CSSi Supplemental Privacy Policy

Purpose

This US Supplemental Privacy Notice (“Supplemental Notice”) pertains solely to information collected from residents of certain US states, including California, Colorado, Virginia, Utah, Connecticut, Washington, and Nevada. It serves to provide information mandated under various state privacy laws, such as:

- - - - California Consumer Privacy Act of 2018 and California Privacy Rights Act of 2020 (collectively, the “CCPA”)
      - Colorado Privacy Act of 2021 (the “CPA”)
      - Connecticut Data Privacy Act (“CDPA”)
      - Utah Consumer Privacy Act of 2022 (the “UCPA”)
      - Virginia Consumer Data Protection Act of 2021 (the “VCDPA”)
      - Washington My Health My Data Law (the “WMHMDL”)
      - Chapter 603A of the Nevada Revised Statutes (the “NRS”)
      - Nevada’s Consumer Health Data Privacy Law (the “NCHDP”)

This Supplemental Notice is an integral part of CSSi’s Privacy Policy, providing additional information tailored to consumers in specific states.

Personal Information We Collect

In the preceding twelve (12) months before the “last reviewed” date of this Notice, CSSi has collected the following categories of Personal Information:

- - - - Identifiers: This includes but is not limited to names, initials, patient IDs, online identifiers, physical characteristics or descriptions, dates of birth, IP addresses, or device IDs.
      - Contact information: Such as phone numbers, addresses, and email addresses.
      - Characteristics of protected classifications under state or federal law: This category may encompass age, gender, race, physical or mental health conditions, disability, sex, and marital status.
      - Biometric information.
      - Internet or electronic network activity information: This pertains to interactions with CSSi’s websites or advertisements.
      - Audio, visual, and similar information: Including call and video recordings.
      - Professional or employment-related information: Which may include specialty, educational history, professional qualifications, work history, and previous employers.
      - Sensitive personal information: Covering precise geolocation, racial or ethnic origin, personal information concerning health, sex life, or sexual orientation, as well as login credentials and passwords.

Retention of Personal Information: CSSi retains Personal Information for a duration reasonably necessary to provide services and support operational purposes.

Sources of Personal Information

CSSi collects the aforementioned categories of Personal Information from various sources, including:

- - - - Directly from individuals: When information is provided to CSSi.
      - Indirectly from individuals: Such as when CSSi automatically collects technical and usage information (e.g., cookies), or when caregivers, healthcare professionals, or clients provide information per individual consent.
      - Public sources.

Purposes for which We Collect and Use Personal Information

CSSi may utilize the Personal Information enumerated above for the subsequent business and commercial purposes:

- - - - To provide clinical trial services to clients, including maintaining and updating information for accuracy.
      - To respond to inquiries from individuals.
      - To provide, support, personalize, and develop CSSi’s websites, applications, and product or service offerings.
      - To prevent malicious, deceptive, fraudulent, or illegal activity, and to participate in any prosecution or enforcement of laws or agreements meant to prevent or punish such activity.
      - For internal operational uses such as research, analytics, development, audits, and security.
      - For legal and operational compliance purposes, including monitoring operational effectiveness in implementing privacy policies.
      - To evaluate or conduct mergers, divestitures, restructurings, reorganizations, dissolutions, or other sales or transfers of some or all CSSi’s assets.
      - To engage in or enable internal uses consistent with CSSi’s relationship with individuals or compatible with the context in which the information was provided.

CSSi uses Sensitive Personal Information solely to provide services and does not utilize or disclose it for any other purposes.

Sharing of Personal Information

CSSi may share Personal Information with the subsequent categories of third parties:

- - - - CSSi’s affiliated companies.
      - Service providers: Only to the extent necessary for them to perform their services.
      - Clinical trial sites and sponsors.
      - Other third parties to protect CSSi’s legal rights or comply with legal requirements.
      - Other third parties to update and/or confirm their contact lists.
      - Other third parties as required by law, such as to comply with subpoenas or other legal processes, protect CSSi’s rights, or respond to governmental requests.
      - Other third parties involved in mergers, sales, joint ventures, or other transactions involving a transfer of CSSi’s business or assets.
      - Other third parties with individual consent.

Sales of Personal Information

CSSi does not engage in “selling” or “sharing” Personal Information for cross-contextual behavioral advertising. While CSSi does not sell or share Personal Information with third parties in exchange for monetary consideration, certain Personal Information may have been shared with customers for monetary consideration in the preceding 12 months, potentially classified as a “sale” under applicable local law.

Your Rights and Choices with Respect to Personal Information

Residents of California, Colorado, Virginia, Utah, Connecticut, Washington, and Nevada possess specific rights regarding the collection and use of their Personal Information. These rights vary by state. As mandated by relevant laws, CSSi provides detailed information regarding data subject rights available to consumers in these states.

Access and Data Portability Rights: Consumers may request, up to twice every 12 months, a copy of specific pieces of personal data collected, used, or disclosed about them in the prior 12 months. This information can be delivered, free of charge, either by mail or electronically in a portable and readily usable format.

Correction: Consumers may request correction of their Personal Information if it is inaccurate or incomplete.

Deletion: Consumers may request deletion of their Personal Information, subject to certain exceptions.

Right to Opt Out of Sharing, Disclosure, or Sale of Personal Information: Consumers have the right to direct CSSi not to share, disclose, or sell their Personal Information.

Right to Non-Discrimination: Consumers have the right not to be discriminated against for exercising their data subject rights.

Right to Restrict or Limit the Use of Sensitive Personal Information: Consumers have the right to restrict the use and disclosure of Sensitive Personal Information to certain purposes related to the offering of goods or services.

Exercising Your Rights

To exercise rights described above, individuals may submit a verifiable consumer request to CSSi via email. CSSi may request information to verify the identity of the requester and will respond consistent with applicable law.

Changes to this Supplemental Notice

CSSi reserves the right to amend this Supplemental Notice at its discretion. Changes will be posted on CSSi’s website.

- - - - California Consumer Privacy Act of 2018 and California Privacy Rights Act of 2020 (collectively, the “CCPA”)
      - Colorado Privacy Act of 2021 (the “CPA”)
      - Connecticut Data Privacy Act (“CDPA”)
      - Utah Consumer Privacy Act of 2022 (the “UCPA”)
      - Virginia Consumer Data Protection Act of 2021 (the “VCDPA”)
      - Washington My Health My Data Law (the “WMHMDL”)
      - Chapter 603A of the Nevada Revised Statutes (the “NRS”)
      - Nevada’s Consumer Health Data Privacy Law (the “NCHDP”)