This California Privacy Notice section applies solely to individuals who reside in the State of California (“consumers” in this section). It describes how we collect, use, and disclose Personal Information of California consumers, and the rights those consumers have under the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020, and other California privacy laws.

Personal Information Definition (California): For purposes of this Section 11, and except where a different definition is noted, “Personal Information” has the meaning given in the CCPA. In general, it includes information that identifies, relates to, describes, or could reasonably be linked with a particular California resident or household. It does not include Publicly Available Information (as defined above), de-identified or aggregated information, or information excluded from the CCPA’s scope (such as protected health information governed by HIPAA, or personal information regulated by certain other federal laws).

If you have a disability or require information in an alternative format, or if you need assistance in a language other than English, you may exercise your California privacy rights by emailing us at privacy@alyze.health and indicating your accessibility needs.

a. Categories of Personal Information Collected (Last 12 Months):
We have collected the following categories of Personal Information about California consumers in the twelve (12) months preceding the Effective Date of this Privacy Policy:

• Identifiers (such as real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, telephone number, account username, or other similar identifiers).
  
• Commercial information (such as records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies relevant to our Services).
  
• Financial information (such as payment card information or other financial account details provided when you purchase our Services).
  
• Internet or other electronic network activity information (such as browsing history, search history, and information on a consumer’s interaction with our Site, App, or advertisements).
  
• Geolocation data (general location information inferred from IP address, or precise location if you have enabled it on our App).
  
• Professional or employment-related information (if you engage with any corporate programs or provide employment info for wellness benefits, as described above).
  
• Audio, electronic, visual, or similar information (such as photographs or videos you share, or recordings of calls if customer service calls are recorded with your consent, etc.).
  
• Characteristics of protected classifications under California or federal law (such as age, gender, etc., that you may provide to us, for example in a health intake form or membership registration).
  
• Inferences drawn from the above (such as profiles reflecting preferences or characteristics).
  

We may also collect information that is considered “Sensitive Personal Information” under California law. In the last 12 months, this may include: your account login credentials (in combination with a password or security code); payment information (payment card number along with any required security code); contents of communications with us (for example, if you send messages with personal content through our Services); information concerning your health or medical condition (for instance, information you provide about your health status, medical history, or wellness goals); and precise geolocation data (if enabled).

b. Purposes for Collecting or Using Personal Information:
We collect and use the Personal Information we collect about California consumers for the following business or commercial purposes (some of which are also described in detail in Sections 1 and 3 above):

• To contact you and provide you with information or respond to your inquiries.
  
• To provide customer service and support.
  
• To verify your identity and age (for example, to ensure you are eligible to use the Services).
  
• To provide and maintain the Site and Services (including to create, maintain, and service your account; to process payments or orders; to fulfill requests; and to operate features of our platform).
  
• To facilitate interactive features (such as community forums, challenges, or referrals).
  
• For internal analytics and research to understand how our users interact with the Services and to improve our offerings.
  
• To market our own products and Services directly to you (such as sending promotional communications or offers we think may interest you).
  
• To market the products and services of others directly to you (for example, to send you special offers from our selected partners, if you have not opted out).
  
• To organize or administer promotions, contests, or sweepstakes that you enter.
  
• For internal business purposes, such as maintaining business records, conducting audits, detecting security incidents, debugging and fixing errors, and generally managing and operating our business.
  
• To develop new products or services (for example, by analyzing usage patterns or feedback to inform product development).
  
• To comply with legal, regulatory, or contractual obligations and requirements. (This includes using Personal Information as necessary to respond to law enforcement requests, meet obligations to our insurance or medical partners, or fulfill reporting requirements.)
  
• To investigate and prevent fraud, spam, misuse of our Services, or other harmful or unlawful activities.
  
• To ensure the security and integrity of our systems and data (including detecting and responding to security incidents).
  
• To protect the safety, rights, or property of our employees, customers, or others.
  
• For targeted advertising (i.e., showing you ads we think you’ll be interested in, based on information such as your browsing behavior or interests).
  
• For profiling in furtherance of the above purposes (for example, segmenting users into groups based on characteristics or preferences to better customize content or offers).
  
