If you, your spouse/domestic partner or your eligible dependent loses coverge under a Givaudan health care plan because of a COBRA-qualifying event, you may have the right to continue coverage under the Consolidated Omnibus Budget Reconciliation Act (COBRA). Learn more.
GIVAUDAN HEALTH BENEFITS PLAN NOTICE OF PRIVACY PRACTICES
Revised effective February 16, 2026
THIS NOTICE DESCRIBES HOW MEDICAL INFORMATION ABOUT YOU MAY BE USED AND DISCLOSED AND HOW YOU CAN GET ACCESS TO THIS INFORMATION. PLEASE REVIEW IT CAREFULLY.
This is your Notice of Privacy Practices for the Givaudan Health Benefits Plan (the “Plan”). Under the Health Insurance Portability and Accountability Act of 1996, as amended (“HIPAA”), the Plan is required by law to maintain the privacy of health information that identifies you called protected health information (“PHI”). The Plan is also required by law to provide you with notice of its legal duties and privacy practices regarding your PHI. The Plan is committed to the protection of your PHI and your privacy is a priority of the Plan.
PHI is any information that:
The Plan may use or disclose your PHI (including to Givaudan as the Plan sponsor), as described below.
How The Plan May Use and Disclose Medical Information About You
The Plan may use or disclose PHI without an authorization in the following circumstances:
For Treatment. The Plan may use or disclose your PHI in connection with your medical treatment. For example, your primary care physician may send us information about your diagnosis and treatment plan so we can arrange for additional services.
For Payment. The Plan may use or disclose your PHI in connection with obtaining or arranging payment for your health care. This includes, but is not limited to, making coverage determinations and administering tasks such as billing, claims management, subrogation, plan reimbursement, reviews for medical necessity and appropriateness of care, utilization review and preauthorizations. For example, the Plan may tell a hospital whether you are covered by the Plan or the percentage of your costs that will be paid by the Plan.
For Health Care Operations. The Plan may use or disclose your PHI in connection with the administration of the Plan. Health care operations include, but are not limited to, quality assessment and improvement, reviewing competence or qualifications of health care professionals, activities relating to creating or renewing insurance contracts, and other administrative activities necessary to operate the Plan. For example, the Plan Administrator may examine claims history to project future benefit costs. However, the Plan may not use or disclose any PHI that is genetic information to determine whether you are eligible for coverage or to determine the price of your coverage.
To Business Associates. The Plan may disclose PHI to its business associates to perform certain plan administration functions. For example, business associates may include claims administrators, consultants, accountants and attorneys. Business associates may receive, create, maintain, and/or disclose your PHI without your authorization, but only after the business associate agrees in writing with the Plan to limit its uses and disclosures to proper purposes and to implement appropriate safeguards regarding your PHI.
To Personal Representatives. The Plan may also disclose your PHI to individuals authorized by you, or to an individual designated as your personal representative (such as your legal guardian), so long as you provide the Plan with a written notice or authorization and any supporting documents (i.e., healthcare power of attorney or designation of personal representative). The Plan will make sure a personal representative is authorized and able to act for you before disclosing your PHI. However, the Plan does not have to disclose information to a personal representative if the Plan has a reasonable belief that (1) you have been, or may be subjected to domestic violence, abuse or neglect by such person; (2) treating such person as your personal representative could endanger you; or (3) it is not in your best interest to treat the person as your personal representative.
To the Plan Sponsor. The Plan may disclose your PHI without your written authorization to Givaudan in certain circumstances. First, the Plan may disclose enrollment information to Givaudan. Second, the Plan may disclose summary health information to Givaudan so that Givaudan can obtain premium bids or modify, amend or terminate the Plan. Third, the Plan may disclose PHI to Givaudan to perform Plan administration functions, and Givaudan will not further use or disclose that PHI except as permitted or required by the Plan documents and by law. Only employees involved in the administration of the Plan will have access to your PHI to perform Plan administration functions, including (but not limited to), evaluating potential new insurers or service providers to the Plan, assisting participants with claims disputes or questions, and coordinating COBRA continuation coverage.
