Additional Information for Residents of California

This addendum applies only to residents of the State of California and to the Personal Information of a particular California consumer or household ("California Personal Information"). It describes how we collect, use, and share California Personal Information to the extent we act as a "business" under the California Consumer Privacy Act of 2018 ("CCPA"), and the rights that consumers have under the CCPA. California Personal Information does not include, and this section of the Privacy Policy does not apply to:

• Personal information that is exempt from the CCPA;
• Personal information we collect in connection with communications or transactions with consumers who are acting as representatives of companies and other organizations that occur solely within the context of conducting due diligence regarding, or providing or receiving a product or service to or from such companies or organizations; or
• Personal Information we collect, use, and share on behalf of our customers as a "service provider" under the CCPA.

California Personal Information We Collect

We may collect, and may have collected the following categories of California Personal Information regarding consumers within the last 12 months:

• Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)), such as name, signature, address, telephone number, bank account number, credit card number, debit card number, or any other financial information. Some Personal Information included in this category may overlap with other categories;
• Identifiers such as your real name, alias, postal address, zip code, telephone number, email address and account name;
• Unique and online identifiers such as device identifiers, internet protocol addresses, cookie identifiers, beacon identifiers, pixel tags or mobile ad identifiers or similar technology, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device;
• Commercial information that identifies or could reasonably be linked to you, such as products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies;
• Internet or other electronic network activity information identifies or could reasonably be linked to you, such as browsing history, search history and information regarding an individual's interaction with an internet website, application, or advertisement;
• Professional or employment-related information, such as current or past job history;
• Sensory data, such as audio, electronic, visual, thermal, olfactory, or similar information;
• Protected classification characteristics under California or federal law, which includes age if 40 years or older, race, color, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, pregnancy or childbirth and related medical conditions), veteran or military status, genetic information (including familial genetic information);
• Inferences drawn from Personal Information, such as person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes; and
• Geolocation data, such as precise location information from your device or rough location generated based on IP address.

Sources of California Personal Information

We collect California Personal Information from the sources described in the "The Personal Information We Collect And How We Use It" section of this Privacy Policy.

Use of California Personal Information

We may use the categories of California Personal Information that we collect, as described above, for one or more of the business purposes and commercial purposes described in the "How We Use Personal Information" section above.

Disclosures of California Personal Information for a Business Purpose

We may disclose the categories of California Personal Information that we collect as indicated above to the categories of third parties described in the How We Share Disclose Information section above. In the preceding 12 months, we may have disclosed all of the categories of California Personal Information listed above to our service providers and other third parties when you direct us to do so, or when you use our Services to do so.

Sales of California Personal Information

We do not sell California Personal Information, and we do not have actual knowledge that we sell California Personal Information of consumers under 16 years of age.

California Personal Information Rights and Choices

The CCPA and other California laws provide consumers with specific rights regarding their California Personal Information. This section describes those rights and explains how to exercise those rights to the extent we direct the purposes and means of the processing of your California Personal Information processing and otherwise qualify as a "business" under the CCPA.

Access to Personal Information and Data Portability Rights

California residents have the right to request that we disclose certain information to you about our collection, use, disclosure, and sale of your California Personal Information over the past 12 months. If we receive and confirm a verifiable consumer request from you pursuant to the "Exercising Access, Data Portability, and Deletion Rights" section below, we will disclose to you, depending on the scope of the request:

• The categories of California Personal Information we collected about you.
• The categories of sources for the California Personal Information we collected about you.
• Our business or commercial purpose for collecting California Personal Information about you.
• The categories of third parties with which we share your California Personal Information.
• The specific pieces of California Personal Information we collected about you.
• If we disclosed your California Personal Information for a business purpose, a list of the categories of third parties to whom we disclosed California Personal Information for a business purpose identifying the categories of California Personal Information disclosed to those parties in the preceding 12 months.

Deletion Request Rights

California residents have the right to request that we delete California Personal Information, subject to certain exceptions. Once we receive and confirm your verifiable consumer request pursuant to the "Exercising Access, Data Portability, and Deletion Rights" section below, we will delete your California Personal Information from our records, unless an exception applies.

Exercising Access, Data Portability, and Deletion Rights

To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to us at https://privacy.curebase.com/consent or privacy@curebase.com.

You may designate an authorized agent to submit requests on your behalf through a signed written permission that authorizes the agent to act on your behalf. We may mandate additional requirements when submitted through an authorized agent, such as requiring you to verify your identity directly with us or to directly confirm the authorized agent's permission to act on your behalf. You may only make a verifiable consumer request for access or data portability twice within a 12-month period. Your request must provide information sufficient to permit us to reasonably verify you are the person about whom we collected California Personal Information, or an authorized agent of that person. To verify your request, we may require you to provide additional information, including account profile information such as your Services email address and other information elements necessary to verify your identity. Your request also must include sufficient detail for us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with California Personal Information if we cannot verify your identity or authority to make the request and confirm the California Personal Information relates to you.

Making a verifiable consumer request does not require you to create an account with us. However, if you have a password-protected account with us we consider requests made through that account sufficiently verified when the request relates to California Personal Information associated with that specific account.

Any disclosures we provide will only cover the 12-month period preceding our receipt of the verifiable request. If we cannot fulfill, or are permitted to decline, your request then we will alert you or your authorized agent. For data portability requests, we will select a format to provide your California Personal Information that is readily usable.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision, and we reserve the right to either refuse to act on your request or charge you a reasonable fee to complete your request if it is excessive, repetitive, or manifestly unfounded.

Non-Discrimination

Subject to certain exceptions, you have a right to not receive discriminatory treatment for exercising your access, data portability, and deletion rights described above.