Privacy Policy

Updated June 2026

Introduction and Scope

Carefully read this Privacy Policy, as it governs your access to, and use of, Path CCM, Inc. d/b/a Rula Health’s (“Rula,” “we,” “us,” or “our”) website located at https://rula.com/ and the online services, pages, features, communications, and digital workflows that link to, or reference, this Privacy Policy.

This Privacy Policy explains how we collect, use, disclose, and otherwise process information through our Services. “Services” means the website located at https://rula.com and the related online services, mobile applications, pages, features, communications, digital workflows, and other products and services that link to or reference this Privacy Policy. Services do not include any page, feature, workflow, product, or service that is expressly governed by the Notice of Privacy Practices of SUD Specialty Group – CA, Mental Health Specialty Group, P.A., Mental Health Specialty Group NJ, PC, and Mental Health Specialty Group KS, P.A., each doing business as Rula Health  (the “NPP”) to which Rula provides management and administrative services  or another applicable privacy notice.

If you do not agree with this Privacy Policy, please do not use our Services.

This Privacy Policy applies to individuals who visit, browse, interact with, or submit information through the portions of our Services and related digital properties, mobile applications, communications, and related online Services that are not governed by a separate Notice of Privacy Practices or other service-specific privacy notice.

Scope of this Privacy Policy

This Privacy Policy applies to all sections of our Services other than the “Find Care” section of the Services and any other page, feature, or workflow that expressly links to the NPP or is used to collect Protected Health Information (“PHI”) in connection with patient care, payment, or health care operations. Information submitted through the “Find Care” section may include PHI and is governed by Rula’s NPP. Where information is governed by the NPP, we will use and disclose that PHI only as described in the NPP and as permitted or required by applicable law.

For clarity, this Privacy Policy generally applies to publicly accessible and general informational portions of the website, Services, marketing pages, provider recruiting pages, customer support pages, newsletter sign-up pages, and similar non-patient-care-facing workflows, unless a different privacy notice is presented.

This Privacy Policy does not apply to: (i) information governed by our NPP; (ii) patient portal, provider portal, appointment scheduling, care-navigation, intake, treatment, payment, or health care operations workflows that are governed by the NPP or another service-specific notice; or (iii) any telehealth session, communication, or interaction that is subject to separate clinical, consent, or patient-facing privacy documentation.

This Privacy Policy is incorporated into and forms part of our Terms of Use. Any terms used in this Privacy Policy that are not defined have the same meaning as in our Terms of Use.

Definitions

For purposes of this Privacy Policy:

• “Child” or “Children” means an individual under 13 years of age, unless applicable law requires a different age threshold for a particular disclosure, consent, or processing activity.

• “Cookies and Tracking Technologies” means cookies, pixels, tags, web beacons, embedded scripts, software development kits, session replay tools, and similar technologies used to collect or process information from a browser, device, or online activity.

• “Minor” means an individual under the age of majority in the individual’s state of residence and may include individuals under 16 where applicable privacy law provides heightened protections based on that threshold.

• “Notice of Privacy Practices” or “NPP” means the notice describing how SUD Specialty Group – CA, Mental Health Specialty Group, P.A., Mental Health Specialty Group NJ, PC, and Mental Health Specialty Group KS, P.A. may use and disclose PHI and the rights individuals may have with respect to PHI, where applicable.

• “Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household. Personal Information does not include PHI governed by the NPP, publicly available information, or deidentified or aggregated information.

• “Protected Health Information” or “PHI” means information that is protected under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations, as amended, including individually identifiable health information that is created, received, maintained, or transmitted by a covered entity or business associate in connection with health care services, payment, or health care operations.

• “Sell” or “Sale” means disclosing or making available Personal Information to a third party for monetary or other valuable consideration, as defined by applicable law.

• “Sensitive Data” means Personal Information that is considered sensitive under applicable U.S. state privacy laws, which may include certain government identifiers, precise geolocation data, information revealing racial or ethnic origin, religious beliefs, health condition or diagnosis, contents of communications where protected by applicable law, Personal Information collected from a known child, and other categories treated as sensitive under applicable law.

