CCPA Privacy Notice

Last Updated: December 20, 2023

This California privacy notice sets out how Rightway Healthcare, Inc. (“Rightway,” “we,” “us,” or “our”) collects and uses personal information about you in compliance with our obligations under the California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act of 2020 (“CPRA”). This Notice supplements our primary privacy practices solely for California consumers and employees (collectively, “Consumers,” “you,” or “your”).

Any terms in initial capital letters that are not defined in this California privacy notice shall have the meaning given to such terms in our Privacy Policy found here. If a term in initial capital letters is not defined in either this California privacy notice or our Privacy Policy, then such term will have the meaning given to the term in the CCPA, as amended by CPRA. In the event of any conflict between this California privacy notice and the rest of our Privacy Policy, this California privacy notice shall control only with respect to Consumers and their personal information. If you are located elsewhere, please see our Privacy Policy here.

Your California Privacy Rights

The CCPA, as amended by CPRA, provides California Consumers with certain privacy rights, which include:

The right to know what personal information we collect, including the categories of personal information the categories, of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom the business discloses personal information, and the specific pieces of personal information the business has collected.

• The right to access your personal information.

• The right to correct inaccurate personal information.

• The right to request that we delete your personal information, subject to certain exceptions.

• The right to know what categories of personal information are sold or shared with third parties and to opt out of that sale.

• The right not to receive discriminatory treatment for the exercise of privacy rights.

Exercising Your Rights

To exercise any of your rights described in this California privacy notice, please submit a request to us by either emailing us at info@rightwayhealthcare.com or calling us at (305) 851-7310.

Please note that you may only make a CCPA or CPRA-related request twice within a 12-month period. Please also note that we may charge a reasonable fee or refuse to act on a request if such request is excessive, repetitive, or unfounded.

If you choose to contact us directly by email or by phone, we are required to verify your identity, and you may need to provide us with one or more of the following items:

• Enough information to identify you (e.g., your account number, your login identifier, your full name, address, social security number, or other reference number);

• Proof of your identity and address (e.g., verbal verification, a copy of your driving license or passport and a recent utility or credit card bill); or

• A description of what right you want to exercise and the information to which your request relates.

We are not obligated to make a data access or data portability disclosure if we cannot verify the person making the request is the person about whom we collected information, or is someone authorized to act on such person’s behalf. Any personal information we collect from you to verify your identity in connection with your request will be used solely for the purposes of verification.

Correction of Personal Information

If we maintain inaccurate personal information about you, you have the right to request that we correct the inaccurate personal information. Upon receipt of a verifiable request from you, we will use commercially reasonable efforts to correct the inaccurate personal information. Please note, however, that if we collected or received personal information about you from (or on behalf of) your employer (either under a contract with your employer or in connection with providing services for your employer), then we may be required to submit your correction request to your employer for approval, action, and response (because our service guidelines may prohibit us from changing your employment information without your employer’s approval). If you desire to correct or change any personal information related to your employment or your employee benefits, we recommend you contact your employer first (rather than using Rightway’ s correction procedure).

Deletion of Personal Information

Subject to certain exceptions listed below, on receipt of a verifiable request from you, we will delete your information as follows:

• Delete your personal information from our records.

• Direct any service providers to delete your personal information from their records.

• Direct third parties with whom we have shared your personal information to delete your personal information unless this proves impossible or involves disproportionate effort.

If we collected or received your personal information from or on behalf of your employer (either under a contract with your employer or in connection with providing services for your employer), then we are frequently required to submit your deletion request to your employer for approval, action, and response (because our service guidelines may prohibit us from deleting your employment information without your employer’s approval). If you desire to delete any personal information related to your employment or your employee benefits, we encourage you to contact your employer first (rather than using Rightway’s deletion procedure).

Finally, please note that we may not delete your personal information if it is reasonably necessary for Rightway to:

1. Complete the transaction for which the personal information was collected, provide a good or service requested by you or by your employer, perform a contract between Rightway and you, or perform a contract between Rightway and your employer;

2. Ensure the security and integrity of your personal information;

3. Debug to identify and repair errors that impair existing intended functionality;

4. Comply with the California Electronic Communications Privacy Act;

5. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable California and federal ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the achievement of such research, (provided we previously obtained your informed consent);

6. Comply with legal or contractual obligations owed to any third-party who engaged us to provide services for you (this is typically your employer or former employer, but it may also be other third-parties who engaged us to provide you with our services);

7. Comply with an existing legal obligation, or exercise any rights provided for by law; or

8. Otherwise use your personal information, internally, in a lawful manner that is compatible with the context in which you provided the information.

