California Consumer’s Protection Act (CCPA)

Effective Date: December 1, 2023

This notice reflects our good faith understanding of the law and our data practices as of the date posted (set forth above), but as of that date the CCPA’s implementing regulations were not final and there remain differing interpretations of the law. Accordingly, we may from time-to-time update information in this and other notices regarding our data practices and your rights, modify our methods for responding to your requests, and/or supplement our response to your requests, as we continue to develop our compliance program to reflect the evolution of the law and our understanding of how it relates to our data practices.

This California Privacy Notice (“Notice”) applies to “Consumers” as defined by the California Consumer Privacy Act (“CCPA”) as a supplement to ClearBalance and its affiliates’ (“Company”, “us”, “we” or our”) other privacy policies or notices. In the event of a conflict between any other Company policy, statement or notice and this Notice, this Notice will prevail as to Consumers and their rights under the CCPA. Please see also any privacy policy or notice of general applicability posted or referenced on our websites, apps, products, or services including, without limitation, the ClearBalance Privacy Notice.

This Notice covers the collection, use, disclosure, and sale of Consumers’ “Personal Information” (“PI”) as defined by the CCPA, except to the extent such PI is exempt from the notice obligations of the CCPA. This Notice also covers rights Consumers have under the CCPA as well other notices to Californians required by other laws.

Consistent with the CCPA, job applicants, current and former employees, and independent contractors (“Personnel”), and subjects of certain business-to-business communications acting solely in their capacity as representatives of another business, are not considered “Consumers” for purposes of this California Privacy Notice or the rights described herein.

MANAGING PI

Consistent with the CCPA our description in this Notice of our collection and use, sharing and sale of PI reflects our current practices and will be updated as needed.

Collection and Use

We collect PI about Consumers including:

As permitted by applicable law, we do not treat de-identified data or aggregate consumer information as PI and we reserve the right to convert, or permit others to convert, your PI into de-identified data or aggregate consumer information. We have no obligation to re-identify such information or keep it longer than we need it to respond to your requests. This helps us practice data minimization, which we consider to be a privacy best practice consistent with our mission to respect our employees and customers.

Sharing of PI

We may share PI with our service providers, other vendors and affiliates, including without limitation as follows:

The business purpose for collecting and sharing personal information is listed above in the Collection and Use PI table.

Sale of PI

We do not believe that we sold your PI in the preceding 12 months and do not believe that we “sell” your PI as defined under the CCPA. Until such time as we change this policy by updating this Notice, and provide a method to opt-out of a sale, we will treat PI collected under this approach as subject to a Do Not Sell request. Notwithstanding anything to the contrary in our other privacy notices, we typically restrict use of your PI to the business purpose associated with that service provider. Additionally, your requests that direct us to share PI are not considered a sale, and disclosures amongst the entities that constitute Company as defined above are not a sale.

Some browsers have signals that may be characterized as do not track signals, but we do not understand them to operate in that manner or to indicate a Do Not Sell expression by you, so we currently do not recognize these as a Do Not Sell request. We understand that various parties are developing Do Not Sell signals and we may recognize certain such signals if we conclude such a program is appropriate. For more information on cookies and sale of PI, see the Do Not Sell subsection of the California Privacy Rights section below.

CALIFORNIA PRIVACY RIGHTS

Commencing January 1, 2020, we provide Consumers with the privacy rights described in this section. You have the right to exercise these rights via an authorized agent who meets the agency requirements of the CCPA and related regulations. As permitted by the CCPA, any request you submit to us is subject to an identification and residency verification process (“Verifiable Consumer Request”). This process may consist of, but is not limited to, our Contact Center agents verifying your identity through established protocols, or our Privacy team asking you to confirm information previously submitted to the company.

We will not fulfill your CCPA request unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we collected PI. Please follow the instructions on our Privacy Rights Request page to submit a form, and respond to any follow up inquires we may make.  You may also contact the ClearBalance Patient Experience Team at 1 (888) 334-4022.

If we cannot comply with a request, we will explain the reasons in our response. You are not required to create an account with us to make a Verifiable Consumer Request.  We will use PI provided in a Verifiable Consumer Request only to verify your identity or authority to make the request and to track and document request responses, unless you also gave it to us for another purpose.

We will make commercially reasonable efforts to identify PI that we collect, process, store, disclose and otherwise use and to respond to your Consumer privacy rights requests. We reserve the right to direct you to where you may access and copy responsive PI yourself. We will typically not charge a fee to fully respond to your requests; provided, however, that we may charge a reasonable fee, or refuse to act upon a request, if your request is excessive, repetitive, unfounded or overly burdensome. If we determine that the request warrants a fee, or that we may refuse it, we will give you notice explaining why we made that decision. You will be provided a cost estimate and the opportunity to accept such fees before we will charge you for responding to your request.

Consistent with the CCPA and our interest in the security of your PI, we will not deliver to you your social security number, driver license number or other government-issued ID number, financial account number, any health or medical identification number, an account password, or security questions or answers in response to a CCPA request; however, you may be able to access some of this information yourself through your account if you have an active account with us.

Your Consumer privacy rights are as follows:

The Right to Know

You have the right to send us a request, no more than twice in a twelve-month period, for any of the following for the period that is twelve months prior to the request date:

• The categories of PI we have collected about you.
• The categories of sources from which we collected your PI.
• The business or commercial purposes for our collecting or selling your PI.
• The categories of third parties to whom we have shared your PI.
• The specific pieces of PI we have collected about you. You have the right to make or obtain a transportable copy, no more than twice in a twelve-month period, of your PI that we have collected in the period that is 12 months prior to the request date and are maintaining. Please note that PI is retained by us for various time periods, so we may not be able to fully respond to what might be relevant going back 12 months prior to the request.
• A list of the categories of PI disclosed for a business purpose in the prior 12 months, or that no disclosure occurred.
• A list of the categories of PI sold about you in the prior 12 months, or that no sale occurred. If we sold your PI, we will explain:
• The categories of your PI we have sold.
• The categories of third parties to which we sold PI, by categories of PI sold for each third party.

To make a request, you may submit a form or contact the ClearBalance Patient Experience Team at 1 (888) 334-4022.  For existing and former ClearBalance Program participants who submit requests through the online form, we will verify identity based on matching information you provided with information available in the ClearBalance system.  This could include, but is not limited to Social Security Number, mailing address, or date of birth.  For those consumers who were presented a credit offer through the ClearBalance Program, but did not accept the program, and who submit requests through the online form, we will verify identity based on matching information you provided with data we have maintained on you in our systems. This data could include, but is not limited to, Social Security Number, mailing address, or date of birth.  For requests received through calling the ClearBalance Patient Experience Team, we will follow the same procedures as above based on whether you are a current account holder or other individual. 

Do Not Sell

As noted above, we do not sell your PI as such is defined under the CCPA.  Until such time as we change this policy by updating this Notice, we will treat PI collected under that policy as subject to a Do Not Sell request.  If you are 16 years of age or older, you have the right to direct us to not sell your PI. To make a request, you may submit a form or call the ClearBalance Patient Experience Team at 1 (888) 334-4022.  For existing and former ClearBalance Program participants who submit requests through the online form, we will verify identity based on matching information you provided with information available in the ClearBalance system.  This could include, but is not limited to Social Security Number, mailing address, or date of birth.  For those consumers who were presented a credit offer through the ClearBalance Program, but did not accept the program, and who submit requests through the online form, we will verify identity based on matching information you provided with data we have maintained on you in our systems. This data could include, but is not limited to, Social Security Number, mailing address, or date of birth.  For requests received through calling the ClearBalance Patient Experience Team, we will follow the same procedures as above based on whether you are a current account holder or other individual. 

While there is not yet a consensus, we do not believe data practices of third-party cookies and tracking technologies associated with our websites and mobile apps may constitute a “sale” of your PI as defined by the CCPA. However, you can exercise control over browser-based cookies by adjusting the settings on your browser, and mobile devices may offer ad and data limitation choices. Our position on this may change if regulatory guidance or industry consensus leads us to a different conclusion, in which case we will update this Notice and our data practices.

We do not knowingly sell the PI of Consumers who are under 16 unless we receive an opt-in from the Consumer who is at least 13 but under 16, or from the parent or guardian of a Consumer younger than 13. Consumers who opt-in to PI sales may opt-out at any time. If you think we may have unknowingly collected the PI (for sale) of yourself or of your child under the age of 13, or if you are at least 13 but under 16, exercising the opt-out will stop our selling of the PI.

We may disclose your PI for the following purposes, which are not a sale: (i) if you direct us to share PI; (ii) to comply with your requests under the CCPA; (iii) disclosures with client companies or amongst the entities that constitute Company as defined above, or as part of a merger or asset sale; and (iv) as otherwise required or permitted by applicable law.

Delete

Except to the extent we have a basis for retention under CCPA, you may request that we delete your PI that we have collected directly from you and are maintaining. Our retention rights include, without limitation, to complete transactions and service you have requested or that are reasonably anticipated, for security purposes, for legitimate internal business purposes, including maintaining business records, to comply with law, to exercise or defend legal claims, and to cooperate with law enforcement.  Note also that we are not required to delete your PI that we did not collect directly from you. To make a request, you may submit a form or call the ClearBalance Patient Experience Team at 1 (888) 334-4022.  For existing and former ClearBalance Program participants who submit requests through the online form, we will verify identity based on matching information you provided with information available in the ClearBalance system.  This could include, but is not limited to Social Security Number, mailing address, or date of birth.  For those consumers who were presented a credit offer through the ClearBalance Program, but did not accept the program, and who submit requests through the online form, we will verify identity based on matching information you provided with data we have maintained on you in our systems. This data could include, but is not limited to, Social Security Number, mailing address, or date of birth.  For requests received through calling the ClearBalance Patient Experience Team, we will follow the same procedures as above based on whether you are a current account holder or other individual. 

Non-Discrimination and Financial Incentive Programs

We will not discriminate against you in a manner prohibited by the CCPA because you exercise your CCPA rights.

ClearBalance Contact Information

If you have questions or concerns with respect to our privacy policies and practices you may submit a form or call the ClearBalance Patient Experience Team at 1 (888) 334-4022.

We will not discriminate against you in a manner prohibited by the CCPA because you exercise your CCPA rights.

AUTHORIZED AGENTS

If a Consumer chooses to submit a request through an authorized agent, ClearBalance requires the Consumer to:

• Provide the authorized agent written permission to submit a request, a copy of which must be submitted to us;
• Verify that instruction and their own identity directly with us.

If the authorized agent has a power of attorney issued under California Probate Code sections 4000 to 4465, then the written agreement is not necessary. In the absence of any of the two general conditions detailed above, the business will reject any request submitted through an agent.

In addition, the agent is subject to the verification standards applicable to the type of request(s) made.

EXCLUSIONS

Notwithstanding anything to the contrary, we may collect, use and disclose your PI as required or permitted by applicable law and this may override your CCPA rights. In addition, we need not honor any of your requests to the extent that doing so would infringe upon our or any other person or party’s rights or conflict with applicable law.