6. U.S. DATA SUBJECT RIGHTS
There are a number of U.S. states that provide specific consumer rights to residents of those jurisdictions regarding personal information. This section of this Policy describes the rights available to those individuals who are entitled to them. For more information, or to request to exercise your data rights, please use the information provided under Contact Us.
Not all individuals about whom we possess information will have access to these rights and we may not be able to provide these rights to everyone due to legal and jurisdictional limitations. We may not be able to comply with your request for a number of reasons, including:
- you do not live in a state that grants you the specific right that you have requested;
- the information that you’ve requested is not subject to the regulation that grants you the right to make a request in relation to your personal information;
- we are prevented or exempted by law, regulation or rule from complying with your request;
- we do not maintain your personal information in a manner that is connected to your identity;
- we are not able to comply with your request without incurring disproportionate burden or expense; or
- if complying with your request conflicts with the integrity of our Services, the ability to administer our websites or mobile applications, to administer our business and related relationships or to establish, defend or administer legal claims.
If any of the above reasons apply, we will let you know in our response to your request. You may initiate a complaint by sending us a message by following the instructions provided under Contact Us.
Note that we may be required to gather additional information from you in order to process your request. We will only use this information in the context of evaluating and responding to your request. If you fail or refuse to provide the necessary information, we may not be able to process your request.
This section contains the following U.S. state specific disclosures:
- California
- Nevada
- Virginia
A. CALIFORNIA
The California Consumer Privacy Act (“CCPA”) provides the residents of California with the right to request the data rights as described in this section. For more information, or if you have questions, you can contact us using the information provided under Contact Us.
Once we receive your request to exercise a right, we will confirm receipt and begin to evaluate, and if appropriate, process the request. We may require that you provide additional information to confirm your identity, including providing us with at least two or more pieces of personal information to match against personal information that we currently maintain about you. We reserve the right to reject your request if we are unable to verify your identity to a sufficiently high level of certainty. The information you provide to verify your identity will only be used for verification purposes, and a record of your request, including certain information contained within it, will be maintained by CorVel for our files.
If we reject a request for any reason, we will inform you of the basis of the rejection.
Please note that certain kinds of personal information that is subject to federal law (like health information subject to the Health Insurance Portability and Accountability Act) is not covered by the CCPA even if you are a California resident. We may not be able to provide these CCPA rights to you with regards to this information due to legal and operational restrictions.
Right to Know: California residents have the right to know what personal information CorVel has collected about them, including the categories of personal information, the categories of sources from which the personal information is collected in the past 12 months, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom CorVel discloses personal information, and the specific pieces of personal information CorVel has collected about them.
The categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for which we collect personal information and the categories of third parties to whom we disclose personal information are found in the general Policy in the section What Information We Collect And Disclose And For What Purposes.
California residents have a right to know if we are “selling” or “sharing” their personal information, what categories of personal information are “sold” or “shared,” and to whom. We do not “sell” or “share” the personal information of California residents, including of those under the age of sixteen, as those terms are defined by California law:
- “Sell,” “selling,” “sale,” or “sold,” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business a third party for monetary or other valuable consideration.
- “Share,” “shared,” or “sharing,” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
If you are a California resident and would like to request to know the specific pieces of personal information that CorVel collected, used and disclosed about you in the past 12 months, please contact us using the information provided under Contact Us. You may further request to know the specific pieces of personal information collected by CorVel beyond 12 months into the past, but note that this additional time frame only applies to personal information collected by CorVel after January 1, 2022, and CorVel may have deleted your personal information in accordance with our data retention policy.
To verify any request to know specific pieces of personal information, you may be required to provide identity verification information. Failure to do so could result in CorVel’s inability to comply with your request.
Right to Delete: California residents have the right to request the deletion of their personal information maintained by CorVel.
California residents have the right to request that CorVel delete the personal information that we maintain about them. We will make every effort to comply with California residents’ requests to delete their personal information, however, certain laws or other legal requirements might prevent some personal information from being deleted. If you are a California resident and would like to request the deletion of your personal information, please contact us using the information provided under Contact Us. To verify any request to delete personal information, you may be required to provide identity verification information. Failure to do so could result in CorVel’s inability to comply with your request.
Right to Correct: California residents have the right to request that a business correct inaccurate personal information about them.
