California Privacy Addendum

Effective Date: Jun 23, 2026

1. Introduction.

This California Privacy Addendum (the “California Privacy Addendum”) supplements the information contained in ClinNEXUS, Inc.’s (“ClinNEXUS”) Privacy Notice (the “Privacy Notice”) and describes our collection and use of Personal Information (as defined below).

This California Privacy Addendum applies to all (i) visitors and users of our Website, and (ii) employees, owners, directors, officers, or independent contractors of another company, partnership, sole proprietorship, nonprofit, or government agency who reside in the State of California (collectively, “California Residents” or “you”). If you are not a resident of California, this California Privacy Addendum does not apply to you. We adopt this notice to comply with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (the “CCPA” or “California Privacy Law”), and any terms defined in the California Privacy Law have the same meaning when used in this California Privacy Addendum.

2. Scope of this California Privacy Addendum.

This California Privacy Addendum applies to: (i) verbal communications or transactions between us and you as a California Resident in the context of providing a product or service to or receiving a product or service from your business (a “Business Relationship”), and (ii) information that we collect on our Website, clinnexus.com (the “Website”), that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household (“Personal Information”). Publicly available information and aggregated and/or deidentified information may be excluded under the California Privacy Law (when aggregated and/or deidentified in accordance with the California Privacy Law).

This California Privacy Addendum may also not apply to certain Personal Information that is excluded from the scope of the California Privacy Law, including: (a) health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) or clinical trial data; (b) Personal Information collected and used as part of a clinical trial or other biomedical research study in accordance with applicable federal policies; and (c) Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Family Educational Rights and Privacy Act (FERPA), and the Driver’s Privacy Protection Act of 1994. Please contact us if you have any questions regarding the applicability of these exclusions.

This California Privacy Addendum does not apply to employment-related Personal Information collected from our employees, job applicants, contractors, or similar individuals (“Personnel”). Please contact us for more information about the applicability of the California Privacy Law and for information on any applicable addenda for Personnel.

3. Information We Collect About You and How We Collect It.

ClinNEXUS’s Website collects the following categories of Personal Information about California Residents, including Personal Information collected in the preceding twelve (12) months:

Personal Information Category	Applicable Pieces of Personal Information Collected
Identifiers.	A real name or alias; email address; Internet Protocol (IP) address; online identifier; and unique personal identifier.
Personal Information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	A name; email address; and employment. Some Personal Information included in this category may overlap with other categories.
Commercial information.	Information on a California Resident’s interaction with a website, application, or advertisement.
Internet or other similar network activity.	Browsing history; traffic data; and information regarding your interaction with our Website, collected through cookies and similar technologies.
Professional or employment-related information.	Current job history.

ClinNEXUS will not collect additional categories of Personal Information without providing you notice. As further described in Sale and Sharing of Your Personal Information, we do not “sell” (as defined by the California Privacy Law) Personal Information for monetary or other valuable consideration.

4. Sources of Personal Information.

We collect Personal Information about you from the sources described in our Privacy Notice.

5. Purposes for Our Collection of Your Personal Information.

We use your Personal Information only for the purposes described in our Privacy Notice.

We will not use the Personal Information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

6. To Whom We Disclose Your Personal Information for Business Purposes.

ClinNEXUS may disclose the following categories of Personal Information to service providers and contractors for business purposes. When we disclose Personal Information to service providers or contractors for a business purpose, where required by the CPRA, we enter into a contract that describes the purpose, requires the recipient to keep that Personal Information confidential, and prohibits the recipient from using it for any purpose except the specific business purposes for which it was disclosed. In the preceding twelve (12) months, ClinNEXUS has disclosed the following categories of Personal Information for one or more of the business purposes described below:

Personal Information Category	Categories of Service Provider Recipients
Identifiers.	Service Providers (e.g., IT, hosting, and security vendors).
Personal Information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	Service Providers (e.g., IT, hosting, and security vendors).
Commercial information.	Service Providers (e.g., customer service and payment processing vendors).
Internet or other similar network activity.	Service Providers (e.g., IT, hosting, and security vendors).
Professional or employment-related information.	Service Providers (e.g., customer service and payment processing vendors).

We may disclose your Personal Information for the following business purposes:

helping to ensure the security and integrity of our Website, services, and IT systems to the extent the use of the Personal Information is reasonably necessary and proportionate for these purposes;
debugging to identify and repair errors that impair existing intended functionality;
performing services on behalf of ClinNEXUS, including maintaining or servicing our Website and IT systems, providing storage and hosting, providing payment processing, providing customer service, and providing similar services; and
undertaking activities to verify or maintain the quality or safety of our Website, services, or IT systems.

