KabaFusion State Consumer Privacy Notice
Introduction
Effective Date: 01/27/2023
Last Updated on: 05/17/2023
Depending on your state of residency, you may have rights as outlined in this Notice.
This State Consumer Privacy Notice supplements the information contained in KabaFusion’s Privacy Policy and applies to all visitors, users, and others who reside in California, Colorado, Connecticut, Utah, or Virginia (“consumers” or “you”). We adopt this notice to comply with the California Consumer Privacy Act (CCPA), as amended, the Colorado Privacy Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring, the Utah Consumer Privacy Act, and the Virginia Consumer Data Protection Act. We call those laws collectively the “U.S. Privacy Laws.” It explains what Personal Information (“PI”) we collect about you, where and from whom we obtain it, why we collect it, and your respective state rights regarding it. If you are a California, Colorado, Connecticut, Utah, or Virginia resident, this notice applies to any PI that we collect about you.
Information We Collect
We collect information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household, or device (“personal information”). Personal information does not include:
- Publicly available information from government records.
- Deidentified or aggregated consumer information.
- Information excluded from the scope of U.S Privacy Laws, like:
- health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA), clinical trial data, or other qualifying research data;
- personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.
In particular, we have collected the following categories of personal information from consumers within the last twelve (12) months:
We will retain the foregoing categories of PI consistent with our internal record-retention policies and for as long as necessary to provide products and services to you or as required by law.
We obtain the categories of personal information listed above from the following categories of sources:
- Directly from you. For example, from forms you complete or products and services, you purchase.
- Indirectly from you. For example, from observing your activity on our Online Services.
Collection from these sources may occur online, in person, via paper or other electronic means, and may occur automatically where state law permits such profiling absent an explicit request to opt-out.
Use of Personal Information
We may use, sell, or disclose the personal information we collect for one or more of the following purposes:
- To fulfill or meet the reason you provided the information. For example, if you share your name and contact information to request a price quote or ask a question about our products or services, we will use that personal information to respond to your inquiry. If you provide your personal information to purchase a product or service, we will use that information to process your payment and facilitate delivery. We may also save your information to facilitate new product orders or process returns.
- To provide, support, personalize, and develop our products, and services.
- To create, maintain, customize, and secure your account with us.
- To process your requests, purchases, transactions, and payments and prevent transactional fraud.
- To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.
- To help maintain the safety, security, and integrity of our products and services, databases and other technology assets, and business.
- For establishing disease management protocols, testing, research, analysis, and product development, including developing and improving our products, and services.
- To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
- As described to you when collecting your personal information or as otherwise set forth in the U.S Privacy Laws.
- To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our Online Services users/consumers is among the assets transferred.
We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.
Sharing Personal Information
We may share your personal information by disclosing it to a third party for business purposes. We only make these business purpose disclosures under written contracts that describe the purposes, require the recipient to keep the personal information confidential, and prohibit using the disclosed information for any purpose except performing the contract. In the preceding twelve (12) months, KabaFusion may have disclosed personal information for business purposes.
We do not sell personal information. In the preceding twelve (12) months, KabaFusion has not sold personal information.
Deidentified Patient Information
We may disclose deidentified (anonymized) patient information which is exempt from the CCPA & CPRA to third parties for business purposes. KabaFusion uses the HIPAA expert determination method and the HIPAA safe harbor method to de-identify patient information.
Children's Privacy
We do not intend for our Online Services to be used by anyone under the age of 13. We do not knowingly collect, sell, or share the personal information (as defined in the Children’s Online Privacy Protection Act) of consumers we know are less than 16 years old. If you are a parent or guardian and believe we may have collected information about your child, please contact us immediately as described in the “Contact Us” section of this Notice.
