UTAH PRIVACY NOTICE PURSUANT TO UTAH CONSUMER PRIVACY ACT (UCPA)

What Information Do We Collect and Disclose?

We collect information that identifies or is linked, or could reasonably be linked, directly or indirectly, with a particular consumer (“personal information”). In particular, we have collected the following categories of personal information from consumers within the last twelve (12) months:

For the previous 12 months we have collected, the following categories of sensitive personal information and profile information:

Please Note: Personal data, as defined by the UCPA, does not include publicly available information from government records, de-identified or aggregated consumer information, or information excluded from the UCPA's scope, such as:

• (i) Protected health information (PHI), defined and regulated under HIPAA;
• (ii) patient-identifying information under the federal substance abuse confidentiality regulations;
• (iii) information derived from exempt healthcare-related information and information deidentified using the HIPAA Privacy Rule's deidentification standards and approved methodologies;
• (iv) identifiable private information for purposes of the Federal Policy for the Protection of Human Subjects;
• (v) identifiable private information or personal data collected as part of human subjects research pursuant to or under the same standards as: (A) the good clinical practice guidelines issued by the International Council for Harmonisation; or (B)the Protection of Human Subjects under 21 C.F.R. Part 50 and Institutional Review Boards under 21 C.F.R. Part 56;
• (vi) personal data used or shared in research conducted in accordance with applicable law;
• (vii) information and documents created specifically for and collected and maintained by one of Utah Health Department's statutory committees;
• (viii) information and documents created for purposes of the federal Health Care Quality Improvement Act of 1986;
• (ix) patient safety work product for purposes of 42 C.F.R. Part 3;
• (x) personal data collected, processed, sold, or disclosed in compliance with the federal Driver's Privacy Protection Act of 1994;
• (xi) personal data regulated by the Family Educational Rights and Privacy Act;
• (xii) personal data regulated by the Farm Credit Act;
• (xiii) emergency contact information used for emergency contact purposes;
• (xiv) Personal data governed by the federal Fair Credit Reporting Act; and
• (xv) all other information exempt from application of the UCPA.

Employment Information: Please note that, under the UCPA, personal data does not include personal data of persons acting in a commercial or employment context. UCPA further excludes data collected or used within the context of an individual's role as an employee, an applicant, independent contractor, or as an agent.

How Do We Collect Information?

We collect this information from you through information you submit to us or passively by observing your actions on the Sites and Services and through cookies and related technologies. We also collect information by gathering, obtaining, receiving, and accessing the information from third parties, including customers, service providers and vendors, auditors, advisors, and data brokers. For more information regarding our data collection practices please read our general Privacy Policy.

Why Do We Collect and Process Information?

We collect and process personal information for business and commercial purposes. To learn more about why we collect and process information, please review our general Privacy Policy.

Why Do We Collect and Process Sensitive Data?

We only collect and process Sensitive Personal Data for those exempt purposes set forth in Section 304, specifically:

• comply with a federal, state, or local law, rule, or regulation;
• comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by a federal, state, local, or other governmental entity;
• cooperate with a law enforcement agency concerning activity that we reasonably and in good faith believe may violate federal, state, or local laws, rules, or regulations;
• investigate, establish, exercise, prepare for, or defend a legal claim;
• provide a product or service requested by you;
• perform a contract to which you are a party, including fulfilling the terms of a written warranty or taking steps at your request before entering into the contract or engagement with you;
• take immediate steps to protect an interest that is essential for the life or physical safety of either you or of another individual;
• detect, prevent, protect against, or respond to a security incident, identity theft, fraud, harassment, malicious or deceptive activity, or any illegal activity; or investigate, report, or prosecute a person responsible for the occurrence of such activity;
• preserve the integrity or security of systems; or investigate, report, or prosecute a person responsible for harming or threatening the integrity or security of systems, as applicable;
• assist another person with an obligation described within the purposes set forth in Section 304 of the UCPA;
• process personal data to: conduct internal analytics or other research to develop, improve, or repair a controller's or processor's product, service, or technology; identify and repair technical errors that impair existing or intended functionality; or effectuate a product recall;
• process personal data to perform an internal operation that is: reasonably aligned with the consumer's expectations based on the consumer's existing relationship with the controller; or otherwise compatible with processing to aid the controller or processor in providing a product or service specifically requested by a consumer or a parent or legal guardian of a child or the performance of a contract to which the consumer or a parent or legal guardian of a child is a party; or
• retain a consumer's email address to comply with the consumer's request to exercise a right.

Do We Share Information With Third Parties?

Yes. We take reasonable precautions to be sure that affiliates and non-affiliated third party service providers, to whom we disclose your personally identifiable information are aware of our privacy policies and will treat the information in a similarly responsible manner. Our contracts and written agreements with non-affiliated third party service providers that receive information from us about you prohibit those parties from transferring the information other than to provide the Services that you obtain from us. To learn more about why we share information with third parties please see our general Privacy Policy.

In the preceding twelve (12) months, we have disclosed the following categories of personal information for a business purpose those corresponding third parties listed below:

To learn more about why we share information with third parties, please see our general Privacy Policy.

Do We Sell Your Information?

No. Although we share data with third parties as outlined in the Privacy Policy, we do not sell any of your personal information to any third party.

Do We Share Your Information for Behavioral Advertising Purposes or Otherwise Engage In Behavioral Advertising?

No. Although we share data with third parties as outlined in the Privacy Policy and this UCPA Privacy Notice, we do not share your personal information for behavioral advertising purposes or otherwise engage in behavioral advertising as defined by the UCPA.

