California privacy

California Privacy Notice

Additional privacy rights for California residents under the CCPA/CPRA. Most of the health information you share with your care team is protected by California's Confidentiality of Medical Information Act (CMIA) and applicable medical-privacy law, and is exempt from the CCPA.

This Notice supplements our Privacy Policy and applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"). Medical information governed by applicable medical-privacy law, including California's Confidentiality of Medical Information Act ("CMIA"), is generally exempt from the CCPA; this Notice addresses the personal information that is covered.

1. Information covered by this Notice

The CCPA covers personal information that is not exempt as CMIA medical information — for example, certain website, device, and account-registration data. Your clinical records remain governed by applicable medical-privacy law (including CMIA) and are addressed in our Notice of Privacy Practices.

2. Categories we collect and why

Identifiers (name, email, phone, address) — to create and manage your account.
Commercial information (membership and billing status) — to operate your membership.
Internet/device activity (log, usage, cookies) — to operate, secure, and improve the Platform.
Geolocation (general, from IP) — for state-availability and security.

We collect this information from you and automatically through the Platform, and use it for the purposes described in our Privacy Policy.

3. We do not sell or "share" your personal information

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined by the CCPA. We do not use or disclose sensitive personal information for purposes that would require an opt-out right.

4. Your California rights

Right to know the categories and specific pieces of personal information we have collected, and how we use and disclose it.
Right to delete personal information we collected from you, subject to legal exceptions (including medical-records-retention requirements).
Right to correct inaccurate personal information.
Right to opt out of any sale or sharing (we do neither) and to limit use of sensitive personal information.
Right to non-discrimination for exercising your rights.

5. How to exercise your rights

You may submit a request in either of two ways: (1) email support@sensibledoc.com with the subject line "California Privacy Request"; or (2) send a secure message to your care team from within your SensibleDoc account. Because SensibleDoc operates exclusively online and has a direct relationship with the people it serves, these are our designated methods for submitting requests under the CCPA.

We will take reasonable steps to verify your identity before disclosing or deleting personal information — typically by matching information you provide against information already associated with your account — and we will respond within the timeframes the CCPA requires (generally within 45 days, with one permitted extension when reasonably necessary). You may use an authorized agent to submit a request on your behalf; we may require written, signed permission from you and may ask you to verify your identity directly with us. We do not charge a fee for most requests.

6. Contact and updates

Questions about your California rights: support@sensibledoc.com. We will update this Notice as required and post the effective date.