Effective Date: January 1, 2023
Last Reviewed/Revised on: January 1, 2023

Notice at Collection and Privacy Policy for California Residents

This California Notice at Collection and Privacy Policy (“CCPA Disclosure”) explains how Geozoning Inc. d/b/a HealthSherpa and its subsidiaries and affiliates (“HealthSherpa”, “us”, “our”, or “we”) collect, use, disclose, sell, share, and/or retain personal information (“Information Practices”) subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”). This CCPA Disclosure applies solely to California residents (“consumers” or “you”).

This CCPA Disclosure does not apply to any information we may collect and use about you that is governed by or held in conformity with the Health Insurance Portability and Accountability Act of 1996, as amended, including its implementing regulations (“HIPAA”).

Notice at Collection

The following notice identifies the categories of personal information to be collected from you and the purposes for which the personal information will be used, including whether that information is sold or shared.

Category	Purposes for Collection and Use	Sold to Third Parties or Shared with Third Parties for Cross-Context Behavioral Advertising
Identifiers: For example, real name, postal address, unique personal identifier, online identifier, IP address, email address, account name, Social Security number, employee number (when applicable), or other similar identifiers.	To fulfill or meet the reason for which the information is provided For our internal operation purposes For auditing relating to consumer transactions including ad impressions and compliance with regulations Fraud and security detection Debugging to identify and repair errors Short-term data use for the current interaction that is not used to build a profile Servicing transactions and accounts (e.g., customer service, maintaining and servicing accounts, customer verification, payment processing) and providing services on behalf of business or service provider (e.g., financing, advertising or marketing, analytics) To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of a bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred. Undertaking internal research for technological development and demonstration Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business. To share the personal information with service providers to carry out other business purposes	Yes
Personal Information Categories from Cal. Civ. Code § 1798.80(e): For example, name, signature, Social Security number, physical characteristics or description, address, telephone number, insurance policy number, employment, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.		No
Characteristics of CA or Federal Protected Classifications: For example, age, medical condition, physical or mental disability, and sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions) as necessary to request an insurance quote or enroll in insurance. You may also voluntarily disclose your race, color, ancestry, national origin, citizenship, religion or creed, marital status, veteran or military status, genetic information (including familial genetic information), and sexual orientation.		No
Commercial Information: For example, records of personal property, products or services purchased, obtained, or considered, [or other purchasing or consuming histories or tendencies].		No
Internet or Other Similar Network Activity: For example, browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement.		Yes
Surveillance Data: For example, call recordings or other audio, electronic, or visual monitoring or surveillance.		No

We do not collect: Biometric information, geolocation data, education information, professional or employment-related information, or profile data under this policy.

Sensitive Personal Information

We do not use or disclose the below sensitive personal information for purposes other than those business purposes specifically enumerated under CCPA. As a result, we do not offer a right to limit our use or disclosure of these categories of sensitive personal information.

Category	In the preceding 12 months this category was:		Business or Commercial Purpose for Collection & Disclosure	Categories of third parties to whom the information was disclosed
Category	Collected	Disclosed	Business or Commercial Purpose for Collection & Disclosure
Account log-in	☒	☐	To perform services or provide goods you request and reasonably expect from us To detect, prevent, and investigate security incidents involving your information To investigate or curtail malicious, fraudulent, or illegal actions directed at us and to prosecute those responsible To ensure the safety of you and others To enhance your experience on our website in real time, so long as we do not disclose your information to a third party To perform services for our business needs such as maintaining accounts, providing customer service, and fulfill orders To ensure the quality or safety of a product, service, or device	Not applicable

We do not collect: Social Security number, driver’s license, state identification card, or passport number; precise geolocation; contents of a consumer’s mail, email, and text messages (unless we are the intended recipient of the communication); genetic data; biometric information for the purpose of unique identification; health information; information concerning sex life or sexual orientation; or racial or ethnic origin, religious or philosophical beliefs, or union membership.

The categories identified as collected in the tables above were collected from the following categories of sources:

You directly

Your Right to Know

You have the right to request any of the following:

the categories of personal information we have collected about you
the categories of sources from which the personal information is collected
the business or commercial purpose for collecting, selling, or sharing with third parties for cross context behavioral advertising (e.g. targeted advertising)
the categories of third parties to whom we disclose personal information
the specific pieces of personal information we have collected about you
You can do this through a verified consumer request. That process is described below in the section, “Submitting a Verified Consumer Request.”

What We Sell to Third Parties or Share with Third Parties for Cross-Context Behavioral Advertising and Right to Opt-Out

We have sold to third parties or shared with third parties for cross-context behavioral advertising personal information in the preceding 12 months as disclosed in the table below. We have not sold or shared and do not sell or share your sensitive personal information.

General Personal Information

Categories sold to or shared with third parties over the last 12 months	Categories of third parties to whom this category of personal information has been sold or shared
Internet or Other Similar Network Activity	Social media companies and advertising partners Web analytics providers

The purpose of the notice of Right to Opt-Out is to inform you that as a California resident, you have the right to direct us to stop selling or sharing your personal information, which is called the “Right to Opt-Out.” We do not have actual knowledge that we sell the personal information of minors under 16 years of age.

