California Consumer Privacy Act ("CCPA") Privacy Notice
This CCPA Privacy Notice for California Residents ("Notice") is provided to California residents in compliance with the California Consumer Privacy Act("CCPA"), as amended by the California Privacy Rights Act("CPRA") (collectively, "CCPA"). It explains your rights regarding your Personal Information and how we handle your Personal Information. Certain terms in this Notice are defined by the CCPA (CA Civil Code § 14, 1798.140) and their meanings may differ from the meanings applied elsewhere in this website. The meanings of such CCPA defined terms are specific to the content of this Notice.
The CCPA identifies 12 separate categories of Personal Information (Categories A through L). They are, as follows:
A: Identifiers (Examples include Real Name, Alias, Postal Address, Email Address) (CA Civil Code § 14, 1798.140 (v)(1)(A)).
B: California Customer Records Statute (Examples include Real Name, Alias, Postal Address, Email Address; Signature, Social Security Number (“SSN”), Telephone Number, Passport Number, Driver’s License (“DL”) or State Identification (“ID”) Card Number, Insurance Policy Number, Bank Account Number, or Any Other Financial Information, Medical Information, Health Insurance Information; Professional or Employment-Related Information) (CA Civil Code § 1798.80(e)).
C: Protected Classification Characteristics (Examples include Age, Marital Status, Medical Condition, Gender, Veteran or Military Status) (CA Civil Code §14, 1798.140 (v)(1)(C))
D: Commercial Information (Examples include Products Or Services Purchased, Consumer History) (CA Civil Code §14, 1798.140 (v)(1)(D)).
E. Biometric Information (Examples include Unique Physical Characteristics, Such as Fingerprints, That Can Be Used for Automated Recognition)(CA Civil Code §14, 1798.140 (c), CA Civil Code §14, 1798.140(c)).
F: Internet/Network Activity (Examples include Browsing And Search History, Usage Of, And Information Regarding Use of Applications or Website) (CA Civil Code §14, 1798.140 (v)(1)(F)).
G: Geolocation Data (Examples: City And State Location of Device, Which May Include GPS-Based, Wi-Fi Based, Or Cell-Based Location Information) (CA Civil Code §14, 1798.140 (v)(1)(G)).
H: Sensory Data (Examples: Audio Recordings of Calls When Calling Customer Service, And Internet and Electronic Network Activity (Consumer Notified at The Beginning of a Call Whether the Call Is Being Recorded) (CA Civil Code §14, 1798.140 (v)(1)(H))
I: Professional or Employment Data (Examples: Resume or Employment Application Information) (CA Civil Code §14, 1798.140 (v)(1)(I))
J: Non-Public Educational Data (Where Applicable, Student Information Related to Eligibility for Benefits) (CA Civ Code §14, 1798.140 (v)(1)(J)).
K: Inferences Drawn From Other Personal Information (Examples may include (1) Information Collected Via Website Visit, Using an App, or Interacting with Tools, Widgets or Plug-Ins; (2) Information Collected from Reimbursement Claims; or (3) Information About User Preferences or Behavior Collected on Website or Mobile App to Create a Profile About a User Reflecting the User’s Preferences, Characteristics, Predispositions, Behavior, or Abilities) (CA Civil Code §14, 1798.140 (v)(1)(K)).
L: Sensitive Personal Information (Examples may overlap with other Categories and may include such information as SSN; DL; State ID Card; Passport Number; Account Log-In; Financial Accounts; Debit Cards and Credit Card Numbers (in combination with any required security or access code, password, or credentials allowing account access); Precise Geolocation; Racial or Ethnic Origin; Religious or Philosophical Belief; Union Membership; Consumer Mail Contents; Recipient Text Messages; Consumer Genetic Data; Biometric Information (Either concerning Consumer’s Health; or Consumer’s Sex Life or Sexual Orientation) (CA Civil Code §14, 1798.140(ae)).
Of those 12 Personal Information Categories, Flow Health, currently and within the past 12 months, has collected Personal Information within Categories A (Identifiers); B (California Customer Records Statute); C (Protected Classification Characteristics); F (Internet or Network Activity); I (Professional and Employment Data); and L (Sensitive Information).
Among the exceptions to the CCPA, the CCPA does not apply to situations in which the HIPAA Privacy Rule otherwise applies to such Personal Information (CA Civil Code §15, 1798.145 (c)(1)). In this regard, Flow Health, as a Hybrid Entity, may treat or handle certain Personal Information as Protected Health Information under the HIPAA Privacy Rule.
We may collect Personal Information from the following categories of sources:
· You, whether in person, via e-mail, through one of our Websites, Mobile Applications, other Online Services by telephone or by way of written correspondence, when, among other things: you first provide it to us; inquire about the Services we offer and provide; create an Account with us; make requests that we receive, process, or fulfill on your behalf; reach out to customer support; receive testing or other clinical or other Services from us; directly or indirectly assist us to submit a claim for reimbursement; make payment or have questions, concerns, or issues with Services provided. The term, “you”, in the context of this section of the Notice includes any Personal Representative authorized under applicable law to make health care decisions about you.
