CCPA

Who this notice applies to

This Notice applies if you are a California resident and the processing of personal information about you is subject to the CCPA. If you are not a California resident, the rights described here may not apply to you, but our general Privacy Policy still governs how we handle your information, and you may have rights under other state privacy laws — see the "Consumer health data rights" section of our Privacy Policy for details.

Personal information we collect

In the past twelve (12) months, Nuvara has collected the following categories of personal information (as defined by the CCPA) from California residents. For examples and additional detail, see the "Information we collect" section of our Privacy Policy.

• Identifiers — name, email address, ZIP code, IP address, and device identifiers.
• Internet or other electronic network activity — browsing history on the Site, pages viewed, links clicked, and similar usage data.
• Geolocation data — approximate location inferred from your IP address (typically city or state level).
• Inferences — inferences drawn from the information above about your interests and preferences.
• Sensitive personal information — health goals or concerns you voluntarily select on our intake form, and any information about your browsing activity on health-related pages of the Site.

We do not collect: government identifiers (driver's license, passport, Social Security number), payment information, biometric information, precise geolocation, audio/visual/video recordings, or union membership on the Site. If you later engage with an affiliated provider or pharmacy through Nuvara, they may collect additional information directly from you — that collection is governed by their own notices, not this one.

How we use your personal information

We use the personal information we collect for the following business and commercial purposes, as described more fully in our Privacy Policy:

• To operate the Site and maintain your waitlist registration.
• To connect you with affiliated licensed healthcare providers and partner pharmacies when early access opens in your area.
• To secure our systems, detect fraud, verify identity, and meet our legal obligations.
• To improve the Site and develop new offerings.
• To personalize the content and communications we share with you.
• To respond to your questions and requests.
• To send you service-related and, where permitted, marketing communications.
• To deliver advertising about Nuvara on third-party websites and platforms.

Where applicable law requires your consent for specific uses of sensitive personal information, we will obtain that consent.

How we share your personal information

In the past twelve (12) months, Nuvara has disclosed the categories of personal information listed above to the following categories of recipients for the business purposes described in our Privacy Policy:

• Service providers — analytics, email delivery, fraud prevention, customer support, and similar vendors acting on our behalf.
• Affiliated providers and partner pharmacies — when you choose to engage with a licensed provider or compounding pharmacy through Nuvara's partner network.
• Marketing and advertising partners — to deliver personalized advertising on third-party platforms.
• Affiliates — our corporate affiliates, where access helps us operate the Site and provide services.
• Legal and law enforcement — as necessary to comply with applicable law, respond to legal process, or protect our rights and those of others.
• Corporate transactions — in connection with a merger, financing, acquisition, bankruptcy, dissolution, or sale of all or a portion of our business.

"Sale" and "sharing" under CCPA

The CCPA defines "sell" and "share" broadly. Some of the disclosures Nuvara makes — in particular, the information we allow analytics and advertising partners to collect through the Site (including identifiers like IP addresses, cookie IDs, and mobile identifiers; activity data; device information; and approximate location) — may be considered a "sale" or "sharing" under CCPA.

We do not sell or share: your name, email address, ZIP code, the contents of your communications with us, or the specific health goals you select on our intake form.

We do not knowingly sell or share the personal information of consumers under 16 years of age.

Your rights under CCPA

If you are a California resident, you have the following rights with respect to personal information we have collected about you:

Right to notice at collection

You have the right to receive notice of the categories of personal information we collect, the purposes for which we collect and use it, whether we sell or share it, and how long we retain it. We provide this notice in our Privacy Policy and on this page.

Right to know

You have the right to request that we disclose to you the personal information we have collected about you, and to request additional information about our collection, use, disclosure, sale, or sharing of that information.

Right to correct

You have the right to request that we correct inaccurate personal information we hold about you.

Right to delete

You have the right to request that we delete personal information we hold about you, subject to exceptions permitted under the CCPA (for example, where we need to retain information to complete a transaction, comply with a legal obligation, or exercise free speech).

Right to opt out of "sale" or "sharing"

You have the right to opt out of the "sale" or "sharing" of personal information, as those terms are defined under CCPA. If you opt out, we will not share personal information in ways that qualify as a "sale" or "sharing" under CCPA. We will continue to provide some information to our partners acting as service providers to help us perform advertising-related functions on our behalf.

Right to limit use of sensitive personal information

You have the right to limit our use and disclosure of sensitive personal information to purposes necessary to provide the services you request, or as otherwise permitted by CCPA.

Right to non-discrimination

You have the right not to be discriminated against for exercising any of your CCPA rights. We will not deny you services, charge you a different price, or provide a different level or quality of service because you exercised your rights.

How to exercise your rights

To submit any of the requests described above — including a request to know, correct, delete, opt out of "sale" or "sharing," or limit use of sensitive personal information — email us at [TBD: privacy@nuvara.com] with your request clearly described in the subject line (for example, "Request to Know," "Request to Delete," or "Do Not Sell or Share").

Your request should include:

• Your full name and the email address associated with any communications you have had with Nuvara.
• A clear description of the right you wish to exercise.
• Sufficient detail for us to identify you and process the request.

We will respond to your request within the timeframes required by CCPA, typically within forty-five (45) days, with a single forty-five (45) day extension if reasonably necessary. We will inform you if an extension is needed.

Authorized agents

You may designate, in writing or through a power of attorney, an authorized agent to make CCPA requests on your behalf. Before accepting a request from an agent, we will require the agent to provide proof that you have authorized them to act on your behalf, and we may also require you to verify your identity directly with us.

How we verify your identity

To protect your privacy and security, we will verify your identity before providing, correcting, or deleting specific pieces of personal information. Depending on the nature of your request, we may ask you to submit it from the email address associated with our interactions, or to provide additional information reasonably necessary to confirm your identity.

If we cannot verify your identity with a reasonable degree of certainty, we may decline to process the request or provide only categorical (rather than specific) information.

Right to appeal

If we decline your request, in whole or in part, you may appeal our decision. Instructions on how to appeal will be provided in our written response to your request.

Right to non-discrimination

Nuvara will not discriminate against you for exercising any of your CCPA rights. We will not deny you services, charge you different prices, or provide a different level of service because you submitted a CCPA request.

California "Shine the Light"

California Civil Code § 1798.83 ("Shine the Light") permits California residents who have an established business relationship with us to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. Nuvara does not disclose personal information to third parties for those parties' own direct marketing purposes as defined by this law. California residents may confirm our compliance with Shine the Light by emailing [TBD: privacy@nuvara.com].

Changes to this notice

We may update this notice from time to time. When we do, we will post the revised notice on this page and update the "Last updated" date at the top. If we make material changes, we will provide additional notice as required by law.

Contact us

If you have questions about this notice or your rights under CCPA, please contact us: