The CCPA provides California residents with specific rights regarding their personal information. This section describes your CCPA rights and explains how to exercise those rights.
Right to Know and Data Portability
You have the right to request that Pareto disclose certain information to you about its collection and use of your personal information over the past 12 months (the “right to know”). Once Pareto receives your request and confirms your identity, Pareto will disclose to you:
- The categories of personal information Pareto collected about you.
- The categories of sources from whom Pareto collected personal information about you.
- Pareto’s business or commercial purpose for collecting or sharing that personal information.
- The categories of third parties with whom Pareto shares that personal information.
- If we sold or disclosed your personal information for a business purpose, two separate lists disclosing:
- sales, identifying the personal information categories that each category of recipient purchased; and
- disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.
- The specific pieces of personal information we collected about you (also called a data portability request).
Pareto does not provide a right to know or data portability disclosure for B2B personal information.
Right to Delete
You have the right to request that Pareto delete any of your personal information that Pareto collected and retained, subject to certain exceptions (the “right to delete”). Once Pareto receives your request and confirms your identity, Pareto will review your request to see if an exception allowing Pareto to retain the information applies. Pareto may deny your deletion request if retaining the information is necessary for Pareto or its service provider(s) to:
- Complete the transaction for which Pareto collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of Pareto’s ongoing business relationship with you, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or otherwise perform Pareto’s contract with you.
- Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
- Debug products to identify and repair errors that impair existing intended functionality.
- Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
- Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
- Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
- Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with Pareto.
- Comply with a legal obligation.
- Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
Pareto will delete or deidentify personal information not subject to one of these exceptions from its records and will direct Pareto’s service providers to take similar action.
Pareto does not provide these deletion rights for B2B personal information.
Exercising Your Rights to Know or Delete
To exercise your rights to know or delete described above, please submit a request by either:
Pareto Health, LLC
2929 Walnut Street, Suite 1500
Philadelphia, PA 19104
Only you, or someone legally authorized to act on your behalf, may make a request to know or delete related to your personal information.
You may only submit a request to know twice within a 12-month period. Your request to know or delete must:
- Provide sufficient information that allows Pareto to reasonably verify that you are the person about whom Pareto collected personal information or an authorized representative of such person, which may include, depending on the type and sensitivity of the personal information in question:
- Answers to questions about personal information provided to Pareto that only the person to whom the personal information pertains would know.
- A response from you to a verification email sent by Pareto.
- A signed declaration under penalty of perjury stating that the personal information requested is about the requestor.
- If you are attempting to exercise your rights to know or delete though an authorized representative, documentation (e.g., a valid power of attorney) that the representative is authorized to make the request on your behalf.
- Describe your request with sufficient detail that allows Pareto to properly understand, evaluate, and respond to it.
Pareto cannot respond to your request or provide you with personal information if it is unable to verify your identity or authority to make the request and confirm the personal information relates to you.
You do not need to create an account with Pareto to submit a request to know or delete.
Pareto will only use personal information provided in the request to verify the requestor’s identity or authority to make it.
Response Timing and Format
Pareto will confirm receipt of your request within ten (10) business days. If you do not receive confirmation within the 10-day timeframe, please contact Pareto at the contact information listed below.
Pareto endeavors to substantively respond to a verifiable consumer request within forty-five (45) days of its receipt. If Pareto requires more time (up to another 45 days), Pareto will inform you of the reason and extension period in writing.
The written response to your request will be delivered by mail or electronically, at your option.
Any disclosures that Pareto provides will only cover the 12-month period preceding Pareto’s receipt of your request. The response that Pareto provides will also explain the reasons that it cannot comply with a request, if applicable. For data portability requests, Pareto will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.
Pareto does not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If Pareto determines that the request warrants a fee, Pareto will let you know the reason for such decision and provide you with a cost estimate before completing your request.
Personal Information Sales Opt-Out and Opt-In Rights