State-Specific privacy information
Last Modified: July 31, 2023
This statement is intended for USA-based users of our public marketing website: https://www.currenthealth.com/
Patients enrolled in the Current Health platform by their health provider should refer to the Current Health Patient Privacy Policy and our Patient Bill of Rights & Responsibilities.
This Statement is designed to be consistent with California, Colorado, Connecticut, and Virginia privacy laws. This Statement uses certain terms that have the meanings given to them by the California Consumer Privacy Act (CCPA), as amended unless otherwise specified.
1. Collection and use
a. Collection
During the 12-month period prior to the effective date of this Statement, we may have collected the following categories of personal information, including sensitive personal information, about you:
- Identifiers: identifiers such as a real name, organization, alias, postal address, unique personal identifier (such as customer number, unique pseudonym, or user alias), email address, account name, Social Security number, driver’s license number, passport number, and other similar identifiers, physical characteristics or description, state identification card number, and signature
- Identifiers (Online): a device identifier; cookies, beacons, pixel tags, mobile ad identifiers and similar technology; other forms of persistent or probabilistic identifiers, and Internet Protocol address
- Information Related to Characteristics Protected Under California or Federal Law: characteristics of protected classifications under California or federal law, such as race, color, national origin, religion, age, sex, gender, gender identity, gender expression, sexual orientation, marital status, medical condition, ancestry, genetic information, disability, citizenship status, and military and veteran status
- Commercial Information: including records of personal property, products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies
- Internet and Other Electronic Network Activity Information: including, but not limited to, browsing history, search history, and information regarding your interaction with websites, applications or advertisements
- Geolocation Data
- Sensory Information: Audio, electronic, visual, thermal, and similar information
- Professional or Employment-Related Information
- Profile Inferences: inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and/or aptitude
b. Sources of collection
We collected personal information about you from the following sources:
- You
- Best Buy
- Current Health
- Device(s) you used to access the website
c. Purposes for collection/use
We collected and used personal information about you for the following purposes:
- Providing customer service, or responding to sales enquiries
- Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance
- Detecting and responding to security incidents, protecting against and responding to malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity
- Short-term, transient use, including, but not limited to, non-personalized advertising shown as part of your interactions with our digital properties
- Debugging to identify and repair errors that impair existing intended functionality
- Undertaking internal research for technological development and demonstration
- Displaying advertisements intended for you based on personal information, related to your activities over time and across nonaffiliated websites or online applications, used to predict your preferences or interests (targeted advertising)
- Customizing your experience on our digital properties
- Processing liability claims
Complying with and enforcing applicable legal requirements, relevant industry standards and our policies.
2. Disclosures
a. We may have disclosed the following categories of personal information for a business purpose:
- Identifiers
- Identifiers (Online)
- Information Related to Characteristics Protected Under California or Federal Law
- Commercial Information
- Internet and Other Electronic Network Activity Information
- Geolocation Data
- Sensory Information
- Professional or Employment-Related Information
- Profile Inferences
b. We may share personal information about you for cross-context behavioral advertising — seeking to place ads to you on others’ digital properties based, at least in part, on personal information obtained from your activity on others’ digital properties.
c. We may have sold (as defined under California, Colorado, and Connecticut law) the following categories of personal information:
- Identifiers (online) associated with a device used to interact with our digital properties or advertisements (such as a device identifier; cookies, beacons, pixel tags, mobile ad identifiers and similar technology)
- Internet and other electronic network activity information associated with a device used to interact with Digital Properties or advertisements
- Profile Inferences (solely as sale is defined under California rules)
d. We do not sell the personal information of consumers under the age of 16 if we have actual knowledge of the individual’s age.
e. We do not sell personal information as the term is traditionally understood or as defined under Virginia law. For example, we do not exchange for money personal information to data brokers or third parties for their marketing purposes independent of us.
f. Sensitive personal information: We do not share sensitive personal information for cross-context behavioral advertising. We do not sell sensitive personal information.
g. We may have disclosed personal information about you with the following categories of third parties:
- Our affiliates
- Our joint marketing partners
- Our business partners
- Social media networks
- Third-party marketing partners
- Government entities, including law enforcement
Information we disclose to third parties:
| Personal information categories | Our affiliates | Our joint marketing partners | Our business partners | Social media networks | Third-party marketing providers | Government entities including law enforcement (see Disclosure) |
|---|---|---|---|---|---|---|
| Indentifiers | Yes | Yes | Yes | Yes | Yes | Yes |
| Identifiers (online) | Yes | No | No | No | Yes | Yes |
| Information related to characteristics protected under California or federal law | No | No | No | No | No | Yes |
| Commerical information | Yes | Yes | Yes | No | No | Yes |
| Internet and other electronic network activity information | Yes | No | No | No | Yes | Yes |
| Geolocation information | No | No | No | No | No | Yes |
| Sensory information | No | No | No | No | No | Yes |
| Professional or employment-related information | No | No | No | No | No | Yes |
| Profile inferences | Yes | No | No | No | No | Yes |
3. Retention – California residents
Current Health has in place a records-retention schedule reflecting our intended retention periods for certain types of information. The following reflects the longest applicable intended retention period by personal information category for information related to California consumers acquired on or after January 1, 2023. Once the intended retention period has passed, subject information is to be deleted or modified such that it is no longer personal information.