In Additional Circumstances. Although less likely, the use or disclosure of your PHI is permitted without your written authorization under the following circumstances:
| Required by law | When required by law. |
| Public health purposes | When permitted for certain public health purposes, such as product recalls, control of communicable diseases, and reporting adverse reactions to medications, or to otherwise prevent or lessen a serious and imminent threat to the health or safety of a person or the public. |
| Victims of abuse, neglect or domestic violence | When authorized by law to report information about abuse, neglect, or domestic violence when the Plan reasonably believes you are a victim of abuse, neglect, or domestic violence and that the disclosure is necessary to prevent serious harm to you or other potential victims. Generally, you must be informed if the Plan makes a disclosure like this. |
| Public health oversight activities | To a public health oversight agency for oversight activities authorized by law, such as audits, investigations, inspections and licensure necessary for the government to monitor the health care system, government programs, and compliance. |
| Judicial and administrative proceedings | When required for judicial or administrative proceedings in response to a court or administrative order, or in response to a subpoena, discovery request or other lawful process, but if the requesting party is not the court, the requesting party must have made a good faith attempt to inform you of the proceeding and permit you to raise an objection or obtain an order protecting the information requested. |
| Law enforcement purposes | When required or permitted for law enforcement purposes or specialized government functions such as military activities. |
| Decedents | To coroners, medical examiners, funeral directors, and organ procurement organizations in accordance with such entities’ needs for PHI about a particular decedent. |
| Specialized government functions | To military command authorities and authorized officials for national security purposes, such as protecting the President of the United States, conducting intelligence, counter-intelligence, other national security activities and when requested by foreign military authorities (only in compliance with U.S. law) and to correctional institutions when requested by a correctional institution or law enforcement for health, safety and security purposes. |
| Research purposes | For research (subject to approval by institutional or private privacy review boards and subject to other certain conditions). |
| Workers’ compensation | When authorized by and to the extent necessary to comply with a workers’ compensation law or other similar programs established by law. |
| HHS investigations | When required by the Secretary of the United States Department of Health and Human Services when the Secretary is investigating or determining compliance with the HIPAA Privacy Rule. |
| Serious Threat to Health or Safety | When necessary to prevent or lessen a serious and imminent threat to the health or safety of a person or the public, or, under certain circumstances, when necessary for law enforcement authorities to identify or apprehend an individual who has admitted to participation in a violent crime or who has escaped from legal custody. |
Substance Use Disorder Treatment Records
Federal regulations known as the Part 2 regulations require special privacy protections for substance use disorder records held by certain treatment programs (“Part 2 Programs”). If you give a Part 2 Program a general consent to use and disclose your Part 2 Program records for purposes of treatment, payment, or health care operations, and if the Plan receives some or all of your Part 2 Program records as a result of that consent, the Plan may use and disclose those records for treatment, payment, and health care operations purposes as described in this notice.
If the Plan receives or maintains Part 2 Program records about you through specific consent you provide to the Plan or another third party, the Plan will use and disclose your Part 2 Program records only as described in the consent you provided.
The Plan will not use or disclose a Part 2 Program record about you, or testimony that describes the information contained in a Part 2 Program record about you, in any civil, criminal, administrative, or legislative proceedings against you, unless authorized by your written consent or a court order that is issued after you are given notice and an opportunity to be heard as provided for in the Part 2 regulations. If the use or disclosure is appropriately authorized by a court order, the Plan will not use or disclose the Part 2 Program record, or testimony about such record, unless the court order authorizing use or disclosure is accompanied by a subpoena or other legal requirement compelling disclosure. You can provide a single consent for all future uses and disclosures of Part 2 Program records for purposes of treatment, payment, and health care operations that do not permit use for civil, criminal, administrative, or legislative proceedings.