Your Rights and Choices
Right to Know/Right to Access: You have the right to request that we disclose certain information to you about our collection and use of your PI. Once we receive and confirm your verifiable consumer request, we will disclose to you:
- What PI we collect about you;
- Where and from whom we collect PI about you;
- Our business purpose for collecting PI about you;
- The types of third parties with whom we share your PI;
- The specific pieces of PI we collect about you, in a readily usable format; note that we will not disclose your actual Social Security number, driver’s license number or other government-issued identification numbers, financial account number, any health insurance or medical identification number, an account password, or security questions and answers; and
- The types of PI that we disclosed about you for a business purpose, and the categories of third parties to whom we disclosed your PI.
Right to Notice at or Before Collection: You have the right to be informed about the PI that we collect about you at the time or before we collect it. This is that notice.
Right to Delete: You have the right to request that we delete any PI about you that we have.
Right to Correct: You have the right to request a correction of any inaccurate information in the PI we collect about you.
Right to Opt-Out of Sale, Sharing, Profiling, or Targeted Ads: You have the right to direct us to not sell or share your personal information at any time (the “right to opt-out”). You have the right to stop us from sharing your PI to profile you or to display advertisements to you based on your activities, preferences, and interests. To opt-out, submit a “Do Not Share My Personal Information” through the form (https://www.kabafusion.com/contact-us/). You do not need to create an account with us to exercise your opt-out rights. We will only use personal information provided in an opt-out request to review and comply with the request.
Right to Limit Use and Disclosure of Sensitive Personal Information: If we use your sensitive PI for purposes other than to render services or offer products to you, you will have the right to request that we limit the processing of your sensitive PI.
Right to Portability: You have the right to request to have your PI transmitted to other entities.
Right to Nondiscrimination: You will not be discriminated against or penalized for exercising your rights to your PI, and we will honor your rights by not:
- Denying you services;
- Charging you different prices or rates for services;
- Imposing penalties; or
- Providing you with a different level or quality of services.
Right to Appeal: Applicable law may require or permit us to decline your request. If we decline your request, we will tell you why within 45 days of receipt of your request. You may appeal this decision by calling us at 888.204.9304 or by emailing us at privacy@kabafusion.com. We will respond to your appeal within 45 days of receipt unless we notify you that we will require an additional 15 days to respond. If you remain concerned about the result of that appeal, you may contact the attorney general in your state of residency.
Exercising Your Rights
You may exercise your rights by calling us at 888.204.9304 or by emailing us at privacy@kabafusion.com. If we do share your PI, you may opt out of the sharing of your PI by using our cookie management tool on our website. You may be required to submit proof of your identity for these requests to be processed. We will not be able to comply with your request if we are unable to confirm your identity. You may designate an authorized agent to make a request on your behalf subject to proof of identity and authorization.
Response Timing and Format
We will confirm receipt of your request within ten (10) business days. You will receive our response to your request within 45 days of your request unless we provide you with notice that it will take more than 45 days to respond (in that case, we won’t take more than 90 days to respond).
Additional California Privacy Rights
California’s “Shine the Light” Law: Users of our Online Services that are California residents can request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please send an email to privacy@kabafusion.com
California Minors Under 18: If you are a California resident under the age of 18 and are a registered user of our Online Services, you may request that we remove from our Online Services any content you post to our Online Services that can be accessed by any other user (whether registered or not).
Changes to our Privacy Policy
We reserve the right to amend this privacy policy at our discretion and at any time. When we make changes to this privacy policy, we will post the updated notice on our Website and Online Services and update the notice’s effective date. Your continued use of our Online Services following the posting of changes constitutes your acceptance of such changes.
Contact Information
If you have any questions or comments about this notice, the ways in which KabaFusion collects and uses your information described here and in the Privacy Policy, your choices, and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at:
Phone: 888.222.2542
Website: https://www.kabafusion.com/contact-us/
Email: privacy@kabafusion.com
Postal Address:
KabaFusion Holdings, LLC
Attn: Information Security & Privacy Officer
80 Hayden Ave
Suite 300
Lexington, MA 02421
If you need to access this Policy in an alternative format due to having a disability, please contact privacy@kabafusion.com and 888.204.9304