Bristol Myers Squibb
Health Care
28
out of 100. Number 414 of 512, counting from the worst.
Where Bristol Myers Squibb does well
- Arbitration 2 of 20. Few problems found.
- Renewals 0 of 20. Nothing found.
- Data retention 3 of 15. Few problems found.
- No forced arbitration or class-action waiver: disputes are handled in New Jersey state/federal courts, not a private arbitrator.
- BMS honors the Global Privacy Control browser signal for opting out of sale/sharing for behavioral advertising, and provides an opt-out phone line (855-961-0474) and online form; it states it does not knowingly sell or share minors' data for behavioral advertising. It has a dedicated policy protecting the confidentiality of Social Security numbers (prohibiting unlawful disclosure, limiting access). Recruitment AI only assists — all final hiring decisions are made “with meaningful human review and independent judgment” — and profiling for legally significant decisions requires human validation. The General Privacy Notice includes a data-minimization commitment to remove, de-identify, or anonymize data before sharing with third parties. US residents are granted deletion, correction, access, and sensitive-data-use-limitation rights under state privacy laws.
When you visit BMS websites (including product sites for its medicines), your identifiers, browsing history, and profile inferences can be sold or shared with ad networks to target you with ads.
The fine print
6 clauses and findings from the draft archive, dated 1 October 2026. The plain English comes first; the small print is the company's own words. None of these has been checked yet.
-
When you visit BMS websites (including product sites for its medicines), your identifiers, browsing history, and profile inferences can be sold or shared with ad networks to target you with ads. An opt-out form/phone line exists, but sharing is the default.
When we engage in digital advertising, we sell the following categories of personal information (according to the broad definition of “sell” under select state privacy laws), share them for purposes of cross-context behavioural advertising, or use them for targeted advertising: personal identifiers (including IP address, mobile advertising IDs), internet or other electronic activity information, inferences. These categories of personal information are sold to or shared for cross-context behavioural advertising or targeted advertising with advertising networks and other companies that facilitate or engage in digital advertising.
-
BMS lets third parties (including Google and Meta) run session-replay trackers on its sites that can record your keystrokes, clicks, taps, and browsing behavior.
Third parties may also use some of these technologies to assist us in determining if you require assistance or are having problems navigating on our websites or apps, and this may include technologies that record your interactions with the website or app, including without limitation, your keystrokes, mouse clicks, screen touches, and information about when, how and from where you accessed our website or app.
-
A pharmaceutical company handling health and sensitive data explicitly reserves the right to mine that sensitive information to infer what products to market to you.
We may use sensitive personal information to infer information about you that we use to market to you products in which you may be interested.
-
Anything you email or submit to BMS — including ideas, questions, or suggestions — becomes theirs to use freely, even to develop and sell products, with no confidentiality or compensation.
any communication or material you transmit to the Site by electronic mail or otherwise, including any data, questions, comments, suggestions or the like is, and will be treated as, non-confidential and non-proprietary. You understand that anything you transmit or post may be used by Bristol Myers Squibb for any purpose, including, but not limited to, reproduction, disclosure, transmission, publication, broadcast, and posting. Furthermore, Bristol Myers Squibb is free to use any ideas, concepts, know-how, processes, or techniques contained in any communication you send to the Site for any purpose whatsoever including, but not limited to, developing, manufacturing, marketing, and selling products and service using such ideas, concepts, know-how, processes, or techniques.
-
Simply opening the BMS website counts as accepting the terms — and the act of browsing overrides any other agreement you may have with the company about using the site.
By accessing and browsing the Site, you accept and agree to, without limitation or qualification, these Terms and Conditions and acknowledge that any other agreements between you and Bristol Myers Squibb are superseded and of no force or effect with respect to your access and use of the Site.
-
If BMS is acquired, merged, or sells part of its business, your personal data can be sold or transferred to the buyers — without your consent and without even notifying you.
In any such circumstance, your personal information may be shared with, sold, transferred, rented, licensed, or otherwise provided or made available by us or on our behalf to actual or potential parties to, and in connection with, the contemplated transaction (without your consent or any further notice to you).
BMS United States Privacy Notice (Section 14, Data sharing in connection with a transfer of control)
How these were found
Documents read via browser_open on Oct 1, 2026: (1) BMS General Privacy Notice, January 2026 (28 pages) at esg.bms.com; (2) BMS United States Privacy Notice, January 2026 (14 pages) at bms.com — the US notice supersedes the General notice for US residents; (3) full Legal Notice (Terms and Conditions) at http://www.bms.com/ae/en/legal-notice.html, whose text is US-oriented despite the /ae/ locale path (likely mirrored across locales; the 'Modification of Agreement' section tail was truncated in the fetch). Two attempted fetches of the older US-notice filename (bmsglobalunitedstatesprivacynotice.pdf) 404'd; the working file is bms-global-united-states-privacy-notice.pdf (correct hyphens). BMS is a B2B prescription-pharma company with a thin consumer surface (no e-commerce accounts, subscriptions, or auto-renewals), so the score is modest by design; adverse-event/medical-inquiry data retention is driven by drug-safety regulatory obligations rather than monetization. Consumer-health-data notices (Washington/Nevada) were not separately reviewed.
These notes come from the original draft and are not independent verification.