HEMOCUE CALIFORNIA CONSUMER RIGHTS NOTICE

Effective Date 2023-01-19 (last updated 2023-01-19)

ABOUT THIS POLICY

This California Consumer Rights Notice (“Notice”) supplements our Privacy Policy (“Policy”) by providing additional information about how HemoCue and its affiliates and subsidiaries, a full list of which can be located here (collectively, “Company,” “we,” “our,” and “us”) process Personal Data relating to California residents that is subject to the California Consumer Privacy Act, as amended from time to time (“CCPA”). We strongly encourage you to read in full our Policy in addition to this Notice. In the event of a conflict between the Policy and this Notice, the Notice shall control with respect to our processing of Personal Data relating to California residents that is subject to the CCPA, otherwise the Policy shall control.

PERSONAL DATA DEFINED BY CALIFORNIA CONSUMER PRIVACY ACT

Under the CCPA and for the purpose of this Notice “Personal Data” is any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, as defined in the. Personal Data includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular consumer or household (California Consumer Privacy Act Section 1798.140(v)):

Personal Data does not include information that is deidentified or aggregate information. Nor does it include Publicly Available information. Publicly Available information is information lawfully made available from federal, state, or local government records, or information that a business has a reasonable basis to believe is lawfully made available to the public by the consumer or from widely distributed media; or information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience. Publicly available does not mean biometric information collected by a business about a consumer without the consumer’s knowledge.

PERSONAL DATA COLLECTION

See the section of the Privacy Policy entitled “General Categories of Personal Data We Collect” for more information about the types of Personal Data we collect and about the sources from which we obtain Personal Data. This includes types of Personal Data that may be considered “sensitive” under the CCPA.

PURPOSES OF PROCESSING PERSONAL DATA

See the section of the Privacy Policy entitled “General Categories of Personal Data We Collect” for more information about the business and commercial purposes for which we collect, use, and disclose Personal Data, including Personal Data that may be considered “sensitive” under the CCPA. See the section of the Policy entitled “Data Retention” for more information about retention practices.

PERSONAL DATA NOTICE

See the section of the Privacy Policy entitled “General Categories of Personal Data We Collect” for more information about the circumstances in which we disclose Personal Data and the parties to whom we disclose such Personal Data. As described in the Policy, we disclose Personal Data relating to California residents for various business purposes to Company entities and Third Party Service Providers that process such Personal Data on our behalf, including the following:

Categories of Personal Data that we Disclosed for Business Purpose

Identity and Contact Information
Demographic Information
Commercial and Financial Information
Health Information
Professional and Education Information
Technical Information

YOUR RIGHTS AND EXERCISING YOUR RIGHTS

Your Rights under the California Consumer Privacy Act
You may have the right under applicable law to:

• Request to know the categories of Personal Data we collect
• Request to know the categories of Service Providers and 3rd Parties we share your Personal Data with
• Request access to your Personal Data (a copy of the data will be provided to you in a reasonable format)
• Request we delete your Personal Data
• Request we correct your Personal Data
• Request we transfer your Personal Data to another person or organization
• Request that we do not sell your data with third parties
• Request that we opt you out of sharing your Personal Data for cross-context behavioral advertising or automated decision making
• Request that we limit use or disclosure of Sensitive Personal Data

Our Verification Process
Before we can begin to process your request, we must first verify your identity. We will use the following points of information for our verification process.

• Email Address
• Full Name
• Phone Number
• Mailing Address
• Employer, Service Provider, 3rd Party Vendor or Organization’s Name you are associated with
• A unique ID assigned to you by Company (if applicable)

Requests made for categories of information about you requires that we verify your identity using at least two points of information listed above.

Requests made for specific information requires that we use at least three points of information listed above. Additionally, you will be required to provide a document signed under penalty of perjury affirming that you are the consumer who you are making the information request about.

For requests made for the deletion of information we will require two or three of the points of information above, depending on the sensitivity of the information requested to be deleted.

How To Make A Request
To exercise your rights under the CCPA, you can contact us by:
• Calling our toll-free number 1-888-914-9661 PIN: 046783 (when prompted to do so, please leave your name, email address, and the fact that your request relates to HemoCue) or
• Submitting a request through this webform.

We will not unlawfully deny you goods or services or discriminate against you for exercising your privacy rights.

Proxy Requests
Requests made by a California resident’s proxy will follow the same Verification Process as above. If you are submitting a request through a proxy, the proxy must provide documentation proving they have your permission.

Sales and Sharing of Information of California Residents
We do not sell or share your Personal Data, including Personal Data of minors under the age of 16, with third parties for any purpose other than to provision services to you, and which are in line with our Privacy Policy. To exercise your right to opt-out click here.

PERSONAL DATA EXEMPT FROM CALIFORNIA CONSUMER PRIVACY ACT

Certain types of Personal Data are exempt from the CCPA. If you submit a request regarding your Personal Data, and in our sole opinion we believe that your Personal Data is either in part or in whole exempt from the CCPA we will inform you as such. Examples include Personal Data that is processed under the following laws or obligations:
• Our compliance with federal, state, or local laws, compliance with a court order or subpoena to provide information, or cooperating with law enforcement and regulatory agencies in conducting investigations
• Health Insurance Portability and Accountability Act (HIPAA)
• Confidentiality of Medical Information Act
• Gramm-Leach-Bliley Act
• California Financial Information Privacy Act

For a full list of the exemptions please visit California Consumer Privacy Act Section 1798.145.

QUESTIONS AND COMPLAINTS

For more information about your privacy rights, or if you are not able to resolve a problem directly with us and wish to make a compliant, you can contact the California Attorney General.

CONTACT US

If you have any questions about this Notice or our data practices, you can write to us at:

HemoCue AB
Attn: Legal & Compliance (Privacy)
PO Box 1204
SE-26223 Ängelholm
Sweden

Alternatively, you can email us directly at privacy@hemocue.com.

WE MAY UPDATE THIS NOTICE

From time to time we may change this Notice. The most updated copy will be found on our website. Please check our site periodically for updates.