California Applicant Privacy Notice

CALIFORNIA APPLICANT PRIVACY NOTICE/YOUR PRIVACY RIGHTS
EFFECTIVE DATE: January 1, 2024
eHealthInsurance Services, Inc., together with its subsidiaries and affiliates (collectively, “Company” “us,” “we,” or “our”) is committed to protecting the privacy of Personal Data (i.e., information reasonably related to a specific individual). This Privacy Notice (“Notice”) describes how we process Personal Data of California residents who apply for a job with the Company. If you interact with our website, purchase our products or services, or otherwise engage with us outside of the job application context, the privacy notice provided in connection with that interaction applies instead, not this Notice. Whenever you interact with us on behalf of another individual or entity, such as if you provide us with names of other individuals as references in your job application, you must obtain their consent (or have the legal authority without consent) to share their Personal Data with us. Changes: We may update this Notice from time to time. Any updated Notice will be effective when posted. Please check this Notice periodically for updates. This Notice does not form part of any contract of employment or other contract to provide services and does not give you any contractual rights.

1. Sources of Personal Data
We collect Personal Data about you from the following sources:

• Directly from you. We may collect Personal Data you provide to us directly, such as when you complete a paper or online application (including on a dedicated online talent management platform), communicate with us in connection with your application, provide references, or participate in an interview or any aptitude test or assessment (including online). We may also collect your Personal Data when you decide to complete questionnaires, such as a satisfaction survey or a diversity and inclusion questionnaire.
• Data collected automatically. We may automatically collect information or inferences from or about you or your device.
• From third parties. We may collect Personal Data from third parties, such as companies or individuals who direct or refer you to us (including third-party staffing or recruiting firms), as well as from publicly available sources and third-party professional social networking websites. Where permitted or otherwise authorized by law, we may also collect information received from third parties in connection with background checks.

We may combine and use information and make inferences from information that we receive from the various sources described in this Notice, including third party sources. We also use or disclose the combined information and inferences for the purposes identified below.
2. Types of Personal Data We Collect
We may collect the following types of Personal Data about you:

• Identifiers, such as your name, email address, physical address, telephone number, device identifiers (e.g., IP address), and other contact information.
• Records about you, such as your employment history, background check information (where permitted or required by law), information from employment eligibility checks, disciplinary records (including criminal convictions and offenses), signatures, and your physical characteristics or a description of you.
• Protected class and demographic information, such as your military or veteran status and your gender.
• Internet or other electronic network activity information, such as your application status through the candidate portal.
• Non-precise geolocation data, such as your location as derived from your IP address.
• Audio, electronic, visual, or other sensory information, such as photographs or security camera footage in public areas of Company facilities (including reception, conference rooms, parking, and other general areas) if you participate in on-site activities, such as a job fair, job interview or aptitude test; as well as photographs, audio, or footage collected in the course of video interviews or through an online applicant platform; and other recordings.
• Professional or employment-related information, such as resume information, certifications, qualifications, membership in professional organizations, employment history, job preferences (including your willingness to relocate or travel), documentation required under immigration and employment laws (such as citizenship, visa data, details of residency, and work permit information), and such other information you provide. We may also collect and process information about you generated during or after interviews and related activities, such as tests or satisfaction surveys. This information may come directly from you or from our employees or contractors.
• Education information, such as education history, professional qualifications, academic certificates and licenses, languages spoken, and other relevant skills.
• Inferences drawn from any of the information we collect, such as the likelihood of your profile being a good fit with our internal team and long-term prospects with the Company.
• Sensitive Personal Data, including the following, where permissible or required under applicable laws and regulations:
  • Social Security number, driver’s license, state identification card, or passport number.
  • Racial or ethnic origin, if you chose to provide it.

3. How We Use Personal Data
We may use Personal Data for the following purposes:

• In connection with your application, such as assessing your application, interview, and test results for suitability for the position for which you have applied or other open positions; communicating with you concerning job openings or your application; conducting pre-employment verification and screening; offering you the job position, in our discretion; notifying you of job opportunities (including from affiliates in our group, where we have shared your job application with them); and dealing with any inquiry, challenge, or request for feedback received in relation to our recruitment and hiring decisions.
• For our internal business purposes, such as managing and improving our recruitment process (for example, enhancing our scouting and talent identification processes); enforcing our policies and rules; and operating our diversity and inclusion initiatives.
• For legal, safety or security reasons, such as complying with legal, reporting, and similar requirements; investigating and responding to claims against the Company, its personnel, and its customers; for the establishment, exercise or defense of legal claims; protecting our, your, our customers’, and other third parties’ safety (including managing spread of communicable diseases), property or rights; detecting, preventing, and responding to security incidents; and protecting against malicious, deceptive, fraudulent, or illegal activity.
• In connection with a corporate transaction, such as if we acquire, or some or all of our assets are acquired by another entity.
• For promotional purposes, such as to notify you about new job openings in accordance with your preferences.