| Personal information | Intended retention period |
|---|---|
| Commercial information | 10 years after expiration of contractual obligations |
| Education information | 10 years after the expiration of employment obligations |
| Geolocation data | Up to 3 years |
| Identifiers | Up to 10 years after last activity, subject to contractual obligations |
| Identifiers (online) | Up to 3 years |
| Information related to characteristics protected under California or federal law | Up to 3 years |
| Internet and other electronic network activity information | Up to 3 years |
| Other financial, medical and health information | Up to 10 years after last activity, subject to contractual obligations |
| Professional or employment related information | Up to 10 years after the last activity, subject to contractual obligations |
| Profile inferences | Up to 3 years |
| Sensory information | Up to 40 Days |
There are a number of reasons personal information may be retained longer than the intended retention period. For example, deletion or modification does not happen immediately after a retention period has passed and instead executes periodically, no less frequently than annually. Additionally, some information systems or information may be placed on legal holds due to potential litigation or regulatory review and information, therefore, is not deleted or modified.
4. Consumer privacy rights
You have certain choices regarding our use and disclosure of personal information about you, as described below.
Access: You have the right to request, twice in a 12-month period, that we disclose to you the personal information related to you we have collected during the past 12 months. This may include:
- The categories and specific pieces of personal information we have collected about you
- The categories of sources from which we collected the personal information
- The business or commercial purpose for which we collected or sold the personal information
- The categories of third parties with whom we shared the personal information
- The categories of personal information about you that we sold or disclosed for a business purpose, and the categories of third parties to whom we sold or disclosed that information for a business purpose
Correction: You have the right to request that we correct certain personal information we have collected, taking into account the nature of the personal information and the purposes of the processing of the personal information. If you make a correction request, we may correct or instead delete information as allowed by law. Exceptions apply.
Deletion: You have the right to request that we delete certain personal information we have collected from you. Exceptions apply.
Opt-Out of Sale: You have the right to opt-out of the sale of your personal information.
5. How to submit a request
- Submit an access request to the contact details listed in our privacy policy. The report you receive containing personal information we have on file will provide instructions on how to pursue the correction of applicable information
- Submit a deletion request to the contact details listed in our privacy policy
Further assistance on opting out of the sale of your personal information is available by contacting us using the details listed in our privacy policy.
California residents
- Limit the Use or Disclosure of Sensitive Personal Information. You have the right to request that we limit our use or disclosure of Sensitive Personal Information (as defined by California law) about you to certain uses authorized by the CCPA. We do not disclose Sensitive Personal Information beyond such authorizations. Please contact us using the details listed in our privacy policy. for more information.
- Do Not Share My Personal Information. You have the right to opt out of our sharing of personal information for cross-context behavioral advertising. Please contact us using the details listed in our privacy policy for more information on how to exercise this right
- Shine the Light Request: You also may have the right to request that we provide you with (a) a list of certain categories of personal information we have disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year and (b) the identity of those third parties. To submit a Shine the Light Request, please contact us using the details listed in our privacy policy.
Colorado residents
- Opt-Out of Targeted Advertising: You have the right to opt out of “Targeted Advertising.” Please contact us using the details listed in our privacy policy for more information on how to exercise this right.
- Appeal a Refusal to Take Actions: Colorado law requires that we establish a process for a consumer to appeal our refusal to take action on certain requests. You may access that process by contacting us using the details listed in our privacy policy. If you are not satisfied with the outcome of that process, you may contact the Colorado Attorney General to submit a complaint.
- Other Options not Relevant: We do not use your data for the purpose of profiling to make decisions that would have legal or similarly significant effects on you. We do not knowingly process “sensitive data” concerning Colorado residents, as defined under Colorado law unless required as a matter of law.
Connecticut residents
- Opt-Out of Targeted Advertising: You have the right to opt out of “Targeted Advertising.” Please contact us using the details listed in our privacy policy for more information on how to exercise this right.
- Appeal a Refusal to Take Actions: Connecticut law requires that we establish a process for a consumer to appeal our refusal to take action on certain requests. You may access that process by contacting us using the details listed in our privacy policy. If you are not satisfied with the outcome of that process, you may contact the Connecticut Attorney General to submit a complaint.
Virginia residents
- Opt-Out of Targeted Advertising: You have the right to opt out of “Targeted Advertising.” Please contact us using the details listed in our privacy policy for more information on how to exercise this right.
- Appeal a Refusal to Take Action: Connecticut law requires that we establish a process for a consumer to appeal our refusal to take action on certain requests. You may access that process by contacting us using the details listed in our privacy policy. If you are not happy with the outcome of that process, you may contact the Virginia Attorney General to submit a complaint.
- Other Options not Relevant: We do not sell personal information as “sale” is defined under Virginia law. We do not knowingly process “sensitive data” concerning Virginia residents, as defined under Virginia law unless required as a matter of law.
Verifying requests
To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal information or complying with your request. If you have an account with us, we may verify your identity by requiring you to sign in to your account. If you request access to or deletion of your personal information and do not sign in to an account with us, we require you to provide the following information: name, email address, phone number, and postal address. In addition, if you do not have an account and you ask us to provide you with specific pieces of personal information, we reserve the option to require you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request. If you designate an authorized agent to make a request on your behalf for which verification is required, we may (1) require you to provide the authorized agent written permission to do so, and (2) require you to verify your own identity directly with us (as described above).
6. Additional information
If you choose to exercise any of your rights, you have the right not to receive, and will not receive, discriminatory treatment by us. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request. Employees and contractors are provided notice via different statements.
This statement is available in alternative formats upon request. Please contact us using the details listed in our privacy policy. for more information.