Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Notice (“Notice”) provides additional information regarding the consumer health data (defined below) that National Disability Alliance, its affiliated entities, and its partnered professional corporations (collectively, “we,” “us” or “our”) collects, how we use it, what sources it is derived from, and to whom we disclose it. This Notice applies to Connecticut, Nevada, and Washington residents about whom we collect consumer health data, and is intended to provide notices in compliance with the Connecticut Data Privacy Act (“CTDPA”), Nevada SB 370, and Washington’s My Health, My Data Act (“MHMD”).

We encourage you to review our Privacy Policy to learn more about our privacy practices and our commitments to you. Any capitalized terms in our Privacy Policy have the same meaning in this Notice.

This Notice applies to information we collect from visitors to nationaldisabilityalliance.com and any related websites (the “Sites”) and any other technologies, features, mobile applications, content, and other services we offer (collectively, the “Services”). This Notice does not apply to information we collect from individuals in a business-to-business or employment context, or data that is already subject to certain federal and state regulations, such as protected health information.

This Notice also does not apply to third-party websites, applications products, services, or other properties, if they may link to our Sites or our Sites may link to them. We recommend you review the privacy practices of those third parties before connecting with and/or accessing third party offerings and sharing any Personal Information.

1. Consumer Health Data We Collect

For purposes of this Notice, personal data means information that identifies or is reasonably capable of being associated or linked, directly or indirectly, with an individual in Connecticut, Nevada, and/or Washington. Personal data does not include de-identified data or publicly available information. “Consumer health data” means personal data that is linked or reasonably linkable to an individual and that identifies the individual’s past, present, or future health status or mental health status, as may be applicable.

We may collect, or have collected, the following categories of consumer health data about you:

• Individual health treatments, conditions, or diseases
• Use or purchase of prescribed medication
• Diagnosis or diagnostic testing, treatment, or medication
• Social, psychological, behavioral, or medical interventions
• Health-related surgeries or procedures
• Data that identifies you seeking health care services
• Reproductive or sexual health information
• Bodily functions
• Vital signs, symptoms, or measurements of the above categories
• Precise location information that could reasonably indicate your attempt to acquire or receive health services or supplies
• Any information that we or our service providers process to associate or identify you with the above information that is derived from non-health information (such as inferred data).

2. Categories of Sources of Consumer Health Data

We may collect consumer health data from the following categories of sources:

• Directly from you through your interactions with us, such as when you use the Services, complete electronic forms, or otherwise communicate with us, including by phone, text, or email (altogether “Self-Reported Information”).
• From our service providers, business partners, and affiliates, in accordance with applicable law and the context in which you provided the data.
• From your doctor(s), with your consent.
• From your friends and/or neighbors, to obtain personal testimonials if it is necessary to complete a Third Party Function Form (SSA 3380).

3. How We Use Consumer Health Data

We use the consumer health data we collect about you to provide customer service; to provide and maintain our Services; for internal business purposes, including general business administration; to market our products and Services; and for any purpose consistent with your preferences.

4. To Whom We Disclose Consumer Health Data

We will only disclose consumer health data with your consent. Under certain circumstances, we may be required to disclose your consumer health data if required to do so by law, in response to valid requests by public authorities, and/or in response to a threat of harm involving an individual’s health and/or safety.

We may transfer and assign all right, title, interest, and obligations in your consumer health data in connection with a merger, acquisition, sale of all or substantially all of our assets with respect to our company or the business unit therein that primarily utilizes your consumer health data, reincorporation, consolidation, reorganization, and/or any other change of control.

5. Consumer Health Data Privacy Rights

a. Your Privacy Rights

Connecticut residents have the following rights in relation to your consumer health data, subject to certain exceptions:

• Right to know and access. You have the right to know what consumer health data we process, as the term is defined under the CTDPA. You may ask us to provide you a portable copy of this information up to two times in a rolling twelve-month period.
• Right to delete. You have the right to request under certain circumstances that we, as well as our service providers and contractors, delete the consumer health data that we collect about you.
• Right to correct inaccurate consumer health data. You have the right to request the correction of inaccurate consumer health data.
• Right to opt out. You have the right to opt out of targeted advertising, our sale of your personal data, and profiling decisions that could produce legal or similarly significant effects.
• Rights concerning sensitive personal data. We cannot process your consumer health data, or use your consumer health data for certain purposes without your affirmative consent.
• Right to non-discrimination. You have the right not to receive discriminatory treatment for the exercise of the privacy rights described above.

