PRIVACY NOTICE FOR CALIFORNIA RESIDENTS

Effective Date: April 1, 2021

This Privacy Notice for California Residents (this “Notice”) is provided on behalf of HealthCare Royalty and its subsidiaries (referred to collectively as “HCRx”, “we”, “us”, “our” or similar pronouns) and applies solely to California residents who are our customers, users of the Sites, as defined below, or others (“consumers” or “you”), except as noted in the paragraph below.  We adopt this Notice to comply with the California Consumer Privacy Act of 2018 (“CCPA”) and any terms defined in the CCPA (such as “personal information”) have the same meaning when used in this Notice. This Notice supplements the information contained in our Online Privacy and Cookie Policy, which applies to information collected through our website www.hcrx.com, and our accounts on various social media platforms (collectively, the “Sites”), our U.S. Customer Privacy Notice and our Non-US Customer Privacy Notice (collectively, the “HCRx Privacy Policies”).

This Notice does not apply to information about our employees resident in California that is used in the context of employment; our employees should see our Employee Handbook for relevant information.

Categories of Personal Information

We have collected the following categories of personal information in the preceding 12 months:

  • Identifiers, such as name, postal address, email address and other contact details, Social Security number, identification number, identification documents such as passport, national identity card or driver’s license, unique personal identifier, online identifier, Internet Protocol address or other similar identifiers.
  • Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)), such as name, address, telephone number, signature, Social Security number, passport number, driver’s license or state identification card number, employment, employment history or bank account number.
  • Protected classification characteristics under California or federal law, such as age (40 years or older), race, citizenship or sex.
  • Commercial information, such as records of products, account balance, account transactions, source of wealth, assets and account history, risk tolerance or services obtained or considered.
  • Internet or other electronic network activity, such as browsing history, search history or information on a consumer’s interaction with a website, application or advertisement.
  • Geolocation data.
  • Professional or employment-related information.
  • Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99))

Categories of Sources

We collect personal information directly from you (e.g., from applications or other forms and questionnaires), indirectly from you (e.g., from observing your actions on the Sites) and from other sources, such as information from internet service providers, social media platforms, analytics providers, operating systems and platforms, credit bureaus and vendors supplying background checking services, commercially available sources, public records, our affiliates or other business partners.

Use and Disclosure For Business and Commercial Purposes

We use and disclose the categories of personal information listed above for business or commercial purposes.  As further described in the Online Privacy and Cookie Policy and U.S. Customer Privacy Notice, these purposes include to operate, manage and maintain our business, to comply with applicable legal and regulatory requirements, to provide our products and services, in connection with our vendor relationships, for job applicant administration and review, to perform requisite risk assessments including background, credit, money laundering and conflict checks and to accomplish our business purposes and objectives. In the preceding 12 months, we have shared the categories of personal information listed above for business purposes with our service providers, business partners and affiliates who are involved in providing our services or operating our business.

Sales of Personal Information

We do not sell personal information of our customers. We have not “sold” personal information of other California consumers in the preceding 12 months.  You can find more detail about our practices for sharing personal information with third parties in our Online Privacy and Cookie Policy, and our U.S. Customer Privacy Notice. Moreover, we do not have actual knowledge that we sell the personal information of minors under 16 years of age.

Access and Data Portability Rights

You have the right to request that we disclose the following information to you with respect to the preceding 12 months:

  • the categories of personal information collected about you;
  • the categories of sources from which the personal information is collected;
  • the purposes for collecting or sharing personal information;
  • the categories of third parties with which we share personal information for a business purpose;
  • the categories of personal information we have “sold” and, if applicable, the categories of third parties to which we sold personal information; and
  • the specific pieces of personal information we collected about you.

These access and data portability rights do not apply to (i) personal information collected about job applicants, contractors or similar individuals and used only within the context of such a relationship (“employment-related personal information”) or (ii) personal information reflecting a written or verbal business-to-business communication (“B2B personal information”).

Deletion Request Rights

You have the right to request that we delete the personal information (other than employment-related personal information or B2B personal information) we collected about you, subject to certain exceptions provided by the CCPA.  Once we receive and confirm your verifiable request, we will delete the requested personal information from our records, unless an exception provided by the CCPA applies.  For example, we may retain personal information as required or permitted by law, and may maintain a copy of your deletion request.

Exercising Your Access, Data Portability Or Deletion Rights

To exercise the access, data portability and deletion rights described above, please submit a verifiable consumer request to us by either calling us at 203 487 8300 or emailing us at privacy@hcrx.com.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative. Please describe your request with sufficient detail for us to properly understand, evaluate and respond to it.

Requests From Authorized Agents

If you would like an authorized agent to submit a CCPA request on your behalf or if you are an authorized agent of a consumer and registered with the Secretary of State to conduct business in California, please send us an email at privacy@hcrx.com for instructions and details on proof required for use of an authorized agent, including a copy of the written permission signed by the consumer for the agent to act on the consumer’s behalf in this manner.

Right Of Non-Discrimination

You have the right not to receive discriminatory treatment by us for exercising any of your CCPA rights.

Reasonable Access For Consumers With Disabilities

Persons with disabilities may obtain this Notice in alternative format upon request by contacting us at privacy@hcrx.com or calling 203 487 8300.

Changes To This Notice

We reserve the right to amend this Notice at our discretion at any time. When we make changes to this Notice, we will post the updated Notice on the website and update the Effective Date. Your continued use of the Sites following the posting of changes constitutes your acceptance of such changes.

Contact Information

If you have any questions or concerns about this Notice, the ways in which we collect, use and disclose your personal information described here, or your choices and rights regarding such practices, please do not hesitate to contact us at 203 487 8300 or privacy@hcrx.com.