Skip to main content

      California Workforce Privacy Notice

       

      LAST UPDATED: October 10, 2025

      This California Workforce Privacy Notice (“Notice”) describes how CVS Pharmacy, Inc. and its subsidiaries and affiliated companies (“CVS,” “we,” “our,” or “us”) may collect and use Personal Information from or about job applicants, employees, former employees, contractors and other CVS professionals who are residents of California, including through your interactions with us on jobs.cvshealth.com (the “Site”). This Notice supplements our Workforce Privacy Policy, which can be found here.

      The terms used in this Notice have the same meaning given to them in the California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020 (the “CCPA”).

      Contents:

      1. Personal Information We Collect
      2. Purposes for Processing Your Personal Information
      3. How We May Disclose Your Personal Information
      4. Your Privacy Choices and Rights
      5. External Links
      6. Children’s Privacy
      7. Data Security
      8. Revisions To This Notice
      9. How To Contact Us

      1. Personal Information We Collect

      There are several ways we may collect Personal Information about you, including through information you provide to us; information we collect through your interactions with us; information we receive from third parties; and by combining information from different sources.

      a) Categories of Information We May Collect

      From applicants, employees and other CVS professionals, we may collect the following categories of Personal Information:

      • Identifiers/demographic information, such as name, age, date of birth, sex, gender, postal and email address, phone number, and online identifiers, Internet Protocol (“IP”) address, and other similar identifiers.
      • Internet or other electronic network activity information.
      • Geolocation data (non-precise).
      • Audio, electronic, visual, or similar information.
      • Professional or employment-related information.
      • Education information.
      • Sensitive Personal Information such as account log-in and password.

      From applicants who have accepted an offer, employees and other CVS professionals, in addition to the categories of Personal Information above, we may also collect the following:

      • Sensitive Personal Information, such as drug test results and criminal background checks.

      From employees and other CVS professionals, in addition to the categories of Personal Information above, we may also collect the following:

      • Personal information categories listed in the California Customer Records statute, such as your health insurance information and workers’ compensation claim information, signature and physical characteristics or description.
      • Sensitive Personal Information and protected classification characteristics under California or federal law, including government identification numbers, biometric information, precise geolocation, racial or ethnic origin, nationality and national origin, trade union membership, and Personal Information collected and analyzed concerning a consumer’s health, sex life, or sexual orientation.
      • Commercial information, such as VIN or vehicle license plate number.

      We do not “sell” or “share” this Personal Information. We only disclose Personal Information to service providers for permissible business purposes such as to process your application for employment, facilitate payroll, etc. as described in Section 2.

      We take commercially reasonable steps to protect the confidentiality of the Personal Information we collect from disclosure to third parties, except on a need-to-know basis to facilitate the hiring and employment process.

      b) Information You May Provide

      We may collect Personal Information directly from you when you interact with us or our service providers, through communications, and automatically when you visit our Site or interact with our services.

      c) Information We May Automatically Collect

      When you visit our Site or interact with our services, we or our service providers may use a variety of technologies, such as cookies, tags, SDKs or scripts, to collect certain information regarding your activity.

      The specific types of information that we and service providers may automatically collect when you visit and interact with our Site and services include:

      • Device and Browser Information. Your device’s IP address and/or other unique identifiers, browser type, device type, internet service provider, and operating system.
      • Location Information. Your device’s approximate location (derived from your device’s IP address or other signals) may be collected. Additionally, when you visit one of our stores, your location may also be collected.
      • Usage Information. The date and time of your visit, the pages you view immediately before and after you access our Site and services, the areas or pages of our Site and the services that you visit, the amount of time you spend viewing or using our Site and the services, keystrokes, mouse movements, form field entries, recordings of chat sessions or your use of and inputs to other AI-supported tools, and other use and overall engagement with the Site and the services.

      Cookies and Other Similar Technologies: “Cookies” are text files that are placed on your browser by the websites that you visit. Cookies are used for various purposes, such as to distinguish you from other users, make your site navigation more efficient, help remember your preferences, enhance your browsing experience, and improve the use and functionality of our Site and the services.

