HealthCareFairs Supplementary Privacy Notice for California Residents Only

1. California Privacy Rights Under CCPA
1. Right to Know About Personal Information Collected, Disclosed or Sold ("Right to Know")
1. Scope of Applicable Personal Information

CCPA provides you the right to request that we disclose to you any or all of the following about your personal information for the 12-month period preceding your request:

• the specific pieces of personal information that we have collected about you;
• the categories of personal information we have collected about you;
• the categories of sources from which we have collected your personal information;
• the categories of personal information that we have sold or disclosed for a business purpose about you;
• the categories of third parties to whom your personal information was sold or disclosed for a business purpose; and
• the business purpose for collecting or selling your personal information.

CCPA also provides you the right to receive information about any financial incentives (i.e., compensation payments) that we may offer in connection with use of your personal information for participating in certain of our Activities (as that term is defined in "About PracticeMatch" in our Main Privacy Policy ).

For detailed information about the personal information that we collect and the purposes for which we collect it, please see Part II ("Information We Collect and What We May Do With It") below.

If you exercise your Right To Know, after we confirm your identity, as explained more fully in Part III ("Exercising Your California Privacy Rights"), we will: (a) disclose to you the information we have collected about you during the preceding 12 months that corresponds to your request; and (b) deliver, free of charge to you, by mail, or electronically, the personal information that you have requested, in the manner required by CCPA and as further described below in Part III ("Exercising Your California Privacy Rights").

2. Exclusions from Scope of Personal Information

CCPA excludes the following from its definition of "personal information":

• Publicly available information from government records
• De-identified or aggregated consumer information
• Information excluded from CCPA's scope, such as
• Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data; and
• Personal information regulated by other sector-specific laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA), California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994
3. Statement With Respect to the Personal Information of Minor Children

HealthCareFairs Does Not Collect, Use, Disclose or Sell Personal Information of Minor Children.

HealthCareFairs does not offer any Services designed for, intended to attract, or directed towards children under the age of 18. We have a historically followed a careful policy that should we become aware of personal information we have unknowingly collected or held about or for minors under age 18, we will immediately and permanently delete it.

Moreover, we have not ever, and nor do we intend to ever, knowingly or purposefully collect, use, disclose, share, or sell any personal information of minors under age 18.

2. Right to Have Personal Information Deleted ("Right to Delete")

You have the right to request the deletion of your personal information that we collect or maintain.

If you exercise your Right to Delete, after we confirm your identity, as explained more fully below in Part III ("Exercising Your California Privacy Rights"), we will, in the manner specified by CCPA, permanently delete your personal information from our records, unless one of the CCPA exceptions applies to your deletion request applies.

Also, to the extent required by CCPA, we will direct deletion of your personal information by third parties with whom we have shared the personal information that you have requested that we delete.

Exceptions to your Right To Delete include, but are not limited to, instances when the personal information is necessary to complete a transaction or provide the service requested by you for which the subject personal information was collected or provided (such as to participate in our market research Activities), detect security incidents or protect against deceptive, fraudulent, or illegal activity, or to comply with a legal obligation under CCPA, the California Electronic Communications Privacy Act, or other California or US federal law.

3. Right to Opt-Out of the Sale of Personal Information ("Right to Opt-Out")

Under CCPA, you have the right to opt-out of the "sale" (as defined by CCPA) by a CCPA-subject business of your personal information to third parties. Please refer to our separate notice entitled Do Not Sell My Personal Information.

4. Right to Not Be Discriminated Against for Exercising Your California Privacy Rights ("Right to Non-Discrimination")

You have the right to not receive discriminatory treatment if and when you exercise any of your California Privacy Rights under CCPA. This would include, as examples, imposing a penalty fee or denying services to you because you exercised a CCPA right.

We will never penalize or otherwise subject you to discriminatory treatment for exercising any of your California Privacy Rights.

Please note that exercising your right to delete some or all of your personal information may mean that you are not able to participate in certain market research opportunities that we offer.

For example, if we do not have enough information to determine whether you meet the criteria for a study, you will not receive invitations to participate. In addition, certain studies may require that certain aspects of your personal information be shared with the client (such as a focus group opportunity, where your name, contact information, medical background, and practice location are needed in order to convene a desired focus group).

Financial incentives, such as per-survey compensation payments, are made for certain of our market research Activities. Market research compensation payment amounts are set at levels determined by taking into account many variables such as (by way of examples only) the complexity of the subject matter of the research inquiry, the professional education, training, and experience level desired for the respondents, the number of respondents needed, and the number of qualified respondents available.

If you have questions about your Right to Non-Discrimination, please contact us as described in Part III ("Exercising Your California Privacy Rights") below.

