, or receivership, personal data may also be transferred as a business asset. If another entity acquires our company, business, or assets, that entity will possess the personal data collected by us and will assume the rights and obligations regarding your personal data as described in this Notice. Omnicell will not disclose your personal data to Third Parties without your express, revocable consent except as specified in this Notice.

For avoidance of doubt, "Consumer" means any California resident, and "Personal Information" means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, as more fully defined in the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). "Personal Information" does not include information that is: (1) lawfully made available from government records; (2) de-identified or aggregate information; or (3) otherwise excluded from the scope of the CCPA. "Consumer" does not include a natural person acting as a job applicant to, employee of, owner of, director of, officer of, medical staff member of, or contractor of Omnicell to the extent such person's Personal Information is collected within the context of the person acting in such role.

The Personal Information that is collected and how it is used and shared may be found in this Notice. In no event will Omnicell sell Personal Information provided by a Consumer. Omnicell does not offer financial incentives to Consumers for the collection of Personal Information or the deletion of Personal Information. Except as permitted by the CCPA and in accordance with any program of financial incentives established by Omnicell, if any, Omnicell will not discriminate against a Consumer because the Consumer exercised any rights under the CCPA by denying goods or services to the Consumer; charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; providing a different level or quality of goods or services to the Consumer; or suggesting that the Consumer will receive a different price or rate for goods or services or a different level or quality of goods or services. By law, Omnicell is not required to collect Personal Information that we otherwise would not collect in the ordinary course of business. Omnicell shall not retain Personal Information for longer than we would otherwise retain such information in the ordinary course of our business, or re-identify or otherwise link information that is not maintained in a manner that would be considered Personal Information.

If you are a Consumer, the CCPA may permit you to request information regarding the:

• Categories of Personal Information (as defined by the CCPA) collected or disclosed by us;
• Purposes for which categories of Personal Information collected by us are used;
• Categories of sources from which we collect Personal Information;
• Categories of third parties with whom we share Personal Information; and
• Specific pieces of Personal Information we have collected about you and in some cases your Household.

In addition, if you are a Consumer, you may:

• Opt out of receiving marketing communications from us; however, you may still receive administrative communications regarding our services; and
• Request that we and our service providers delete Personal Information we have collected from you, in some circumstances.

All requests related to Personal Information shall be made by clicking on the Individual Data Requests link at the top of this Notice.

Children

Our services are not directed to children, and we do not knowingly collect or sell Personal Information from children under the age of 16. If you learn that a child has provided us with Personal Information, then you may contact us through the "Contact Us" section below.

Contact Us

Inquiries concerning CCPA or our compliance with the CCPA may be directed to us by email at privacy@omnicell.com, or to our toll-free telephone number at (800) 671-0535.

If you are user of the Site residing outside of the United States, by visiting the Site and providing us with personal data, you acknowledge and agree that your personal data may be processed for the purposes identified in this Notice. In addition, your personal data may be processed in the country in which it was collected, but also in other countries outside of your country of Residence, including the United States, where laws regarding processing of personal data may be less stringent than or otherwise differ from the laws of the country in which you reside or are located when using our services. If you are a User in India, by using our Site or the Services, you accept the terms hereof and hereby consent to us, sharing and/or processing your personal information and SPDI with third parties and in any location, including outside India. We will make best efforts to ensure that the third party of the location to which SPDI is transferred accords same level of data protection as would be afforded under India law.

Privacy laws and regulations in certain countries, including the rights of governmental authorities to access your personal data, may differ from those in the country in which you reside or are located when using Omnicell's services. Omnicell will only transfer personal data to governmental entities when authorized by the laws of the countries in which such transfers of personal data occur.

The Privacy Shield Frameworks

In light of the judgment of the Court of Justice of the European Union (CJEU) in Case C-311/18, the Privacy Shield framework for the transfer of personal data from the EU to the United States has been invalidated. Transfers of personal data between the EU and the United States are now based on the Standard Contractual Clauses (SCCs) and data processing agreements.

However, Omnicell remains certified under the Privacy Shield Frameworks and is fully committed to its principles. The Federal Trade Commission has jurisdiction over Omnicell's compliance with the Privacy Shield Frameworks. Omnicell's U.S. affiliates, namely Omnicell, Inc., Omnicell International, Inc., Medpak Holdings, Inc., MTS Medication Technologies, Inc., MTS Packing Systems, Inc., and ateb, Inc. (collectively "Omnicell US") comply with the EU-U.S. and the Swiss-U.S. Privacy Shield Frameworks, as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union and Switzerland, to the United States. Omnicell US has certified to the Department of Commerce that it adheres to the Privacy Shield Principles. If there is any conflict between terms in this Notice and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield Frameworks and to view our certification, please visit https://www.privacyshield.gov/.

In compliance with the Privacy Shield Principles, Omnicell commits to resolve complaints about our collection or use of your personal information. EU and Swiss individuals with inquiries or complaints regarding Omnicell's compliance with the Privacy Shield program should first contact Omnicell at GDPR@omnicell.com. In addition, our EU Data Protection Officer may be reached at:

2B Advice GmbH
Joseph-Schumpeter-Allee 25, 53227 Bonn, Germany
Telephone: +49 228 926165 120
E-Mail: omnicell@2b-advice.com

Omnicell has further committed to refer unresolved Privacy Shield complaints to JAMS, an alternative dispute resolution provider located in the United States. If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, please visit https://www.jamsadr.com/file-an-eu-us-privacy-shield-claim for more information or to file a complaint. The services of JAMS are provided at no cost to you.

An individual who decides to invoke this arbitration option must take the following steps prior to initiating an arbitration claim: (1) raise the claimed violation directly with Omnicell and afford Omnicell an opportunity to resolve the issue within the timeframe set forth in Section III.11(d)(i) of the Principles: https://www.privacyshield.gov/article?id=11-Dispute-Resolution-and-Enforcement-d-e; (2) make use of the independent recourse mechanism under the Principles, which is at no cost to the individual; and (3) raise the issue through their Data Protection Authority to the Department of Commerce and afford the Department of Commerce an opportunity to use best efforts to resolve the issue within the timeframes set forth in the Letter from the International Trade Administration of the Department of Commerce, at no cost to the individual. This arbitration option may not be invoked if the individual's same claimed violation of the Principles (1) has previously been subject to binding arbitration; (2) was the subject of a final judgment entered in a court action to which the individual was a party; or (3) was previously settled by the parties.

In addition, this option may not be invoked if an EU Data Protection Authority or the Commissioner (1) has authority under Sections III.5 or III.9 of the Principles; or (2) has the authority to resolve the claimed violation directly with the organization. A DPA's/the Commissioner's authority to resolve the same claim against an EU or a Swiss data controller does not alone preclude invocation of this arbitration option against a different legal entity not bound by the DPA/Commissioner's authority.

In the context of an onward transfer, Omnicell, as a Privacy Shield Organization, has responsibility for the processing of personal information it receives under the Privacy Shield and subsequently transfers to a third party acting as an agent on its behalf. Omnicell organization shall remain liable under the Privacy Shield Principles if its agent processes such personal information in a manner inconsistent with the Privacy Shield Principles, unless the organization proves that it is not responsible for the event giving rise to the damage.

Omnicell commits to cooperate with EU data protection authorities (DPAs) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) and comply with the advice given by such authorities with regard to human resources data transferred from the EU and Switzerland in the context of the employment relationship.

