California Privacy Rights Act (CPRA / CCPA)
Addendum & Notice
Effective from Apr 17, 2026|Last updated Oct 12, 2026
1. Introduction
This California Privacy Notice (“CCPA Notice”) supplements our main Privacy Policy and Terms of Service. It applies strictly to California residents (“consumers” or “you”) pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, “CCPA”).
2. Scope & HIPAA Exemption
- HIPAA Exemption: Protected Health Information (PHI) processed by AsterMD is governed by HIPAA and our Business Associate Agreements (BAAs) with healthcare providers, and is statutorily exempt from CCPA (Cal. Civ. Code § 1798.145).
- Service Provider Role: When processing data on behalf of healthcare organizations, AsterMD acts as a Service Provider. If you are a patient, please submit privacy requests directly to your healthcare provider.
- Covered Scope: This notice governs personal information collected outside of HIPAA exemptions (e.g., platform account administrators, website visitors, and enterprise sales inquiries).
3. CCPA Category Mapping (Past 12 Months)
The table below maps the categories of personal information collected and disclosed under CCPA definitions, as further described in Section 3 of our main Privacy Policy:
| CCPA Category | Examples | Disclosed for Business Purpose? | Sold or Shared? |
|---|---|---|---|
| A. Identifiers | Name, business email, IP address, account IDs | Yes (Hosting & Infrastructure) | No |
| B. Personal Records (Cal. Civ. Code § 1798.80) | Name, business email, IP address, account IDs | Yes (Service Providers) | No |
| C. Protected Classifications | Date of birth (platform user profile) | Yes (As directed by Customer) | No |
| D. Commercial Information | API usage history, subscription details | Yes (Billing & Internal Ops) | No |
| E. Internet / Network Activity | Logs, system diagnostics, session cookies | Yes (Analytics & Security) | No |
| F. Professional Information | Job title, employer / healthcare organization name | Yes (Account Management) | No |
| G. Sensitive Personal Information | Account login credentials / API tokens | Yes (Security & Authentication) | No |
4. Statutory Disclosures
- No Sale of Personal Information: AsterMD does not sell personal information.
- No Sharing for Cross-Context Behavioral Advertising: AsterMD does not share personal information with third parties for cross-context behavioral or targeted advertising.
- Minors: AsterMD does not sell or share personal information of consumers under 16 years of age.
- Use of Sensitive Personal Information: Sensitive Personal Information (e.g., authentication credentials) is used exclusively for account security and platform operations, and not for inferring consumer characteristics.
5. California Consumer Rights
Subject to verification and statutory exemptions, California residents have the following rights:
- Right to Know / Access: Request disclosure of categories and specific pieces of personal information collected, sources, business purposes, and third parties to whom data was disclosed.
- Right to Delete: Request deletion of personal information held by us, subject to legal and operational exceptions.
- Right to Correct: Request correction of inaccurate personal information.
- Right to Limit Sensitive Data Use: Limit the use of Sensitive Personal Information to necessary operational functions (AsterMD already restricts use to these functions).
- Right to Non-Discrimination: You will not receive discriminatory treatment for exercising any CCPA rights.
6. Exercising Your Rights
- For Platform/Account Information: California residents may exercise their rights by emailing privacy@astermd.com with the subject line "CCPA Consumer Request". We will verify your request using your account credentials or government-issued ID. Authorized agents must provide written permission signed by the consumer.
- For Patient / Clinical Records: Contact your healthcare provider directly. AsterMD acts as a Service Provider for patient data and will forward any direct patient requests to the responsible healthcare provider.
For general details on security, retention, and third-party integrations, please refer to our main Privacy Policy and Terms of Service.