We only use Sensitive Personal Information for the following purposes: (i) performing services or providing goods reasonably expected by an average consumer; (ii) detecting security incidents; (iii) resisting malicious, deceptive, or illegal actions; (iv) ensuring the physical safety of individuals; (v) for short-term, transient use, including non-personalized advertising; (vi) performing or providing internal business services; (vii) verifying or maintaining the quality or safety of a service or device; or (viii) for purposes that do not infer characteristics about you.
We may use anonymized, de-identified, or aggregated information for any purpose.
4. How We Disclose Personal Data
We may disclose Personal Data to third parties, including the categories of recipients described below. We do not “sell” or “share” job applicant Personal Data (as those terms are defined in the CCPA).
Categories of Personal Data We Collect
Categories of Third Parties With Whom We Disclose Personal Data for a Business Purpose Identifiers (Section 2.A)

• Affiliates and subsidiaries
• Service providers
• Professional consultants
• Vendors necessary to complete transactions you request
• Business partners
• Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
• In connection with a corporate transaction
• Business partners
• Entities to which you have consented to the disclosure

Records about you (Section 2.B)

• Affiliates and subsidiaries
• Service providers
• Professional consultants
• Vendors necessary to complete transactions you request
• Business partners
• Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
• In connection with a corporate transaction
• Entities to which you have consented to the disclosure

Characteristics of protected classifications under California or federal law (Section 2.C) 

• Affiliates and subsidiaries
• Service providers
• Professional consultants
• Vendors necessary to complete transactions you request
• Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
• In connection with a corporate transaction
• Entities to which you have consented to the disclosure

Internet or other electronic network activity (Section 2.D)

• Affiliates and subsidiaries
• Service providers
• Professional consultants
• Vendors necessary to complete transactions you request
• Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
• In connection with a corporate transaction
• Entities to which you have consented to the disclosure

Geolocation data (Section 2.E)

• Affiliates and subsidiaries
• Service providers
• Professional consultants
• Vendors necessary to complete transactions you request
• Business partners
• Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
• In connection with a corporate transaction
• Entities to which you have consented to the disclosure

Audio, electronic, visual, olfactory, or similar information (Section 2.F)

• Affiliates and subsidiaries
• Service providers
• Professional consultants
• Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
• In connection with a corporate transaction
• Entities to which you have consented to the disclosure

Professional or employment-related information (Section 2.G)

• Affiliates and subsidiaries
• Service providers
• Professional consultants
• Business partners
• Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
• In connection with a corporate transaction
• Entities to which you have consented to the disclosure

Education information (Section 2.H)

• Affiliates and subsidiaries
• Service providers
• Professional consultants
• Business partners
• Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
• In connection with a corporate transaction
• Entities to which you have consented to the disclosure

Inferences (Section 2.I)

• Affiliates and subsidiaries
• Service providers
• Professional consultants
• Vendors necessary to complete transactions you request
• Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
• In connection with a corporate transaction
• Entities to which you have consented to the disclosure

Sensitive personal information (Section 2.J)

• Affiliates and subsidiaries
• Service providers
• Professional consultants
• Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes
• In connection with a corporate transaction
• Entities to which you have consented to the disclosure

The categories of recipients in the chart above are used to mean:

• Affiliates and subsidiaries, including parent entities, corporate affiliates, subsidiaries, business units, and other companies that share common ownership with us.
• Service providers that work on our behalf to provide products and services, such as IT support providers, software service providers, background check vendors, and drug-screening providers.
• Professional consultants, such as recruiters, accountants, lawyers, financial advisors, and audit firms.
• Vendors necessary to complete transactions you request, such as shipping companies and logistics providers.
• Law enforcement, government agencies, and other recipients for legal, security, or safety purposes, such as when we share information to comply with law or legal requirements, to enforce or apply our policies, and to protect ours, our customers’, or third parties’ safety, property or rights.
• To other entities in connection with a corporate transaction, such as if we, or some or all of our assets, are acquired by another entity, including through a sale in connection with bankruptcy or other forms of corporate change.
• Business partners, such as certain travel services, recruitment firms, and certification providers.
• Entities to which you have consented to the disclosure, where consent is required by law.

We may disclose anonymized, de-identified, or aggregated information for any purpose permitted by law.
5. Data Retention
Your Personal Data will be retained as long as necessary to fulfill the purposes we have outlined above unless we are required to do otherwise by applicable law. This includes retaining your Personal Data for purposes consistent with the applicant-related context of our interactions; to improve our application and recruiting practices over time; to ensure the ongoing legality, safety and security of our services and relationships; and for other legitimate business purposes in accordance with our internal retention procedures. 
6. Rights Concerning Personal Data
California residents may have certain rights, subject to legal limitations, concerning the collection, use, and disclosure of Personal Data under the CCPA, such as: 

• Right to Know. You have the right to request information about the categories of Personal Data we have collected about you, the categories of sources from which we collected the Personal Data, the purposes for collecting, selling, or sharing the Personal Data, and to whom we have disclosed Personal Data and why. You may also request the specific pieces of Personal Data we have collected about you.
• Right to Delete. You have the right to request that we delete Personal Data that we have collected from you.
• Right to Correct. You have the right to request that we correct inaccurate Personal Data that we maintain about you.

California residents may request to exercise the rights above by emailing legalreview@ehealth.com. Please indicate CA Applicant Privacy Request in the email. We will not discriminate against you for exercising your privacy rights.
Verification: In order to process requests, we will need to obtain information to locate you in our records or verify your identity depending on the nature of the request. In most cases, we will collect some or all of the following data elements: first and last name, email address, and telephone number. In some cases, we may request different or additional information, including a signed declaration that you are who you say you are, and will inform you if we need such information. 
Authorized Agents: Authorized agents may exercise rights on behalf of California residents by submitting a request via email at the email address provided below and indicating that they are submitting the request as an agent. We will require the agent to demonstrate authority to act on behalf of the resident by providing signed permission from the resident. We may also require the resident to verify their own identity directly with us or to directly confirm with us that they provided the authorized agent permission to submit the request.
7. Contact Information 
If you have questions regarding this Privacy Notice or how we use your Personal Data, please contact us at: legalreview@ehealth.com