State Addenda

The below “State Addenda” supplement and form part of the Privacy Notice.

For consistency, capitalized terms have the meanings assigned to them here unless otherwise noted.

If you are a resident of Washington, please click here.

If you are a resident of Nevada, please click here.

Please note that this page may be updated as necessary to address evolving operations and regulations.

California

Capitalized terms in this section have the meaning given to them under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

You have the following rights under the CPRA:

The right to delete Personal Information. You have the right to request that we delete your Personal Information. Once we have verified this request, we will delete this information unless certain exceptions apply.
The right to correct inaccurate information. You have the right to request that we correct your Personal Information if it is inaccurate. Once we have verified this request, we will use commercially reasonable efforts to correct this information unless certain exceptions apply.
The right to know categories and specific pieces of Personal Information. You have the right to know which Personal Information we collect, use, disclose, and/or Sell, as applicable.
The right to opt-out of the Sale or Sharing of Personal Information. You have the right to request to be opted-out from the Sale or Sharing of your Personal Information.
The right to limit the use and disclosure of Sensitive Personal Information. You have the right to direct us to limit use of your Sensitive Personal Information to what is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests such goods or services, or for the performance of specifically enumerated Business Purposes.
The right of non-retaliation. We will not retaliate or discriminate against you for exercising any of these enumerated rights.

If you wish to exercise any of these rights, contact us at data-requests@get-carrot.com. To exercise your right to limit the use of your Sensitive Personal Information, in addition to contacting us with the provided email, you may also submit a request on this page.

Texas

Individuals residing in Texas are afforded certain additional rights with respect to their Personal Information under the Texas Data Privacy and Security Act (“DPSA”). If you are a Texas resident, this section applies to you.

i. Personal identifiers – such as your name or email address.
ii. Geolocation – the state you reside in and/or receive care.
iii. Sensitive personal data – Information related to your health, diagnoses and related health data.
iv. Transactional information – related to your use of Services.

We process your personal data to make Services available to consumers pursuant to the terms of the Employer Agreement and as requested by the consumer.

We also process your personal information to send you marketing communications in accordance with your preferences.

i. Carrot employees who assist you with your request.
ii. Your employer.
iii. Health care service providers.

DPSA Rights

Subject to verification of your identity and other information that we may need to honor your request, all Texas consumers have the following rights:

(i) Right to know or confirm. You have the right to know and confirm whether we are processing your Personal Information and the right to access such data.

(ii) Right to portability. You have the right to receive a portable copy of your Personal Information in a readily usable format.

(iii) Right to correct. You have the right to request we correct inaccuracies in your Personal Information.

(iv) Right to delete. You have the right to request we delete your Personal Information.

(v) Right to opt-out. You have the right to opt out of the processing of Personal Information for the purposes of targeted advertising, the sale of Personal Information, profiling or processing of sensitive Personal Information.

Please contact us at the following email if you have questions or would like to exercise your rights: data-requests@get-carrot.com. We will respond to your request within the period of time required by Texas State law. You have the right to appeal any negative decision and we will identify what steps you can take to appeal the applicable decision.

Connecticut

This Connecticut Addendum supplements the information set forth in our Privacy Notice and applies if you are a resident of Connecticut. It describes how Carrot collects, uses, discloses, and protects your Personal Information, and the rights you have under the Connecticut Data Privacy Act (“CTDPA”), as amended, and the consumer health data provisions of Connecticut law.

To the extent there is any conflict between this Addendum and the Privacy Notice, this Addendum controls for Connecticut residents.

Categories of Personal Information We Collect, Use, and Disclose

For details about the categories of Personal Information we collect, the purposes for which we process Personal Information, the legal bases on which we rely, and the categories of third parties with whom we share Personal Information, please see the “Collection, Use, and Disclosure of Personal Information” section of the Privacy Notice.