      Cookies (and other similar tracking technologies) provided by third parties may be placed on certain places within our Site and the services, and the providers of these technologies may combine information collected from your interaction(s) with our Services with information they collect from other sources and use the combined information for analytics or to provide site functionality and integrity.

      d) Information We May Receive from Third Parties

      We may receive Personal Information from other sources. Our third-party sources may include:

      • Other Companies that provide Personal Information to supplement what we already know about you, such as data aggregators and background check providers.

      e) Combination of Information

      We may combine Personal Information that we receive from various sources. For example, we may combine Personal Information that we receive from third parties with Personal Information we already have about you. We use, disclose, and protect combined Personal Information as described in this Notice.

      f) Retention

      We will retain your Personal Information for as long as reasonably necessary to provide you with our Services that you request or otherwise where permitted or required in accordance with applicable law. We will retain and use your Personal Information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. What this means in practice will vary between different types of information, and when we consider our approach we take into account ongoing business or legal needs for the information, for example in relation to tax, health and safety, and potential or actual disputes or investigations.

      2. Purposes for Processing Your Personal Information

      We may use the Personal Information we collect about you for the purposes listed below:

      • To provide you with our Site and the services, including creating and managing your accounts, and assessing your job application and applicable records.
      • To communicate with you, such as through bots (which may be powered by third party vendors and be trained on your inputs through AI-based technology), including to respond to your inquiries/requests and request feedback from you, and to send you important updates and messages about your job applications or your employment as well as changes to this Notice and/or other applicable terms and conditions.
      • To manage our workforce, to the extent you are a CVS employee, former employee or other CVS professional, such as payroll and tax, benefits administration, investigations and corrective actions, workforce development programs, diversity, equality and inclusion initiatives.
      • To review the usage and maintain the operation of our Site, the services, and our systems.
      • To conduct analysis and develop and/or improve our Site, the services, and our systems.
      • To monitor, protect and maintain the security and integrity of our Site and the services and our systems, such as protecting against and preventing fraud, claims and other liabilities.
      • To comply with applicable laws and regulations and respond to lawful requests and communications from law enforcement and other government officials.
      • To carry out sales and business transactions in which information held by us is among the assets transferred or is otherwise relevant to the evaluation, negotiation or completion of the transaction.
      • To protect our rights, privacy, safety, property and/or those of others.
      • To fulfill any other purpose for which you provide your Personal Information or as explained to you at the point of information collection.

      3. How We May Disclose Your Personal Information

      We may disclose Personal Information that we collect to the following categories of recipients:

      • Our Affiliates. We may disclose your Personal Information with our affiliates for purposes set forth in this Notice.
      • Our Service Providers. We disclose your Personal Information to our service providers that provide business, professional, or technical support services to us, help us operate our business and the Services, or administer activities on our behalf. We require our service providers to only use your Personal Information in connection with providing services to CVS.

      In certain circumstances, we may disclose each category of your Personal Information to:

      • Competent Governmental, Regulatory, and Public Authorities. We may disclose your Personal Information only as permitted or if required to do so by government and law enforcement authorities. We disclose Personal Information in matters involving claims of personal or public safety, or in litigation. This may include disclosure of your Personal Information to allow us to pursue remedies or to limit the damages we may sustain. We may also use or disclose your information to enforce our terms and conditions, to protect our operations or those of any of our affiliates, to prevent misuse of our Services, or to protect our rights, privacy, safety or property and/or that of our affiliates, you, or others.
      • Relevant Third Parties as Part of a Corporate Transaction. In the event of a reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with a bankruptcy or similar proceeding), we may disclose or transfer your Personal Information to certain third parties, such as the acquiring entity and its advisers.
      • Other Third Parties. We will disclose your Personal Information to other third parties at your direction or with your consent. Additionally, we will disclose your Personal Information as we believe necessary or appropriate to: (a) comply with applicable law; (b) enforce our terms and conditions; (c) protect our operations; (d) protect our rights, privacy, safety, or property, and/or those of you or others; and (e) allow us to pursue available remedies or limit damages that we may sustain.

      We may disclose Personal Information for other reasons that we will describe at the time of information collection or prior to disclosing your information.

      Please note that we may de-identify or aggregate Personal Information so that it will no longer be considered Personal Information and disclose such information to other parties for purposes consistent with those described in this Notice. Unless you take action to re-identify your de-identified information, we will not attempt to re-identify this information so that it may be associated with you.

      4. Your Privacy Choices and Rights

      a) Privacy Right

      You may have the following rights under the CCPA with respect to your Personal Information.

