M3 Global Research: California Privacy Policy

Effective Date: January 1, 2020
Last Revised: March 15, 2020

This notice supplements the information contained in the main M3 Global Research Privacy Policy (the "Main Privacy Policy") set forth above, and applies solely to residents of the State of California ("California Privacy Policy"). We have adopted our California Privacy Policy in order to comply with the California Consumer Privacy Act of 2018 ("CCPA").¹

Our California Privacy Policy is intended to fulfill CCPA's objectives of providing California consumers with a comprehensive disclosure of the collection, sharing, disclosure, and sale of their personal information by particular businesses (as CCPA defines those terms), and of the rights that California consumers have regarding their personal information ("California Privacy Rights").

California Privacy Rights Under CCPA

Right to Know About Personal Information Collected, Disclosed or Sold ("Right to Know")

Scope of Applicable Personal Information

CCPA provides you the right to request that we disclose to you any or all of the following about your personal information for the 12-month period preceding your request:

the specific pieces of personal information that we have collected about you;
the categories of personal information we have collected about you;
the categories of sources from which we have collected your personal information;
the categories of personal information that we have sold or disclosed for a business purpose about you;
the categories of third parties to whom your personal information was sold or disclosed for a business purpose; and
the business purpose for collecting or selling your personal information.

CCPA also provides you the right to receive information about any financial incentives (i.e., compensation payments) that we may offer in connection with use of your personal information for participating in certain of our Activities (as that term is defined in "About M3 Global Research" in our Main Privacy Policy ).

For detailed information about the personal information that we collect and the purposes for which we collect it, please see Part II ("Information We Collect and What We May Do With It") below.

If you exercise your Right To Know, after we confirm your identity, as explained more fully in Part III ("Exercising Your California Privacy Rights"), we will: (a) disclose to you the information we have collected about you during the preceding 12 months that corresponds to your request; and (b) deliver, free of charge to you, by mail, or electronically, the personal information that you have requested, in the manner required by CCPA and as further described below in Part III ("Exercising Your California Privacy Rights").

Exclusions from Scope of Personal Information

CCPA excludes the following from its definition of "personal information":

Publicly available information from government records
De-identified or aggregated consumer information
Information excluded from CCPA's scope, such as

Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data; and
Personal information regulated by other sector-specific laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA), California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994

Right to Have Personal Information Deleted ("Right to Delete")

You have the right to request the deletion of your personal information that we collect or maintain.

If you exercise your Right to Delete, after we confirm your identity, as explained more fully below in Part III ("Exercising Your California Privacy Rights"), we will, in the manner specified by CCPA, permanently delete your personal information from our records, unless one of the CCPA exceptions applies to your deletion request applies.

Also, to the extent required by CCPA, we will direct deletion of your personal information by third parties with whom we have shared the personal information that you have requested that we delete.

Exceptions to your Right To Delete include, but are not limited to, instances when the personal information is necessary to complete a transaction or provide the service requested by you for which the subject personal information was collected or provided (such as to participate in our market research Activities), detect security incidents or protect against deceptive, fraudulent, or illegal activity, or to comply with a legal obligation under CCPA, the California Electronic Communications Privacy Act, or other California or US federal law.

Right to Opt-Out of the Sale of Personal Information ("Right to Opt-Out")

Under CCPA, you have the right to opt-out of the "sale" (as defined by CCPA) by a CCPA-subject business of your personal information to third parties. CCPA defines a "sale" of personal information as occurring when a business exchanges personal information of California residents to a third party for monetary or other valuable consideration.

M3 Global Research does not "sell" your personal information, in either the CCPA sense, nor any other sense.

When you consent to participate in one of our market research Activities, we may share your personal information with our clients and carefully selected service providers solely for business purposes and as otherwise required by law.

Except as set forth herein, all data that we share will be deidentified information (meaning, data that has been carefully encrypted so it no longer identifies you or is linkable to you) or aggregate information (which means data from a group of individuals from which all individual identities have been carefully removed so no particular person may be identified). Neither deidentified information nor aggregate consumer information are considered personal information as defined in CCPA.

