California Notice at Collection

Updated: November 21, 2025

California Residents

This California Privacy Notice (this "CA Notice") supplements the information contained in our Privacy Notice and applies solely to California residents ("consumers" or "you"), who visit or use the Sites. This CA Notice describes how Edifecs, a Cotiviti Business ("Edifecs", "we", "us" or "our") collects, uses, discloses, and otherwise processes personal information of individual residents of the State of California, either online or offline, within the scope of the California Consumer Privacy Act of 2018 (the "CCPA"), as amended by the California Privacy Rights Act of 2020 (the "CPRA"). Unless otherwise expressly stated, all terms in this CA Notice have the same meaning as defined in our Privacy Notice or as otherwise defined in the CCPA.

Personal Information

When we use the term "personal information" in this CA Notice, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. This CA Notice does not apply to personal information we collect when we are acting as a "service provider" to process information pursuant to a contract with one of our business customers.

For the purposes of this CA Notice, personal information does not include:

Information from online or offline locations that do not refer to and/or link to this CA Notice.
Publicly available information from government records.
Deidentified, aggregated, or anonymized information that is maintained in a form that is not capable of being associated with or linked to a consumer.
Information excluded from the CCPA's scope, such as:
- Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
- Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994 (DPPA).

Collection and Use of Personal Information

We collect personal information from and about you for a variety of purposes. For example, we use personal information to provide you with information about our products and services, to provide our products and services to our customers, for the proper administration of our business, to improve our products and services for our customers, to protect the safety and integrity of our business, and to comply with legal obligations.

To learn more about the types of personal information we collect and the purposes for which we use this information, please refer to the "Collection of Personal Information" and the "Uses of Personal Information" sections of our Privacy Notice.

In the last 12 months, we may have collected the following categories of personal information:

Identifiers, such as your name and email address;
California Customer Records (Cal. Civ. Code § 1798.80(e)), such as your username and password and phone number;
Commercial Information, such as products or services purchased, obtained or considered, or other purchasing or consuming histories or tendencies;
Internet/Network Information, such as device information, logs and analytics data;
Geolocation Data, such as non-precise geolocation information derived from your IP address;
Audio, Visual or Other Sensory Information, such as your image when recorded or captured in surveillance camera footage, pictures taken in our workplace, or voice recordings from customer service phone calls between you and Edifecs;
Other Personal Information, such as information you submit into the feedback form and any communications between you and Edifecs; and
Inferences, such as information generated from your use of the Services reflecting predictions about your interests and preferences.

We collect this information from the following sources: directly from you, from our business partners and affiliates, from your browser or device when you visit our Site or use our Services, and from third parties that you permit to share information with us.

Disclosure of Personal Information

As described in the "Disclosure of Personal Information" section of our Privacy Notice, we share personal information with third parties for business purposes.

The categories of third parties to whom we disclose your personal information for a business purpose may include: (i) other brands and affiliates in our family of companies; (ii) our service providers and advisors; (iii) marketing and strategic partners; (iv) promotional partners; (v) ad networks and advertising partners; (vi) analytics providers; and (vii) social networks.

In the previous 12 months, we have disclosed the following categories of personal information to third parties for a business purpose: Identifiers, California Customer Records, Commercial Information, Internet/Network Information, Geolocation Data, Audio, Visual or Other Sensory Information, Other Personal Information and Inferences.

We do not sell personal information.

Your California Privacy Rights

As a California resident, you may be able to exercise the following rights in relation to the personal information about you that we have collected (subject to certain limitations at law):

California Privacy Rights
Right	Description
The Right to Know	You may have the right to request any or all of the following information relating to your personal information we have collected and disclosed in the last 12 months, upon verification of your identity: The specific pieces of personal information we have collected about you; The categories of personal information we have collected about you; The categories of sources of the personal information; The categories of personal information that we have disclosed to third parties for a business purpose, and the categories of recipients to whom this information was disclosed; The categories of personal information we have sold about you (if any), and the categories of third parties to whom the information was sold; and The business or commercial purposes for collecting or, if applicable, selling the personal information.
The Right to Request Deletion	You may have the right to request the deletion of personal information we have collected from you, subject to certain exceptions.
The Right to Correct	You may have the right to correct or request that we correct inaccurate personal information that we maintain about you.
The Right to Opt Out	You may have the right to opt-out of the sale of your personal information or the sharing of your personal information for cross-context behavioral advertising or targeted advertising.
The Right to Non-Discrimination	You have the right not to receive discriminatory treatment for exercising these rights. However, please note that if the exercise of these rights limits our ability to process personal information (such as in the case of a deletion request), we may no longer be able to provide you our products and services or engage with you in the same manner.

California job applicants, employees and business contacts may submit requests via our webform located at www.dsrcotiviti.ethicspoint.com or by calling us at 844-916-1330.

Verification

Before processing your request, we will need to verify your identity and confirm you are a resident of the State of California. In order to verify your identity, we will generally either require the successful authentication of your account, or the matching of sufficient information you provide us to the information we maintain about you in our systems. This process may require us to request additional personal information from you, including, but not limited to, your first and last name, email address, phone number, company name, and/or date of last interaction with Edifecs.

In certain circumstances, we may decline a request to exercise the rights described above, particularly where we are unable to verify your identity or locate your information in our systems. If we are unable to comply with all or a portion of your request, we will explain the reasons for declining to comply with the request.

Authorized Agents

In certain circumstances, you are permitted to use an authorized agent (as that term is defined by the CCPA) to submit requests on your behalf through the designated methods set forth in this California Privacy Disclosures where we can verify the authorized agent's authority to act on your behalf. For consumer requests, we require the following for verification purposes: (a) receiving a power of attorney valid under the laws of California from you or your authorized agent; or (b) receiving sufficient evidence to show that you have provided the authorized agent signed permission to act on your behalf. We may also require you to verify your identity directly with us pursuant to the instructions set forth in these California Privacy Disclosures, and/or to confirm with us directly that you have provided the authorized agent permission to submit the request on your behalf. We do not require consumers to re-verify their identity when an authorized agent submits a "Request to Opt-Out of Sale/Sharing" or "Request to Limit the Use of Sensitive Personal Information" on the consumers behalf.

Timing

We will confirm receipt of your verifiable request within ten (10) business days. We will respond to all requests within 45 days, unless we need more time, in which case we will notify you and may take up to 90 days total to respond to your request.

Minors Under Age 18

Please contact us at PrivacyOffice@Cotiviti.com to inform us if you are under the age of 18 and are interested in using our Services, or if you are the parent or guardian of someone under 18 who is interested in doing so. We do not knowingly collect, sell or share the personal information of consumers less than 18 years of age, unless we receive affirmative authorization (the "Right to Opt In") from the parent or guardian of such minor and consent to such minor dependent's use of the Sites. If we learn that any Personal Information we collect has been provided by a child under the age of 18, we will take reasonable measures to promptly delete that personal information from our records. If you become aware of any data we may have collected from children under age 18, please contact us at PrivacyOffice@cotiviti.com.

Additional Information

We will update this CA Notice from time to time. When we make changes to this CA Notice, we will change the "Updated" date at the beginning of this CA Notice. All changes shall be effective from the date of publication unless otherwise provided in the notification.

Contact Us

If you have any questions or requests in connection with this CA Notice or other privacy-related matters, please send an email to PrivacyOffice@Cotiviti.com.