California residents have the right to request that a business correct inaccurate personal information maintained by the business about them. If you are a California resident and would like to request the correction of your inaccurate personal information, please contact us using the information provided under Contact Us. To verify any request to correct, you may be required to provide identity verification information. Failure to do so could result in CorVel’s inability to comply with your request.
You may be required to provide documentation to support your assertion that your personal information as maintained by CorVel is incorrect. If you fail to provide this documentation, your request may be rejected. We reserve the right to delete your inaccurate personal information instead of correcting it, if permitted by the CCPA.
Right to Non-Discrimination: California residents have the right to not be discriminated against due to the exercise of their privacy rights under the CCPA.
California residents have the right to be free from discriminatory treatment by CorVel for the exercise of their privacy rights. However, the exercise of certain privacy rights by California residents may make it so that we are no longer able to provide those residents with certain services or communications. For example, if, at the request of a California resident, CorVel deletes all of the California resident’s personal information that it maintains, CorVel will no longer be able to send communications to that resident.
Right to Opt-Out: California residents have the right to opt-out of the “sale” or “sharing” of their personal information.
California residents can request that a business stop “selling” or “sharing” their personal information. As stated above, we do not “sell” or “share” your personal information. Therefore, we do not offer a way to opt-out of “sale” or “share” of personal information and neither do we look for or process any online browser preference or opt-out signals that purport to opt-out of the “selling” or “sharing” of personal information.
Right to Limit Use and Disclosure of Sensitive Personal Information: California residents have the right to direct a business to limit its use and disclosure of their “sensitive” personal information.
California residents can request that a business limit its use or disclosure of their “sensitive” personal information to that use or disclosure which is necessary to perform the services or provide the goods reasonably expected by an average consumer, or to those uses or disclosures otherwise authorized by California law in CCPA regulation § 7027(m).
However, we do not use or disclose your “sensitive” personal information for any purpose other than for the specific purposes described under the CCPA regulation § 7027(m) and always in a manner reasonably necessary and proportionate for these permitted purposes. For information on how we use or disclose your “sensitive” personal information, please see the applicable disclosures in the section titled: What Information We Collect From You And For What Purposes.
Right to Make Requests Through an Authorized Agent: California residents can designate an authorized agent to make a request under the CCPA on their behalf.
California residents can designate an authorized agent to make requests under the CCPA on their behalf relating to the residents’ personal information. Only you as a California resident, or a person you have designated in writing as your authorized agent, may make a consumer request related to your personal information.
If you wish to have an authorized agent make a verifiable consumer request on your behalf, they will need to provide us with sufficient written proof that you have designated them as your authorized agent, such as a power of attorney pursuant to California Probate Code sections 4000 to 4465. We will still require you to provide sufficient information to allow us to reasonably verify that you are the person about whom we have collected personal information.
We can deny any request made by a purported authorized agent who does not submit proof that they has been authorized by the California resident to act on the California resident’s behalf. For more information on submitting a request on behalf of a California resident as an authorized agent, you can contact us using the information provided under Contact Us.
Notice of Financial Incentives: California residents are entitled to certain information about CorVel’s financial incentive programs.
However, CorVel does not offer any programs with a financial incentive, as defined by the CCPA, to consumers.
Do Not Track (“DNT”): DNT is an optional browser setting that allows you to express your preferences regarding tracking across websites. Most modern web browsers give you the option to send a Do Not Track signal to the websites you visit, indicating that you do not wish to be tracked. However, there is no accepted standard for how a website should respond to this signal, so we do not take any action in response to this signal. We do not have a mechanism in place to respond to DNT signals. Instead, in addition to publicly available third-party tools, we offer you the choices described in this Privacy Policy to manage the collection and use of information about you.
B. NEVADA
Nevada law provides Nevada residents the ability to opt-out of the sale of their personal information. However, we do not sell the personal information of Nevada residents as described by Nevada law. CorVel does not disclose your personal information unless the disclosure is (i) to an entity that processes personal information on our behalf as a service provider or (ii) for purposes which are consistent with the reasonable expectations of a consumer considering the context in which we collected it.
C. VIRGINIA
The Virginia Consumer Data Protection Act (“VCDPA”) provides the residents of Virginia with the right to request the data rights as described in this section. For more information, or if you have questions, you can contact us using the information provided under Contact Us.