The Personal Information we collect about you may include sensitive data under Connecticut law, including data that reveals your mental or physical health condition, diagnosis, disability, or treatment; biometric data (when processed to uniquely identify you); precise geolocation data; and data revealing racial or ethnic origin or sexual orientation. We process sensitive data only with your consent, and we obtain separate consent before selling any sensitive data.

Sources of Personal Information

We collect Personal Information directly from you, automatically through your use of the Service, from your Plan Sponsor, from third parties acting on your behalf or on behalf of your Plan Sponsor, and from connected sources you elect to link to your Carrot experience (such as Apple HealthKit, Android Health Connect, or Withings devices).

Sale of Personal Information

We do not sell your Personal Information for monetary consideration. To the extent any disclosure of your Personal Information constitutes a “sale” under the CTDPA, you have the right to opt out as described below.

Profiling and Automated Decision-Making

We do not use solely automated processing to make decisions about you that produce legal or similarly significant effects without meaningful human review. For more information about our use of artificial intelligence and machine learning, including our approach to human oversight, see the “Use of Artificial Intelligence (AI) and Machine Learning (ML)” section of the Privacy Notice.

If a decision concerning you has been made through profiling that produces a legal or similarly significant effect, you have the right to question the outcome, be informed of the reasoning behind the decision, review the personal data used in the decision, and, where applicable, request that the decision be reevaluated.

Your Rights Under the CTDPA

As a Connecticut resident, you have the following rights:

Right to confirm and access. You may confirm whether we are processing your Personal Information and request access to that Personal Information, including, where applicable, the inferences we have derived from it. Certain categories of higher-risk data (including Social Security numbers, government identifiers, financial account numbers, account credentials, and biometric data) will not be disclosed in response to an access request; instead, we will confirm with sufficient particularity that we have collected such data.
Right to correct. You may request that we correct inaccuracies in your Personal Information.
Right to delete. You may request that we delete Personal Information we have collected from or about you.
Right to data portability. You may obtain a copy of your Personal Information that you previously provided to us in a portable and, to the extent technically feasible, readily usable format.
Right to obtain a list of third parties. You may request a list of the specific third parties (or, at our option, the categories of third parties) to whom we have disclosed your Personal Information.
Right to opt out. You may opt out of (i) the sale of your Personal Information, (ii) targeted advertising, and (iii) profiling in furtherance of automated decisions that produce legal or similarly significant effects concerning you.
Right to question and reevaluate profiling decisions. Where a profiling decision produces a legal or similarly significant effect concerning you, you have the right to question the outcome, be informed of the reasoning, review the personal data used, and, where applicable, request reevaluation.
Right to withdraw consent. Where we rely on your consent to process Personal Information, you may withdraw that consent at any time.
Right to appeal. If we deny your request, you have the right to appeal our decision. We will respond to your appeal within 60 days. If we deny your appeal, we will provide you with information on how to submit a complaint to the Connecticut Attorney General.

How to Exercise Your Rights

To exercise any of these rights, contact us at data-requests@get-carrot.com. We will respond to verifiable consumer requests within 45 days. If we need additional time (up to an additional 45 days), we will inform you of the extension and the reason for it.

You may also designate an authorized agent to submit requests on your behalf. We may require reasonable proof of the agent’s authority and may require you to verify your identity.

Universal Opt-Out Mechanisms

We recognize universal opt-out preference signals (such as the Global Privacy Control) sent through privacy-protective browsers or browser extensions, where the signal allows us to accurately determine that you are a Connecticut resident.

Consumer Health Data

Consumer health data — including data that identifies your physical or mental health condition or diagnosis, gender-affirming health data, and reproductive or sexual health data — is subject to additional protections under Connecticut law. We obtain your consent before processing or selling consumer health data, and we maintain contractual safeguards with any processor that handles consumer health data on our behalf.

Complaints

You may file a complaint with the Connecticut Attorney General at Connecticut Office of the Attorney General .

‍

Nebraska

This Nebraska Addendum supplements the information set forth in our Privacy Notice and applies if you are a resident of Nebraska. It describes how Carrot collects, uses, discloses, and protects your Personal Information, and the rights you have under the Nebraska Data Privacy Act (“NDPA”).