2. Information We Collect and What We May Do With It

HealthCareFairs, our subsidiaries, and our affiliates, as well as our third-party business partners with whom we conduct our regular business operations, may collect, share, or disclose personal information solely for business purposes as described in the following sections:

1. Categories of Third Parties refers to the following persons or entities with whom we may share personal information for business purposes:
1. Business Support Consultants (examples include our consultants, advisors, and/or vendors who help us by (as examples only): (a) preventing fraud or violations of our Terms of Service; (b) analyzing site user data and behavior, and tracking page performance; (c) identifying site issues and repair errors that impair intended functionality; (d) providing marketing and survey panel recruitment assistance, such as moderators and translators; (e) providing customer service to our Site users; (f) providing CCPA-required and other verifications of consumers or consumer consent; and/or (g) providing data storage and/or data processing services.

All of our Business Support Consultants have written agreements with us which:

• require them to comply with all legal privacy requirements to which we are subject, including those provided in CCPA;
• limit their access to personal information to the minimum necessary in order to perform their services for us; and
• restrict them from making any use of personal information beyond fulfilling the specific services to us for which they are engaged;
2. Business Partners (examples include clients, prospective clients and their representatives who may engage us to conduct market research or provide other services for CCPA-permitted business purposes); and
3. Public Authorities (examples include law enforcement and other government authorities if required by law or reasonably necessary to protect the rights, property, and safety of others or ourselves
4. Hiring Organizations Examples include employers, employee recruitment professionals (i.e., "headhunters"), hiring managers, and human resource professionals who access our Career Center database for healthcare industry job candidate recruitment purposes.
2. Business Purposes for Collecting Personal Information: HealthCareFairs will only collect and use your personal information for the following business purposes listed below:
1. Providing you with the services and support that you may request, and processing and validating your transactions;
2. Communicating with you about your account or transactions, changes to our policies and other administrative matters, or responding to your questions and comments;
3. Understanding better your interests in order to provide you with customized opportunities and other content;
4. Administering and improving all of our products, services and operations;
5. Ensuring compliance with our policies and Website Terms and Condition, or as we believe is necessary to protect, enforce or defend the legal rights, privacy, safety or property of ourselves and others;
6. Complying with our legal and regulatory requirements; and
7. Providing you with information regarding employment opportunities and career-related information, tools, and resources, and sharing your resume and other job candidate information with prospective employers and recruiters.

These business purposes are indicated by numeral, as applicable, in the third and fourth columns (respectively) of the charts in the next two sections.

We will never use your personal information differently than what we have disclosed to you in this notice, unless we first notify you and obtain your consent to a different use.

3. Notice at Collection (Personal Information Collected By Us Upon Your Visiting Our Site)

CATEGORY OF PERSONAL INFORMATION from CCPA §1798.140(o)(1)(A-K)	PERSONAL INFORMATION COLLECTED BY US UPON YOUR VISITING OUR SITE	BUSINESS PURPOSE FOR WHICH PERSONAL INFORMATION WILL BE USED
A. Internet or Other Electronic Network Activity Information	Browsing history and information about interaction with HealthCareFairs websites and applications Cookies, web beacons and device fingerprinting/watermarking are collected by and then used on the website as Google ReCAPTCHA to determine whether the user is human and not a bot.	I, II, III, IV, V, VI, VII
B. Geolocation Data	General physical and work location	I, III, IV, V, VI, VII

4. Personal Information We Have Collected Over the Past Twelve Months

CATEGORY OF PERSONAL INFORMATION from CCPA §1798.140(o)(1)(A-K)	EXAMPLES OF PERSONAL INFORMATION COLLECTED BY US OVER THE PAST 12 MONTHS	CATEGORY OF SOURCES FROM WHICH COLLECTED	BUSINESS PURPOSE FOR WHICH COLLECTED	CATEGORY OF THIRD PARTIES TO WHICH DISCLOSED
A. Identifiers	Name, postal address, e-mail address, telephone numbers, registration details for Healthcare Professionals, Internet protocol address, records of the Activities (as defined in the Main Privacy Policy) participated in, qualified for, completed or partially completed.	Directly from You Business Support Consultants Business Partners Public Authorities Public Records Hiring Organizations	I, II, III, IV, V, VI, VII	Business Support Consultants Business Partners Public Authorities
B. Categories of Personal Information from California's Customer Records statute	Signature (electronic and/or physical), education (level and institution), employment, and employment history and for Healthcare Professionals, their specialty and information on occupation and seniority	Directly from You Business Support Consultants Business Partners Public Authorities Public Records	I, III, IV, V, VI, VII	Business Support Consultants Business Partners Public Authorities
C. Protected Classifications Under US or California Law	Nationality, age, race, marital status, medical condition, physical or mental disability and gender	Directly from You Business Support Consultants Business Partners Public Authorities Public Records Hiring Organizations	I, II, III, IV, V, VI	Business Support Consultants Business Partners Public Authorities
D. Commercial Information	Ad Views and clicks, email opens, and clicks	Directly from You Business Support Consultants Specifically-Authorized Third Parties	III, VII	Business Support Consultants Business Partners Public Authorities Specifically-Authorized Third Parties
E. Internet or Other Electronic Network Activity Information	Browsing history information about interaction with HealthCareFairs websites and applications. Cookies, web beacons and device fingerprinting/watermarking are collected by and used on the website as Google ReCAPTCHA to determine whether the user is human and not a bot.	Directly from You Business Support Consultants Business Partners	I, II, III, IV, V, VI, VII	Business Support Consultants Business Partners Public Authorities
F. Geolocation Data	General physical and work location, IP Address	Business Support Consultants Directly from You Specifically-Authorized Third Parties	I, III, IV, V, VI	Business Support Consultants Public Authorities Specifically-Authorized Third Parties
G. Professional or Employment Related Information	Profession, specialty, university and graduation year, NPI number, and work history	Directly from You Business Support Consultants Hiring Organizations Specifically-Authorized Third Parties Public Records
I. Inferences Drawn From Other Personal Information	Profile reflecting preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes	Business Support Consultants	III, IV, V, VI, VII	Business Support Consultants Public Authorities