· Your electronic device or browser when you visit or access one of our Websites, Mobile Applications, or Online Services, in which case, in addition to the Personal Information you directly provide, we may receive such other Personal Information, such as about your device, operating system, browser type, IP address, language settings, dates and times of connecting to or using one of our Websites, Mobile Applications, or Online Services.
· Your employer, educational institution, or other entity that may be sponsoring or arranging for Services to be provided to you, and that may be asking or requiring certain test results or information about you.
· Any health care provider may be disclosing your Personal Information in relation to the Services provided.
· From family, friends, close loved ones, or others who may be involved in your healthcare.
· Our affiliates and business partners.
· Data verification services.
How we may use your Personal Information includes the following uses and disclosures, based on our receiving appropriate level of consent and authorization from you:
· To fulfill or meet the reason for which your Personal Information is provided; To provide you with information about the Services provided or requested.
· For scheduling appointments for Services.
· To carry out billing and payment operations.
· To alert you about test results; To carry out and comply with contracts or agreements for providing Services to you.
· To communicate with you or authorized persons about the Services provided to you and the results of any tests; To operate, manage, and maintain our Business.
· To perform analytics to improve our Services; To answer your questions, concerns, or issues.
· To detect and protect against non-compliance or privacy or security incidents; To inform you about and carryout special programs, initiatives, or promotions.
· To comply with law enforcement, government agency, or court orders, requests, or requirements.
· To keep a record of our transactions and communications; and to comply with legal obligations.
· To protect the rights, property, or safety of us, you, and others; To report any adverse events or test results when the government mandates; and for De-Identified or Data Aggregated Reports.
· To offer or provide employee benefits and services.
· To protect our rights, property, and safety or the rights, property, and safety of others.
· Engage in a merger, acquisition, reorganization, or sale of all or a portion of Flow Health assets.
· Meet applicable laws, regulations, legal processes, or enforceable governmental requests.
· Enforce applicable Terms of Service, including investigation of potential violations.
· Detect, prevent, or otherwise address fraud, security, or technical issues.
· Protect against harm to the rights, property or safety of our users, McKesson, or the public as required or permitted by law.
We may share Personal Information we collect with you, as well as with: Vendors and service providers; Health Care Providers; Advertising networks, subject to your Authorization or de-identification; Our affiliates and business partners; and Law enforcement, where required by law. We may also share Personal Information with other companies, organizations, or individuals outside of Flow Health, if we have a good faith belief that access, use, preservation, or disclosure of that information is reasonably necessary to perform the services reasonably expected by you.
The following categories of your Personal Information may be shared with these parties for our business purposes:
California residents’ CCPA privacy rights:
Your CCPA Rights, in addition to being apprised of the contents of this Notice, include the following:
Right to Access Personal Information: Users may request access to the categories and specific pieces of their Personal Information we collect. (CA Civil Code §7, 1798.110).
Right to Data Portability: Users may request to receive their Personal Information, when provided electronically, in a readily useable format. (CA Civil Code §4, 1798.100).
Right to Deletion: Users can ask us to delete certain Personal Information we have collected (CA Civil Code §5, 1798.105). You can exercise your right to request deletion of Personal Information by clicking here.
Right to Disclosure: Users may request to receive additional information about the sources of information we collect, why we collect and share Personal Information, the information of theirs we collect, and the categories of parties with whom we share their information. (CA Civil Code §4, 1798.100).
Right to Opt-Out of Sales: We do not typically Sell or Share Personal Information such as to require the need for an “opt out”. However, as permitted by law, we reserve the right to share your Personal Information for monetary or other valuable consideration (a “sale”); but you may direct us to not sell your Personal Information (CA Civil Code §9, 1798.120).
Users may opt to limit the use or disclosure of your Sensitive Personal Information as defined in Category L. Sensitive Personal Information that is not collected for the purpose of inferring a consumer’s characteristic is not subject to this option to limit use or disclosure and is treated as Personal Information (CA Civil Code, § 10,1798.121(d)). Sensitive Personal Information that is ‘publicly available’ (CA Civil Code, § 14, 1798.140(v)(2)) shall not be considered Sensitive Personal Information or Personal Information. (CA Civil Code §14, 1798.140(ae(2)).
Right to be free from discrimination: Users may freely exercise these rights without fear of being denied goods or services (CA Civil Code §11, 1798.125). We may, however, provide a different level of service or charge a different rate reasonably relating to the value of your data.
If you are a California resident and would like to exercise one of your rights, please contact us by e-mailing us at privacy@flowhealth.com or calling 323.905.0125 (TTY/TDD users should call 711);. In compliance with CCPA we will require certain identifying information from you to verify your request. We will honor your request incompliance with CCPA but may be required to continue to retain or share portions of your Personal Information to comply with regulatory or legal obligations.
