CCPA Privacy Notice for California Residents

Effective Date: June 1, 2024

LAST UPDATED June 1, 2024

gro (“we”, “us”, “our”) is an app that validates and encourages changes in behavior and takes a proactive approach to mental health. We help university students (our “Customers”)  identify tools that can help them form new ways of thinking and learn how to cope with life’s challenges and prepare for their future. We are required by the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, (referred to collectively as “CCPA”) to explain to California residents (“Consumers”) our online and offline practices regarding how we collect, use and share their Personal Information, and the rights and choices we offer them regarding our handling of their Personal Information. This Privacy Notice for California Residents (“CCPA Notice”) supplements our Privacy Notice. Capitalized terms in this CCPA Notice not specifically defined herein shall have the meaning set forth in the CCPA as context requires.

Personal Information

When we use the term “Personal Information” in this CCPA Notice, we mean information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

Changes

We may update this CCPA Notice from time to time. Any updated Privacy Notice, including this CCPA Notice, will be effective when posted. Please check this CCPA Notice periodically for updates. If required by law, we will contact you directly to provide you with an updated CCPA Notice.

1. Sources of Personal Information

“Personal Information” is any information relating to an identified or identifiable natural person.

We may collect Personal Information about you from the following sources:

1. Directly from you. We may collect Personal Information you provide to us directly, such as when you contact us through our website(s), fill out a survey, sign up for offers or newsletters, communicate with us, purchase a product, place or customize orders, or sign up for an account or other services.
2. Data collected automatically and through tracking technologies. We may automatically collect information or inferences about you, such as through cookies and other tracking technologies, when you interact with our website(s). This may include information about how you use and interact with our website(s) or otherwise interact with us, information about your device, and internet usage information).
3. From third parties. We may collect Personal Information from third parties, such as service and content providers, business partners, data brokers, social media companies, or other parties who interact with us.
4. From publicly available sources. We may collect Persona Data about you from publicly available sources, such as public profiles and websites.

We may combine and use information and make inferences from information that we receive from the various sources described in this Notice, including third party sources. We may also use and disclose the combined information and inferences for the purposes identified below.

2. Types of Personal Information We Collect

We may collect the following types of Personal Information:

1. Identifiers, such as your name, email address, physical address, telephone number, business contact information, account number, and device identifiers (e.g., cookie IDs and IP address).
2. Business Contact Records, such as
   1. Signatures; and
   2. Your physical characteristics or a description of you.
3. Protected class and demographic information, such as age (including birthdates) and gender.
4. Commercial information, such as purchase or subscription information, information about products you or our business contacts order or are interested in, payment details, delivery details, and other commercial or financial information; and legal information relating to your transactions, such as fraud checks or flags raised about your transactions, payment card refusals, complaints and information related to their resolution, and legal requests and communications.

5. Internet or other electronic network activity information, such as your browsing history, search history, preference information (including marketing and purchasing preferences), account settings (including any default preferences), and information regarding your interactions with and use of the website(s). For more information about cookies and other device data, please see Section 6 below.
6. Non-precise geolocation data, such as your location as derived from your IP address.
7. Audio, electronic, visual, or other sensory information, such as photographs and audio/video recordings.
8. Professional or employment-related information, such as job title, organization, professional licenses, credentials, professional specialty, professional affiliations, and other professional information.
9. Education information.
10. Inferences drawn from any of the information we collect to assess the level of interest in our products and services based on frequency of visits and contact, evaluate the industries showing interest in our products and services based on IP address (where we can infer your approximate location to improve our communications to you), and determine your preferred frequency for receiving offers.
11. Sensitive Personal Information, which may include the following:
    1. Social Security number, driver’s license number, or passport number.
    2. Account log-in, access code, password, or credentials allowing access to an account.
    3. Information about your health.
    4. Medical or health insurance information, including insurance policy number.
    5. Precise geolocation.
    6. Racial or ethnic origin, political opinions, religious or philosophical beliefs, or union membership.
    7. Biometric data.

3. How We Use Personal Information

We may use Personal Information for the following purposes:

