California Consumer Privacy Act Notice

The chart above reflects those categories of PI required to be addressed by the CCPA. There may be additional information that we collect that meets the CCPA’s definition of PI but is not reflected by a category, in which case we will treat it as PI as required by the CCPA but will not include it when we are required to describe our practices by category of PI.

As permitted by applicable law, we do not treat de-identified data or aggregate Consumer information as PI, and we reserve the right to convert, or permit others to convert, your PI into de-identified data or aggregate Consumer information and may elect not to treat publicly available information as PI. We have no obligation to re-identify information or keep it longer than we need it to respond to your requests.

Purposes for PI Collection:

• Performing services: (§1798.140(d)(5))
• Managing interactions and transactions: (§1798.140(d)(1))
• Security: (§1798.140(d)(2))
• Debugging to repair errors: (§1798.140(d)(3))
• Processing interactions and transactions: (§1798.140(d)(4))
• Quality/safety maintenance: (§1798.140(d)(7))

Additional business purposes include i.) sharing PI with third parties for purposes other than a sale, or ii) one of the foregoing business purposes as required or permitted by applicable law (such as to the vendors that perform services for us, to the government or private parties to comply with law or legal process, and to the Consumer or other parties at the Consumer’s request) (“Other Business Purposes”).

Subject to restrictions and obligations of the CCPA, our vendors may also use your PI for some or all of the above-listed business purposes. Our vendors may themselves engage services providers or subcontractors to enable them to perform services for us, which sub-processing is, for purposes of certainty, other Business Purposes for which we are providing you notice.

Do We Sell Any of Your Personal Information?
A common understanding of “selling” information involves a company taking information it has learned about you and exchanging that information with an unrelated third party for money, who will then use that data for a new purpose you did not intend. CCFH never does this with your information.

We use our users’ information to help people seek treatment at one of our centers. However, the CCPA has a much broader definition of “sell” than this, which encompasses activities beyond the traditional common understanding of “selling” for money, such as disclosing, disseminating, making available, transferring, or otherwise communicating by electronic or other means, a consumer’s personal information. CCFH strives to live up to the law, and your wishes, as it relates to this right.

• We don’t sell data to data brokers.
• We don’t exchange information about you with a third party for money

2. California Privacy Rights

If you are a California resident, you have the following rights in relation to the categories of PI described above, as provided under California law:

Subject to legal limitations, certain California residents have the following rights:

• Right to Know. You have the right to request information about the categories of PI we have collected about you, the categories of sources from which we collected your PI, the purposes for collecting your PI, the categories of third parties with whom we have shared your PI, and the purpose for which we shared your PI (“Categories Report”). You may also request information about the specific pieces of PI we have collected about you (“Specific Pieces Report”).
• Right, to Delete. You have the right to request that we delete the PI we collected from you.
• Right to Opt-Out (Do Not Sell My Personal Information). We do not “sell” PI as such a term is defined under the CCPA.

a. How to Submit a Request
To exercise your right to know or your right to delete, please email us at info@cancercenterforhealing.com and include “Request under CCPA” in the subject line or call us toll-free at (949) 680-1880 and clearly state your name, contact information, and nature of your inquiry.

We recommend making your request by email to ensure we accurately capture your contact details and other information. Please include the following in your request:

• Your full name and address
• Former names (if applicable)
• Former addresses (including dates of change) (if applicable)
• Contact information (phone number or email address)
• Your relationship to us (e.g., former or existing patient)
• Type of request that you are making (e.g., Categories Report, Specific Pieces Report).

