Privacy Rights for California Residents

California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA)

The California Consumer Privacy Act (CCPA), which has been amended by the California Privacy Rights Act (CPRA), is a law intended to enhance privacy rights and consumer protection for residents of the state of California.

Our Collection, Use, and Disclosure of Personal Information

For further details on the types of Personal Information we have collected about you in the preceding 12 months, the sources of that information, how we use the information (e.g., our business or commercial purposes for collecting Personal Information), and the categories of third parties to whom we disclose Personal Information, please visit the Vault Workforce Screening Privacy Notice. We will retain the Personal Information we collect for as long as reasonably necessary to carry out the purposes set forth in the Vault Workforce Screening Privacy Notice.

‍We do not “sell” or “share” Personal Information, as those terms are defined under CCPA.

Your Rights Under the CCPA

If you are a California resident, you have certain rights regarding your Personal Information under the CCPA. Please review each of the rights, below, and the section that follows for more information applicable to these rights. The following rights apply to all individual California residents (this list does not apply to legal entities, such as companies):

The Right to Know

You have the right to request that Vault disclose certain information to you about Vault’s collection and use of your Personal Information. Once Vault receives and confirms a verifiable consumer request from you, Vault will disclose to you, to the extent permitted by law:

• The categories of personal information Vault collected about you.
• The categories of sources for your personal information Vault collected about you.
• Vault’s business or commercial purpose for collecting your Personal Information.
• The categories of third parties with whom Vault shares your Personal Information.
• If we disclosed your Personal Information for a business purpose, the personal information categories that each category of recipient obtained.

The Right to Receive a copy of your Personal Information

You have the right to request that the information described above be provided to you in a portable and readily useable format, to the extent technically feasible (“data portability”).

The Right to Correct

You have the right to request that Vault correct the Personal Information it collects, uses, discloses, and sells. Under this Right to Correct, you can request a correction of any inaccurate Personal Information, and Vault will use commercially reasonable efforts to correct this information.

The Right to Request Deletion of your Personal Information

You have the right to request that Vault delete your personal information that Vault collected from and/or related to you and retained, subject to certain exceptions.

To the extent that Vault can delete your personal information, once Vault receives and confirms your verifiable consumer request, Vault will delete (and direct our service providers to delete) your Personal Information unless an exception applies.

We may deny your deletion request if retaining the information is necessary for Vault or our service providers to:

• Complete the transaction for which we collected your Personal Information, provide a good or service that you requested, or take actions reasonably anticipated within the context of our ongoing business relationship with you.
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
• Debug products to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546).
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
• Comply with a legal obligation.
• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

These rights will not apply, however, if Vault does not collect any Personal Information about you or if all of the information we collect is exempt from the CCPA.

Exercising Your Rights – Making a “Verifiable” Consumer Request
To exercise your rights described above, Vault needs to receive a request from you and needs to be able to verify your identity. Please submit a  consumer request to Vault by either:

• Contacting us at dataprivacy@vaulthealth.com; or
• Calling Vault’s Privacy Officer, at 800.732.3784 ext. 97603.

You may designate an authorized agent to make a request on your behalf. We will deny requests from agents that do not submit proof of authorization from you. To verify that an authorized agent has authority to act for you, we may require a copy of a power of attorney or require that you provide the authorized agent with written permission and verify your own identity with us.

Only you or your authorized agent may make a verifiable consumer request related to your Personal Information. You may also make a verifiable consumer request on behalf of your minor child. Some jurisdictions may limit you to only making a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

• Provide sufficient information that allows Vault to reasonably verify you are the person about whom Vault collected Personal Information or an authorized representative.
• Describe your request with sufficient detail that Vault to properly understand, evaluate, and respond to it.

Vault cannot respond to your request or provide you with your Personal Information if Vault cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.  

Vault will respond to a verifiable consumer request within 45 days of its receipt or notify you that Vault requires more time to respond and the reason for the extended response time. Vault will deliver its written response by mail or electronically, at your option.

To the extent that your verifiable consumer request is excessive, repetitive, or manifestly unfounded, Vault may charge a reasonable fee to respond to such request.

Vault will not discriminate against you for exercising any of your rights. Unless permitted by law, Vault will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.