1. To provide you or your company with products and services, such as providing and delivering you the goods and services you or the company that you represent requests; providing customer service; processing or fulfilling orders and transactions; verifying customer information; processing payments; communicating with you about your product, service or subscription; hosting informational webinars; verifying eligibility for certain programs or benefits; responding to requests, complaints, and inquiries; and providing similar services or otherwise facilitating your relationship with us.
2. For our internal business purposes, such as maintaining or servicing accounts; operating our website(s) and customizing the content; maintaining internal business records; enforcing our policies and rules; conducting organizational analysis; completing management reporting; managing Company assets and global workforce; undertaking work planning, both administratively and organizationally (including work schedules and billing of clients); project management; auditing; maintaining records on business activities, such as accounting, commercial, procurement, document management and other similar activities; budgeting; real estate management; IT administration of our network, intranet, and other technologies; and IT security management and tasks.
3. For our internal research, academic research and product improvement purposes, such as verifying or maintaining the quality or safety of our products or services; improving our products and services; designing new products or services; evaluating the effectiveness of our advertising or marketing efforts; partnering with academic institutions to perform academic research, and debugging and repairing errors with our systems, networks, and equipment.
4. For legal, safety or security reasons, such as complying with legal requirements, processes, or orders; complying with reporting and similar requirements; complying with government inspections and other requests from government or other public authorities; pursuing legal rights and remedies; investigating and responding to claims against the Company and its customers and employees; protecting our, your, our customers’, and other individuals’ safety, property or rights; addressing security and health and safety issues (including managing spread of communicable diseases) and malicious, deceptive, fraudulent, or illegal activity; and receiving legal advice or approval.
5. In connection with a corporate transaction, such as if we acquire, or some or all of our assets are acquired by, another entity, including through a sale in connection with bankruptcy and other forms of corporate change.
6. For marketing, such as marketing our products or services or those of our affiliates, business partners, or other third parties (for purposes of this paragraph alone, “we’” or “our” includes our affiliates, business partners, or other third parties we may be working with to provide marketing). For example, we may use Personal Information we collect to send you newsletters, surveys, questionnaires, promotions, or information about events or webinars, to show you personalized ads on our website(s) or our business partner’s websites, to analyze emails sent and content viewed by customers, to identify visitors across devices and sites, to identify (lookalike) audiences (including by identifying you across devices and sites) to better target our advertising to you. You can unsubscribe to our email marketing via the link in the email or by contacting us using the information in the Contact Information section below.

We may use anonymized, de-identified, or aggregated information for any purpose permitted by law.

4. How We Disclose Personal Information

We may disclose Personal Information to third parties, including to the categories of recipients described below:

1. Service providers that work on our behalf to provide the products and services you request or support our relationship with you, such as IT providers, internet service providers, web hosting providers, data analytic providers, and companies that provide business support services, financial administration, or event organization.
2. Professional consultants, such as accountants, lawyers, and financial advisors.
3. Vendors necessary to complete transactions you request, such as shipping companies and logistics providers.
4. Law enforcement, government agencies, and other recipients for legal, security, or safety purposes, such as when we share information to comply with law or legal requirements, to enforce or apply our Terms of Use and other agreements or policies, and to protect our, your, our customers’, or other third parties’ safety, property or rights.
5. Other entities in connection with a corporate transaction, such as if we, or some or all of our assets, are acquired by another entity, including through a sale in connection with bankruptcy or other forms of corporate change.
6. Business partners that may use Personal Information for their own purposes, such as companies that operate cookies and other tracking technologies, academic institutions, social media companies, data brokers, and other business partners who may use the data for their own marketing, research, or analytics purposes. Where required by law, we will obtain your consent prior to disclosing your Personal Information to our business partners. Where recipients use your Personal Information for their own purposes independently from us, we are not responsible for their privacy practices or Personal Information processing policies. You should consult the privacy notices of those third-party services for details on their practices.
7. Entities to which you have consented to the disclosure.

5.  Your Rights Concerning Personal Data as a California Resident

California residents may have the following rights concerning collection, use, sharing, and deletion of Personal Information:

• Right to Know. You have the right to request information about the categories of Personal Information we have collected about you, the categories of sources from which we collected the Personal Information, the purposes for collecting, selling, or sharing the Personal Information, and to whom we have disclosed your Personal Information and why. You may also request the specific pieces of Personal Information we have collected about you.
• Right to Delete. You have the right to request that we delete Personal Information that we have collected from you.
• Right to Correct. You have the right to request that we correct inaccurate Personal Information that we maintain about you.

California residents may exercise the Right to Know, the Right to Delete, and the Right to Correct by calling/emailing us at [PHONE NUMBER/EMAIL ADDRESS].

Verification: In order to process rights requests, we may need to obtain information to locate you in our records or verify your identity depending on the nature of the request. In most cases, we will collect some or all of the following data elements: first and last name, email address, and telephone number. In some cases, we may request different or additional information, including a signed declaration that you are who you say you are. We will inform you if we need such information.

Authorized Agents: Authorized agents may exercise rights on behalf of you by submitting a request by [calling us/emailing us] at [Phone Number or change to email] and indicating that they are submitting the request as an agent. We may require the agent to demonstrate authority to act on behalf of you by providing signed permission from you. We may also require you to verify your own identity directly with us or to directly confirm with us that you provided the authorized agent permission to submit the request.

Timing: We will respond to Right to Delete, Right to Correct, and Right to Know requests within 45 days unless we need more time, in which case we will notify you and may take up to 90 days total to respond to your request.

1. Additional Data Processing Disclosures

In addition to the disclosures in the sections above, this section provides supplemental information about how we process Personal Information.

Disclosure of Personal Information

We do not knowingly sell or share Personal Information of California residents. We do not knowingly collect, sell or share any Personal Information of minors under the age of 16.

