Populi U.S. Supplemental Privacy Policy

Effective date: July 1, 2024

This U.S. Supplemental Privacy Policy (“Supplement”) supplements the information in the Populi Product Privacy Policy It is applicable only for Personal Information collected or processed by Populi from or about residents of U.S. states with comprehensive privacy laws (collectively, hereafter, “Comprehensive State Privacy Laws”), including, for example: the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (“CPRA”), together referred to as (“CCPA”); the Colorado Privacy Act (“CPA”); the Connecticut Personal Data Privacy and Online Monitoring Act (“CTDPA”); the Virginia Consumer Data Protection Act (“VCDPA”); the Oregon Consumer Data Privacy Act (“OCDPA”); the Utah Consumer Privacy Act (“UCPA”); the Texas Data Privacy and Security Act (“TDPSA”) and similar state privacy and data protection laws. This Supplement describes the categories of Personal Information that Populi may collect or process from U.S. residents in those states, how we may use and disclose that Personal Information, and how you may exercise any rights you may have regarding our processing of your Personal Information.

Personal Information subject to this Supplement does not include the information covered by certain federal and state laws, such as the Health Insurance Portability and Accountability Act of 1996 (HIPAA), clinical trials, or other exemptions as described in Comprehensive State Privacy Laws. In addition, even Personal Information covered in this Supplement may be collected and processed—including by disclosure to governmental entities or third parties—outside the requirements of this Supplement where applicable Comprehensive State Privacy Laws allow, including where such action is necessary to comply with federal, state, and local laws; to prepare for any law suit; to protect the vital interests of a consumer or other individual; to act in the public interest in areas of public health; to cooperate with government authorities; or to protect against security threats and illegal, fraudulent, or malicious activity and any subsequent investigation of that activity.

This Supplement uses the terms “consumer,” “personal data” or “personal information,” and “sale” as defined in their respective laws. References to “Personal Information” include personal data or personal information as defined under Comprehensive State Privacy Laws.

Personal Information collected

Personal information we collect. Populi licenses the categories of Personal Information described below from the third-party sources categorized below in developing Populi Services. Personal Information which may qualify as “sensitive” under applicable Comprehensive State Privacy Laws have been marked with an asterisk (*). We process such sensitive information where permissible under Comprehensive State Privacy Laws. Populi licenses the Services to categories of third parties as described in the table below.

Categories of Personal Information Processed for Each Processing Purpose	Personal identifiers and personal contact information such as name, postal address, and email address. Education and employment information such as education level, employment status, and occupation category. Personal characteristics such as age group, ethnicity, * marital status, gender, military status, and whether you have had children. Commercial information such as home ownership/rental status, household income bracket, and buying activity/interest. Internet activity such as interest based on web site type or media preferences. Inferences about Consumers’ behavioral characteristics, drawn from personal information, such as likelihood indicators for certain lifestyle habits or preferences. General geolocation information such as city, state, zip code, and geo tract code.
Categories of Sources for Personal Information	Publicly available information (about healthcare providers) Licensed data from third parties HIPAA-certified de-identified data Directly from consumers (in the case of product users) Directly and indirectly from consumers by their activities on our Services Directly and indirectly from our customers Through communications with prospective customers
Business and Commercial Purposes for which Personal Information is Processed	To fulfill the purpose for which the information was provided; To include in Populi’s Population Intelligence product licensed to Customers, which is used by Customers for marketing efforts; To use together with other data points to create our propensity models included in our Population Intelligence product; To research, develop, test, evaluate future product features and enhancements and improve the Services; To provide product customer service; As necessary to comply with applicable federal, state, and local laws; and To protect against security threats and protect against illegal, fraudulent, or malicious activity, and any subsequent investigation of that activity.
Categories of Third Parties with Which Personal Information is Disclosed	Populi Customers Service providers Third parties integrated into our services Third parties as required by law Third parties in relation to a merger, sales, or asset transfer Other third parties with consumers’ consent Our affiliates
Categories of Third Parties with Which Personal Information is Sold	Populi Customers Our Customers use the Personal Information they obtain from us—in accordance with their own privacy policies— for direct-to-consumer marketing, patient matching and appends, and other commercial purposes.
Categories of Personal Information that the Controller Sells to or shares with Third Parties	Personal identifiers and personal contact information such as name, postal address, and email address. Education and employment information such as education level, employment status, and occupation category. Personal characteristics such as age group, ethnicity,* marital status, gender, military status, and whether you have had children. Commercial information such as home ownership/rental status, household income bracket, and buying activity/interest. Internet activity such as interest based on web site type or media preferences. Inferences about Consumers’ behavioral characteristics, drawn from personal information, such as likelihood indicators for certain lifestyle habits or preferences. General geolocation information such as city, state, zip code, and geo tract code.

Disclosure and Sale of Personal Information. During the last year, Populi has sold Personal Information it has processed to our third-party Customers for their business and commercial purposes. Our enterprise customers use the Personal Information they obtain from us—in accordance with their own privacy policies— for direct-to-consumer marketing, patient matching and appends, and other commercial purposes.

During the last year, Populi has disclosed Personal Information to service providers (e.g., cloud computing and storage vendors; security contractors, and consultants), for our own operational business purposes.