In addition to the above, we may disclose any or all categories of Personal Information as necessary to:

comply with federal, state, or local laws, or comply with a court order or subpoena to provide information;
comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authorities;
cooperate with law enforcement agencies concerning conduct or activity that we believe may violate federal, state, or local law;
comply with a government agency request for emergency access to Personal Information if a person is at risk or danger of death or serious physical injury; or
exercise or defend legal claims.

We may also disclose any or all categories of Personal Information to a potential or actual buyer or other successor in the event of a planned or actual merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of ClinNEXUS’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information held by ClinNEXUS is among the assets transferred.

7. Sale and Sharing of Your Personal Information.

“Sale” of Your Personal Information for Monetary or Other Valuable Consideration

ClinNEXUS does not “sell,” and has not “sold,” Personal Information for either monetary or other valuable consideration.

“Sharing” of Your Personal Information for Cross-Context Behavioral (Targeted) Advertising

ClinNEXUS does not process Personal Information for the purpose of cross-context behavioral (targeted) advertising.

ClinNEXUS does not have actual knowledge that it collects, “sells,” or “shares” the Personal Information of California Residents under the age of 16.

8. California Resident Data Requests and Rights.

The California Privacy Law provides California Residents with specific rights regarding their Personal Information. This section describes your rights under applicable law and explains how to exercise those rights. You may exercise one or more of these rights yourself or through your Authorized Agent. For more information on how you or your Authorized Agent can exercise these rights, please see Exercising Your California Privacy Law Rights.

Right to Know. You have the right to request that ClinNEXUS confirm that it is processing Personal Information about you and disclose certain information to you about our collection, use, processing, and disclosure of your Personal Information (a “Right to Know” Request).

This also includes: (a) the categories of Personal Information we have collected about you; (b) the categories of sources from which that Personal Information came; (c) our purposes for collecting this Personal Information; (d) the categories of third parties with whom we have shared your Personal Information; and (e) if we have “sold,” “shared,” or disclosed your Personal Information, a list of categories of third parties to whom we “sold” or “shared” your Personal Information, and a separate list of the categories of third parties to whom we disclosed your Personal Information.

In California, you must specifically describe whether you are making a Right to Know Request or a Data Portability Request, and if you would like to make both, you must make both requests clear. If it is not reasonably clear from your request, we will process your request only as a Right to Know Request.

You may make a Right to Know or a Data Portability Request a total of two (2) times within a 12-month period at no charge.

Access to Specific Pieces of Information (Data Portability). You also have the right to request that ClinNEXUS provide you with a copy of the specific pieces of Personal Information that we have collected about you, including any Personal Information that we have created or otherwise received from a third party about you (a “Data Portability” Request).If you make a Data Portability Request electronically, we will provide you with a copy of your Personal Information in a portable and, to the extent technically feasible, readily reusable format that allows you to transmit the Personal Information to another third party.
In California, you must specifically describe whether you are making a Right to Know Request or a Data Portability Request, and if you would like to make both, you must make both requests clear. If it is not reasonably clear from your request, we will process your request only as a Right to Know Request.
In response to a Data Portability Request, we will not disclose your Social Security number, driver’s license number or other government-issued identification number, financial account number, health insurance or medical identification number, or any password or security questions or answers. We will also not provide this information if the disclosure would create a substantial, articulable, and unreasonable risk to your Personal Information or the security of our systems or networks, or if the Personal Information is subject to another exception under the California Privacy Law. If we are unable to disclose certain pieces of your Personal Information, we will describe generally the types of Personal Information that we were unable to disclose and provide you with a description of the reason we are unable to disclose it.
You may make a Right to Know or a Data Portability Request (or a combined request) a total of two (2) times within a 12-month period at no charge.
Right to Correction. You have the right to request that we correct any inaccurate Personal Information about you to ensure that it is complete, accurate, and as current as possible. You may request that we correct the Personal Information we have about you as described below. In some cases, we may require you to provide reasonable documentation to show that the Personal Information we have about you is inaccurate and what the correct Personal Information may be. We may also not be able to accommodate your request if we believe it would violate any law or legal requirement, cause the information to be incorrect, or if the Personal Information is subject to another exception under the applicable California Privacy Law.
Right to Deletion. You have the right to request that ClinNEXUS delete any of your Personal Information that we collected from or about you and retained, subject to certain exceptions (limited to Personal Information we have collected directly from you). Once we receive and confirm your Request (see Exercising Your California Privacy Law Rights), we will delete (and direct our service providers to delete) your Personal Information from our records, unless an exception applies under the applicable California Privacy Law. Some exceptions to your right to delete may include, but are not limited to: if we are required to retain your Personal Information to complete the transaction or provide you the goods and services for which we collected the Personal Information or otherwise perform under our contract with you; to detect security incidents or protect against other malicious activities; and to comply with legal obligations. We may also retain your Personal Information for other internal and lawful uses that are compatible with the context in which we collected it.
● Right to Non-Discrimination. We will not discriminate against you for exercising any of your California privacy rights. Unless permitted by the California Privacy Law, we will not do any of the following as a result of your exercising your California privacy rights: (a) deny you goods or services; (b) charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties; or (c) provide you a different level or quality of goods or services.