To the extent we collect personal information of minor children under the age of 18, we similarly limit the disclosure of their personal information to business purposes, or use deidentified or aggregate information about them. We do not sell the personal information of minor children.

Personal information will never be shared in any way, or for any purpose, other than for what has been specifically consented for us to do with it.

Right to Not Be Discriminated Against for Exercising Your California Privacy Rights ("Right to Non-Discrimination")

You have the right to not receive discriminatory treatment if and when you exercise any of your California Privacy Rights under CCPA. This would include, as examples, imposing a penalty fee or denying services to you because you exercised a CCPA right.

We will never penalize or otherwise subject you to discriminatory treatment for exercising any of your California Privacy Rights.

Please note that exercising your right to delete some or all of your personal information may mean that you are not able to participate in certain market research opportunities that we offer.

For example, if we do not have enough information to determine whether you meet the criteria for a study, you will not receive invitations to participate. In addition, certain studies may require that certain aspects of your personal information be shared with the client (such as a focus group opportunity, where your name, contact information, medical background, and practice location are needed in order to convene a desired focus group).

Financial incentives, such as per-survey compensation payments, are made for certain of our market research Activities. Market research compensation payment amounts are set at levels determined by taking into account many variables such as (by way of examples only) the complexity of the subject matter of the research inquiry, the professional education, training, and experience level desired for the respondents, the number of respondents needed, and the number of qualified respondents available.

If you have questions about your Right to Non-Discrimination, please contact us as described in Part III ("Exercising Your California Privacy Rights") below.

Information We Collect and What We May Do With It

M3 Global Research, our subsidiaries, and our affiliates, as well as our third-party business partners with whom we conduct our regular business operations, may collect, share, or disclose personal information solely for business purposes as described in the following sections:

Categories of Third Parties refers to the following persons or entities with whom we may share personal information for business purposes:

Business Support Consultants (examples include our consultants, advisors, and/or vendors who help us by (as examples only): (a) preventing fraud or violations of our Terms of Service; (b) analyzing site user data and behavior, and tracking page performance; (c) identifying site issues and repair errors that impair intended functionality; (d) providing marketing and survey panel recruitment assistance, such as moderators and translators; (e) providing customer service to our Site users; (f) providing CCPA-required and other verifications of consumers or consumer consent; and/or (g) providing data storage and/or data processing services.

All of our Business Support Consultants have written agreements with us which:

require them to comply with all legal privacy requirements to which we are subject, including those provided in CCPA;
limit their access to personal information to the minimum necessary in order to perform their services for us; and
restrict them from making any use of personal information beyond fulfilling the specific services to us for which they are engaged;

Business Partners (examples include clients, prospective clients and their representatives who may engage us to conduct market research or provide other services for CCPA-permitted business purposes); and
Public Authorities (examples include law enforcement and other government authorities if required by law or reasonably necessary to protect the rights, property, and safety of others or ourselves

Business Purposes for Collecting Personal Information: M3 will only collect and use your personal information for the following business purposes listed below:

Providing you with the services and support that you may request, and processing and validating your transactions;
Communicating with you about your account or transactions, changes to our policies and other administrative matters, or responding to your questions and comments;
Understanding better your interests in order to provide you with customized market research opportunities and other content;
Administering our research surveys and studies, and improving all of our products, services and operations;
Ensuring compliance with our policies and Website Terms and Condition, or as we believe is necessary to protect, enforce or defend the legal rights, privacy, safety or property of ourselves and others;
Complying with our legal and regulatory requirements; and
Helping us better search for, communicate with, and validate prospective panel members in our systems in order to match them with particular market research needs.

These business purposes are indicated by numeral, as applicable, in the third and fourth columns (respectively) of the charts in the next two sections.

We will never use your personal information differently than what we have disclosed to you in this notice, unless we first notify you and obtain your consent to a different use.