The main EU DPAs with which we cooperate and to which we have notified our DPO are the following:

United Kingdom
Information Commissioner's Office
Address
Wycliffe House, Water Lane, Wilmslow
Cheshire SK9 5AF
https://ico.org.uk/
Telephone: 0303 123 1113
Fax: 01625 524510

Italy
Garante per la protezione dei dati personali
Address:
Piazza Venezia n. 11 - 00187 Roma
www.gpdp.it - www.garanteprivacy.it
Telephone: (+39) 06.69677.1
Fax: (+39) 06.69677.3785
E-mail: garante@gpdp.it

France
CNIL (Commission Nationale de l'Informatique et des Libertés)
Address:
3 Place de Fontenoy TSA 80715
75334 PARIS CEDEX 07, France
Telephone: +33 (0)1.53.73.22.22
Fax: +33 (0)1.53.73.22.00
E-Mail: servicedpo@cnil.fr

Netherlands
Autoriteit Persoonsgegevens
Address
PO Box 93374
2509 AJ DEN HAAG
https://www.rijksoverheid.nl/contact/contactgids/autoriteit-persoonsgegevens
Telephone: (+31) - (0)70 - 888 85 00
Fax: (+31) - (0)70 - 888 85 01

Germany (Darmstadt)
The Hessian Commissioner for Data Protection and Freedom of Information
Address
Gustav-Stresemann-Ring 1, 65189 Wiesbaden
Telephone: 0611 – 1408 0
Fax: 0611 – 1408 611
E-mail: poststelle@datenschutz.hessen.de

Germany (Bochum)
State Commissioner for Data Protection and Freedom of Information
Address
North Rhine-Westphalia
Postfach 20 04 44
40102 Düsseldorf
Telephone: 0211 / 38424-0
Fax: 0211 / 38424-10
E-mail: poststelle@ldi.nrw.de

If you are residing, or located, in an EU Member State, you may also contact your local supervisory authority, the government agency charged with the enforcement of privacy laws, for information about your rights as a data subject. Under the law, you have the right to redress for violations of your privacy rights, as well as to seek compensation for violations of your privacy rights. Contact information for the respective supervisory authorities can be found at https://edpb.europa.eu/about-edpb/board/members_en.

If you are a User in India, you may address any feedback, comments or grievances about this Notice, or our data protection practices to the Privacy Officer mentioned below:

Attn: Privacy Officer
Address: 500 Cranberry Woods Drive
Cranberry Township, PA 16066
E-mail: privacy@omnicell.com

• Request access to your personal data in order to receive a copy of the personal data we hold about you.
• Request correction of the personal data that we hold about you in order to correct any incomplete or inaccurate information. New information provided to us may require verification.
• Request erasure of your personal data where a legitimate interest for us to process such personal data does not exist. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be provided to you, if applicable, at the time of your request. For example, where we have a legal obligation to retain and store your personal data.
• Request restriction of processing of your personal data.
• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party at your direction, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to personal data which you (a) initially provided consent for us to use, (b) where we utilized the personal data to perform a contract, or (c) we utilized the personal data to provide services to you.

• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and you object to processing on the basis that the processing impacts your fundamental rights and freedoms. In some cases, we may demonstrate that we have compelling legitimate grounds to process your personal data, which override your rights and freedoms. You may, however, control the extent to which we market to you, and you have the right to request that we stop sending you marketing messages at any time.
• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. In particular, you may opt out of receiving promotional emails from us by following the instructions in those emails. If you opt out, we may still send you non-promotional emails, such as emails about our ongoing business relations. You may also send requests about your contact preferences and changes to your personal data including requests to opt-out of sharing your personal data with third parties by clicking on the Individual Data Requests link at the top of this Notice.

If we make any material changes in the way we use your personal data, we will notify you by sending you an email to the last email address you provided to us and/or by posting notice of the changes on our Site. These changes will be effective immediately for new users of our Site. Please note that at all times you are responsible for updating your personal data to provide us with your most current email address. In the event that the last email address that you have provided to us is not valid, or for any reason is not capable of delivering to you the notice described above, our dispatch of the email containing such notice will nonetheless constitute effective notice of the changes described in the notice. Continued use of our Site or service, following notice of such changes after such emails are sent shall indicate your acknowledgement of such changes and agreement to be bound by the terms and conditions of such changes.

What is a Cookie?