• “Share,” “Shared,” or “Sharing” means disclosing or making available Personal Information to a third party for Targeted Advertising, Cross-Context Behavioral Advertising, or similar advertising-related purposes, but only to the extent applicable law uses or defines that concept.

• “Targeted Advertising” or “Cross-Context Behavioral Advertising” means displaying advertisements selected based on Personal Information obtained or inferred from an individual’s activities over time and across nonaffiliated websites, applications, or online services to predict preferences or interests, as defined by applicable law, and generally does not include advertising based solely on an individual’s current interaction with our Services or direct interactions with us.

How We Collect and Use Personal Information

When you visit our website or engage with our Services, we may collect information about you that may identify you, such as your name, mobile number, email address, or other information you voluntarily provide through forms or when you initiate contact with us. We may store or retrieve information from your browser, computer, or mobile device, including through Cookies and Tracking Technologies, as described below.

We may use both first-party and third-party Cookies and Tracking Technologies, including tools used for essential website operations, performance and analytics, fraud prevention, security, debugging, content personalization, attribution, diagnostics, and service improvement purposes. Depending on the technology used and applicable law, information collected through Cookies and Tracking Technologies may constitute Personal Information or Sensitive Data.

Information We Collect

The categories of information we collect depend on how you interact with our website and Services, which pages, forms, features, or workflows you use, and whether a particular interaction is governed by this Privacy Policy or a separate NPP or other service-specific notice.

Depending on the feature you use, we may collect the contents of messages, inquiry details, professional or account-related information, preferences, and any other information you elect to provide when you contact us or complete an online form.

Depending on how you interact with our mobile applications and digital Services, we may also collect:

• account and authentication information;

•  device and application information, including notification preferences;

• application usage and engagement information;

• diagnostics, logging, and performance monitoring information.

Personal Information You Provide: This includes, but is not limited to, name, phone number, email, state, and license type. You directly provide Rula with most of the Personal Information we collect. For example, we may collect Personal Information when you submit information through our provider sign-up page or share Personal Information within the chat feature on our provider help pages.

Internet and Device Activity Information: As you interact with our website and Services, we may collect information about your browsing history or certain other information through your use of and visits to the website, use of our Services, and our use of technologies, including cookies, tags, SDKs, beacons, and similar tools. The types of information collected may include search terms, browser information, computer type, operating system, page visits, referring pages, platform type, date/time stamp, and similar usage information.

Our mobile applications and digital Services may also use authentication providers, analytics providers, monitoring technologies, logging systems, feature management tools, and cloud infrastructure providers to support application functionality, security, diagnostics, reliability, and performance monitoring.

IP Address: Your IP address is a number that is automatically assigned to the device you are using by your Internet Service Provider. An IP address is identified and logged automatically in our server log files whenever a user visits the website, along with the time of the visit and the page or pages visited. Collecting IP addresses is standard practice on the internet and is done automatically by many websites. We use IP addresses for purposes such as calculating website and Services usage levels, diagnosing server problems, supporting compliance and security efforts, and administering the website and related Services.

We may also collect information about your interactions with website and Services content and features, including clicks, navigation paths, session activity, form interactions, error data, and similar usage information generated through analytics technologies or other website and related Services’ functionality tools.

We may receive information about you from affiliates, service providers, advertising, analytics, or technology vendors, social media platforms, and other third parties in connection with the operation of the website and related Services. The information we receive from those sources may include identifiers, contact information, device and browser data, referral information, campaign data, or other information associated with your interactions with our website, Services, or communications.

Automatic Data Collection Preferences

You may be able to use third-party tools and features to restrict our use of automatic data collection technologies. For example, (i) most browsers allow you to change browser settings to limit automatic data collection technologies on websites, (ii) most email providers allow you to prevent the automatic downloading of images in emails that may contain automatic data collection technologies, and (iii) many devices allow you to change your device settings to limit automatic data collection technologies for device applications. Please note that blocking automatic data collection technologies through third-party tools and features may negatively impact your experience using our website, as some features and offerings may not work properly or at all. Depending on the third-party tool or feature you use, you may not be able to block all automatic data collection technologies or you may need to update your preferences on multiple devices or browsers. We do not exercise control over these third-party tools and features and are not responsible if they do not function as intended.