• For any other purpose with your consent (if we ask for consent for a specific use not otherwise listed here).
  

c. Sources of Personal Information (Categories):
We collect the above-mentioned categories of Personal Information from the following sources:

• Directly from you – e.g., when you provide information during account sign-up, fill out forms, use interactive features, or communicate with us.
  
• From our corporate affiliates – e.g., if we have related companies helping to provide the Services, they may share data with us as needed.
  
• Through Cookies and tracking tech – e.g., via your interactions with our Site as described in Section 5 (which may collect device and browsing info).
  
• Through linked devices or apps – e.g., if you choose to connect a fitness tracker or other device to our Services in the future (not applicable if you do not do so).
  
• From our Lab and Provider Partners – e.g., if we coordinate with a lab or clinic for your services, they may send us your test results or appointment information (with your permission).
  
• From other third parties – e.g., marketing partners, analytics providers, or social media platforms as described earlier.
  
• From public sources – e.g., public databases or government records, if we verify addresses or licenses.
  

We may combine information from these sources with information we already have about you to ensure our records are accurate and complete.

d. Disclosure of Personal Information (Categories of Recipients):
In the preceding 12 months, we have disclosed (or may have disclosed) the above categories of Personal Information to third parties for one or more business purposes, as described in Section 3 of this Privacy Policy. The categories of third parties to whom we disclose Personal Information (for business or commercial purposes) include:

• Our service providers and contractors (companies that process information on our behalf for functions like payment processing, data hosting, analytics, customer support, etc.).
  
• Our affiliates (within our corporate family).
  
• Advertising partners and analytics providers (to the extent they provide services to us, as described in Section 3, and subject to the limitations noted about not sharing health data without consent).
  
• Professional advisors (lawyers, accountants, insurance providers, etc., as needed for business operations or in the event of disputes).
  
• Government entities, law enforcement, or other parties as required by law or to protect rights (for legal compliance and safety reasons).
  
• Entities involved in business transfers (if there is a merger or acquisition as described above).
  
• Other individuals or entities at your direction (for example, if you instruct us to share data with a third party or make information public).
  

We have not sold Personal Information to third parties for monetary compensation. However, as explained above, we do allow certain third-party Cookies on our website which might be considered a “sale” or “sharing” of Personal Information (specifically, device identifiers and browsing activity) under the CCPA’s broad definitions. In the last 12 months, we may have “sold” or “shared” the following categories of Personal Information for advertising or analytics purposes (as those terms are defined under California law): Identifiers, Commercial Information, and Internet or Electronic Network Activity. This “sale”/“sharing” occurs through the use of third-party Cookies and similar technologies for advertising analytics.

Importantly, we do not and will not sell or share your sensitive personal information, such as any health or medical information, without your express affirmative consent. In fact, we do not disclose any of your Consumer Health Data (including any Self-Reported Health Information or similar data) to third parties for their own marketing or advertising purposes.

e. Your California Privacy Rights:
If you are a California resident, you may have the following rights with respect to your Personal Information, subject to certain exceptions:

• Right to Know/Access: You have the right to request that we disclose to you the specific pieces and categories of Personal Information we have collected about you in the past 12 months, the categories of sources of that information, the business or commercial purposes for collecting (or selling/sharing, if applicable) the information, and the categories of third parties with whom we have disclosed your information. You may request this information up to twice in a 12-month period, free of charge.
  
• Right to Delete: You have the right to request that we delete Personal Information we collected from you and retained, subject to certain exceptions (for example, we may need to retain some data to complete a transaction you initiated, to detect security incidents, for legal compliance, etc.). If we are able to verify your request and no exception applies, we will delete (and instruct our service providers to delete) your Personal Information from our records.
  
• Right to Correct: You have the right to request the correction of any inaccurate Personal Information that we maintain about you. Upon verifying the validity of a correction request, we will use commercially reasonable efforts to correct the inaccuracy.
  
• Right to Opt-Out of Sale/Sharing: You have the right to opt out of the “sale” or “sharing” of your Personal Information by a business to third parties. We do not sell Personal Information for money, but as noted above, we may share certain identifiers and online activity with advertising partners for cross-context behavioral advertising, which California law treats as a “sale”/“sharing.” You can opt out of this by using the “Your Privacy Choices” link on our website (or by broadcasting a Global Privacy Control signal, as described below).
  