How Do We Protect Personal Data?

We protect data using administrative, technical, and physical safeguards. When we use third-party service providers, we ask those providers to implement similar safeguards. However, we cannot guarantee that your information is completely secure either within Company or on the systems of third party service providers.

How Long Do We Keep Your Personal Data?

We retain personal data we collect from you when we have an ongoing legitimate business need to do so (i.e., to provide you with the Services you have requested or to comply with applicable legal requirements). When we no longer have an ongoing legitimate business need to process your personal information, we will physically destroy, delete or anonymize it or, if this is not possible, then we will securely store your personal data and isolate it from any further processing until deletion is possible.

What Are My Utah Consumer Privacy Rights?

If you are a Utah resident and are engaged in a direct business relationship with Company as a consumer for provision of the Sites or Services, you may have the following rights:

• Right to Access and Data Portability.
  You may request that we provide to you certain information about our collection and use of your personal information for the 12 month period preceding your request, such as (i) requesting confirmation as to whether or not we collect your personal data and process your personal data, and (ii) accessing or otherwise receiving a copy of your personal data collected by the Company (data portability request), the categories of personal information we collected about you.
• Though you may request specific pieces of your personal information that we have collected, we may not provide certain information in order to protect the security of such information.
• Right to Correct Inaccurate Data.
  Under certain circumstances, you may request that we correct your personal data to the extent that it is inaccurate. We may deny your request depending on factors relating to the nature of the personal data and the processing purposes.
• Right to Request Deletion.
  Under certain, limited circumstances, you may request that we delete personal information that we have collected from you or maintain about you. Once we receive your request and confirm your identity, we will review your request to see if an exception allowing us to retain the information applies.
• We may deny your deletion request if retaining such information is necessary for us or our service providers to:
  • Comply with federal, state, or local laws, rules, or regulations;
  • Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, local, or other governmental authorities;
  • Cooperate with law-enforcement agencies concerning conduct or activity that the controller or processor reasonably and in good faith believes may violate federal, state, or local laws, rules, or regulations;
  • Investigate, establish, exercise, prepare for, or defend legal claims;
  • Provide a product or service specifically requested by a consumer;
  • Perform a contract to which you are a party, including fulfilling the terms of a written warranty, or take steps at your of the consumer prior to entering into a contract;
  • Take immediate steps to protect an interest that is essential for the life or physical safety of you or of another natural person;
  • Prevent, detect, protect against, or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity; preserve the integrity or security of systems; or investigate, report, or prosecute those responsible for any such action;
  • Engage in public or peer-reviewed scientific or statistical research in the public interest that adheres to all other applicable ethics and privacy laws and is approved, monitored, and governed by an institutional review board, or similar independent oversight entities;
  • Assist another controller, processor, or third party with any of the obligations under the UCPA. Make other internal and lawful uses of that information that are compatible with the context in which you provided it; or
  • We obtained the personal data from a source other than you and we either (i) maintain a record of the deletion request and retain only the minimum data necessary to ensure your personal data remains deleted, or (ii) stop processing your personal data subject to the deletion request, other than processing for purposes excluded by UCPA from application.

With respect to your Utah Privacy Rights Request, please also note the following:

• If you choose to email or mail your request, please include “Utah Privacy Rights Request” in the subject line.
• We will confirm receipt of your request within 10 business days. If you do not receive confirmation within the 10 business day timeframe, please contactStart@trupointco.com.
• Once we have verified your identity, we will respond to your request within 45 days. If we require more time (up to an additional 45 days), we will notify you in writing of the reason and the extension period.
• Making a verifiable consumer request does not require you to create an account with us, and we will only use personal information provided in a verifiable consumer request to verify your identity or authority to make the request.
• If you have an account with us, we will deliver our written response to that account. If you do not have account with us, we will deliver our written response by mail or electronically, at your option.
• Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, as applicable. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit the information from one entity to another entity without hindrance, specifically CSV format.
• We, at our option, may not respond to more than two requests in a 12 month period.
• We do not charge a fee to process or respond to your request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

What are My Personal Information Sales and Sharing Opt-Out and Opt-In Rights? We do not sell personal information, nor do we share personal information for behavioral advertising purposes or otherwise engage in behavior advertising.

What are My Sensitive Personal Information Opt-Out Rights? We do not collect or process your sensitive personal data for any purpose except (i) as necessary to perform or otherwise provide the Services to you, and (ii) for those exempt purposes set forth in Section 304 of the UCPA.

Do I have Right to Non-Discrimination? We will not discriminate against any consumer who has chosen to exercise their rights under the UCPA. Unless permitted by the UCPA, we will not deny you the Services, charge you different prices/rates for the Services (including through granting discounts or other benefit or imposing penalties), provide you a different level of quality of service, or suggest that you may receive a different price or rate for the Services or a different level or quality of Services. However, we can deny you access to our Services if such Services require your personal data that we do not collect or maintain.

However, we may offer you certain financial incentives permitted by the UCPA that can result in different prices, rates, or quality levels. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.

Changes To This Privacy Notice: We reserve the right to amend this Privacy Notice at our discretion and at any time. We may make changes to the Privacy Policy without providing you prior notice. However, after we make any changes to this Privacy Policy, we will give notice to you via (i) the Sites or (ii), where feasible, and at our discretion, contact information available to us. We encourage you to periodically review this Privacy Policy so as to remain informed on how we are protecting your information. YOUR CONTINUED USE OF OUR SITES AND SERVICES FOLLOWING THE POSTING OF CHANGES CONSTITUTES YOUR ACCEPTANCE OF SUCH CHANGES.