We will typically not charge a fee to respond to your requests fully; however, we may charge a reasonable fee or refuse to act upon a request if your request is excessive, repetitive, unfounded, or overly burdensome. If we determine that the request warrants a fee or that we may refuse it, we will give you notice explaining why we made that decision. You will be provided a cost estimate and the opportunity to accept such fees before we charge you for responding to your request. There may also be reasons to limit our response to your request. For instance, retention exceptions may limit a right to delete. If so, we will explain the retention purposes and limit our use to those purposes only so long as the retention purpose continues. Consistent with the CCPA’s requirements, to protect your security, we will not deliver certain high-risk PI like your social security number to you, but we will describe the PI types not provided for that reason. We also will not provide PI where disclosure would infringe on the rights or privileges of others. Whenever we limit a response for reasons the law permits, we will explain that in our response.

 b. Verification
For us to look into your request, we first need to verify your identity, meaning that we need to make sure that you are the Consumer we may have collected PI about or a person who has been duly authorized to request on behalf of the Consumer (“Verifiable Consumer Request”). We will not fulfill your Right to Know or Right to Delete request unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we collected PI.

Right to Know – Categories Request:
We are required to verify a Consumer’s request to know categories of PI to a reasonable degree of certainty, which may include matching at least two data points provided by the Consumer with data points maintained by us, which we have determined to be reliable to verify the Consumer. If we cannot verify you sufficiently to honor your request, we will refer you to Section 1 of this Notice for our categories disclosure regarding Consumers generally.

Right to Know – Specific Pieces Request:
We are required to verify a Consumer’s request to know specific pieces of PI to a reasonably high degree of certainty, which may include matching at least three data points provided by the Consumer with data points maintained by us, which we have determined to be reliable to verify the Consumer together with a signed declaration under penalty of perjury that the requestor is the Consumer whose PI is the subject of the request. If we cannot verify you sufficiently to honor your request, we will consider if you can be verified sufficiently to receive a Categories Report.

Right, to Delete Request:
We are required to verify a Consumer’s request to delete to a reasonable degree of certainty, which may include matching at least two data points provided by the Consumer with data points maintained by us, or to a reasonably high degree of certainty, which may include matching at least three data points provided by the Consumer with data points maintained by us, depending on the sensitivity of the PI and the risk of harm to the Consumer posed by unauthorized deletion.

Some PI we maintain about Consumers is not sufficiently associated with enough PI about the Consumer for us to be able to verify that it is a particular Consumer’s PI when a Consumer request that requires verification pursuant to the CCPA’s verification standards is made (e.g., clickstream data tied only to a pseudonymous browser ID). As required by the CCPA, we do not include that PI in response to those requests. If we cannot comply with a request, we will explain the reasons in our response. We will use the PI provided in a Verifiable Consumer Request only to verify your identity or authority to make the request and to track and document request responses unless you also gave it to us for another purpose.

Do not send us identification documents unless requested by us. In this case, they should be transmitted to us through the secure means of communication we specify or approve and should be photocopies or scanned images (do not send the originals).

c. Authorized Agents
Authorized agents may exercise rights on behalf of California Consumers, but we reserve the right also to verify the Consumer directly as described above. Authorized agents may email us at info@cancercenterforhealing.com to exercise rights on the Consumer’s behalf. We will require the agent to demonstrate authority to act on behalf of the Consumer by providing, for example, evidence of the agent’s identity and proof of registration with the California Secretary of State (if the agent is a business). At least one of the following evidencing proof of the agent’s legal authority to act on behalf of the individual Consumer:

• Presenting a Power of Attorney granted under the Probate Code that we can reasonably verify, or
• Signed permission by the Consumer. We may also require the Consumer to verify their identity directly with us and confirm that they provided the authorized agent permission to submit the request.

d. Timing
We will respond to requests to delete and demands to know within 45 calendar days unless we need more time, in which case we will notify you and may take up to 90 calendar days total to respond to your request.

e. Non-Discrimination
California residents cannot be discriminated against for exercising their rights under the CCPA. We will not discriminate against you in a manner prohibited by the CCPA because you exercise your CCPA rights.

f. Other California Privacy Rights
We do not share “personal information” subject to California Civil Code §1798.83 (the “Shine the Light law”) with third parties for the third party’s direct marketing purposes, absent your consent. If you are a California resident, you may request information about our compliance with the Shine the Light law by emailing us at info@cancercenterforhealing.com. Any such request must include “California Privacy Rights Request” in the first line of the description and include your name, street address, city, state, and ZIP code. Please note that we are only required to respond to one request per customer each year, and we are not required to respond to requests made by means other than through this email address.