In addition to taking the steps set forth in the Automatic Data Collection Preferences section above, you may be able to further exercise control over the advertisements that you see by using one or more targeted advertising opt-out programs. For example:

• Device-Specific Opt-Out Programs: Certain devices provide individuals the option to turn off targeted advertising for the entire device (such as Apple devices through their App Tracking Transparency framework or Android devices through their opt out of ads personalization feature). Please refer to your device manufacturer’s user guides for additional information about implementing any available device-specific targeted advertising opt-outs.

• Digital Advertising Alliance: The Digital Advertising Alliance allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://optout.aboutads.info/?c=2&lang=EN for browser-based advertising and https://www.youradchoices.com/appchoices for app-based advertising to opt out of targeted advertising carried out by our third-party partners and other third parties that participate in the Digital Advertising Alliance’s self-regulatory program.

• Network Advertising Initiative: The Network Advertising Initiative also provides individuals instructions for further controlling how information is used for online advertising. Please follow the instructions at https://thenai.org/how-to-opt-out/  to exercise these controls.

• Platform-Specific Opt-Out Programs: Certain third-party platforms provide individuals the option to turn off targeted advertising for the entire platform (such as certain social media platforms). Please refer to your platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.

Please note that when you opt out of receiving interest-based advertisements through one of these programs, this does not mean you will no longer see advertisements from us or on our Services.  Instead, it means that the online ads you do see from relevant program participants should not be based on your interests.  We are not responsible for the effectiveness of, or compliance with, any third parties’ opt-out options or programs or the accuracy of their statements regarding their programs. In addition, program participants may still use automatic data collection technologies to collect information about your use of our Services, including for analytics and fraud prevention as well as any other purpose permitted under the applicable advertising industry program. intended. 

How We Use Your Information

We collect information about you in the normal course of business in order to serve you better and to operate our website and our Services, including as follows:

• To communicate with you, such as when contacting you or providing you with information that is related to our Services.

•  For marketing, advertising, analytics, content personalization, operational monitoring, service improvement, and campaign and application measurement purposes, subject to applicable law and your choices where required.

• To operate, maintain, supervise, administer, and enhance our Services, including monitoring and analyzing the effectiveness of content on the website, applications, and aggregate usage data.

• To provide you with a tailored and user-friendly experience as you navigate our Services.

• To gather information on users’ demographics, interests, and behavior based upon information provided during use of our Services.

• To anonymize and aggregate information for analytics, reporting, and other business purposes.

• To develop, test, and improve our Services.

• To provide and maintain the Services and related functionality.

• To support certain features and functionality using artificial intelligence and machine learning technologies, and related user-support features.

• To respond to requests, questions, comments, and other inquiries submitted through the website or other contact channels.

• To inform you about important information regarding the website or Services that may interest you or changes to terms, conditions, policies, or other administrative information.

• To deliver marketing communications that we believe may be of interest to you.

• To verify your identity and/or location, or the identity or location of your representative or agent, in order to allow access to Services, conduct online transactions, prevent fraud, and protect the security of your Personal Information.

• To allow you to participate in surveys and other forms of market research.

• To send you emails regarding system downtime and/or changes to this Privacy Policy or the Terms of Use.

•  For risk control, fraud detection and prevention, compliance with laws and regulations, and compliance with other legal processes and law enforcement requirements.

• If we engage in Targeted Advertising, to support advertising, attribution, campaign measurement, and related marketing activities, subject to your choices and rights under applicable law.

• To provide customer service, troubleshoot issues, debug errors, maintain functionality, and improve Service performance and user experience.

• For any other purpose with your consent.

How We Share Personal Information

We may disclose certain Personal Information to third parties, including advertising partners, analytics providers, and social media platforms, for advertising, analytics, attribution, campaign measurement, and related purposes. Depending on the circumstances and applicable law, some of these disclosures may constitute a “Sale,” “Sharing,” or processing for “Targeted Advertising.”

We engage in Targeted Advertising on the website. We do not use Protected Health Information or information governed by the NPP for Targeted Advertising purposes.

We may disclose your Personal Information in the following ways:

• To Affiliates: We may disclose your Personal Information to our affiliates and subsidiaries for the purposes of providing Services to you, operating our business, supporting our website and related Services, communicating with you, and for internal administrative, analytics, security, and business purposes consistent with this Privacy Policy.