3. Exercising Your California Privacy Rights

In order to exercise your Right to Opt-Out, please use our dedicated "Do Not Sell My Information" link.

In order to exercise your Right to Know, Right to Delete, or Right to Non-Discrimination, please submit your request to us in any one of the ways listed below.

• By Webform: please click here and you will be directed to a form that you may either submit electronically, or print out and mail to us at our address below:
• By Telephone: 800 489-1440 (Monday through Friday from 8:00 a.m. to 5:00 p.m. ET)
• By E-mail: datarequest@practicematch.com (please put "California Privacy Request" in the subject line)
• By Mail or Courier:
  PracticeMatch Data Protection Officer
  PracticeMatch Corporation
  600 Emerson Road; Suite 450
  Saint Louis, MO 63141-6762

Only you, or a person (or a business entity registered with the California Secretary of State) whom you have authorized to act on your behalf may make a consumer request about your personal information. Consistent with CCPA's provisions, we may require either (or both) that you provide your authorized agent with written permission to act for you and verify your own identity to us (or provide a power of attorney signed by you stating your authorized agent's power to act for you).²

If you have questions or concerns about your rights under our California Privacy Policy, or any of the provisions or practices described in either our California Privacy Policy or our Main Privacy Policy, please contact us via the telephone number, e-mail address, or mail/courier address provided above.

4. Responding to Right to Know and Right to Delete Requests

Within ten (10) business days of receipt of your Right to Know or Right to Delete request, we will confirm our receipt, provide you details about the process we will follow to respond to your request, and/or ask questions, or for additional information, that may be required.

We plan to fulfill these requests within 45 calendar days of receiving the request. If we need more time to respond to your request, we will let you know the reason and, within the first 45 calendar days following receipt of your request, estimate how much additional time we will need (in any event, we will complete your request within 90 calendar days in total from receipt of the request).

If we deny your Right to Know or Right to Delete request, in whole or in part, we will provide you with the reason for this, and if our denial is partial, we will disclose to you, or delete (as applicable), the other information you have requested.

1. Verification Process: To assert your Right to Know or your Right to Delete, you will be asked to verify your identity before fulfilling your request. This verification process may require you to provide pieces of personal information that we already hold on you, or, in certain circumstances, a signed declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request.
2. Procedure; Frequency of Submitting Right to Know Requests: You may make requests regarding your Right to Know only twice within any 12-month period.
   
   We do not charge a fee to process or respond to your Right to Know requests, unless a particular request is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
3. Procedure; Frequency of Submitting Right to Delete Requests: You may make a Right to Delete request to us at any time. Following verification of your request, we will immediately and permanently delete the personal information requested by you, unless one of CCPA's exception to this right applies to your request.
   
   If we cannot verify the identity of the consumer requesting deletion of personal information, we may deny the Right to Delete request, and will inform the requestor of this.
   
   Once we verify the identity of the consumer making the Right to Delete request, we will respond to their request by either:
1. permanently and completing erasing the personal information from our systems and records, in the manner specific by CCPA;
2. de-identifying the personal information (meaning, carefully encrypting the personal information so it no longer identifiable or linkable to a particular consumer); or
3. aggregating the personal information individual (meaning, we will carefully remove any consumer-identifiers from it, and group it together with other similarly-stripped data from which the resulting data group contains no particular consumer's personal information in an identifiable fashion).

We will inform you of the manner in which we have deleted your personal information following a Right to Delete request.

5. Updates to this Supplementary Privacy Notice

We may reserve the right to periodically update our California Privacy Policy. Please reference the "LAST UPDATED" legend above for the effective date of the most recent updates. Your continued use of our Site following these changes means that you accept the revised California Privacy Policy.

¹ California's full CCPA statute, 1798 Cal. Civ. Code §§ 1978.100 - 1798.199, may be found here: https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&title=1.81.5.&part=4.

² For information on preparing a Power of Attorney, see Cal. Probate Code §§ 4000-4465 ("Powers of Attorney"), here: http://leginfo.legislature.ca.gov/faces/codes_displayexpandedbranch.xhtml?tocCode=PROB&division=4.5.