You may exercise your Right to Opt-Out by: (1) Clicking the “Do Not Sell or Share My Personal Information” link to use the interactive form, (2) submitting your request through an opt-out preference signal (described further in the section titled “Opt-Out Preference Signals”).

Your Right to Request Correction of Inaccurate Personal Information

You have the right to request correction of inaccurate personal information maintained by us. We may request documentation from you to determine the accuracy of the information. If you provide us documentation either upon our request or through your own initiative, that documentation will only be used for the purpose of correcting your personal information and complying with our recordkeeping requirements. We may deny your request if we have previously denied your same request to correct an alleged inaccuracy in the past six (6) months, unless you provide new or additional documentation that the information at issue is inaccurate.

As an alternative to correction, we may delete the inaccurate information if it does not negatively impact you or if you consent to this deletion. We reserve the right to deny this request if allowed under law, or if we determine that the contested information is more likely than not accurate, based on the totality of circumstances. You can submit a correction request through a verified consumer request. That process is described below in the section, “Submitting a Verified Consumer Request.”

Your Right to Request Deletion of Your Personal Information

You have the right to request that we delete any of your personal information collected by us, subject to certain exceptions. You can do this through a verified consumer request. That process is described below in the section, “Submitting a Verified Consumer Request.”

There may be scenarios where we deny your deletion request. If that occurs, we will provide you with an explanation as to why we could not delete all or some of your personal information.

Submitting a Verified Consumer Request

You have the right to submit verified consumer requests to know information, to correct information, or for deletion.

The response to a request to know will provide all personal information collected and maintained about you since January 1, 2022, unless doing so proves impossible or would involve disproportionate effort. Please note that we are not required to provide personal information to you more than twice in a 12-month period. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

You can submit a verified consumer request through any of the below methods:

Emailing us at customer_support@healthsherpa.com
Calling us at (855) 772-2663

Submitting a request via phone or email will require you to provide your name, email address, and phone number. If we are unable to verify your identity, we may ask you to provide additional information necessary to verify your identity.

If you submit a request that is not through one of these designated methods or is deficient in some manner unrelated to verification, we will provide you with information on how to submit the request or remedy any deficiencies.

Your request will be verified by matching the information you provide to information that we have collected. This process may include verifying your request through your email address on record, calling you on your phone number on record (which may include the use of an automated dialer), sending you a text message and requesting that you text us a confirmation, or sending you a confirmation through US mail.

Once we receive your verifiable consumer request, we will confirm receipt of the request within 10 business days describing our verification process. We will respond to your request within 45 calendar days, if we are able to verify your identity. Requests for deletion will require a separate confirmation that you want your information deleted.

Requests to Know or Delete for Child Under the Age of 13: We do not knowingly collect information of minors under the age of 13.

Using an Authorized Agent to Submit a Request

Only you, or a natural person or a business entity registered with the Secretary of State to conduct business in California that you have authorized to act on your behalf, may make a verifiable consumer request related to your personal information, to opt-out of sale or sharing, or to limit the use or disclosure of your sensitive personal information. You may also make a verifiable consumer request or request to opt-out/limit on behalf of your minor child. If you use an authorized agent, you may provide a power of attorney executed pursuant to California Probate Code sections 4000 to 4465. If a power of attorney that meets those provisions is not submitted, you will be required to provide the authorized agent signed permission to submit a request, verify your identity directly with us, and directly confirm with us that you provided the authorized agent permission to submit the request. An authorized agent can submit a request on a consumer’s behalf through any of the below methods:

Emailing us at customer_support@healthsherpa.com
Calling us at (855) 772-2663

Opt-Out Preference Signals

Our use of tracking technologies may be considered a sale/sharing under California law. You can opt-out of being tracked by these third parties by clicking the cookie icon in the bottom left of your screen. After doing so, a side bar will open where you can choose to end tracking. Your request to opt-out of sale/sharing will be linked to your browser identifier only and not linked to any account information because the connection between your browser and the account is not known to us. Because the signal is browser-specific, you will need to broadcast subsequent signals if you are accessing our website through different online devices (e.g., computers, smartphones, tablets).

Your Right to Non-Discrimination for the Exercise of a Privacy Right

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

Deny you goods or services.
Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
Provide you a different level or quality of goods or services.
Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
Retaliate against you, as an employee, applicant for employment, or independent contractor.

Changes to Our CCPA Disclosure

We reserve the right to amend this CCPA Disclosure at our discretion and at any time. When we make changes to this CCPA Disclosure, we will post the updated notice on the Website and update the notice’s effective date. Your continued use of our Website following the posting of changes constitutes your acceptance of such changes.

Contact for More Information

If you have any questions or comments about this notice, the ways in which we collect and use your information, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us via phone at (855) 772-2663, via email to customer_support@healthsherpa.com, or write to us at:

HealthSherpa
Attn: Legal Department
PO Box 1739
Sacramento, CA, 95812