If you reside in California, please read this section for additional disclosures about how C4 Therapeutics, Inc. (“C4T,” “we,” “our,” or “us”) may collect, use, and disclose information about you, and for information about your rights under California law under the California Consumer Privacy Act (“CCPA,” including as amended by the California Privacy Rights Act (the “CPRA”)). References to the CPRA in this Supplemental Privacy Policy for California Residents become operative January 1, 2023.
1. Information We May Collect About You
We collect personal data that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular person or household (“Personal Information,” as defined by the CCPA).
Personal Information does not include:
- Publicly available information from government records;
- De-identified or aggregated consumer information; and
- Information excluded from the CCPA’s scope, such as:
- Health or medical information collected by entities directly subject to the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) and the California Confidentiality of Medical Information Act (“CMIA”), clinical trial data or certain other research data; and
- Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (“FRCA”), the Gramm-Leach-Bliley Act (“GLBA”) or California Financial Information Privacy Act (“FIPA”), and the Driver’s Privacy Protection Act of 1994.
Over the last 12 months, we may have collected the information referenced in Section B of our Privacy Policy, “Personal Data We Collect About You,” which may include one or more of the following categories of Personal Information:
- Identifiers;
- Personal Information categories listed in the California Consumer Records statute (Cal. Civ. Code § 1798.80(e));
- Sensitive Personal Information (as defined in the CPRA);
- Internet or other electronic network activity information;
- Non-public education information;
- Professional or employment-related information;
- Characteristics of protected classifications under California or federal law;
- Biometric information;
- Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies;
- Audio, electronic, visual, thermal, olfactory, or similar information;
- Geolocation data; and
- Inferences drawn from other Personal Information.
2. Sources of Personal Information
We obtain the Personal Information from the following categories of sources:
- Directly from you, your caregiver or agent;
- Indirectly from you or your caregivers or agents (i.e., in the course of providing services);
- Directly and indirectly from activity on our websites (for example, from submissions through our websites or from website usage details collected automatically); and
- From third parties in connection with the provision of services.
3. Use of Personal Information
We may use the Personal Information we collect for one or more of the business purposes described in Section D of our Privacy Policy, “How We Use Your Personal Data.”
4. How We Share Your Personal Information
C4T does not “sell“ (as such term is defined by the CCPA) your Personal Information. C4T does not “share” (as such term is defined by the CPRA) your Personal Information.
For information about how we may otherwise share your Personal Information for business purposes, please see Section G of our Privacy Policy, “How We Share Your Personal Data.”
5. How Long We Retain Your Personal Information
For information about how long we retain your Personal Information, please see Section D of our Privacy Policy, “How We Use Your Personal Data.”
6. Your CCPA Rights
The CCPA provides consumers (i.e., California residents) with specific rights (listed below and subsequently referred to as “CCPA Rights”), subject to some limitations and the verification of their identity, regarding their Personal Information:
- The right to know about and request access to the specific pieces of Personal Information that C4T has collected, used, shared or sold about them, including the categories of information, sources and business purposes of collection, as well as the categories of third parties to whom C4T has disclosed or shared the Personal Information. You may only make a request twice within a 12-month calendar year;
- The right to request deletion of their Personal Information (subject to certain exceptions);
- The right to opt-out of the sale of their Personal Information, and under the CPRA, the right to opt-out of the sharing of certain Personal Information;
- The right to receive equal service and price and not be discriminated against for exercising their CCPA Rights;
- Under the CPRA, the right to correct inaccurate Personal Information; and
- In certain circumstances, under the CPRA, the right to restrict the processing of Sensitive Personal Information.
In order for C4T to process a request for you to exercise your CCPA Rights, we will first verify your identity by asking you to provide certain Personal Information. This may include a description of your relationship with C4T, your first and last name, email address, telephone number and postal address or other Personal Information that will allow us to verify your identity. Please submit your requests by contacting us at this number: (617) 231-0700 or by emailing us at privacy@c4therapeutics.com.
You may designate an authorized agent to exercise your CCPA Rights on your behalf in accordance with the CCPA. C4T may require that you provide the authorized agent with written permission to act on your behalf and that the authorized agent verify his or her identity directly with us.
We do not charge a fee to process or respond to your verifiable request unless it is excessive, repetitive or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
When you submit a request to exercise your CCPA Rights, C4T will do its best to respond to your request as soon as possible after we verify your identity, and, in any event, no later than 45 days after receiving your request.
*****
Last Revised: November 10, 2022