      • Right to Know: You may have the right to know what Personal Information we have collected about you, including the categories of sources from which the Personal Information is collected, the business purposes we disclose Personal Information, the categories of third parties to whom we disclose Personal Information, the categories of Personal Information disclosed to third parties, and the specific pieces of Personal Information we have collected about you. Please note that we may not be required to respond to your requests “to know” or access specific pieces of Personal Information more than twice in any 12-month period.
      • Right to Data Portability: You may have the right to access your information in a portable format.
      • Right to Delete: You may have the right to request that we delete Personal Information that we have collected from or about you, subject to certain exceptions.
      • Right to Correct: You may have the right to correct inaccurate Personal Information that we may maintain about you, subject to appropriate verification.
      • Right to non-discrimination: We will not discriminate against you if you exercise any of these privacy rights.

      Before we fulfill a request, we must verify your identity and ability to exercise these rights. There are also some exclusions and exceptions that may apply. So that we can verify your identity, if you are a CVS employee or former employee, you will need to first sign into your account. If you are not a CVS employee or former employee, you will be asked to give us certain Personal Information via webform or on the phone, as described above.

      If you are not a CVS employee or former employee and request access to, correction or deletion of your Personal Information, we may require you to provide any of the following information: Full legal name, email address, phone number, position(s) applied for, store/office location applied to and/or home address (depending on the information you may have provided).  In addition, if you are not a CVS employee or former employee and you ask us to provide you with specific pieces of Personal Information, we may require you to sign a declaration under penalty of perjury that you are the consumer whose Personal Information is the subject of the request.

      Please note that, where permitted under applicable law, we may decline a request if we are unable to verify your identity (or an agent’s authority to make the request) and confirm the Personal Information we maintain relates to you.

      If you are interested in exercising one or more of these rights, see Section 4(b) below. We may take steps to verify your identity before responding to your request by asking you a series of questions about you or your previous interactions with us. Submitting a privacy rights request does not require you to create an account with us.

      b) Submit a Privacy Rights Request

      Current Employees:

      • Go to the Colleague Zone via this link: Submit a General Inquiry
        • Complete and submit the request with your information
        • Under Additional details, write-in, “CA Privacy Rights Request” and then describe the nature of your request in the description box.
      • Call us at: 1-888-694-7287
      • Oak Street Health employees can call 1-888-776-4854 or email privacy@oakstreethealth.com to submit a request

      Former Employees:

      • Password-protected web portal for Aetna/CVS former employees: Sign in here 
        • Once you have completed login, navigate to and select the “California Privacy Law” link at bottom of the webpage
        • Next, under “Your Privacy Request” click on the “by submitting your request here”
        • Complete the online submission form
      • Call us at: 1-888-694-7287
      • Former Oak Street Health employees can call 1-888-776-4854 or email privacy@oakstreethealth.com to submit a request

      Applicants and Other Professionals:

      c) Agent Requests

      Only you, or someone legally authorized to act on your behalf, may submit a request related to your Personal Information. You may authorize someone to make a privacy rights request on your behalf (an authorized agent). Authorized agents will need to demonstrate that you’ve authorized them to act on your behalf. CVS retains the right to request confirmation directly from you confirming that the agent is authorized to make such a request, or to request additional information to confirm the agent’s identity.

      d) Right to Appeal

      You may have the right to appeal a decision we have made in connection with your privacy rights request. To appeal a decision, please contact us at ConsumerPrivacy@CVSHealth.com.

      5. External Links

      Our Site and the services may have links to third-party services, which may have privacy policies that differ from our own. We are not responsible for the practices of third-party services.

      6. Children’s Privacy

      Our Services are intended for a general audience. We do not direct our Site or the services to individuals under eighteen (18), nor do we knowingly solicit or collect any Personal Information from individuals under eighteen (18).

      7. Data Security

      We have implemented physical, administrative, and technical safeguards to maintain the security, confidentiality, and integrity of your information. However, as no transmission of information over the internet is absolutely secure, we cannot guarantee the safety of your information.

      8. Revisions To This Notice

      We reserve the right, in our sole discretion, to change, modify, add, remove, or otherwise revise portions of this Notice at any time. When we do, we will post the change(s) to our Site or the services. Your continued use of our Site and the services following the posting of changes to these terms means you accept these changes. If we change the Notice in a material way, we will provide appropriate notice to you and seek your consent where required by applicable privacy laws. Notice may be provided via a temporary banner on our Site or within the services, an email sent to users for whom we have an email address, or by temporarily noting “UPDATED” next to the Workforce Privacy Policy link on the footer of our Site or within the services.

      9. How To Contact Us

      If you have any questions or concerns about this Notice or the practices described herein, you may contact us by email at ConsumerPrivacy@CVSHealth.com, by mail to CVS Health, Attn: Privacy Office, 1 CVS Drive, Woonsocket, R.I. 02895, or by phone at 1-888-607-4287.