Once we receive your request to exercise a data right, we will confirm receipt and begin to evaluate, and if appropriate, process the request. We may require that you provide additional information to confirm your identity, including providing us with at least two or more pieces of personal information to match against personal information about you that we may maintain about you. We reserve the right to reject your request if we are unable to verify your identity to a sufficiently high level of certainty. The information you provide to verify your identity will only be used for verification purposes, and a record of your request, including certain information contained within it, will be maintained by CorVel for our files.
If we reject a request for any reason, we will inform you of the basis for the rejection. If you disagree with our decision to reject your request, you have the right to appeal our refusal within a reasonable period of time. If you wish to appeal, please clearly and plainly describe your basis of disagreement with our decision by responding through the same means by which we communicated our refusal or by submitting your appeal through the information provided under Contact Us. We will review your appeal and either change our decision or reject your appeal, and in either case, we will provide a written explanation of the reason for the decision. This decision will be final. However, you have the right to submit a complaint to the Virginia Attorney General through the means described here.
Please note that certain kinds of personal information that is subject to federal law (like health information subject to the Health Insurance Portability and Accountability Act) is not covered by the VCDPA even if you are a Virginia resident. We may not be able to provide these VCDPA rights to you with regards to this information due to legal and operational restrictions.
Right to Confirmation and Access: Virginia residents have the right to confirm whether or not a business is processing their personal information and to access such personal information.
The general categories of personal information that we collect and disclose about Virginia residents are listed in the general Policy in the section titled: What Information We Collect From You And For What Purposes.
If you are a Virginia resident and would like to request to access the personal information that CorVel collects, uses and discloses about you, please contact us using the information provided under Contact Us.
To authenticate any request to access personal information, you may be required to provide authentication information. Failure to do so could result in CorVel’s inability to comply with your request.
Right to Correct: Virginia residents have the right to request that a business correct inaccurate personal information that the business maintains, taking into account the nature of the personal information and the purposes of the processing of the personal information.
If you are a Virginia resident and would like to request correction of the personal information that we hold about you, please contact us using the information provided under Contact Us. To authenticate any request to correct personal information, you may be required to provide authentication information. Failure to do so could result in CorVel’s inability to comply with your request.
Right to Delete: Virginia residents have the right to request that a business delete the personal information that the business maintains about them.
We will make every effort to comply with Virginia residents’ requests to delete their personal information, however, certain laws or other legal requirements might prevent some personal information from being deleted.
If you are a Virginia resident and would like to request the deletion of your personal information, please contact us using the information provided under Contact Us. To authenticate any request to delete personal information, you will be required to provide the information requested. Failure to do so could result in CorVel’s inability to comply with your request.
Right to Portability: Virginia residents have the right to request to receive their personal information that they have provided to a business in a portable and readily usable format.
Virginia residents have the right to request that they receive the personal information that they have provided to CorVel in a portable and, to the extent technically feasible, readily usable format that allows the resident to transmit the personal information to another entity without hindrance, in cases where CorVel’s processing of personal information is carried out by automated means.
If you are a Virginia resident and would like to request to receive the personal information that you have provided to us in a portable and, to the extent technically feasible, readily usable format, please contact us using the information provided under Contact Us.
Right to Opt-Out of Targeted Advertising: Virginia residents have the right to request to opt out of the processing of personal information by a business for purposes of targeted advertising.
Under Virginia law, “targeted advertising” generally means displaying advertisements where the advertisement is selected based on personal information obtained from your activities over time and across non-CorVel websites or online applications to predict your preferences or interests. However, we do not engage in targeted advertising of Virginia residents, as that term is defined by Virginia law.
Right to Opt-Out of Sale: Virginia residents have the right to request to opt out of the sale of their personal information.
Under Virginia law, “selling” personal information generally means the exchange of personal information for monetary consideration to a third party. However, we do not “sell” the personal information of Virginia residents, as that term is defined by Virginia law.
Right to Opt-Out of Profiling: Virginia residents have the right to request to opt out of any profiling that produce legal or similarly significant effects concerning them.
Under Virginia law, “profiling” generally means any automated processing performed on your personal information to evaluate, analyze, or predict personal aspects related to your economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.
However, we do not “profile” Virginia residents, as that term is defined by Virginia law.