To the extent there is any conflict between this Addendum and the Privacy Notice, this Addendum controls for Nebraska residents.

Categories of Personal Information We Collect, Use, and Disclose

The Personal Information we collect about you may include sensitive data under Nebraska law, including data that reveals your mental or physical health diagnosis; genetic or biometric data processed to uniquely identify you; precise geolocation data; data revealing racial or ethnic origin, religious beliefs, sexual orientation, or citizenship or immigration status; and personal data collected from a known child. We process sensitive data only with your consent.

Sources of Personal Information

Sale of Personal Information

We do not sell your Personal Information for monetary consideration. To the extent any disclosure of your Personal Information constitutes a “sale” under the NDPA, you have the right to opt out as described below.

Profiling and Automated Decision-Making

Your Rights Under the NDPA

As a Nebraska resident, you have the following rights:

Right to confirm and access. You may confirm whether we are processing your Personal Information and request access to that Personal Information.
Right to correct. You may request that we correct inaccuracies in your Personal Information.
Right to delete. You may request that we delete Personal Information we have collected from or about you.
Right to data portability. You may obtain a copy of your Personal Information that you previously provided to us in a portable and, to the extent technically feasible, readily usable format.
Right to opt out. You may opt out of (i) the sale of your Personal Information, (ii) targeted advertising, and (iii) profiling in furtherance of automated decisions that produce legal or similarly significant effects concerning you.
Right to withdraw consent. Where we rely on your consent to process Personal Information, you may withdraw that consent at any time.
Right to non-discrimination. You will not be discriminated against for exercising any of these rights, provided that the refusal to provide Personal Information or a deletion request does not prevent us from providing you the Service.

How to Exercise Your Rights

You may also designate an authorized agent to submit opt-out requests on your behalf.

Universal Opt-Out Mechanisms

We recognize universal opt-out preference signals sent through privacy-protective browsers or browser extensions, where the signal allows us to accurately determine that you are a Nebraska resident.

Complaints

You may file a complaint with the Nebraska Attorney General at Data Privacy Homepage | Protect The Good Life .

Delaware

This Delaware Addendum supplements the information set forth in our Privacy Notice and applies if you are a resident of Delaware. It describes how Carrot collects, uses, discloses, and protects your Personal Information, and the rights you have under the Delaware Personal Data Privacy Act (“DPDPA”).

To the extent there is any conflict between this Addendum and the Privacy Notice, this Addendum controls for Delaware residents.

Categories of Personal Information We Collect, Use, and Disclose

The Personal Information we collect about you may include sensitive data under Delaware law, including data that reveals your mental or physical health condition or diagnosis (including pregnancy status); genetic or biometric data processed to uniquely identify you; precise geolocation data; data revealing racial or ethnic origin, religious beliefs, sex life, sexual orientation, or citizenship or immigration status; status as transgender or nonbinary; and personal data collected from a known child. We process sensitive data only with your consent.

Sources of Personal Information

Sale of Personal Information

We do not sell your Personal Information for monetary consideration. To the extent any disclosure of your Personal Information constitutes a “sale” under the DPDPA, you have the right to opt out as described below.

Profiling and Automated Decision-Making

Your Rights Under the DPDPA

As a Delaware resident, you have the following rights:

Right to confirm and access. You may confirm whether we are processing your Personal Information and request access to that Personal Information.
Right to correct. You may request that we correct inaccuracies in your Personal Information.
Right to delete. You may request that we delete Personal Information we have collected from or about you, including Personal Information we collected through third parties.
Right to data portability. You may obtain a copy of your Personal Information that you previously provided to us in a portable and, to the extent technically feasible, readily usable format.
Right to obtain a list of third parties. You may request a list of the categories of third parties to whom we have disclosed your Personal Information.
Right to opt out. You may opt out of (i) the sale of your Personal Information, (ii) targeted advertising, and (iii) profiling in furtherance of automated decisions that produce legal or similarly significant effects concerning you.
Right to withdraw consent. Where we rely on your consent to process Personal Information, you may withdraw that consent at any time.
Right to appeal. If we deny your request, you have the right to appeal our decision. We will respond to your appeal within 60 days. If we deny your appeal, we will provide you with information on how to submit a complaint to the Delaware Department of Justice.

