Essity AB and its subsidiaries and affiliates (collectively, “Essity,” “us,” “we,” and “our") provide this supplemental privacy policy (the “Supplemental State Privacy Policy”) for consumers who reside in US States with dedicated state privacy laws, as each are amended and as and when they become effective, and including any regulations thereunder (collectively, the “U.S. Privacy Laws”).

The Supplemental State Privacy Policy supplements the information contained in the Privacy Policy on the website (available by Link to Privacy Policy) and applies solely to visitors, users, and others who reside in the Supplemental States. To the extent any provision in this Supplemental State Privacy Policy conflicts with a provision of the Privacy Policy, the Supplemental State Privacy Policy shall govern with respect to visitors, users, and others who reside in the Supplemental States.

We may collect the personal information categories listed in the table below. We do not collect sensitive personal information. The table also lists whether we sell the information or share it with third parties for cross-context behavioral advertising.

Sources of Personal Information

We collect personal information about you directly from you when you provide it to us, automatically using cookies and other tracking technologies when you use our website and mobile applications, and from third parties.

Personal information does not include publicly available information lawfully made available from government records, deidentified or aggregated consumer information, or information excluded from the State Privacy Laws (as applicable).

We collect personal information to:

• Facilitate our provision of, and your use, of the Service
• Develop and improve our products and services
• Process and respond to your inquiries and requests
• Provide products and services you request
• Identify you as a user of the Service
• Contact and communicate with you, including for marketing purposes
• Conduct promotions
• Perform analytics
• Display relevant advertising
• Prevent fraudulent transactions and prevent misuse of the Service, monitor against theft, protect our intellectual property or the rights or property of others, and otherwise protect our users and our business
• Comply with legal obligations and defend, establish, and exercise legal claims.

We may use or disclose the personal information collected for one or more of the following business or commercial purposes:

• To fulfill or meet the reason for which the information is provided. For example, to create your personal account at Essity.com or to process your orders.
• To provide you with information, products, or services that you request from us.
• To be able to analyze your personal data to provide you with relevant marketing offers and information.
• To respond to law enforcement requests and as required by applicable law, court order, or government regulations.
• As described to you when collecting your personal information.

We will not collect additional categories of personal information or use the personal information we collect for different, unrelated, or incompatible purposes without providing you with notice.

Residents of the Supplemental States have certain rights. Please note that the below rights are not absolute, and we may be entitled to refuse requests, wholly or in part, where exceptions under applicable law apply.

Right to Access 

You have the right to access personal information that we may collect or retain about you. If requested, we shall provide you with a copy of your personal information which we collected as permitted by the State Privacy Laws.

You also have the right to receive your personal information in a structured and commonly used format so that it can be transferred to another entity (“data portability”).

Right to Know 

You have the right to request that we disclose the following about your personal information, as defined by the applicable State Privacy Law:
- The specific personal information we have collected;
- The categories of personal information we have collected;
- The categories of sources from which we have collected your personal information;
- The business purpose(s) for collecting or sharing your personal information;
- The categories of personal information we disclosed for business purposes; and
- The categories of third parties to whom we disclosed your personal information. 

Right to Opt-Out/Do Not Sell My Personal Information

You have the right to opt-out of sharing your personal information with third parties for some purposes, including sharing that may be defined as a sale under applicable laws. You can opt-out of this sharing by clicking HERE or clicking on the “Do Not Sell My Information” link at the bottom of our homepage and submitting a request via the authorized methods.

You also may have a right to opt out of the use of curtained automated decision-making technology.

Do Not Share or Disclose My Sensitive Personal Information 

You have the right to limit how your sensitive personal information is disclosed or shared with third parties, as defined in the California Consumer Privacy Act. Currently, we do not collect any sensitive personal information.

Right to Deletion

In certain circumstances, you have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (instructions and description below), we will delete, and, as applicable, direct our service providers to delete, your personal information from our records, unless an exception applies.

We may deny your request to delete your personal information if retaining the information is necessary for us or our service providers, subject to certain exemptions based on your state of residence.

