What is the Voice of the Customer Survey?

Cardinal Health strongly believes in regular feedback and looks forward to hearing your thoughts as you share them through our Voice of the Customer Survey process. As part of Our Path Forward, we recognize that we can only get better by taking steps to actively listen to our customers on a regular basis.

The VOC Survey is your opportunity to provide Cardinal Health with valuable feedback. Your input will be used to guide further positive changes across Cardinal Health, including future transformative service excellence initiatives to help enhance the customer experience.

What Personal Data Do You Collect About Me?

When you complete the Cardinal Health Voice of the Customer Survey (''VOC Survey''), Cardinal Health processes certain personal data about you including your name, unique identification number, role, function, business name, business email address, IP address, and any other information you voluntarily supply. Sensitive or special categories of personal data (e.g., health, race, religion) will not be collected or processed, and you should please abstain from supplying any such sensitive data voluntarily.

Cardinal Health only collects and processes your personal data when we have a legal basis to do so. With your consent, your personal data and responses to this Survey will be used to identify you as the source of certain statements or selections as part of completing the VOC Survey in order to better understand and service our customers (''Purposes'').

What Do You Do with My Personal Data?

When you participate in the VOC Survey, your results are compiled with other customers' responses allowing Cardinal Health to analyze collective input and feedback to improve our customers' experience with Cardinal Health.

The personal data you provide in the VOC Survey is used to identify you as the actual participant. We do not use your personal data for automated decision-making or profiling purposes.

All raw data will be stored and archived at Cardinal Health.

From a legal perspective, Cardinal Health requests your consent to process your Personal Data for the reasons listed above.

Who Is the Data Controller?

Cardinal Health, Inc., located at 7000 Cardinal Place, Dublin, Ohio 43017 (USA). Cardinal Health Ireland Unlimited, located at 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32. You may contact Cardinal Health at DPO@cardinalhealth.com.

Who Receives My Personal Data?

Your privacy is important to us. Cardinal Health only shares your personal data and the VOC Survey results on a need-to-know basis, as explained below.

Cardinal Health may share your personal data to further the Purposes for which it was collected with our affiliates located outside your local or home country, including the United States. Please note that the United States may not have the same sufficiently high level of data protection laws as may be afforded to you in your country. Nonetheless, Cardinal Health and its affiliates will apply adequate technical, organizational, and physical safeguards to protect such personal data. Moreover, access to your personal data will be limited by need. Except for you, only authorized personnel may access your personal data for the Purposes described above.

We may also share your personal data with third-party service providers who assist us in facilitating the VOC Survey and meeting the Purposes. This includes sharing or disclosing your personal data with Customer Care Measurement and Consulting, LLC (''CCMC'') located in the United States and CCMC' sub processor Surveylab Limited located in the United Kingdom. We may also release your personal data when we believe release is appropriate to comply with the law, enforce our policies, protect our or others' rights, property, or safety, or with your consent.

We do not sell, trade, or otherwise transfer to outside parties your personal data for direct marketing purposes.

International Transfer of Your Personal Data

Cardinal Health relies on your consent to transfer your data outside of your local or home country if required by law, and in the European Economic Area (''EEA''), Cardinal Health relies on controller-to-controller standard contractual clauses to transfer your personal data outside the EEA to Cardinal Health group companies.

Transfers of data to third-party data processors, such as between Customer Care Measurement and Consulting, LLC (''CCMC'') located in the United States and CCMC's sub processor Surveylab Limited located in the United Kingdom, are secured by following Cardinal Health's Service Provider Guidelines and by implementing the safeguards required under applicable data protection laws including contractual arrangements entered into with third-party vendors. CCMC's Privacy Policy can be found at Privacy Policy (customercaremc.com) and Surveylab's Privacy Policy can be found at Privacy policy (surveylab.co.uk).

Your Data Protection Rights

Subject to applicable law, you are entitled to certain rights with respect to your personal data. Upon written request, you may request access to the personal data about you that is processed by Cardinal Health. You may also have the right to request that your personal data be rectified, erased, or restricted for processing. You also may be entitled to make use of the right of data portability.

You may object to the processing of your personal data at any time, based on grounds relating to your particular situation, if and to the extent the processing is based upon legitimate interests, or necessary to perform a task in the public interest or in the exercise of official authority.

For exercising these data subject rights requests, please contact Cardinal Health's Data Protection Officer in writing at the following email address: DPO@cardinalhealth.com. We will respond to your requests as soon as possible, but no later than the legally required period of time. You may also withdraw your consent to future processing of your personal data for the reasons set forth above, at any time, by sending an email to DPO@cardinalhealth.com. If you withdraw your consent, Cardinal Health will stop processing and delete your personal data without undue delay, unless there are other legal grounds for processing. Your revocation will not affect any personal data that Cardinal Health has already processed and transferred with your consent. You can also lodge a complete with the competent supervisory authority in your country of residence at any time.

Security Measures

We maintain appropriate security measures to prevent loss, misuse, unauthorized access, disclosure, or modification of your personal data under Cardinal Health's control. If you believe that the personal data you supplied is no longer secure, please notify Cardinal Health immediately using the contact information supplied below.

Retention Period

We retain your personal data not longer than it is allowed under the applicable data protection laws and in any case, not longer than such personal data is necessary for the purpose for which it was collected or otherwise processed, unless a longer retention period is required by applicable law.

Contact Us

If you have any questions or concerns regarding this Notice, please contact the Data Protection Officer at DPO@cardinalhealth.com.

Consent

Your responses to the VOC Survey are voluntary. You will not receive payment of any kind in exchange for granting your consent.

By continuing with this survey, you acknowledge that you have read the Privacy Notice and you consent to the processing and transfer of your personal data to Cardinal Health, as explained in the Privacy Notice.

You freely confirm your consent to all of the above. You understand that you may withdraw your consent to future processing at any time or for any reason by sending an email to DPO@cardinalhealth.com. If you withdraw your consent, we will stop processing and delete your information without undue delay, unless there are other legal grounds for processing. Your revocation, however, will not affect any personal data that we have already processed and transferred with your consent.