How to Exercise Your Rights

You may also designate an authorized agent to submit requests on your behalf. We may require reasonable proof of the agent’s authority and may require you to verify your identity.

Universal Opt-Out Mechanisms

We recognize universal opt-out preference signals sent through privacy-protective browsers or browser extensions, where the signal allows us to accurately determine that you are a Delaware resident.

Complaints

You may file a complaint with the Delaware Department of Justice at privacy@delaware.gov or at Personal Data Privacy Portal - Delaware Department of Justice - State of Delaware .

New Jersey

This New Jersey Addendum supplements the information set forth in our Privacy Notice and applies if you are a resident of New Jersey. It describes how Carrot collects, uses, discloses, and protects your Personal Information, and the rights you have under the New Jersey Data Privacy Act (“NJDPA”).

To the extent there is any conflict between this Addendum and the Privacy Notice, this Addendum controls for New Jersey residents.

Categories of Personal Information We Collect, Use, and Disclose

The Personal Information we collect about you may include sensitive data under New Jersey law, including data that reveals your mental or physical health condition or diagnosis; financial information (including account numbers and credentials providing access to financial accounts); genetic or biometric data processed to uniquely identify you; precise geolocation data; data revealing racial or ethnic origin, religious beliefs, sex life, sexual orientation, transgender or nonbinary status, or citizenship or immigration status; and personal data collected from a known child. We process sensitive data only with your consent.

Sources of Personal Information

Sale of Personal Information

We do not sell your Personal Information for monetary consideration. To the extent any disclosure of your Personal Information constitutes a “sale” under the NJDPA, you have the right to opt out as described below.

Profiling and Automated Decision-Making

Your Rights Under the NJDPA

As a New Jersey resident, you have the following rights:

Right to confirm and access. You may confirm whether we are processing your Personal Information and request access to that Personal Information.
Right to correct. You may request that we correct inaccuracies in your Personal Information.
Right to delete. You may request that we delete Personal Information we have collected from or about you.
Right to data portability. You may obtain a copy of your Personal Information that you previously provided to us in a portable and, to the extent technically feasible, readily usable format.
Right to opt out. You may opt out of (i) the sale of your Personal Information, (ii) targeted advertising, and (iii) profiling in furtherance of automated decisions that produce legal or similarly significant effects concerning you. We will process opt-out requests within 15 days of receipt.
Right to withdraw consent. Where we rely on your consent to process Personal Information, you may withdraw that consent at any time.
Right to non-discrimination. You will not be discriminated against for exercising any of these rights.
Right to appeal. If we deny your request, you have the right to appeal our decision. We will respond to your appeal within a reasonable time. If we deny your appeal, we will provide you with information on how to submit a complaint to the New Jersey Division of Consumer Affairs.

How to Exercise Your Rights

To exercise any of these rights, contact us at data-requests@get-carrot.com. We will respond to verifiable consumer requests within 45 days (with the exception of opt-out requests, which we process within 15 days). If we need additional time (up to an additional 45 days), we will inform you of the extension and the reason for it.

You may also designate an authorized agent to submit opt-out requests on your behalf.

Universal Opt-Out Mechanisms

We recognize universal opt-out preference signals sent through privacy-protective browsers or browser extensions, where the signal allows us to accurately determine that you are a New Jersey resident.

Complaints

You may file a complaint with the New Jersey Division of Consumer Affairs at https://www.njconsumeraffairs.gov/.

arrow_back

Return to privacy policy

State addenda to privacy notice

California

Texas

Connecticut

Nebraska

Delaware

New Jersey