Non-HIPAA Data Privacy Policies

California Consumer Privacy Rights Addendum

Last Updated: August 7, 2026

This Privacy Addendum (together with the Privacy Policy, Terms of Use, and any other policies referenced on our Website) identifies how Privia Health, LLC (“Privia,” “us,” “we” or “our”) will collect and handle any Personal Information that we collect from consumers or Website visitors located in California, the European Economic Area (“EEA”), the United Kingdom (“UK”), or Switzerland, as applicable, as well as any Personal Information that they provide to us.

Our privacy practices comply with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (together, the “CCPA”). An explanation of your rights under the CCPA can be found here.

If you are a resident of the EEA, UK, or Switzerland, additional policies applicable to our collection and processing of your Personal Information can be found here. Non-EEA countries do not have the same data protection laws as the EEA, UK, or Switzerland. We will, however, take steps to ensure that any transfer of Personal Information will be secure and complies with applicable data protection laws.

As our services evolve and we perceive the need or desirability of using the Personal Information we collect from you in ways that are not described in this Privacy Addendum, we may from time to time amend this Privacy Addendum. We encourage you to check our Website frequently to review the current Privacy Addendum in effect and any changes that may have been made to it.

1. Introduction

This Privacy Addendum describes how Privia collects, uses, and shares Personal Information of our clients, prospective employees, visitors to our websites at www.priviahealth.com and www.myprivia.com as well as the websites of our affiliated doctors and care centers (collectively, “Website”), and individuals who contact us to request information. The Website and our other programs and services are referred to in this Privacy Addendum as the “Services.”  This Privacy Addendum describes how we collect and use Personal Information (information which can be used to identify a specific individual) and anonymous data (which cannot be used to identify a specific individual).

Region-specific provisions. Certain provisions of this Policy, which are clearly labelled, apply only to users who are citizens or residents of particular regions (e.g., the EU or California).

Children. Our Services are not directed to children. See Protecting children’s privacy, below.

2. What Personal Information does Privia collect?

For purposes of this Policy, “Personal Information” means information (whether stored electronically or in paper-based filing systems) relating to a living individual who can be identified from that data (or from a combination of that data and other information in our possession). The table below describes the categories of Personal Information we may collect.

The examples given in this table are not meant to provide an exhaustive list, but are examples of the kinds of data included in each category. Sections 2.1 through 2.4, below, specify the categories of information we do collect.

Please note that “Personal Information” does not include publicly available information from government records, deidentified or aggregated consumer information, or information excluded from the CCPA's scope (such as health data covered by HIPAA).

2.1 Personal Information and Sensitive Personal Information

Privia collects only that Personal Information that is relevant for the purposes for which the data is requested. Privia does not use your Personal Information in any way that is incompatible with the purposes for which it was collected or for which you have consented.

Some of the categories of Personal Information include “Sensitive Personal Information,” and Privia may collect and maintain your Sensitive Personal Information, which includes the following (if the information is not publicly available):

• Identifiers: social security number, driver’s license, state identification card, or passport number.
• Other Data: Most data in this category includes sensitive Personal Information, such as health information and data, account log-ins, financial account information, debit or credit card numbers in combination with any required security or access code, password, or credentials allowing access to an account.
• Protected Classes: a consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership, or information concerning a consumer’s sex life or sexual orientation.
• Biometric Information: a consumer’s genetic data, or any biometric information processed for the purpose of uniquely identifying a consumer.
• Internet Activity: the contents of a consumer’s mail, email, and text messages, unless Privia is the intended recipient of the communication.
• Geolocation Data: a consumer’s precise location.

Privia only uses and discloses your Sensitive Personal Information for the purposes specified in Title 11 of the California Code of Regulations, Section 7027(m). We do not collect or process Sensitive Personal Information for the purpose of inferring characteristics about you.

2.2 Personal Information Collected about Clients

In order to provide our clients with individualized services, we collect certain non-public, Personal Information about you from documents you provide to us, such as patient consent forms and government-issued identification documents (e.g., driver’s license. In addition to receiving Personal Information directly from you, we may also receive information from your attorneys, banks, and other sources. We will only obtain such information from third parties with your express consent and as permitted by law.

2.3 Personal Information Collected about Prospective Employees

We may collect Personal Information from individuals seeking employment with Privia and entering information within the Privia employment portal, which is operated by SmartRecruiters, Inc., and accessible via our Website. If we extend an offer of employment that is accepted by a prospective employee, we may collect additional information, such as a social security number, for purposes of facilitating a background check, which is conducted by Inflection Risk Solutions, LLC, a subsidiary of Checkr Group, Inc., or one of its affiliates, such as GoodHire or Checkr. We do not collect Commercial Information, Biometric Information, Internet Activity or Sensory Data from prospective employees.

2.4 Personal Information Collected about Website Visitors or Callers

We may collect Personal Information from visitors to our website and others who contact us to request information. In addition, our web server automatically collects and stores the following information from visitors to our Site:

• We collect information from web browsers, mobile devices, and servers, including browser type, IP address, unique device identifiers, language preference, referring website, date and time of access, operating system and mobile network information.
• We may also determine the approximate location of your device from your IP address. We collect and use this information to determine statistics about our website, including how many people visit our website from certain geographic regions.
• Our Site uses cookies and pixel tags to collect this information, including Google Analytics cookies.  
• You can block our use of cookies through settings in your browser. Because these settings are different in different browsers, we recommend that you visit All About Cookies at www.allaboutcookies.org, where you can find comprehensive information on cookie management and blocking for a wide variety of browsers.

We do not collect any other categories of information from our website visitors or individuals who contact us to request information.

2.5 Opt-Out Preference Signals

Our website recognizes and honors browser-based opt-out preference signals, such as the Global Privacy Control (GPC). If your browser or extension transmits a GPC signal when visiting our Website, our systems will automatically process that signal as a request to disable non-essential tracking cookies and analytics on that browser and device.

3. Personal Information from Vendors and Business Partners

We collect Personal Information from representatives of our vendors and business partners in the course of our business when the representative or the company they work for is a customer or vendor of Privia. We collect this information from the following sources:

• Their employer in connection with the work they do for their employer and how that relates to the Services.
• Third parties Privia works with, such as business partners, and through introductions from other individuals or companies.

When you or the company you work for interacts with Privia (for example, when providing technical services to us), we collect the following types of Personal Information:

• Contact information: such as your email address, phone number, and any other information you provide relating to your work or to you personally (for example, your name, job title or other information in your email signature).
• Financial Information, which can include bank account information.
• Information relating to our dealings with you or the company you work for, such as information used to administer your company account, verify financial transactions, details of goods or services that Privia has exchanged with you, and information that you give us or we otherwise obtain when you interact with Privia.

4. How does Privia use Personal Information?

4.1 Personal Information Collected about Clients

We will use this information:  

• to provide you with the Services that you request from us;
• to assess your satisfaction with the Services;
• to carry out our obligations arising from any contracts entered into between you and us or any affiliated companies or third-party vendors;  
• to contact you in the future to provide you with information about other products and services we offer;
• to manage your online account(s) and send you technical notices, updates, security alerts, and support and administrative messages;
• to detect, investigate, and prevent security incidents and other malicious, deceptive, fraudulent, or illegal activity, and protect the rights and property of Privia and others;
• to notify you about changes to our Services;
• to comply with applicable laws and regulations.

4.2 Personal Information Collected about Prospective Employees

We will use this information:  

• to respond to and process your job application;
• in the case of candidates who accept employment with Privia, to administer employment benefits;
• to make inquiries about you for reference purposes.

4.3 Personal Information Collected about Website Visitors or Callers

We will use this information:  

• to provide information you requested about our Services;
• to improve our Website to ensure that content is presented in the most effective manner for you and for your computer;
• as part of our efforts to keep our Website safe and secure.

4.4 Personal Information Collected from Vendors and Business Partners

We will use this information:  

• to contact you in connection with the services you or your company provide to us;
• to fulfill our contractual and business obligations, and ensure that you fulfill your obligations;
• to confirm that you have the ability and resources to provide services to us, which may include making inquiries about your financial status and business experience, as well as your past commercial practices.

5. Do we disclose your Personal Information to any third parties?

5.1 Personal Information Collected about Clients

Privia does not sell your Personal Information to any third parties, or share your Personal Information to facilitate advertising goods or services by others.

Privia may share your information with service providers and contractors to provide the Services. The Personal Information we share with service providers and contractors can include all of the categories of Personal Information that we collect. When we do, we enter into a written agreement requiring that party to comply with all applicable laws, such as the CCPA, and restricting that party from the following: selling or sharing Personal Information; using the Personal Information for any purpose other than the purpose specified in the agreement; using, retaining, or disclosing the Personal Information other than as specified in the agreement; or combining the Personal Information with Personal Information the service provider or contractor receives or collects in other contexts. There are times when a service provider or contractor may engage another party to assist in providing the Services; in those cases, the service provider or contractor must notify us in advance, and must have an agreement restricting the use, sale, and sharing of the Personal Information that is similar to our agreement with our service provider or contractor. Privia does not share Personal Information of any person who is less than 16 years old without their or their legal guardian’s explicit consent.

By using our Services and providing your Personal Information, you agree that we have the right to disclose the categories of Personal Information we collect, as identified in Section 2, to our service providers or contractors for the business purposes identified in Section 4.

There are other circumstances when we may share your Personal Information:

• Merger or Sale – We may share information in conjunction with a prospective purchase, sale, or merger of all or part of our business, provided that we take appropriate precautions (for example, through a written confidentiality agreement) so the prospective purchaser does not disclose information obtained in the course of the review. If we sell all or a part of our business or assets, or merge with another company, we will disclose Personal Information to the purchaser as part of the transaction.
• Legal Proceedings – We may share Personal Information in connection with actual or threatened legal proceedings or alternative dispute resolution proceedings, either initiated by or against us, provided we disclose only the information necessary to file, pursue, or defend against the lawsuit, and take reasonable precautions to ensure that the information disclosed does not become a matter of public record.
• Legal Obligations – If we are under a duty to disclose your Personal Information in order to comply with any legal obligation, or any lawful request by public authorities (including to meet national security or law enforcement requirements), or in order to enforce or apply our terms of use and other agreements, or to protect the rights, property, or safety of us, our customers, or others.

5.2 Personal Information Collected about Prospective Employees

We do not disclose any Personal Information about prospective employees and job applicants except as permitted or required by law. Personal Information about prospective employees and job applicants may be disclosed to service providers or contractors for the following business purposes:

• To verify information provided on the job application.
• To perform a background check on the job applicant, but only after obtaining consent to do so.  

In some instances, we receive Personal Information about prospective employees and job applicants from third-party services providing employment referrals. In such situations, once we receive the Personal Information we do not disclose it except as described in this section.

5.3 Personal Information Collected about Website Visitors or Callers

We do not disclose to any third parties Personal Information collected from Website visitors or callers seeking additional information about our Services.

6. Our storage of your Personal Information

Privia uses reasonable and appropriate measures to protect your Personal Information from loss, misuse, and unauthorized access, disclosure, alteration and destruction, taking into due account the risks involved in processing the Personal Information and the nature of the Personal Information we collect. For more detailed information about how we store and protect your Personal Information, please refer to Section 2 of our Privacy Policy.

6.1 Data Retention

We retain Personal Information for only as long as reasonably necessary to fulfill the purposes for which it was collected, comply with legal and regulatory obligations, resolve disputes, and enforce our agreements. The retention criteria and timeframes for each category of Personal Information collected are as follows:

• Identifiers (e.g., Name, Email, SSN, ID Numbers): Retained for the duration of the client or employee relationship plus up to 7 to 10 years to satisfy statutory medical record and legal recordkeeping requirements.
• Protected Classes & Sensitive Personal Information: Retained for the duration of the relationship plus applicable statutory recordkeeping periods (e.g., employment background check laws).
• Internet Activity & Technical Data (e.g., IP Address, Browsing History): Retained for up to 13 months from the date of collection.
• Commercial, Professional, & Education Data: Retained for the duration of the client, prospective employee, or vendor contract term plus 6 years post-termination.
• Financial & Account Credentials: Retained for as long as required to process transactions and satisfy financial record retention laws.

7. Access to other websites

Our Website may include links to and from other websites of affiliates or other unaffiliated third parties. If you follow a link to any of these websites, please note that these websites are not covered by this Privacy Addendum. We are not responsible for the privacy practices of any third parties or the content of linked sites, and we encourage you to read the applicable privacy policies and terms and conditions of such parties or websites. This Privacy Addendum only applies to how Privia collects and uses your Personal Information, and it does not apply to any other company or any other company’s websites even if you access them from our Website. Please check those websites’ policies before you submit any Personal Information to them.

8. Protecting children’s privacy

We are strongly committed to protecting the safety and privacy of children who visit our Website. Our Website is not designed nor is it intended to be used by children under 13, and we do not knowingly collect Personal Information online from children under 13 and have adopted techniques to ensure compliance with this Privacy Addendum and the Children’s Online Privacy Protection Act of 1998 (“COPPA”). Our Website includes content that we believe to be unsuitable for children under 13, and we encourage all parents to talk to their children about online safety and to monitor their children’s use of the Internet.

9. Policies for California Residents

The CCPA affords California consumers certain rights with respect to their Personal Information, as set forth in this section.

9.1 Your Rights with Respect to Your Personal Information

Subject to certain exceptions, you have the following rights with respect to your Personal Information:

• To request that Privia disclose what Personal Information it has collected, used, or disclosed, over the 12-month period preceding Privia's receipt of such a request;  
• To request that Privia disclose whether any of your information was sold or shared with third parties, to whom such information was sold or shared, and the business purpose for selling or sharing the information;
• To request that any inaccurate or incomplete Personal Information maintained by Privia be corrected or supplemented; and
• To request deletion of your Personal Information maintained by Privia.
• To direct us not to sell your Personal Information or share it for cross-context behavioral advertising. (Privia does not sell or share Personal Information.)