• To Service Providers: We may disclose your Personal Information to our service providers. These service providers have access to the Personal Information necessary to provide Services to you and Rula and may not use it for purposes other than to provide Services to you and Rula, or as otherwise permitted by applicable law. These service providers may include vendors that assist with website hosting, cloud storage, customer support, communications, analytics, security, fraud prevention, form processing, payment processing, customer relationship management, marketing support, and other operational functions.

• To Contractors and Professional Advisors: We may disclose Personal Information to contractors, consultants, auditors, insurers, attorneys, accountants, and other professional advisors who need the information to provide services to us or assist us in operating our business.

• For Compliance with Applicable Laws or Law Enforcement: We may disclose your Personal Information in response to law enforcement requests, court orders, subpoenas, and other legal processes in compliance with applicable laws, regulations, and contractual obligations. We may disclose your information to law enforcement agencies or other governmental bodies if we suspect improper use of our platform, or where we believe disclosure is necessary or appropriate to comply with law, regulation, legal process, or governmental request, or to protect the rights, property, safety, and security of Rula, our users, or others.

• For Business Operations: In the event of a sale, merger, or other business transaction or proposed business transaction, we may transfer your Personal Information to relevant third parties involved in the business transaction or operations.

• To Advertising Partners and Analytics Providers: We may disclose identifiers, device and browser information, internet or electronic network activity information, and similar information to advertising partners, analytics providers, social media platforms, and other third parties that help us measure traffic, understand Service usage, improve our content and campaigns, and support advertising and related Services. We may disclose deidentified or aggregated information to third parties for analytics, reporting, research, marketing, product improvement, and other lawful business purposes.

• For Other Purposes: We may disclose your Personal Information to enforce any applicable Terms of Use and to ensure the safety and security of the website, Services, users, and providers.

Targeted Advertising Preferences

We engage third parties to help facilitate Targeted Advertising designed to show personalized ads based on predictions of preferences and interests developed using Personal Information we maintain and information our third-party partners obtain from activity over time and across nonaffiliated websites and other services. You may opt out of this by emailing privacy@rula.com or by interacting with our Support Center Chat feature.

Social Networks

Features of Rula’s website and Services may permit you to initiate interactions between Rula and third-party social networking websites and platforms, such as Facebook, Instagram, and LinkedIn, as applicable. Clicking those links may allow you to access Rula’s pages on third-party social networks and may involve the social network collecting or using your data and Personal Information. If you “like,” “share,” or “repost” information on those social networks, your Personal Information may be publicly displayed by the third party.

Links to Other Sites

Our website and Services may contain links to external websites or services. Rula does not maintain those sites and is not responsible for the privacy practices of external websites or services. Those third-party websites and services are governed by their own privacy practices.

Artificial Intelligence and Machine Learning Services

We may use artificial intelligence (“AI”) or machine learning technologies to support certain features and functionality available through the Services.These features may process user-provided information in connection with the Services.

We do not use user-submitted healthcare content to train generalized AI models except as disclosed to users and permitted by applicable law.

Security

To help prevent unauthorized access to your Personal Information, we maintain reasonable physical, technical, and administrative safeguards designed to protect it. We also comply with applicable laws regarding data privacy and follow accepted industry standards to protect Personal Information in transit and while stored.

Nevertheless, no safeguards are guaranteed to protect against all unauthorized access, use, or disclosure of Personal Information.

Children and Minors

Our website and Services are not directed to children under 13, and we do not actively market the website or Services to children.

A Child or Minor may sign up, submit Personal Information, or otherwise use features of the website and Services only with the consent of a parent or legal guardian where required by applicable law.

If we have actual knowledge that we have collected Personal Information from a Child in a manner inconsistent with applicable law, we will take appropriate steps to delete or deidentify that information as required by law.

Where required by applicable law, we do not Sell, Share, or use the Personal Information of a known Minor for Targeted Advertising without the consent required by law. Where applicable law imposes broader protections for Minors, we will apply those protections as required.

International Users

Our website and Services are not intended for use by, and is not directed to, users outside the United States, including users located in the European Union.

