Notice of Fortra Data Security Incident

California Resident Privacy Policy

Last Revised Date: February 5, 2025

If you are a California resident, the information below applies to you. This California Resident Privacy Policy (“California Policy”) supplements the information contained in the main Privacy Policy and applies only to individual residents of the State of California (“consumers” or “you”). This California Policy describes how CHSPSC collects information about you through this Website and how it uses and shares that information. The California Policy reflects CHSPSC’s current practices and practices during the past 12 months.

This California Policy describes your rights under the California Consumer Privacy Act (the “CCPA”) and explains how to exercise those rights. The CCPA protects information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (called “Personal Information”). The CCPA does not apply to protected health information (PHI) governed by HIPAA, “medical information” governed by the California Confidentiality of Medical Information Act (“CMIA”), or other patient information we maintain in the same manner as PHI or medical information. (How we protect that information is described under our HIPAA Notice of Privacy Practices for patients.) The CCPA also excludes other categories of information that don’t apply here.

What Personal Information We Collect

We may collect (and may have collected during the last twelve months), the following categories of Personal Information about you:

  • Name, alias, mailing address, email address, telephone numbers, or other unique personal identifiers;
  • Internet or other electronic network activity information, such as your account name, username, IP address, online identifiers, cookies or similar data, browsing history, search history, and information regarding your interaction with our Website;
  • Company name;
  • Contents of messages to us.

How We Collect Personal Information

We may collect your Personal Information directly from you. We may also collect your Personal Information through your use of the Website. This may include collecting IP address automatically as you navigate through the Website or through using Automatic Tracking Technologies. Automatic Tracking Technologies are explained in the main Privacy Policy.

How We Use Personal Information

We may use your Personal information for the following business and/or commercial purposes:

  • To operate, present, maintain and improve the Website and our services;
  • To customize the Website according to your individual interests;
  • To recognize you when you return to the Website and to speed up your searches;
  • To provide you with information about our company and our services;
  • To fulfill the purpose(s) for which you provided your information to us;
  • To communicate with you. For example, if you sign up for one or more of our newsletters, you may receive email communications from us. If, at any time, you do not wish to receive email communications from us, please use the “UNSUBSCRIBE” link at the bottom of our email;
  • To carry out our obligations and enforce our Terms of Use;
  • To perform legitimate business interests such as reporting and administrative functions within our organization;
  • To perform data analytics, such as determining which Website pages are most popular;
  • To comply with any applicable laws, such as to satisfy reporting obligations;
  • To notify you about changes to our Website or any products or services we offer or provide through it;
  • To improve our marketing efforts;
  • To protect against prevent fraud or other damage through the Website;
  • In any other way we may describe when you provide the information;
  • For any other purpose described to you through the Website;
  • For any other purpose that is permissible under the laws that apply to us; and
  • For any other purpose to which you consent.

How We Disclose Personal Information

We may disclose De-identified Information as permitted by law.

We may disclose Personal Information that we collect or you provide:

  • To anyone you authorize to have it;
  • To our workforce and affiliated organizations;
  • To contractors, service providers, and other third parties we use to support our Website, or to provide professional services to support our business. For example, we may disclose information to analytics companies that help us perform statistical analysis and IT contractors that provide customer service or IT support;
  • To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information about our Website users is among the assets transferred;
  • To fulfill the purpose for which you provide it;
  • To protect our users, property, and services, such as exchanging data with third parties for fraud protection and malware prevention;
  • For any other purpose we disclose when you provide the information; and
  • At your direction or with your consent.

We do not collect or process Personal Information for the purpose of inferring characteristics about individuals, such as creating a profile that reflects an individual’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. We do not sell Personal Information to third parties or share Personal Information with third parties for purposes of cross-context behavioral advertising. We do not offer a right to limit our use and disclosure of sensitive Personal Information because we do not use or disclose sensitive Personal Information in a way that would require offering that right (such as for purposes of inferring characteristics about an individual).

How We Retain Your Personal Information

We will retain your personal information in accordance with CHSPSC’s record retention requirements and policies which reflect business and legal considerations. CHSPSC will retain your personal information for the time period reasonably necessary to achieve the business and commercial purposes described in the Privacy Policy and this California Policy or any other notice provided at the time of collection. Your Personal Information may be retained longer if required or permitted by applicable law.

Your Right to Know

You have the right to know and request the following information relating to the Personal Information we may have collected and disclosed:

  • The categories of Personal Information we collected about you;
  • The categories of sources for the Personal Information we collected about you;
  • The business or commercial purposes for collecting, selling, or sharing your Personal Information; and
  • If we sold, shared or disclosed your Personal Information for a business or commercial purpose, two separate lists disclosing: (1) the categories of Personal Information that were disclosed for a business purpose and the categories of who received that information; and (2) the categories of Personal Information that we sold to or shared with third parties and the categories of who received that information.

We are not required to provide you with this information more than twice in a twelve (12) month period.

Your Right to Access

You have the right to access and obtain a copy of the specific pieces of Personal Information we have collected about you, upon verification of your identity.

Your Right to Correct

You have the right to request that we correct inaccurate Personal Information that we collected and maintain about you.

Your Right to Request Deletion

You have the right to request that we delete the Personal Information that we collected from you, subject to certain exceptions under the law. Once we receive and confirm your identity, we will delete (and direct our service providers to delete) your Personal Information from our records, unless an exception applies.

Your Right Not to Receive Discriminating Treatment

You have the right not to receive discriminatory treatment for exercising any consumer rights described in this California Policy or the CCPA.

How to Exercise Your Rights

To exercise your rights to know, access, correct and delete, you or your authorized agent may contact us at: websiteprivacy@chs.net or via our toll-free phone number: 877-892-9813.

We may ask you to provide additional Personal Information, such as your name, email, or other information, so that we can properly identify you in our dataset to track compliance with a request. We will only use Personal Information provided in a request to review and comply with the request. If you choose not to provide this information, we may not be able to respond to your request if we cannot verify your identity (or our authority to make the request for someone else). In certain circumstances, we may decline a request to exercise the rights described above.

You may designate an authorized agent to exercise your rights on your behalf.

Our Response

We will try to respond to a verifiable consumer request within forty-five (45) days of receipt. If we are unable to process your request in such time, we will inform you of the delay in writing. We will deliver our written response by mail or email. Information provided in response to a consumer request will be provided free of charge, up to twice.

We will not charge a fee to process or respond to your request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Your Right to Appeal

If we are unable to comply with all or a portion of your request, we will explain the reasons we cannot comply. You may appeal our decision by resubmitting a request and we will inform you of any action taken or not taken in response to the request and explain the reasons for our decision within sixty (60) days of receiving the request.