Below please find a chart detailing the categories of Personal Information we collected and with whom it was sold, shared, or disclosed for a business purpose in the past 12 months:

Categories of Personal Information We Collect	Categories of Third Parties With Whom We May Disclose Personal Information for a Business Purpose	Categories of Third Parties to Whom Personal Information May be Sold [1] or Shared [2]
Identifiers (Section 2.A)	Service providers; Professional consultants; Vendors necessary to complete transactions you request; Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes; In connection with a corporate transaction; Entities to which you have consented to the disclosure	Not sold or shared
Personal Information subject to the California Customer Records Act (Section 2.B)	Service providers; Professional consultants; Vendors necessary to complete transactions you request; Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes; In connection with a corporate transaction; Entities to which you have consented to the disclosure	Not sold or shared
Characteristics of protected classifications under California or federal law (Section 2.C)	Service providers; Professional consultants; Vendors necessary to complete transactions you request; Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes; In connection with a corporate transaction; Entities to which you have consented to the disclosure	Not sold or shared
Commercial information (Section 2.D)	Service providers; Professional consultants; Vendors necessary to complete transactions you request; Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes; In connection with a corporate transaction; Entities to which you have consented to the disclosure	Not sold or shared
Biometric information (Section 2.E)	Service providers; Professional consultants; Vendors necessary to complete transactions you request; Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes; In connection with a corporate transaction; Entities to which you have consented to the disclosure	Not sold or shared
Internet or other electronic network activity (Section 2.F)	Service providers; Professional consultants; Vendors necessary to complete transactions you request; Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes; In connection with a corporate transaction; Entities to which you have consented to the disclosure	Not sold or shared
Geolocation data (Section 2.G)	Service providers; Professional consultants; Vendors necessary to complete transactions you request; Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes; In connection with a corporate transaction; Entities to which you have consented to the disclosure	Not sold or shared
Audio, electronic, visual, olfactory, or similar information (Section 2.H)	Service providers; Professional consultants; Vendors necessary to complete transactions you request; Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes; In connection with a corporate transaction; Entities to which you have consented to the disclosure	Not sold or shared
Professional or employment-related information (Section 2.I)	Service providers; Professional consultants; Vendors necessary to complete transactions you request; Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes; In connection with a corporate transaction; Entities to which you have consented to the disclosure	Not sold or shared
Education information (Section 2.J)	Service providers; Professional consultants; Vendors necessary to complete transactions you request; Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes; In connection with a corporate transaction; Entities to which you have consented to the disclosure	Not sold or shared
Inferences (Section 2.K)	Service providers; Professional consultants; Vendors necessary to complete transactions you request; Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes; In connection with a corporate transaction; Entities to which you have consented to the disclosure	Not sold or shared
Sensitive Personal Information (Section 2.L)	Service providers; Professional consultants; Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes; In connection with a corporate transaction; Entities to which you have consented to the disclosure	Not sold or shared

1.  CCPA defines “sale” as selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration. Cal. Civ. Code § 1798.140(ad).

2. CCPA defines “sharing” as s renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged. Cal. Civ. Code § 1798.140(ah).

6.  Cookies and Other Tracking Technologies

We use cookies and other tracking tools to analyze website traffic and facilitate advertising. These cookies and other tracking tools may be shared with others in connection with advertising. We honor your advertising choices, and if you would like to opt out of our (and our third party advertising partners’) use of cookies and/or other tracking tools, please review the instructions provided in the Tracking Opt Out section below.

7.  Tracking Opt-Out Guide

Like many companies online, we use services provided by Google, Facebook and others companies that use tracking technology. These services rely on online tracking technologies – such as cookies and web beacons – to collect directly from your device information about your browsing activities, about your interactions with websites, and about the device you are using to connect to the Internet. There are a number of ways to opt out of having you online activity and device data collected through these services, which we have summarized below:

• Blocking cookies in your browser. Most browsers let you remove or reject cookies, including cookies used for interest-based advertising. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. For more information about cookies, including how to see what cookies have been set on your device and how to manage and delete them, visit www.allaboutcookies.org.
• Blocking advertising ID use in your mobile settings. Your mobile device settings may provide functionality to limit use of the advertising ID associated with your mobile device for interest-based advertising purposes.
• Using privacy plug-ins or browsers. You can block our websites from setting cookies used for interest- based ads by using a browser with privacy features, like Brave, or installing browser plugins like Privacy Badger, Ghostery or uBlock Origin, and configuring them to block third party cookies/trackers.
• Platform opt-outs. The following advertising partners offer opt-out features that let you opt-out of use of your information for interest-based advertising:
  • Google: https://adssettings.google.com
  • Facebook: https://www.facebook.com/about/ads
• Advertising industry opt-out tools. You can also use these opt-out options to limit use of your information for interest-based advertising by participating companies:
  • Digital advertising Alliance: http://optout.aboutads.info
  • Network Advertising Initiative: http://optout.networkadvertising.org/?c=1

8.         Requesting Additional Information

If you have any questions or comments about this notice or how we handle Personal Information, you may contact us via mail at: beau@gromentalhealth.com