Personal Information We May Collect

The following shows categories of personal information and sensitive personal information that we may have collected, the sources of such information, and the business or commercial purposes for which we may use and disclose such information. For all categories of personal information collected, we disclose data to our service providers and other third parties to help us accomplish the business purposes described below, as set out in more detail here. We do not process any sensitive personal information (as defined by California law) for the purpose of inferring characteristics about you. We do not sell your personal information.

Purposes for Collecting Personal Information

To support your relationship with Rightway, or your use of our services, we may have collected and disclosed information within the past 12 months for the following purposes:

Consumer Information: Rightway may collect personal information from Consumers for the following purposes:

1. Account activation and utilization

2. Account administration

3. Customer support and feedback

4. Marketing and promotion of Rightway products and services

Employee Information: Rightway may collect personal information from employees (and applicants for employment) for the following purposes:

1. Workforce planning

2. Recruiting, hiring, and onboarding

3. Performing background or credit checks

4. Implementing diversity and inclusion initiatives

5. Increasing employee engagement

6. Training and career development

7. Assessing performance

8. Determining promotions, transfers, salary, awards, and bonuses

9. Managing disciplinary matters

10. Managing payroll and business expenses

11. Administering leave requests

12. Employee communications

13. Administration of benefits

14. Promoting employee health and safety

Consumer and Employee Information: For both Consumers and employees (or applicants for employment), Rightway may collect personal information for the following internal purposes:

1. Conducting business operations:

   1. Budgeting

   2. Recordkeeping and reporting requirements

   3. Managing infrastructure and company assets

   4. Strategic planning

   5. Maintaining security

   6. Emergency response and business continuity

   7. Conducting audits

   8. Pursuing or defending legal or administrative claims

2. Monitoring:

   1. Compliance with internal policies and procedures

   2. Any other monitoring activities permitted by applicable laws

3. Compliance with:

   1. Legal and regulatory obligations

   2. Court or other government directives

   3. Internal policies and procedures

4. Investigating:

   1. Reports of wrongdoing

   2. Policy violations

   3. Internal complaints

Categories of Personal Information Collected

1. Identifiers: Name, alias, postal address, email address, account name, social security number, driver’s license number, passport number, account login identifier, employer identifier, insurance policy identifier, internet protocol address, or other similar identifiers.

2. Personal information as defined in Customer Records law: Name, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, medical information, or health insurance information.

3. Information about protected classifications under California or federal law: race, religion, national origin, age, sex, sexual orientation, pregnancy, familial status, disability, military or veteran status, and genetic information.

4. Internet or other electronic network activity: information such as browsing history, search history, and information regarding your interaction with our websites and applications.

5. Geolocation data.

6. Professional or employment-related information: work history, prior employer, information, qualifications, skills and experience, human resources data, emergency contact information, and data necessary for benefits and related administrative services.

7. Education information: we may collect information that is not “publicly available personally identifiable information” as defined in the Family Educational Rights and Privacy Act (FERPA).

Sources and Disclosures

We may collect Personal Information directly from you, from your employer (if we have been engaged to provide services for or on behalf of your employer), from your interactions with Rightway, including without limitation our website, our customer service representatives, and our personnel, and from selected partners.

We may share your personal information with third parties including third-party service providers, employee benefit plan administrators, insurance carriers (for medical or other benefit plans), regulatory bodies, and under valid court orders. We may also share personal information when we believe that disclosure is necessary or appropriate to prevent physical harm or financial loss in connection with an investigation of suspected or actual illegal activity. We reserve the right to transfer any information we have about you in the event we sell or transfer all or a portion of our business or assets. Should such a sale or transfer occur, we will use reasonable efforts to direct the transferee to use the personal information you have provided through this Site in a manner that is consistent with this Privacy Policy.

Data Retention

We will only retain your personal information for as long as necessary to fulfill the purposes for which it was collected, including for the purposes of satisfying any legal, regulatory accounting, or reporting requirements. If Rightway has been engaged to provide services for you on behalf of your employer, we may also retain your personal information as required to meet our contractual obligations with such employer.

Contacting Us

If you have any questions regarding our privacy practices as it relates to this California privacy notice, please contact us via email at info@rightwayhealthcare.com with the subject line, “California privacy notice.”