California Privacy Notice

The CCPA covers personal information that is not exempt as CMIA medical information — for example, certain website, device, and account-registration data. Your clinical records remain governed by applicable medical-privacy law (including CMIA) and are addressed in our Notice of Privacy Practices.

• Identifiers (name, email, phone, address) — to create and manage your account.
• Commercial information (membership and billing status) — to operate your membership.
• Internet/device activity (log, usage, cookies) — to operate, secure, and improve the Platform and, on marketing pages only, to measure advertising.
• Geolocation (general, from IP) — for state-availability and security.

We collect this information from you and automatically through the Platform, and use it for the purposes described in our Privacy Policy.

We do not sell your personal or health information for money.

On marketing pages only (for example the homepage, pricing, and get-started pages), we may use advertising and measurement tools from Meta (Facebook/Instagram) and Google. These tools may receive identifiers and internet or device activity from those pages — for example a cookie or pixel identifier, pages viewed, and a conversion event (such as "membership started"). Under the CCPA, this may constitute "sharing" for cross-context behavioral advertising.

You can opt out of this "sharing" at any time: control cookies through your browser settings, or use a browser or extension that sends the Global Privacy Control (GPC) signal — we honor GPC signals as a valid opt-out of sale/share.

We do not send your health information, intake answers, diagnoses, lab results, or medication names to advertising companies, and we do not place these tools on clinical intake, checkout questionnaires, messaging, or other pages where you provide health information. We do not use or disclose sensitive personal information for purposes that would require a right to limit its use.

• Right to know the categories and specific pieces of personal information we have collected, and how we use and disclose it.
• Right to delete personal information we collected from you, subject to legal exceptions (including medical-records-retention requirements).
• Right to correct inaccurate personal information.
• Right to opt out of any sale or "sharing" of personal information (Section 3 explains how) and to limit use of sensitive personal information.
• Right to non-discrimination for exercising your rights.

You may submit a request in either of two ways: (1) email support@sensibledoc.com with the subject line "California Privacy Request"; or (2) send a secure message to your care team from within your SensibleDoc account. Because SensibleDoc operates exclusively online and has a direct relationship with the people it serves, these are our designated methods for submitting requests under the CCPA.

We will take reasonable steps to verify your identity before disclosing or deleting personal information — typically by matching information you provide against information already associated with your account — and we will respond within the timeframes the CCPA requires (generally within 45 days, with one permitted extension when reasonably necessary). You may use an authorized agent to submit a request on your behalf; we may require written, signed permission from you and may ask you to verify your identity directly with us. We do not charge a fee for most requests.

Questions about your California rights: support@sensibledoc.com. We will update this Notice as required and post the effective date. This Notice was last updated September 1, 2026.