Although the Plan does not anticipate using any Part 2 Program records for fundraising purposes, you will be given an opportunity to opt out of receiving any fundraising communications from the Plan before the Plan will use your Part 2 Program records for fundraising purposes.
Other Restrictions on the Use and Disclosure of PHI.
Certain other federal and state laws may require special privacy protections that restrict the use and disclosure of certain health information. If a use or disclosure of PHI described above in this notice is prohibited or materially limited by other laws that apply to the Plan, the Plan intends to meet the requirements of the more stringent law.
Uses and Disclosures that Require Your Authorization
Other than disclosures to you, the Plan will ask you for your written authorization before using or disclosing your PHI for any purpose not described above, including uses and disclosures of PHI for marketing purposes, disclosures that would constitute a sale of PHI, and most uses and disclosures of psychotherapy notes. If you signed an authorization form, you may revoke it in writing at any time, except to the extent that action has been taken in reliance on the authorization before the Plan Administrator received your written notice revoking your authorization.
Minimum Necessary Standard
The Plan will make reasonable efforts not to use, disclose or request more than the minimum amount of PHI necessary to accomplish the intended purpose of the use, disclosure, or request. The “minimum necessary” standard will not apply, however, to certain disclosures, such as disclosures of your PHI to you.
Your Rights Regarding Your PHI
You have certain rights with respect to your PHI, including:
Right to Inspect and Copy Your PHI. You have the right to inspect and receive a copy of your PHI that is used to make decisions about your treatment or payment for your care, such as your health and claims records. For PHI for which you have a right of access, you have the right to receive your PHI in an electronic format if it is readily producible in such format, and to direct the Plan to transmit a copy of your PHI to an entity or person you designate, provided the designation is clear, conspicuous and specific. The Plan typically will provide you with your requested records within 30 days of your request. The Plan may charge a reasonable fee for the costs of copying, mailing or other supplies associated with your request.
Right to Amend Your PHI. You have the right to request, in writing, that an amendment be made to your PHI if you believe any part of your PHI is incorrect or incomplete. Your request must include a reason to support your request. If your request is denied, the Plan will provide you with a written explanation of the reason for the denial within 60 days. The Plan may deny your request if you ask the Plan to amend information that: (i) is not part of the medical information kept by or for the Plan; (ii) was not created by the Plan, unless the person or entity that created the information is no longer available to make the amendment; (iii) is not part of the information that you would be permitted to inspect and copy; or (iv) is already accurate and complete. If the Plan denies your request for an amendment, you have the right to file a statement of disagreement with the Plan and any future disclosures of the disputed information will include your statement of disagreement.
Right to an Accounting of Disclosures. You have the right to request an accounting of certain disclosures of PHI made by the Plan. The accounting will not include disclosures (1) that were made for treatment, payment or health care operations purposes; (2) that were authorized by you; (3) that were made to friends or family members in your presence or because of an emergency; (4) that were made for national security purposes, or (5) that were incidental to otherwise permissible disclosures. Your request must be in writing and state a time period, which may not be longer than six (6) years nor start more than six (6) years before the date of your request. Your request should indicate in what form you want the accounting (for example, paper or electronic). The first list you request within a 12-month period will be provided free of charge. Additional lists will be subject to a reasonable charge.
Right to Receive Notification of a Breach of Unsecured PHI. You have the right to receive notice if there is a breach of your unsecured PHI (i.e., your PHI is disclosed in violation of HIPAA and there is more than a low probability that the PHI has been compromised). If it is determined from the Plan’s risk assessment that a breach has occurred, you will be notified without unreasonable delay and no later than 60 days after discovery of the breach. The notification will include information about what happened and what may be done to mitigate any harm.