To ensure our Site(s) work properly and to provide the most up to date and relevant information to the user of such Site(s) ( "User" or "you"), Omnicell places cookies on your device. Cookies are small files or part of a file stored on an internet user's computer, creating and subsequently read by a website server, and containing personal information (such as user identification code, customized preferences, or a record of pages visited). Cookies enhance a User's experience when using the Site(s). In addition, cookies help Omnicell to understand how Users use our Site(s) so that we can make improvements to better serve you. This Cookie Policy provides you with information about cookies and how to control them for the Site(s).

What Cookies Does Omnicell Use on its Site(s)?

Essential Cookies

Essential cookies are necessary for the Site(s) functionality and cannot be disabled by Users. These cookies do not gather information about you that could be used for marketing purposes and do not remember where you have been on the internet

Performance and Functionality

Performance and functionality cookies are used to enhance the performance and functionality of our Site(s), but are not essential to its use. However, without these cookies, certain functionality may become unavailable. Performance and functionality Cookies will only be activated upon providing your consent.

Analytics Cookies

• Omnicell uses analytic cookies including Google Analytics Cookies to help analyze how Users use the Site(s). Google Analytics uses Cookies to collect information, such as how often Users visit the Site(s), what pages they visit and what other sites they used prior to coming to the Site(s). Omnicell uses the information it gets from Google Analytics only to improve its Site(s) and services. Google Analytics collects only the IP address assigned to a User on the date they visit the Site(s), rather than a name or other personally identifying information. Omnicell does not link the information generated through the use of Google Analytics to other personal data. Although Google Analytics plants a persistent cookie on a web browser to identify a visitor as a unique User the next time such User visits the Site(s), the cookie cannot be used by anyone but Google. Google's ability to use and share information collected by Google Analytics about visits to the Site(s) is restricted by the data processing agreement Omnicell has concluded with Google. To review a summary of the privacy of your Google Analytics cookies, please click here: https://support.google.com/analytics/answer/6004245. You can prevent your personal data from being used by Google Analytics by downloading and installing Google Analytics Opt-Out Browser Add-on, accessible through the following link: https://tools.google.com/dlpage/gaoptout?hl=en::

Omnicell also uses analytic cookies in order to determine User interests. Providers, such as Turtl Inc. ("Turtl") may use cookies to collect the following information:

• Identity Data (first name, last name and title, username, and password);
• Contact Data (billing address, email address and telephone number);
• Technical Data (internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices if used to access Turtl's website);
• Profile Data (interests, preferences, feedback and survey responses);
• Usage Data (information about how a User uses the Turtl website, products and services, if applicable);
• Usage Data (information about how a User uses the Turtl website, products and services, if applicable);
• Aggregated Data statistical or demographic information).

Marketing Cookie

A marketing cookie collects personal information such as your name, pages visited on our Site(s), a User's history arriving at our website, and the like. Collected information is used to evaluate the effectiveness of our marketing campaigns or to provide better targeting for marketing.

Third Party Website Cookies

Third party cookies do not originate from Omnicell's Site(s). Rather, they are from a third party, such as an advertiser. These cookies collect information on a User's behavior, demographics, or personalized marketing. When visiting our Site(s), a User may encounter embedded content or be directed to a website for activities. These websites and embedded content use their own cookies. Omnicell does not have control over the placement of cookies by third parties, even if a user is directed to these cookies as a result of visiting our Site(s). However, if you do not want cookies placed on your device by a third party, many third parties offer ways to opt-out of these cookies.

Deletion and Control of Cookies

If you consented to cookies placed on your device but then wish to disable such cookies, please note that many of the cookies used on Omnicell's Site(s) can be enabled/disabled through a User's browser. To disable cookies through a browser, follow instructions located within the "Edit", "Tools" or "Help" menus in the browser. Disabling a cookie or category of cookies does not delete the cookie from a User's browser unless manually completed through a User's browser function. To change cookie settings, please click on the following link.

Past Cookies

Collection of a User's data from Omnicell's analytics cookies can be deleted. If cookies are deleted, the information collected prior to the preference change may still be used. However, Omnicell will cease using the disabled cookie to collect any further information from your user experience.

Contact Us

Questions or requests may be directed to privacy@omnicell.com.