Version: 1.1

Date: 2/1/2023

THIS ADDENDUM (“ADDENDUM”) FORMS PART OF THE MASTER AGREEMENT (“AGREEMENT”), ENTERED INTO BY AND BETWEEN YOU, THE CLIENT AND THE VENDOR (EACH AS RECITED IN THE APPLICABLE ENROLLMENT FORM). CLIENT AND VENDOR MAY BE REFERRED TO IN THIS ADDENDUM INDIVIDUALLY AS A “PARTY” AND COLLECTIVELY AS THE “PARTIES”.

This Addendum reflects the Parties’ desire and intent to modify and amend the Agreement, in accordance with the terms and conditions herein expressly with regard to the processing of Client Personal Information (as defined below) by Vendor on behalf of the Client. This Addendum prevails over any conflicting terms of the Agreement, but does not otherwise modify the Agreement. Capitalized terms not defined herein shall have the meanings in the Agreement. Client enters into this Addendum on behalf of itself and, to the extent required under the CCPA, in the name and on behalf of its Authorized Affiliates (defined below).

The parties agree as follows:

1. Definitions.
   1. “Affiliate” has the meaning set forth in the Agreement.
   2. “Authorized Affiliate” means any of Client’s Affiliate(s) permitted to or otherwise receiving the benefit of the Services pursuant to the Agreement.
   3. “Business” has the meaning set forth in Section 1798.140(c) of the CCPA.
   4. “Business Purpose” has the meaning set forth in Section 1798.140(d) of the CCPA.
   5. “CCPA” means the California Consumer Privacy Act of 2018, Cal. Civ. Code §1798.100 et. seq., and its implementing regulations.
   6. “Commercial Purpose” has the meaning set forth in Section 1798.140(f) of the CCPA.
   7. “Consumer” has the meaning set forth in Section 1798.140(g) of the CCPA.
   8. “Client Personal Information” means any Personal Information provided by, or collected on behalf of, Client in its capacity as a Business subject to the CCPA and processed by Vendor solely on Client behalf.
   9. “Deidentified” has the meaning set forth in Section 1798.140(h) of the CCPA.
   10. “Personal Information” has the meaning set forth in Section 1798.140(o) of the CCPA.
   11. “Service” has the meaning set forth in the Agreement.
   12. “Service Provider” has the meaning set forth in Section 1798.140(v) of the CCPA.
        
2. Scope and Applicability of this Addendum.
   1. This Addendum shall only apply and bind the Parties if and to the extent Client is a “Business” under the CCPA as to Customer Personal Information.
   2. Client appoints Vendor as a Service Provider to process the Client Personal Information on behalf of Client. As between the parties, Client is solely responsible for compliance with the requirements of the CCPA applicable to Businesses.
       
3. Restrictions on Processing.
   1. Vendor may only retain, use, or disclose Client Personal Information for the specific purpose of performing the Services or as otherwise permitted by the CCPA, including for its Business Purposes. Vendor shall not retain, use, or disclose Client Personal Information for a Commercial Purpose other than providing the Services.
       
4. Notice.
   1. If applicable, Client represents and warrants that it has provided notice that the Client Personal Information is being used or shared consistent with Cal. Civ. Code 1798.140(t)(2)(C)(i).
       
5. Consumer Rights.
   1. To the extent Client, in its use of the Services or otherwise, does not have the ability to fulfill a request that Client receives from a Client pursuant to Sections 1798.100, 1798.105, 1798.110, or 1798.120 of the CCPA with respect to Client Personal Information (a “Privacy Request”), Vendor shall provide commercially reasonable assistance to Client in responding to such Privacy Request. Client will reimburse Vendor for its reasonable costs in providing such assistance.
   2. Vendor may retain Client Personal Information subject to a Privacy Request pursuant to Section 1798.105 of the CCPA if it is necessary for Vendor to maintain such information for one or more purposes provided in Cal. Civ. Code 1798.105(d), but only for the period of time the applicable purpose(s) apply.
       
6. Deidentified Information.
   Vendor may Deidentify Client Personal Information in accordance with the CCPA, and may use, retain, and disclose such Deidentified information for its own purposes. Such Deidentified information will not be subject to this Addendum.
    
7. Certification.
   Vendor certifies that it understands and will comply with the restrictions in Section 3 (Restrictions on Processing) of this Addendum.
    
8. Term.
   This Addendum shall remain in effect for so long as Vendor maintains Client Personal Information pursuant to the Agreement.