Right to Request Restrictions. You have the right to request that the Plan limit the PHI the Plan uses or discloses about you for treatment, payment or healthcare operations. You also have the right to request a restriction or limit on your PHI that the Plan discloses to someone who is involved in your care or involved in the payment for your care, like a family member or friend. The Plan will consider your request, but it is not required to agree to your request for restrictions. To request restrictions, your request must be in writing and you must provide the Plan (i) with the information you want to limit; (ii) whether you want to limit the Plan’s use, disclosures, or both; and (iii) to whom you want the limits to apply (for example: your spouse).
Right to Request Confidential Communications. You have the right to receive, upon your request, communications of your PHI in a confidential and alternative manner or at an alternative address if you would be endangered by the usual method of communication. To request PHI in a confidential and alternate way, you must make your request in writing and specify how or where you wish to be contacted. The Plan will accommodate all reasonable requests if you clearly provide information that the disclosure of all or part of your PHI could endanger you. You do not have to provide the specific reason that you believe the disclosure of your PHI could endanger you.
Right to Receive a Paper Copy of this Notice of Privacy Practices. You have the right to receive a paper copy of the Plan’s Notice of Privacy Practices at any time by contacting the Plan’s Privacy Officer at the address or phone number listed below. This notice will also be posted on www.givaudanbenefits.com.
Right to Choose Someone to Act For You. You have the right to choose someone to act on your behalf (i.e., designation of a healthcare power of attorney or personal representative) by exercising your rights and making decisions about your health information.
Changes to this Notice of Privacy Practices
This Plan is required to abide by the terms of the Notice of Privacy Practices currently in effect. This notice takes effect on February 16, 2026. However, the Plan reserves the right to change the terms of this notice and the Plan’s privacy policies from time to time. Changes to this notice will apply to all PHI that the Plan maintains. If the Plan makes a material change to this notice, the revised version of the notice will be available upon request and on the website which provides information about the Plan benefits. Additionally, either the revised version of this notice or information about the material change will be mailed to persons covered under the Plan.
Privacy Officer and Further Information
For more information about your rights described in this Notice of Privacy Practices, you may contact the HIPAA Privacy Officer, Givaudan, Attn: Ryan Samuels, 1199 Edison Dr., Cincinnati, Ohio 45216, 513.948.5571.
How to File a Complaint
If you have questions or comments about the Plan’s Notice of Privacy Practices or the Plan’s privacy policies and procedures, please contact the Plan’s HIPAA Privacy Officer at the address or phone number listed above. If you would like to file a complaint with the Privacy Officer about the Plan’s use or disclosure of your PHI or the Plan’s privacy policies and procedures (including its breach notification policies and procedures), please submit your complaint in writing to the Privacy Officer at the address listed above.
You may also file a complaint with the Secretary of the U.S. Department of Health and Human Services by submitting a detailed written description of the issue via mail to 200 Independence Avenue, S.W., Room 509F HHH Bldg., Washington, D.C. 20201; via email to OCRComplaint@hhs.gov; or through the OCR Complaint portal at ocrportal.hhs.gov/ocr/smartscreen/main.jsf. Your written description must name the covered entity (the Plan) and what action (or lack of action) you believe has violated HIPAA. Your complaint must be submitted within 180 days of when you knew or should have known of the issue, unless this deadline is waived by the Office for Civil Rights.
You will not be penalized or retaliated against for filing a complaint about the Plan’s privacy practices.
The Newborns’ and Mothers’ Health Protection Act of 1996 (NMHPA) is a federal law that affects the length of time a mother and newborn child are covered for a hospital stay in connection with childbirth. Learn more.
If you or your children are eligible for Medicaid or CHIP and you’re eligible for health coverage from your employer, your state may have a premium assistance program that can help pay for coverage, using funds from their Medicaid or CHIP programs. Learn more.
The Women’s Health and Cancer Rights Act of 1998 (WHCRA) is a federal law that provides protections to patients who choose to have breast reconstruction in connection with a mastectomy. Learn more.