Right to Correct/Right to Rectification 

In certain circumstances, you have the right to request correction of any inaccurate personal information. Upon verifying the validity of a valid consumer correction request, we will use commercially reasonable efforts to correct your personal information as directed, taking into account the nature of the personal information and the purposes of maintaining your personal information.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your rights under the applicable State Privacy Law. Unless permitted by the applicable State Privacy Law, we will not:

- Deny you goods or services;

- Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties; 

- Provide you with a different level or quality of goods or services; or 

- Suggest that you receive a different price or rate for goods or services or a different level or quality of goods or services. 

California Shine the Light Law 

California Civil Code Section 1798.83 permits our visitors who are California residents to request certain information regarding our disclosure of personal data to third parties for their direct marketing purposes. To make such a request, please contact Customer Service.

If you are a resident of the Supplemental States, you can exercise any of your rights as described in this Policy and under applicable State Privacy Laws.

If you wish to exercise your Right to Opt-Out/Do Not Sell My Personal Information by clicking HERE or clicking on the “Do Not Sell My Information” link at the bottom of our web site and submitting a request via the authorized methods. You can email us to dataprotection@essity.com. We also have a toll-free number: i.e. 1-866-275-8362.

If you wish to exercise your rights: Right to Access, Right to Know, Right to Deletion, Right to Correct/Right to Rectification please submit/email your request to:dataprivacy@essity.com or read more in our Privacy Policy.

Except as provided for under applicable privacy laws, there is no charge to exercise any of your legal rights. However, if your requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may (as permitted under applicable State Privacy Law):

- Charge a reasonable fee taking in account the administrative costs of providing the information or taking the action requested; or

- Refuse to act on the request and notify you of the reason for refusing the request.

What Personal Information Do I Provide to Verify My Identity?

We take the privacy of your personal information seriously and want to ensure that we provide only you with your personal information. Applicable law also requires that we verify the identity of each person who makes a request to know what personal information we have about you or to delete the

- First name*

- Last name*

- Email address*

- Phone number

*required field

In some instances, we may ask you to provide documentation to verify your identity. If this happens, we will reach out to you directly with this request.

What If You Can’t Verify My Identity?

If we can’t verify your identity, we will not be able to process your request to know what personal information we have about you or to delete the personal information we have about you. If we are unable to verify your identity with a high degree of certainty, we will only be able to provide a report with category-level information and we may not be able to delete some of your information.

If you are submitting a request on behalf of another person, we require valid documentation demonstrating your authority to submit this request. This can be a letter or other documentation signed by the Supplemental State resident authorizing you to submit this request.

How Do I Send You My Documentation?

If you submit a request HERE, you must include the appropriate above-listed documentation for us to act on your request. If you submit your request over the phone by calling us at 1-866-275-8362 (Toll-free), you will also be asked to email your forms to dataprotection@essity.com.

Response Timing and Format

We will confirm receipt of a request within 10 days and provide information about how we will process the request. We endeavor to substantively respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. Any disclosure we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance..

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

This Supplemental Consumer Health Data Privacy Notice (“Consumer Health Data Privacy Notice”) supplements the Privacy Policy.

This Consumer Health Data Privacy Notice only applies to personal information that we process that is “consumer health data” subject to the Washington My Health My Data Act (“MHMDA”) or Nevada Senate Bill 370 (“NV SB 370”) (as applicable).

Terms used in this Consumer Health Data Privacy Notice that are defined in MHMDA or NV SB 370 will have the meaning set forth in those laws to the extent such laws are applicable.

I. Consumer Health Data We Collect

Under the MHMDA, “consumer health data” is defined as “personal information that is linked or reasonably linkable to a consumer and that identifies the consumer's past, present, or future physical or mental health status.”

Under NV SB 370, “consumer health data” is defined as “personally identifiable information that is linked or reasonably capable of being linked to a consumer and that a regulated entity uses to identify the past, present or future health status of the consumer.”

