Privacy Notice for California Residents

This Privacy Notice for California Residents("Notice") supplements the information contained in Epic Research'sprivacy policy and applies solely to all visitors, users, and others who reside in the State of California ("readers" or "you"). This Notice applies to your access to and use of epicresearch.org (the "Website"), and we adopt this notice to comply with the California Consumer Privacy Act of 2018 (CCPA). Any terms defined in the CCPA have the same meaning when used in this Notice.

By using the Website, you may provide Epic Research (also known as Epic Health Research Network or EHRN) with information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual, household, or device ("personal information").

The Website may collect certain personal information from its readers as listed in the Epic Researchprivacy policy. This includes certain categories of personal information as indicated below (with a "Yes"):

We obtain the categories of personal information listed above from the following sources:

• Directly from you. For example, from comments you leave on the Website or communications you send to Epic Research.
• Indirectly from you. For example, by observing your actions on the Website.

We may use or disclose the personal information we collect for one or more of the following purposes:

• To fulfill or meet the reason you provided the information. For example, if you share your name and contact information to ask a question or share a comment, we may use that personal information to respond to you.
• To provide, support, and develop the Website.
• To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.
• To help maintain the safety, security, and integrity of the Website.
• For testing, analysis, and product development, including to develop and improve the Website.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• As described to you when collecting your personal information or as otherwise set forth in the CCPA.

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice. We will not sell your personal information.

We may disclose your personal information to a third party for a business purpose.

You can review the Epic Research privacy policy to see a list of the individuals or third parties that may have access to your personal information.

Disclosures of Personal Information for a Business Purpose

In the preceding twelve (12) months, we have disclosed the following categories of personal information for a business purpose related to the Website:

• Category A: Identifiers.
• Category F: Internet or other similar network activity.

We disclose your personal information for a business purpose to our third party service providers.

The CCPA provides California residents with specific rights regarding their personal information. This section describes your CCPA rights and explains how to exercise those rights.

Access to Specific Information and Data Portability Rights

You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable request (see Exercising Access, Data Portability, and Deletion Rights), we will disclose to you:

• The categories of personal information we collected about you.
• The categories of sources for the personal information we collected about you.
• Our business or commercial purpose for collecting that personal information.
• The categories of third parties with whom we share that personal information.
• The specific pieces of personal information we collected about you (also called a data portability request).
• If we disclosed your personal information for a business purpose, a list of the disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.

We do not provide these access and data portability rights for personal information (including health information) that is stored or otherwise used by healthcare systems or other Covered Entities (as that term is defined in the Health Insurance Portability and Accountability Act of 1996 (HIPAA)). Contact your healthcare system(s) if you have questions about these rights with respect to information about you that is stored or otherwise used by them.

Deletion Request Rights

You have the right to request that we delete any of your personal information that we have collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable request (see Exercising Access, Data Portability, and Deletion Rights), we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.

We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

1. Complete a transaction for which we collected the personal information, provide something that you requested, take actions reasonably anticipated within the context of our ongoing relationship with you, or fulfill any legal obligations we may have.
2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
3. Debug products to identify and repair errors that impair existing intended functionality.
4. Exercise free speech, ensure the right of another individual to exercise their free speech rights, or exercise another right provided for by law.
5. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
6. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
7. Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us.
8. Comply with a legal obligation.
9. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

We do not provide these deletion rights for personal information (including health information) that is stored or otherwise used by healthcare systems or other Covered Entities (as that term is defined in HIPAA). Contact your healthcare system(s) if you have questions about these rights with respect to information about you that is stored or otherwise used by them.

Exercising Access, Data Portability, and Deletion Rights

To exercise the access, data portability, and deletion rights described above, please submit a verifiable request to us by either:

• Emailing us at PrivacyInquiries@epicresearch.org
• Calling us at 608-271-9000

Only you, or someone legally authorized to act on your behalf, may make a verifiable request related to your personal information. You may also make a verifiable request on behalf of your minor child. To designate an authorized agent, email us at PrivacyInquiries@epicresearch.org and include a designation of your authorized agent in your email, including the agent’s name, email address, and other relevant information that will help us identify your authorized agent.

You may only make a verifiable request for access or data portability twice within a 12-month period. The verifiable request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative, which may include:
  • First, Middle (if available), and Last Name
  • California address
  • Valid email address
  • Photograph of the front and back of your driver’s license
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.

Making a verifiable request does not require you to have or create an account with Epic Research. We will only use personal information provided in a verifiable request to verify the requestor’s identity or authority to make the request.

Response Timing and Format

We endeavor to respond to verifiable requests within forty-five (45) days of receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing.

Any disclosures we provide will only cover the 12-month period preceding the date we received the verifiable request. The response we provide will explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will provide your personal information in a format we select that is readily usable and should allow you to transmit your personal information from one entity to another entity.

We do not charge fees to process or respond to verifiable requests unless the requests are excessive, repetitive, or unfounded. If we determine that your request warrants a fee, we will tell you why we made that decision and provide you with a fee estimate before completing your request.

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not deny you goods or services or provide you a different level or quality of goods or services.

We reserve the right to amend this Notice at our discretion and at any time. When we make changes to this Notice, we will post updates on the Website and update the Notice’s "last updated" date. Your continued use of the Website following the posting of updates constitutes your acceptance of such changes.

If you have any questions or comments about this Notice, the ways in which Epic Research collects and uses your information described here and in the Epic Research privacy policy, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at:

Phone: 608-271-9000

Email: PrivacyInquiries@epicresearch.org