Notice at Collection (Personal Information Collected By Us Upon Your Visiting Our Site)

CATEGORY OF PERSONAL INFORMATION from CCPA §1798.140(o)(1)(A-K)	PERSONAL INFORMATION COLLECTED BY US UPON YOUR VISITING OUR SITE	BUSINESS PURPOSE FOR WHICH PERSONAL INFORMATION WILL BE USED
A. Internet or Other Electronic Network Activity Information	Browsing history and information about interaction with M3 Global research websites and applications Cookies, web beacons and device fingerprinting/watermarking are collected by and then used on the website as Google ReCAPTCHA to determine whether the user is human and not a bot.	I, II, III, IV, V, VI, VII
B. Geolocation Data	General physical and work location	I, III, IV, V, VI, VII

Personal Information We Have Collected Over the Past Twelve Months

CATEGORY OF PERSONAL INFORMATION from CCPA §1798.140(o)(1)(A-K)	EXAMPLES OF PERSONAL INFORMATION COLLECTED BY US OVER THE PAST 12 MONTHS	CATEGORY OF SOURCES FROM WHICH COLLECTED	BUSINESS PURPOSE FOR WHICH COLLECTED	CATEGORY OF THIRD PARTIES TO WHICH DISCLOSED
A. Identifiers	Name, postal address, e-mail address, telephone numbers, registration details for Healthcare Professionals, Internet protocol address, records of the Activities (as defined in the Main Privacy Policy) participated in, qualified for, completed or partially completed.	Directly from You Business Support Consultants Business Partners Public Authorities Public Records	I, II, III, IV, V, VI, VII	Business Support Consultants Business Partners Public Authorities
B. Categories of Personal Information from California's Customer Records statute	Signature (electronic and/or physical), education (level and institution) and for Healthcare Professionals, their specialty and information on occupation and seniority	Directly from You Business Support Consultants Business Partners Public Authorities Public Records	I, III, IV, V, VI, VII	Business Support Consultants Business Partners Public Authorities
C. Protected Classifications Under US or California Law	Nationality, age, race, marital status, medical condition, physical or mental disability, gender, and banking details for compensation payments	Directly from You Business Support Consultants Business Partners Public Authorities Public Records	I, II, III, IV, V, VI	Business Support Consultants Business Partners Public Authorities
D. Commercial Information	Products or services purchased and participation in market research and any associated compensation for time.	Directly from You Business Support Consultants Business Partners Public Authorities Public Records	I, II, III, IV, V, VI, VII	Business Support Consultants Business Partners Public Authorities
E. Internet or Other Electronic Network Activity Information	Browsing history information about interaction with M3 Global research websites and applications. Cookies, web beacons and device fingerprinting/watermarking are used on the website as Google ReCAPTCHA to determine whether the user is human and not a bot.	Directly from You Business Support Consultants Business Partners	I, II, III, IV, V, VI, VII	Business Support Consultants Business Partners Public Authorities
F. Geolocation Data	General physical and work location	Business Support Consultants	I, III, IV, V, VI	Business Support Consultants Public Authorities
G. Sensory Information	Audio, electronic, visual, recordings of market research participation	Directly from You Business Support Consultants Business Partners	I, II, III, IV, V, VI, VII	Business Support Consultants Public Authorities
H. Professional or Employment-Related Information	Specialty and seniority of Healthcare Professionals, medical experience and types of patients treated.	Directly from You Business Support Consultants Business Partners Public Authorities Public Records	I, III, IV, V, VI, VII	Business Support Consultants Public Authorities
I. Inferences Drawn From Other Personal Information	Profile reflecting preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes	Business Support Consultants	III, IV, V, VI, VII	Business Support Consultants Public Authorities

Sales of Personal Information During Past 12 Months

M3 Global Research does not ever "sell" personal information, as described in more detail above in Part I.C ("Right to Opt-Out of the Sale of Personal Information").

Exercising Your California Privacy Rights

Exercising Rights to Opt-Out of Sale of Personal Information: As M3 Global Research does not "sell" any personal information, as that term is defined in CCPA, we have not provided consumers with a means to "opt-out" of such sales. However, we will be glad to answer any questions you may have about this or any of your California Privacy Rights. Please use one of the contact methods described below to reach us for any questions.