• Right to Limit Use of Sensitive Personal Information: ALYZE does not use or disclose Sensitive Personal Information for purposes that, under the CCPA, would trigger a right to limit (we only use Sensitive PI for the purposes necessary to provide the Services or as otherwise described). Therefore, at this time, we do not offer a specific mechanism to limit use of Sensitive Personal Information beyond what is already described in this Policy. Rest assured, we handle sensitive data with care and do not use it for unexpected purposes like advertising without consent.
  
• Right of No Retaliation (Non-Discrimination): You have the right not to receive discriminatory treatment from us for exercising any of your California privacy rights. This means we will not deny you our Services, charge you a different price, or provide a different level or quality of service just because you exercised your rights. If we ever offer a financial incentive or different price that is related to the use of your Personal Information (for example, a discount program in exchange for certain data), we will present the terms of such program and you can decide whether to participate (and you may opt out of it at any time).
  

Additionally, California’s “Shine the Light” law permits residents to request certain information regarding our disclosure of Personal Information to third parties for their own direct marketing purposes. However, ALYZE does not disclose Personal Information to third parties for their independent direct marketing purposes without your consent. If you have questions about this, you may Contact Us as provided below.

How to exercise your California rights: You may submit requests to know, delete, or correct, or to opt out of sale/sharing, as described in Section 10(e) above under “Exercising your privacy rights.” Specifically, to opt out of sale/sharing of Personal Information for cross-context advertising, you may also use the “Your Privacy Choices” link or toggle on our website (typically found in the footer) or enable a Global Privacy Control (GPC) signal in your browser as described below.

f. Notice of Right to Opt-Out of Sale/Sharing:
As a California consumer, you have the right to direct us to stop “selling” or “sharing” your Personal Information (as those terms are defined by California law). As explained, the only context in which ALYZE “sells” or “shares” Personal Information is through the use of third-party cookies for advertising purposes. If you wish to opt out of this, you have a few options:

• Use the “Your Privacy Choices” link: On our website, click the “Your Privacy Choices” (or similarly titled) link, which will take you to a mechanism where you can opt out of the sale/sharing of your Personal Information (usually by adjusting cookie preferences or toggling off advertising cookies).
  
• Global Privacy Control (GPC): You may use a browser or browser extension that broadcasts a GPC signal, which is a universal opt-out mechanism. If our Site detects a GPC signal from your device, we will treat it as a valid opt-out request for the browser or device sending the signal, and opt you out of cookie-based sales/sharing of Personal Information. Visit globalprivacycontrol.org for more information on how to set up a GPC signal in your browser. Please note that if you have an account with us, the GPC-based opt-out will apply to data tied to your browser, and if you log into your account from a different device or browser, you may need to set the signal there as well or use our in-site options.
  
• Other industry opt-outs: As mentioned above in Section 5(c), you can also manage targeted advertising cookies through the DAA and NAI opt-out pages. These are additional tools and do not substitute for a direct request to us, but they can be helpful in controlling cookies across many sites.
  

Once you opt out, we will, as applicable, stop the “sale”/“sharing” of your Personal Information. Please understand that this opt-out is specific to the device and browser you use, so you may need to opt out separately on all your browsers and devices. Also, if you clear cookies, you may need to opt out again via the “Your Privacy Choices” link because the preference can be lost when cookies are cleared.

We do not knowingly sell or share the Personal Information of consumers under 16 years of age without affirmative authorization as required by the CCPA. If we ever were to engage in such activity and you are between 13 and 16, we would seek opt-in consent; for under 13, we would seek parental consent. But as stated, our Services are not intended for anyone under 18, and we do not knowingly have users in that age range.

g. Retention of Personal Information (California):
We retain each category of Personal Information for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required by law. The criteria we use to determine retention periods are outlined in Section 7 above. In general, we apply similar retention standards for California residents as for other users.

h. “Do Not Track” Signals:
Some browsers have a “Do Not Track” (DNT) feature that signals to websites that you do not want your online activity tracked. There is currently no consensus on how to interpret DNT signals, and we do not respond to them in any specific way. Instead, we allow you to control tracking through the cookie preferences and GPC signals described above. To learn more about Do Not Track, you can visit allaboutdnt.com.