Because consumer health data is defined very broadly, many of the categories of personal information that we collect under our Privacy Policy may also be considered consumer health data.

Examples of consumer health data that you may provide to us, or that we may otherwise collect, may include:

• Information that could identify your attempt to seek information, including services that allow you to assess, measure, improve, or learn about your or another person’s health. For example, we may collect your search queries, which may include information concerning your health and wellbeing, or other health-related topics.
• Information related to the precise (geo)location information of a consumer used to indicate an attempt by a consumer to receive health care services or products.

II. Sources of Consumer Health Data

We collect consumer health data that you provide to us, consumer health data we collect automatically when you use the Services, and consumer health data from third-party sources, as described in our privacy policy (LINK) and below.

III. Why We Collect and Use Consumer Health Data

We collect and use consumer health data for the purposes and in the manner described in the Supplemental Privacy Policy .

Primarily, we collect and use consumer health data as reasonably necessary to provide you with the products or Services you have requested or authorized. This may include delivering and operating the products or Services and their features, personalization of certain product or Services features, ensuring the secure and reliable operation of the products or Services and the systems that support them, troubleshooting and improving the products and Services, and other essential business operations that support the provision of the products and Services (such as analyzing our performance and meeting our legal obligations).

We may also use consumer health data for other purposes for which we give you choices and/or obtain your consent as required by law.

IV. Sharing of Consumer Health Data

We may share each of the categories of consumer health data described above for the purposes described above and in the the Supplemental Privacy Policy.

In particular, we may share consumer health data, with your consent or as reasonably necessary to complete any transaction or provide any product or Service you have requested or authorized, as described above.

V. Third Parties With Which We Share Consumer Health Data

We may share consumer health data with the categories of third parties listed in the Privacy Policy.

VI. How to Exercise Your Rights

MHMDA and NV SB 370 provide consumers with certain rights with respect to consumer health data.

Under MHMDA, consumers have the right to: (i) confirm whether TENA is collecting, sharing, or selling consumer health data and to access such data; (ii) withdraw consent from TENA collection and sharing of consumer health data; and (iii) request that TENA delete consumer health data. Under NV SB 370, consumers have the right to: (i) confirm whether TENA is collecting, sharing or selling consumer health data; (ii) have TENA provide the consumer with a list of all third parties with whom TENA has shared consumer health data relating to the consumer or to whom TENA has sold such consumer health data; (iii) request that TENA cease collecting, sharing, or selling consumer health data relating to the consumer; and (iv) request that TENA delete consumer health data.

The rights afforded to consumers under MHMDA and NV SB 370 are subject to certain exceptions.

You can request to exercise such rights by following the instructions found under the “Your Rights” section of the Privacy Policy.

If your request to exercise a right under MHMDA or NV SB 370 is denied, you may appeal that decision by contacting us at: dataprivacy@essity.com.

If your appeal is unsuccessful and your consumer health data is subject to MHMDA, you can raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.

VII. DISCLOSURE REGARDING THIRD PARTY COLLECTION OF CONSUMER HEALTH DATA UNDER NV SB 370

This section only applies to our processing of consumer health data that is subject to NV SB 370.

We do not allow third parties to collect consumer health data over time and across different Internet websites or online services when the consumer uses any Internet website or online service of TENA.

Nonetheless, please note that third parties may still be able to collect information that may be considered “consumer health data” under NV SB 370 from you over time and across different websites depending on your browser, browser add-ons, and associated permissions you set on your device. This collection of consumer health data by those third parties is unrelated to TENA collection of consumer health data from you, and we encourage you to view those third parties’ privacy notices for more information about their processing of consumer health data and the methods they provide to allow you to opt out of such processing.

VIII. UPDATES TO THIS CONSUMER HEALTH DATA PRIVACY NOTICE

We may update this Consumer Health Data Privacy Notice from time to time in our sole discretion. If we do, we’ll let you know by posting the updated Consumer Health Data Privacy Notice on our website, and/or we may also send other communications.