State addenda to privacy notice

The below “State Addenda” supplement and form part of the Privacy Notice.

If you are a resident of Washington, please click here.

If you are a resident of Nevada, please click here.

Please note that this page may be updated as necessary to address evolving operations and regulations.

California

Capitalized terms in this section have the meaning given to them under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

You have the following rights under the CPRA:

• The right to delete Personal Information. You have the right to request that we delete your Personal Information. Once we have verified this request, we will delete this information unless certain exceptions apply.
• The right to correct inaccurate information. You have the right to request that we correct your Personal Information if it is inaccurate. Once we have verified this request, we will use commercially reasonable efforts to correct this information unless certain exceptions apply.
• The right to know categories and specific pieces of Personal Information. You have the right to know which Personal Information we collect, use, disclose, and/or Sell, as applicable.
• The right to opt-out of the Sale or Sharing of Personal Information. You have the right to request to be opted-out from the Sale or Sharing of your Personal Information.
• The right to limit the use and disclosure of Sensitive Personal Information. You have the right to direct us to limit use of your Sensitive Personal Information to what is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests such goods or services, or for the performance of specifically enumerated Business Purposes.
• The right of non-retaliation. We will not retaliate or discriminate against you for exercising any of these enumerated rights.

If you wish to exercise any of these rights, contact us at data-requests@get-carrot.com. To exercise your right to limit the use of your Sensitive Personal Information, in addition to contacting us with the provided email, you may also submit a request on this page.

Texas

Individuals residing in Texas are afforded certain additional rights with respect to their Personal Information under the Texas Data Privacy and Security Act (“DPSA”). If you are a Texas resident, this section applies to you.

• Personal identifiers – such as your name or email address.
• Geolocation – the state you reside in and/or receive care.
• Sensitive personal data – Information related to your health, diagnoses and related health data.
• Transactional information – related to your use of Services.

We process your personal data to make Services available to consumers pursuant to the terms of the Employer Agreement and as requested by the consumer.

Subject to verification of your identity and other information that we may need to honor your request, all Texas consumers have the following rights:

• Right to know or confirm. You have the right to know and confirm whether we are processing your Personal Information and the right to access such data.
• Right to portability. You have the right to receive a portable copy of your Personal Information in a readily usable format.
• Right to correct. You have the right to request we correct inaccuracies in your Personal Information.
• Right to delete. You have the right to request we delete your Personal Information.
• Right to opt-out. You have the right to opt out of the processing of Personal Information for the purposes of targeted advertising, the sale of Personal Information, profiling or processing of sensitive Personal Information.

Please contact us at the following email if you have questions or would like to exercise your rights: data-requests@get-carrot.com.

Connecticut

This Connecticut Addendum supplements the information set forth in our Privacy Notice and applies if you are a resident of Connecticut. It describes how Carrot collects, uses, discloses, and protects your Personal Information, and the rights you have under the Connecticut Data Privacy Act (“CTDPA”), as amended, and the consumer health data provisions of Connecticut law.

Categories of Personal Information We Collect, Use, and Disclose

For details about the categories of Personal Information we collect, the purposes for which we process Personal Information, the legal bases on which we rely, and the categories of third parties with whom we share Personal Information, please see the “Collection, Use, and Disclosure of Personal Information” section of the Privacy Notice.

The Personal Information we collect about you may include sensitive data under Connecticut law, including data that reveals your mental or physical health condition, diagnosis, disability, or treatment; biometric data (when processed to uniquely identify you); precise geolocation data; and data revealing racial or ethnic origin or sexual orientation. We process sensitive data only with your consent, and we obtain separate consent before selling any sensitive data.

Sources of Personal Information

We collect Personal Information directly from you, automatically through your use of the Service, from your Plan Sponsor, from third parties acting on your behalf or on behalf of your Plan Sponsor, and from connected sources you elect to link to your Carrot experience (such as Apple HealthKit, Android Health Connect, or Withings devices).

Sale of Personal Information

We do not sell your Personal Information for monetary consideration. To the extent any disclosure of your Personal Information constitutes a “sale” under the CTDPA, you have the right to opt out as described below.

Profiling and Automated Decision-Making

We do not use solely automated processing to make decisions about you that produce legal or similarly significant effects without meaningful human review. For more information about our use of artificial intelligence and machine learning, including our approach to human oversight, see the “Use of Artificial Intelligence (AI) and Machine Learning (ML)” section of the Privacy Notice.

Your Rights Under the CTDPA

As a Connecticut resident, you have the following rights:

• Right to confirm and access. You may confirm whether we are processing your Personal Information and request access to that Personal Information.
• Right to correct. You may request that we correct inaccuracies in your Personal Information.
• Right to delete. You may request that we delete Personal Information we have collected from or about you.
• Right to data portability. You may obtain a copy of your Personal Information that you previously provided to us in a portable and, to the extent technically feasible, readily usable format.
• Right to obtain a list of third parties. You may request a list of the specific third parties (or, at our option, the categories of third parties) to whom we have disclosed your Personal Information.
• Right to opt out. You may opt out of (i) the sale of your Personal Information, (ii) targeted advertising, and (iii) profiling in furtherance of automated decisions that produce legal or similarly significant effects concerning you.
• Right to question and reevaluate profiling decisions. Where a profiling decision produces a legal or similarly significant effect concerning you, you have the right to question the outcome, be informed of the reasoning behind the decision, review the personal data used in the decision, and, where applicable, request that the decision be reevaluated.
• Right to withdraw consent. Where we rely on your consent to process Personal Information, you may withdraw that consent at any time.
• Right to appeal. If we deny your request, you have the right to appeal our decision. We will respond to your appeal within 60 days. If we deny your appeal, we will provide you with information on how to submit a complaint to the Connecticut Attorney General.

How to Exercise Your Rights

To exercise any of these rights, contact us at data-requests@get-carrot.com. We will respond to verifiable consumer requests within 45 days. If we need additional time (up to an additional 45 days), we will inform you of the extension and the reason for it.

Nebraska

This Nebraska Addendum supplements the information set forth in our Privacy Notice and applies if you are a resident of Nebraska. It describes how Carrot collects, uses, discloses, and protects your Personal Information, and the rights you have under the Nebraska Data Privacy Act (“NDPA”).

Your Rights Under the NDPA

As a Nebraska resident, you have the following rights:

Delaware

This Delaware Addendum supplements the information set forth in our Privacy Notice and applies if you are a resident of Delaware. It describes how Carrot collects, uses, discloses, and protects your Personal Information, and the rights you have under the Delaware Personal Data Privacy Act (“DPDPA”).

Your Rights Under the DPDPA

As a Delaware resident, you have the following rights:

New Jersey

This New Jersey Addendum supplements the information set forth in our Privacy Notice and applies if you are a resident of New Jersey. It describes how Carrot collects, uses, discloses, and protects your Personal Information, and the rights you have under the New Jersey Data Privacy Act (“NJDPA”).

Your Rights Under the NJDPA

As a New Jersey resident, you have the following rights: