California Privacy Notice

Effective Date: June 30, 2023

Last Modified Date: June 30, 2023

This California Privacy Notice (“CA Notice”) supplements the information contained in Foundation Medicine’s ("FMI") Legal Notice, Terms of Use, and Online Privacy Policy (collectively, “Privacy Policy”) and applies solely to California “consumers”, as such term is defined under the California Consumer Privacy Act of 2018, as amended from time to time, including by the California Privacy Rights Act of 2020 and its implementing regulations (collectively, the “CCPA”).

If you are a California consumer, this CA Notice applies to you when you use any website or other online service that links to or refers to the Privacy Policy, or when you otherwise interact with Foundation Medicine (collectively, the “Services”). Any capitalized terms in this CA Notice that are not otherwise defined here shall have the same meaning as they do in the CCPA or in our Privacy Policy, as applicable.

This CA Notice does not apply to personal information that is otherwise subject to certain state or federal privacy laws, such as HIPAA, or information that is otherwise excluded from the scope of the CCPA. Please refer to Foundation Medicine’s Notice of Privacy Practices for information on how we maintain protected health information (PHI) in accordance with HIPAA.

I. Collection and Disclosure of Personal Information

We may collect and disclose information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, to a particular California consumer or household (“personal information”). The CCPA provides California consumers with the right to know what categories of personal information we have collected about them, the sources of such personal information, and whether we have shared or disclosed such personal information for a business or commercial purpose in the preceding 12 months.

Personal information does not include de-identified or aggregated consumer information that is maintained in such a form that it cannot be associated with or linked to you.

Within the last twelve (12) months, we have collected, and in certain cases, disclosed, the following categories of personal information from the sources and for the business or commercial purposes described below. Information provided here is intended to supplement the “Information We Collect” and the “How We Use Information” sections of our Privacy Policy.

Category of Personal Information	Examples of Personal Information Collected	Business or Commercial Purpose for Collection	Categories of Recipients, if Personal Information is Disclosed for a Business or Commercial Purpose
Identifiers.	Name, postal address, city, state, region, country, zip code, online identifier, Internet Protocol (IP) address, and email address. Note: Some personal information included in this category may overlap with other categories.	To provide and manage FMI services; to respond to customer or user queries; to fulfill or meet the reason for which the information was provided; to provide updates, alerts, and other notices concerning our products or services, or events or news, that may be of interest to you; to maintain, monitor, secure, customize or optimize FMI websites and services; to evaluate user behavior on FMI websites; to identify or correspond with customer prospects; to enable marketing efforts and deliver ads; to measure the effectiveness of marketing efforts; to customize the advertisements you receive from us; to comply with applicable law, court order, or governmental regulations.	Service providers (e.g., web hosting and internet service providers, customer service and technical support providers, cloud service providers, data analytics providers), in order to receive customer or technical support, data analytics support, IT-related services, or other services that are performed on FMI’s behalf for a business or commercial purpose. Marketing and advertising agencies, in order to enable and customize marketing efforts and ad delivery. Business affiliates, in order to administer any shared systems within FMI’s family of affiliated companies.
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	Name, address, telephone number (including ordering physician name, phone, facility address, fax, and/or email).	To provide and manage FMI services; to respond to customer or user queries; to fulfill or meet the reason for which the information was provided; to provide updates, alerts, and other notices concerning our products or services, or events or news, that may be of interest to you; to comply with applicable law, court order, or governmental regulations.	Service providers (e.g., web hosting and internet service providers, customer service and technical support providers, cloud service providers, data analytics providers), in order to receive customer or technical support, data analytics support, IT-related services, or other services that are performed on FMI’s behalf for a business or commercial purpose. Business partners, for commercial purposes. Marketing and advertising agencies, in order to enable and customize marketing efforts and ad delivery. Business affiliates, in order to administer any shared systems within FMI’s family of affiliated companies.
Commercial information.	Records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	To provide, manage, and improve FMI services; to respond to customer or user queries; to fulfill or meet the reason for which the information was provided.	Service providers (e.g., customer service and technical support providers), who respond to, address, or support with requests on FMI’s behalf.
Internet or other similar network activity.	Browser information, search history, information on a consumer's interaction with a website, application, or advertisement. Device information (e.g., IP address, device identifiers, operating system) and usage information (e.g., time and duration of use, interaction with content, information stored in cookies or similar technologies).	To ensure an optimal website experience for users; to maintain, monitor, or secure FMI websites; to evaluate user behavior on FMI websites; to enable marketing efforts and deliver ads; to measure the effectiveness of marketing efforts; to customize the advertisements you receive from us.	Service providers (e.g., internet service providers, data analytics providers, operating systems and platforms, information technology service providers), who provide IT-related services on FMI’s behalf. Marketing and advertising agencies, in order to enable and customize marketing efforts and ad delivery.
Geolocation data.	IP address and device identifier(s).	To determine the general (and not precise) location from which you are accessing FMI websites or services; to provide location-specific content, advertisements, or communications; to maintain, monitor, or secure FMI websites.	Service providers (e.g., internet service providers, data analytics providers, operating systems and platforms, information technology service providers), who provide IT-related services on FMI’s behalf. Marketing and advertising agencies, in order to enable and customize marketing efforts and ad delivery.
Sensory data.	Voicemail recordings.	To respond to customer or user queries; to fulfill or meet the reason for which the information was provided (e.g., customer service).	Service providers (e.g., business application providers and telephone communication providers), who provide communications and customer support services on FMI’s behalf.
Professional or employment-related information.	With respect to FMI business partners*: current or former employer(s) and position(s), and business contact information.	To enable business-to-business communications.	Service providers (e.g., business application providers, customer service and technical support providers), who respond to, address, or support with requests on FMI’s behalf.
Inferences drawn from other personal information.	Assumptions drawn from collected commercial information.	To enable marketing efforts and deliver ads; to measure the effectiveness of marketing efforts; to customize the advertisements you receive from us.	N/A

* Foundation Medicine provides separate privacy notices to certain categories of California residents, such as job applicants and employees, regarding their personal information. In such cases, the terms set forth in those separate privacy notices will apply over those included in this CA Notice.