Exercising Your California Privacy Law Rights

To exercise the rights described above, please submit a request (a “California Resident Request”) to us by either:

Submitting the Contact Us form; or
Contacting us via the Contact Information below.

If you fail to make your California Resident Request in accordance with the ways described above, we may either treat your request as if it had been submitted with our methods described above or provide you with information on how to submit the request or remedy any deficiencies with your request.

Only you, or your Authorized Agent that you authorize to act on your behalf (when permitted by California Privacy Law), may make a California Resident Request related to your Personal Information. To designate an Authorized Agent when permitted by California Privacy Law, see Authorized Agents below.

All California Resident Requests must:

Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an Authorized Agent of such a person. This may include:
- your name, email address, and any other information reasonably necessary to allow us to verify your identity and the Personal Information that relates to you.
Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm which Personal Information relates to you or the individual for whom you are making the request as their Authorized Agent.

We will use Personal Information provided in a California Resident Request only to verify the requestor’s identity or authority to make the request.

Authorized Agents

When permitted by California Privacy Law, you may authorize your agent to exercise some or all of your rights under the applicable California Privacy Law on your behalf by providing them with written authorization or power of attorney to exercise your rights in accordance with applicable laws, or through other technology that we may provide for this purpose (an “Authorized Agent”). We may request that your Authorized Agent submit proof of identity and proof that they have been authorized to exercise your rights on your behalf. We may deny a request from your Authorized Agent to exercise your rights on your behalf if they fail to submit adequate proof of identity or adequate proof that they have the authority to exercise your rights.

Response Timing and Format

We will generally process these requests within forty-five (45) calendar days of receipt. If we require more time (up to an additional forty-five (45) calendar days), we will inform you of the reason and extension period in writing.

We will deliver our written response by mail or electronically, at your option.

In response to a Right to Know or Data Portability Request, we will provide you with all relevant information we have collected or maintained about you, unless an exception applies. The response we provide will also explain the reasons we cannot comply with a California Resident Request, if applicable. For a Data Portability Request, we will select a format to provide your Personal Information that is readily usable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your California Resident Request unless it is excessive, repetitive, or manifestly unfounded (and under the California Privacy Law, abusive or fraudulent). Under the California Privacy Law, we reserve the right to consider more than two (2) total Right to Know or Data Portability Requests (or combination of the two) in a twelve (12) month period to be repetitive and/or excessive and require a fee. If we determine that your California Resident Request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

9. Retention Periods.

ClinNEXUS will retain your Personal Information for as long as reasonably necessary to fulfill the purposes for which it was collected, including to operate our Website and respond to your inquiries, and to comply with our legal obligations, resolve disputes, and enforce our agreements. We may retain any or all categories of Personal Information when your information is subject to one of the following exceptions:

when stored in our backup and disaster recovery systems. Your Personal Information will be deleted when the backup media your Personal Information is stored on expires or when our disaster recovery systems are updated;
when necessary for us to exercise or defend legal claims;
when necessary to comply with a legal obligation;
when stored in the same document or record with other Personal Information. Your Personal Information will be deleted upon the expiration of the last exception that applies to such document or record; or
when necessary to help ensure the security and integrity of our Website and IT systems.

Your Personal Information will be deleted when we no longer require your Personal Information for any of the above purposes.

10. Other California Privacy Rights.

Shine the Light

Under California Civil Code Section 1798.83 (California’s “Shine the Light” law), California Residents may request information about a business’s disclosure of Personal Information to third parties for those third parties’ own direct marketing purposes. ClinNEXUS does not disclose your Personal Information to third parties for their own direct marketing purposes.

11. Changes to This California Privacy Addendum.

ClinNEXUS reserves the right to amend this California Privacy Addendum at our discretion and at any time. When we make material changes to this California Privacy Addendum, we will post the updated addendum on the Website, update the addendum’s effective date, and notify affected California Residents of the material change. Your continued use of our Website following the posting of changes constitutes your acceptance of such changes.

12. Contact Information.

If you have any questions or comments about this California Privacy Addendum, the ways in which ClinNEXUS collects and uses your information as described above and in the Privacy Notice, or your choices and rights regarding such use, or if you wish to exercise your rights under applicable California Privacy Law, please contact us at:

Phone: +1-888-254-3503
Website: The Contact Us form on our Website.
Postal Address:
ClinNEXUS, Inc.
Attn: Privacy Team
527 W. 7th Street
Suite 912
Los Angeles, CA 90014