Your privacy rights

As a resident of a state with a Comprehensive State Privacy Law, you may have some of the following privacy rights, subject to some limitations or exemptions as required or allowed by law:

To opt-out of sharing your Personal Information for cross-context behavioral advertising or, in other states, to opt-out of targeted advertising;
To opt-out of the sale of your Personal Information;
To request to know and access your Personal Information which Populi has collected or processed;
To obtain a copy of your Personal Information, i.e., a right to data portability;
To request that we correct your Personal Information;
To request that we delete your Personal Information;
To request that we limit the use of your Sensitive Personal Information;
To opt-out of processing of Sensitive Personal Information;
To not be discriminated against for exercising any of the rights above; and
To appeal the denial of a request, including in some states to lodge a complaint with the Attorney General.

If you wish to exercise any opt out rights, please contact us by:

Completing this online form: Right to Opt Out
Contacting us by phone at: 1-866-679-6461

If you wish to exercise any other rights, please submit a Privacy Rights Request by:

Completing this online form: Privacy Request Form
Contacting us by phone at: 1-866-679-6461

Verifiable requests

We will make reasonable efforts to promptly respond to your requests in accordance with applicable laws, but your rights under Comprehensive State Privacy Laws are not absolute. For example, any such request must provide sufficient information that allows us to verify that you are the consumer whose Personal Information we have collected. We may, after receiving your request, require additional information from you to honor your request and verify your identity. Please be aware that we may be unable to afford these rights to you under certain circumstances, such as if we are legally prevented from doing so.

Requests by Authorized Agents

Where required by applicable Comprehensive State Privacy Laws, we permit residents of certain states to designate an authorized agent to submit certain requests on your behalf, as outlined below.

California residents may designate an authorized agent to submit a request to opt-out of sale or share of Personal Information, to limit the use of Sensitive Personal Information, or to access, correct, or delete your Personal Information. In each case, the agent must provide us with documentation demonstrating that you have provided signed permission to the agent to exercise these rights with us on your behalf. We may deny the request if we do not receive such proof. In addition, for requests to access, correct, or delete your Personal Information, we may also require you to do either of the following: (1) verify your own identity directly with us; or (2) directly confirm with us that you have provided the authorized agent permission to submit the request on your behalf. These requirements of proof do not apply if the agent has a power of attorney pursuant to California Probate Code.

Colorado, Connecticut, Oregon, Montana, and Texas residents may designate an authorized agent to submit a request to opt-out out of our processing of personal data for the purposes of targeted advertising or sale. If you use an authorized agent to submit a request, we will not act on that request unless we are able to authenticate, with commercially reasonable effort, both your identity and the authorized agent’s authority to act on your behalf.

For all requests via authorized agents, we require that your agent provide us with your Personal Information as required on the request form and provide signed documentation demonstrating that you authorized the agent to submit a request on your behalf. The request must also include sufficient detail that allows us to properly understand, evaluate, and respond to the request. If we need more information to process your request, we will contact you via e-mail or in writing.

Authorized agents may submit requests using one of the following designated methods.

Completing this online form: Right to Opt Out
Completing this online form: Privacy Request Form
Contacting us by phone at: 1-866-679-6461

Please note that this subsection does not apply when an agent is authorized to act on your behalf pursuant to a valid power of attorney. Any such requests will be processed in accordance with your state’s law pertaining to powers of attorney.

Opt-out signals

Certain web browsers and other programs may transmit “opt-out” signals, also called a Global Privacy Control (or GPC) signal (we refer to these as “GPC Signals”), to websites with which the browser communicates.

For users that access our websites from states with Comprehensive State Privacy Laws that requiring recognition of universal opt-out signals, we will recognize and apply the GPC Signal as a browser-level opt-out to inactivate all of the cookies for that website, except for cookies that are essential/strictly necessary for the website to operate. Additionally, you can determine if your browser GPC Signal has been recognized by clicking on the “Your Privacy Choices” link in the footer of the website that will include a short message at the top of the preference center indicating that your GPC Signal has been received.

For users from states not currently requiring recognition of the GPC Signal, our website servers will not recognize the GPC Signal, but you can always check and adjust your cookie settings by going to the Your Privacy Choices link in the footer of this website.

Children’s information

Populi’s products and services are directed at business professionals. Definitive Healthcare’s products and services are not targeted to children under the age of 18. We do not knowingly collect or maintain any Personal Information for children under the age of 18. If we discover we have collected any information for persons under the age of 18, we will delete their Personal Information.

Questions?

Populi is committed to protecting the privacy of Consumers’ Personal Information and being transparent about our privacy practices. To exercise any rights, you might be entitled to under applicable Comprehensive State Privacy Laws, please utilize the designated mechanisms provided in the “Your Privacy Rights” section, above. For other questions, comments, or feedback on this Supplement or our Privacy Policy, please contact us through the Definitive Healthcare-privacy team:

E-mail: privacy@definitivehc.com

Phone: 1-866-679-6461

Mail:

Definitive Healthcare
Attn: Privacy Team
492 Old Connecticut Path
Suite 401
Framingham, MA 01701