Categories of Sources of Personal Information

As set forth in the “Information We Collect” section of our Privacy Policy, we obtain the categories of personal information indicated above from the following categories of sources:

Directly from you. For example, from the forms you complete when you contact us on our websites or through accessing our Services.
Directly and indirectly from activity on our websites. For example, from website usage and activity details that may be collected from cookies and other tracking technologies deployed on our websites.
From third party sources. For example, from publicly and commercially available sources, as permitted by law.

Retention of Personal Information

We retain your personal information for as long as needed to fulfill the purpose for which the personal information was collected and further processed, in accordance with our data retention policy (which sets forth data retention periods and deletion routines in accordance with applicable law).

“Sales” and “Sharing” of Personal Information under the CCPA

Foundation Medicine may use digital ad networks or other analytics services to deliver targeted ads. For more information on the technologies involved in delivery of targeted ads, please see the “Online Tracking” section of our Privacy Policy.

The CCPA may interpret these activities as “selling” or “sharing” (as such terms are defined under the CCPA) your personal information with third parties. In the last 12 months, we have “sold” or “shared” the following categories of personal information to the categories of recipients described below:

Category of Personal Information	Categories of Third Parties to Whom We Sell or Share Personal Information
Identifiers	Marketing and advertising networks; data analytics providers.
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	Marketing and advertising networks; data analytics providers; business partners.
Internet or Other Network Activity.	Marketing and advertising networks; data analytics providers.
Commercial Information.	Marketing and advertising networks; data analytics providers.

We do not have actual knowledge that we “sell” or “share” the personal information of children under 16 years of age.

You, as a California consumer, can opt-out of the “sale” or “sharing” of your personal information for the purposes of cross-context behavioral advertising, as described in this section, by clicking here: Do Not Sell or Share My Personal Information (which is also available at the footer of our website).

II. Your Privacy Rights and Choices

The CCPA provides California consumers with specific rights regarding their personal information. You may have a right to one or more of the following with respect to the personal information FMI may collect and process about you:

1. Right to Know About Personal Information. You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you upon request:

The categories of personal information we collected about you.
The categories of sources for the personal information we collected about you.
Our business or commercial purpose for collecting, selling, or sharing your personal information.
The categories of third parties to whom we disclose or share personal information.
The specific pieces of personal information we collected about you.

2. Right to Deletion. You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and notify our service providers and/or contractors to delete) your personal information from our records, unless an exception applies. We will also notify all third parties to whom we have sold or shared your personal information to delete it to the extent required by law.

3. Right to Correction. You have the right to request that we correct any inaccurate Personal Information that we maintain about you, taking into account the nature of the Personal Information and the purposes of the processing of the personal information. Once we receive and confirm your verifiable consumer request, we will use commercially reasonably efforts to correct the inaccurate information.

4. Right to Opt-Out of Sale or Sharing of Personal Information. You have the right to opt-out of the “sale” or “sharing” of your personal information for cross-contextual behavioral advertising. This practice is also commonly referred to or understood as “interest-based advertising” or “targeted advertising”. You may exercise this right by submitting a request via the following link: Do Not Sell or Share My Personal Information (which is also available at the footer of our website).

Exercising Your Access, Deletion, and Correction Rights.

To exercise your rights to access, delete, or correct your personal information, please submit a verifiable consumer request to us by contacting us using the contact information provided at the end of this notice. You may also submit a request to exercise your rights using the Consumer Rights Request Form. You will be asked to provide certain personal information when submitting your request including your relationship with us, first and last name, email address, telephone number, and postal address in order for us to determine if your information is in our systems.

We will verify and respond to your request consistent with applicable law. We may need to request additional personal information from you in order to protect against fraudulent or spoofed requests. If you want to make a request as an authorized agent on your behalf, you may use the submission methods noted above. As part of our verification process, we may request that you provide us with the documentation specified under applicable law.

In addition to the rights set forth above, the following rights are also provided to you under the CCPA:

5. Right to Non-Discrimination. We will not discriminate against you for exercising any of your rights as set forth in this CA Notice. Unless permitted by the law, we will not:

Deny you goods or services.
Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
Provide you a different level or quality of goods or services.
Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

6. Right to Limit Use or Disclosure of Sensitive Information. At this time, Foundation Medicine does not collect sensitive personal information of California consumers who are subject to this CA Notice. If we begin to collect sensitive personal information about you (e.g., your social security number, financial information, or precise geolocation data), you would be entitled to exercise your right to limit our use or disclosure of such information pursuant to the CCPA.

Changes to this Notice

We may modify this CA Notice from time to time. Please look at the Last Modified Date at the top of this CA Notice to see when it was last revised. Any changes to this CA Notice will become effective when they are posted.

Contact Us

If you have any questions or concerns relating to our use of your personal information under this CA Notice, or to submit a rights request, please contact our Privacy Officer at privacy@foundationmedicine.com or by calling +1 (888) 988-3639. You may also follow the instructions set forth in the Consumer Rights Request Form. For additional contact information, please use the contact information listed on our Contact page.