In order to exercise your Right to Know, Right to Delete, or Right To Non-Discrimination, please submit your request to us in any one of the ways listed below.

By Webform: please click here and you will be directed to a form that you may either submit electronically, or print out and mail to us at our address below:
By Telephone: 833-M3-GRDPO (833-634-7376) (Monday through Friday from 8:00 a.m. to 5:00 p.m. ET)
By E-mail: Privacy@m3globalresearch.com (please put "California Privacy Request" in the subject line)
By Mail or Courier:
M3 Data Protection Officer
c/o M3 USA Corporation
501 W. Office Center Drive; Suite 410
Fort Washington, PA 19034

Only you, or a person (or a business entity registered with the California Secretary of State) whom you have authorized to act on your behalf may make a consumer request about your personal information. Consistent with CCPA's provisions, we may require either (or both) that you provide your authorized agent with written permission to act for you and verify your own identity to us (or provide a power of attorney signed by you stating your authorized agent's power to act for you).²

If you have questions or concerns about your rights under our California Privacy Policy, or any of the provisions or practices described in either our California Privacy Policy or our Main Privacy Policy, please contact us via the telephone number, e-mail address, or mail/courier address provided above.

Responding to Right to Know and Right to Delete Requests

Within ten (10) business days of receipt of your Right to Know or Right to Delete request, we will confirm our receipt, provide you details about the process we will follow to respond to your request, and/or ask questions, or for additional information, that may be required.

We plan to fulfill these requests within 45 calendar days of receiving the request. If we need more time to respond to your request, we will let you know the reason and, within the first 45 calendar days following receipt of your request, estimate how much additional time we will need (in any event, we will complete your request within 90 calendar days in total from receipt of the request).

If we deny your Right to Know or Right to Delete request, in whole or in part, we will provide you with the reason for this, and if our denial is partial, we will disclose to you, or delete (as applicable), the other information you have requested.

Verification Process: To assert your Right to Know or your Right to Delete, you will be asked to verify your identity before fulfilling your request. This verification process may require you to provide pieces of personal information that we already hold on you, or, in certain circumstances, a signed declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request.
Procedure; Frequency of Submitting Right to Know Requests: You may make requests regarding your Right to Know only twice within any 12-month period.

We do not charge a fee to process or respond to your Right to Know requests, unless a particular request is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
Procedure; Frequency of Submitting Right to Delete Requests: You may make a Right to Delete request to us at any time. Following verification of your request, we will immediately and permanently delete the personal information requested by you, unless one of CCPA's exception to this right applies to your request.

If we cannot verify the identity of the consumer requesting deletion of personal information, we may deny the Right to Delete request, and will inform the requestor of this.

Once we verify the identity of the consumer making the Right to Delete request, we will respond to their request by either:

permanently and completing erasing the personal information from our systems and records, in the manner specific by CCPA;
de-identifying the personal information (meaning, carefully encrypting the personal information so it no longer identifiable or linkable to a particular consumer); or
aggregating the personal information individual (meaning, we will carefully remove any consumer-identifiers from it, and group it together with other similarly-stripped data from which the resulting data group contains no particular consumer's personal information in an identifiable fashion).

We will inform you of the manner in which we have deleted your personal information following a Right to Delete request.

Updates to this Supplementary Privacy Notice

We may reserve the right to periodically update our California Privacy Policy. Please reference the "LAST UPDATED" legend above for the effective date of the most recent updates. Your continued use of our Site following these changes means that you accept the revised California Privacy Policy.

¹ California's full CCPA statute, 1798 Cal. Civ. Code #chr(0167)##chr(0167)# 1978.100 - 1798.199, may be found here: https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&title=1.81.5.&part=4.

² For information on preparing a Power of Attorney, see Cal. Probate Code #chr(0167)##chr(0167)# 4000-4465 ("Powers of Attorney"), here: http://leginfo.legislature.ca.gov/faces/codes_displayexpandedbranch.xhtml?tocCode=PROB&division=4.5.

M3 Global Research Supplementary Privacy Notice for California Residents Only