Nevada and Washington residents may have the following rights in relation to your consumer health data, subject to certain exceptions:

• Right to know. You have the right to know what consumer health data we collect, share, or sell, as those terms are defined under applicable law. You also have the right to obtain a list of all third parties and affiliates with whom we have shared or sold your consumer health data, and an active email address or other mechanism that you may use to contact these third parties. If you are a Washington resident or otherwise protected by Washington law, you also have the right to access your consumer health data that we collect, share, or sell.
• Right to withdraw consent. You have the right to withdraw consent from the collection and sharing of your consumer health data.
• Right to delete. You have the right to request that we, as well as our service providers and contractors, delete the consumer health data that we collect about you.
• Right to non-discrimination. You have the right not to receive discriminatory treatment for the exercise of the privacy rights described above.

b. Exercising Your Rights

Please use the following information to exercise your rights. Please note that any request you submit to us is subject to an identification and residency verification process as permitted under applicable law, as well as certain other procedural requirements that may be noted in the sections below. Additionally, all requests are subject to certain exceptions under applicable law, which may vary. We will not discriminate against you for exercising any of the privacy rights described above.

If you are a visually-impaired customer, a customer who has another disability or a customer who seeks support in another language, you may access your privacy rights by emailing us at privacy@ndallc.com.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, manifestly unfounded, or in accordance with applicable law. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Depending on applicable law, you may be limited in how many verifiable or authenticated consumer requests you may make within a twelve (12) month period. If we have inadvertently collected information on your minor child, you may exercise the above rights on behalf of your minor child. Additionally, in some jurisdictions, you may designate an authorized agent to submit a request on your behalf, and if so, we may require proof of the agent’s authorization by you and/or verification of the agent’s own identity. Generally, a rights request must include:

• Sufficient information that allows us to reasonably verify you are the person about whom we collected consumer health data or are an authorized representative, which must include, at a minimum, your first and last name and email address.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to the request.

We cannot respond to your request or provide you with consumer health data if we cannot verify or authenticate your identity or authority to make the request and confirm that the consumer health data relates to you. We will only use consumer health data provided in a verifiable or authenticated consumer request to verify your (or your authorized agent’s as applicable) identity or authority to make the request.

Except where otherwise noted, we will respond to your request within forty-five (45) days after receipt and we reserve the right to extend the response time by an additional forty-five (45) days when reasonably necessary and provided consumer notification of the extension is made within the first forty-five (45) days.

How to submit a request.

To exercise any of the rights described in this Privacy Policy, please send your request(s) using one of the following methods:

• Emailing us at privacy@ndallc.com
• Calling us at (323) 379-2733

How to appeal decisions about your rights.

• Connecticut. If you are a Connecticut resident and want to appeal our decision regarding a request that you have made, please Contact Us. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If the appeal is denied, you may contact Connecticut’s Office of the Attorney General by phone at (860) 808-5420 or by submitting a form here.
• Nevada. If you are a Nevada resident and want to appeal our decision regarding a request that you have made, please Contact Us. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If your appeal is not successful, you may submit a complaint with the Nevada Attorney General here.
• Washington. If you are a Washington resident or located in Washington and want to appeal our decision regarding a request that you have made, please Contact Us. Within forty-five (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If the appeal is denied, you may contact Washington’s Office of the Attorney General by phone at (800) 551-4636 or by submitting a complaint here.

6. Changes to This Notice

We may update this Notice from time to time. We will notify you of any changes by posting the new Notice on this page. We will also let you know via email and/or a prominent notice on our Sites, prior to the change becoming effective and update “effective date” at the top of this Notice. We recommend reviewing this Notice periodically for any changes. Changes to this Notice are effective when they are posted on this page.

7. Contact Us

If you have any questions about this Notice, please email us at privacy@ndallc.com. You can also call us at (323) 379-2733 or write to us at 8 The Green #14451, Dover, Delaware 19901.