By using or accessing our Services from outside the United States, you understand that your Personal Information may be transferred to, stored in, or processed in the United States or other jurisdictions where privacy protections may differ from those in your country of residence or location.

U.S. State Privacy Rights

Depending on your state of residence, whether applicable statutory thresholds are met, and subject to applicable exemptions, you may have certain privacy rights regarding your Personal Information. These rights may include the right to:

• confirm whether we process your Personal Information and access that Personal Information;

• delete Personal Information concerning you;

• correct inaccuracies in your Personal Information;

• obtain a copy of certain Personal Information in a portable and, to the extent technically feasible, readily usable format;

• opt out of the Sale of Personal Information;

• opt out of Sharing or processing of Personal Information for Targeted Advertising;

• opt out of certain profiling activities, where applicable law provides that right; and

• appeal our decision regarding your privacy rights request.

California residents should also review the “Privacy Notice for California Residents” section below, which provides California-specific disclosures and rights.

You may submit a privacy rights request by emailing us at privacy@rula.com, calling our Support Contact Center at (323) 205-7088, or engaging with our Support Center Chat feature which we make available on the website. We may take reasonable steps to verify your identity and, where permitted by law, the authority of an authorized agent acting on your behalf. We will not require you to create a new account solely to submit a privacy rights request, although we may require you to use an existing account where permitted by law.

If we deny your request and applicable law gives you a right to appeal, you may appeal that decision by contacting us at privacy@rula.com and including “Privacy Rights Appeal” in the subject line or heading of your request.

We will not discriminate against you for exercising privacy rights provided by applicable law, except as permitted by law.

Retention

We retain Personal Information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the website and related Services, comply with legal obligations, resolve disputes, enforce agreements, maintain security and fraud-prevention measures, and keep appropriate business and compliance records.

Retention periods may vary depending on the nature of the information, the sensitivity of the information, the purposes for which it is used, our operational needs, and applicable legal, regulatory, tax, accounting, reporting, or recordkeeping requirements.

Where information is governed by the NPP or other service-specific privacy documentation, retention may also be governed by applicable health care, legal, regulatory, contractual, or clinical recordkeeping requirements.

Updates

Rula reserves the right to update this Privacy Policy from time to time. Non-material changes become effective when posted on the website. For material changes, Rula will provide notice as appropriate, which may include posting the updated Privacy Policy on the website or emailing users where appropriate.

We suggest that you review this Privacy Policy periodically to stay informed about how we may collect, use, disclose, and otherwise process Personal Information.

Contact Us

If you have any questions about this Privacy Policy, you may contact us via email at privacy@rula.com or call our Support Contact Center at (323) 205-7088.

California residents may also use the request methods described in the “Privacy Notice for California Residents” section for questions or concerns about California privacy rights or California privacy requests.

Privacy Notice for California Residents

Path CCM, Inc. d/b/a Rula Health (“Rula,” “we,” “us,” or “our”) includes this section for residents of California in order to comply with the California Consumer Privacy Act of 2018, and its amendment, the California Privacy Rights Act of 2020 (together, the “CCPA”). This California Privacy Notice is intended to supplement the information contained elsewhere in the Privacy Policy and applies only to individuals who are residents of California.

This California Privacy Notice applies only to information subject to the CCPA. The CCPA does not apply to certain health information, including protected health information governed by HIPAA or medical information governed by California law. For that reason, CCPA deletion requests generally cannot be used to delete medical records, treatment records, provider notes, billing records, or other protected health information. We may also retain information as required or permitted by law. If we cannot fulfill a request, we will explain why.

This California Privacy Notice is reviewed and updated at least once every 12 months. If this California Privacy Notice conflicts with any other portion of the Privacy Policy, this California Privacy Notice will control for California residents.

California Privacy Disclosure

This California Privacy Notice supplements the Privacy Policy by providing additional information about our personal information processing practices for California residents during the preceding 12 months. This notice applies to Rula’s online and offline information practices involving personal information subject to the CCPA. It does not apply to publicly available information, deidentified, aggregated, or anonymized information, PHI or medical information governed by HIPAA or CMIA, clinical trial data, or information we process as a service provider on behalf of customers or providers.

This California Privacy Notice describes, for the preceding 12 months, the categories of personal information we collected, the categories of sources from which personal information was collected, the business or commercial purposes for collecting, using, disclosing, selling, or sharing personal information, the categories of personal information sold or shared, if any, the categories of personal information disclosed for a business purpose, the categories of third parties or other recipients to whom personal information was sold, shared, or disclosed, and whether we use or disclose sensitive personal information for purposes other than those permitted by law.

Your California Privacy Rights

Subject to applicable law, consumers have the following rights:

• Right to Know/Access: You have the right to submit a verifiable request for information about the categories of personal information we have collected about you, the categories of sources from which that information is collected, the business or commercial purposes for collecting, selling, or sharing that information, the categories of third parties to whom that information is disclosed, and the specific pieces of personal information we have collected about you.

• Right to Delete: You have the right to submit a verifiable request for the deletion of personal information that Rula has collected from you, subject to certain exceptions. Please note that the CCPA deletion right does not apply to all information we maintain. For example, we generally cannot delete medical records, treatment records, provider notes, billing records, or other protected health information in response to a CCPA deletion request, and we may retain information as required or permitted by law.

• Right to Correct: You have the right to submit a verifiable request for the correction of inaccurate personal information maintained by Rula, taking into account the nature of the personal information and the purposes of processing the personal information.

• Right to Opt Out: California residents have the right to direct Rula not to sell or share their personal information, to the extent Rula sells or shares personal information.

• Right to Limit Use and Disclosure of Sensitive Personal Information: Rula collects sensitive personal information. Rula does not use or disclose sensitive personal information for purposes other than those specified by applicable law, and therefore the right to limit the use or disclosure of sensitive personal information does not apply.

• Right to Non-Retaliation/Non-Discrimination: Rula will not unlawfully discriminate or retaliate against you for exercising your rights under the CCPA.

How to Exercise Your Rights

Rula will respond to requests to know, delete, correct, opt out of the sale or sharing of personal information where applicable, and limit the use or disclosure of sensitive personal information where applicable, in accordance with applicable law and subject to verification of identity where required by law.

You can exercise these rights in the following ways:

• Contact our Support Contact Center at (323) 205-7088

• Engage with our Support Center Chat feature

• Chat with a live agent or complete our California Privacy Rights Request Form

• Email us at privacy@rula.com.

We will use commercially reasonable methods for verifying that the person submitting the request is the consumer about whom we have collected personal information or that person’s authorized agent. We match personal information that you provide us against personal information we maintain in our files. The more risk entailed by the request (e.g., a request for specific pieces of personal information), the more items of personal information we may request to verify your identity. If we cannot verify your identity to a sufficient level of certainty to respond securely to your request, we will let you know promptly and explain why we cannot verify your identity.

We will confirm receipt of and respond to a verifiable consumer request within the time periods required by applicable law, generally within 45 days of receipt, subject to one extension of an additional 45 days when reasonably required. If an extension is necessary, we will provide notice of the extension within the initial 45-day period. For requests to know or access personal information, we will disclose and deliver the required information in writing and in a readily usable format that allows you to transmit the information from one entity to another entity without hindrance, as required by applicable law.

You may designate an authorized agent to exercise your right to know, to correct, or to delete, and to exercise any applicable right to opt out of the sale or sharing of personal information, using the same request methods described above. If an authorized agent submits a request on your behalf, the authorized agent must submit with the request another document signed by you that authorizes the authorized agent to submit the request on your behalf. In addition, we may ask you or your authorized agent to follow the applicable process described above for verifying your identity. Authorized agents may also submit requests on your behalf as otherwise permitted by applicable law. In the alternative, you can provide a power of attorney compliant with the California Probate Code.

Categories of Personal Information We Collect About You

In the last 12 months, we have collected the following categories of personal information:

• Identifiers, such as your name and email address;

• California Customer Records (Cal. Civ. Code § 1798.80(e)), such as your phone number;

• Characteristics of protected classifications under state or federal law, such as your age and gender;

• Commercial Information, such as products and services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies;

• Professional/Employment Information, such as licensure information;

• Internet or Other Electronic Network Activity Information, such as device information, browsing activity, logs and analytics data;

• Geolocation Data, such as your approximate location based upon your IP address;

• Other Personal Information, including information you provide through forms, surveys, customer support communications, or feedback submissions, as well as information we may receive from social networking platforms when you interact with our pages;

• Inferences, such as information generated from your use of the services reflecting your interests and preferences; and

• Sensitive Personal Information, such as login credentials to access your account with the services and health-related information from your use of the services.

We retain each category of personal information only for as long as reasonably necessary and proportionate to achieve the disclosed business or commercial purposes, or as otherwise required or permitted by applicable law, taking into account the nature and sensitivity of the personal information, the purposes for which it was collected, our legal and operational needs, and applicable legal retention obligations.

Rula collects sensitive personal information, including login credentials to access your account with the Services and health-related information from your use of the Services, to the extent subject to the CCPA. We use and disclose sensitive personal information for purposes such as providing our Services, maintaining accounts, authenticating users, helping to ensure security and integrity, complying with law, and other purposes permitted by applicable law. Rula does not use or disclose sensitive personal information for purposes other than those specified by applicable law, and therefore the right to limit the use or disclosure of sensitive personal information does not apply.

Disclosure of Personal Information

Rula does not sell personal information for monetary consideration. However, we may share certain personal information with advertising partners for purposes of cross-context behavioral advertising, which may be considered “sharing” under the CCPA.

California residents have the right to opt out of the sale or sharing of their personal information. For information about targeted advertising and available opt-out options, please see the “Targeted Advertising Preferences” section of our Privacy Policy.

In addition, we have no actual knowledge that we sell or share the personal information of individuals under the age of 16. To learn more about the disclosure of your personal information, please refer to the “How We Share Personal Information” section of our Privacy Policy.

Disclosures for Business Purposes

In the preceding 12 months, we may have disclosed the categories of personal information listed in the “Categories of Personal Information We Collect About You” section for one or more of the following business purposes:

• Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.

• Helping to ensure security and integrity to the extent the use of the consumer’s personal information is reasonably necessary and proportionate for these purposes.

• Debugging to identify and repair errors that impair existing intended functionality.

• Short–term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumer’s current interaction with the business, provided that the consumer’s personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumer’s experience outside the current interaction with the business.

• Performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.

•  Providing advertising and marketing services, except for cross-context behavioral advertising, to the consumer provided that, for the purpose of advertising and marketing, a service provider or contractor shall not combine the personal information of opted-out consumers that the service provider or contractor receives from, or on behalf of, the business with personal information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers.

• Undertaking internal research for technological development and demonstration.

• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.

Rula may disclose each of the categories of personal information to the third parties listed below:

• Service providers: Rula may disclose to service providers any of the categories of personal information listed in the “Categories of Personal Information We Collect About You” section, for the business purpose of performing services on Rula’s behalf and, in particular, for the specific purposes described in the “Disclosures for Business Purposes” section, above.

• Auditors, lawyers, consultants, and accountants engaged by Rula: Rula may disclose the categories of personal information listed in the “Categories of Personal Information We Collect About You” section, to these service providers or contractors for the business purpose of auditing compliance with policies and applicable laws, in addition to performing services on Rula’s behalf.

• Other companies: Rula may disclose any of the categories of personal information listed in the “Categories of Personal Information We Collect About You” section to other companies to which Rula provides administrative services, presently including SUD Specialty Group – CA; Mental Health Specialty Group, P.A.; Mental Health Specialty Group NJ, PC; and Mental Health Specialty Group KS, P.A., and also including any future physician-owned entities to which Rula may provide administrative services, for the business purposes of (a) auditing compliance with policies and applicable laws, (b) helping to ensure security and integrity, (c) debugging, (d) short-term transient use, (e) internal research, and (f) activities to maintain or improve the quality or safety of a service or device.

Additional Information for Applicants or HR Individuals

To review supplemental information that describes the additional personal information we collect when you apply for a position with us, please refer to the California Applicant Privacy Notice. To review supplemental information that describes the additional personal information we collect from (a) employees, (b) independent contractors, interns, volunteers, owners, board members, and other individuals who perform work for Rula (collectively “Non-Employee Workers”), or (c) employees’ and Non-Employee Workers’ dependents, emergency contacts, and beneficiaries (“Related Contacts”), (all collectively, “HR Individuals”), please refer to the California HR Individuals Privacy Notice.