All of these rights are subject to certain conditions and exemptions. For example, Privia will not be obligated to delete your Personal Information if we need to retain it to protect ourselves in the event of a legal claim. Similarly, Privia will not be obligated to disclose your Personal Information that Privia has collected, used, or disclosed within the last 12 months, if responding to such request may require Privia to expend disproportionate efforts (e.g., when the Personal Information that is the subject of the request is not in a searchable or readily-accessible format, is maintained only for legal or compliance purposes, is not sold or used for any commercial purpose, and there is no reasonably foreseeable material impact to you by our not responding).  

9.2 Right to Non-Discrimination for the Exercise of a Consumer's Privacy Rights

We will not deny you any Services or offer you a different price, level, or quality of Services because you exercise any of your rights under the CCPA; however, we may not be able to provide the Services if you refuse to provide us the Personal Information that is necessary for us to provide the Services, or if you ask us to delete your Personal Information.

9.3 California Disclosures for the Preceding 12 Months

In the 12 months preceding the effective date of this Privacy Addendum, Privia has collected the categories of Personal Information described in Section 2 above.

• Sales and Sharing: In the preceding 12 months, Privia has not sold Personal Information and has not shared Personal Information for cross-context behavioral advertising.
• Disclosures for Business Purposes: In the preceding 12 months, Privia has disclosed the following categories of Personal Information to service providers and contractors for operational business purposes:
• Identifiers, Financial Data, & Sensitive Personal Information: Disclosed to cloud platforms, background check providers (e.g., Inflection Risk Solutions/Checkr), and medical practice management vendors.
• Internet Activity: Disclosed to website analytics providers (e.g., Google Analytics) and IT security providers.

9.4 Submitting a CCPA Data Request

To submit a request to Privia regarding your Personal Information as described in this section, please contact us by calling this toll-free number (877)-541-9048 or emailing us at privacy@priviahealth.com.

Privia is required to verify the identity of the individual requesting access to a consumer’s data or requesting deletion of a consumer’s data. To verify your identity, we will rely upon information we have previously collected about you, such as phone calls received from a known phone number or emails received from a known email. We will also rely upon our personal relationship with our clients to verify the identity of a requester.

If you submit a request and you are not a Privia client (which may be the case if you requested information through our Website or a phone call to our “contact us” number but did not become a client or employee), then we will verify your identity by using the information we collected, such as phone number or email address.

9.5 Authorized Agent

You may designate an authorized agent to exercise a CCPA right on your behalf. If you use an authorized agent to exercise your rights under the CCPA, we will need the following proof that you have authorized the agent to act on your behalf:

• Written proof that you have authorized the agent to act on your behalf, and separately verify your identity as described above; or
• Proof that the authorized agent holds a power of attorney to act on your behalf pursuant to California Probate Code §§ 4000-4465.

9.6 Exclusion for Data Subject to Other Privacy Laws

Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), clinical trial data, or other qualifying research data are not subject to the CCPA. You do not have the rights described in this section with respect to that information. For information regarding your rights and Privia’s obligations with respect to information covered by HIPAA, please review our HIPAA Privacy Notice.

10. Policies for Residents of EEA, UK and Switzerland

In addition to the other policies described in this Privacy Addendum, residents of the EEA, the UK, and Switzerland have the following additional rights and protections as required by the European Union General Data Privacy Regulation (“GDPR”), and UK and Swiss data protection laws. The additional rights and protections set forth in this section of this Policy apply only to residents of the EEA, the UK, and Switzerland. For ease of reference, when we refer to GDPR in this section, we are referring to the UK and Swiss data protection laws, as well as the GDPR. For the purposes of the GDPR, Privia is a “Controller,” which means Privia determines the purposes for which, and the manner in which, any Personal Information is Processed and used in its business.

10.1 Definitions

The following additional definitions apply to this section of this Privacy Addendum:

“Processor” means any Person Processing Personal Information.

“Person” means a natural person, corporation, association, organization, partnership, or other legal entity.

“Process” or “Processing” is any activity that involves use of the Personal Information. It includes, without limitation, obtaining, recording, or holding the Personal Information, or carrying out any operation or set of operations on the Personal Information including organizing, amending, retrieving, using, disclosing, erasing or destroying it. Processing also includes transferring Personal Information to third parties.

10.2 The legal basis for Processing your Personal Information

In order to comply with the GDPR, we are required to set out the legal basis for the Processing of your Personal Information. The legal basis for Processing your Personal Information will be one of the following:

• our own legitimate business interests, or the legitimate business interests of our third-party partners, promoters, affiliates, distributors, suppliers, vendors, and subcontractors, such as, for example, providing direct marketing to our customers of our products and services that we think would be of interest, permitting prospective employees to search and apply for job opportunities, handling inquiries from our promoters, affiliates, distributors, vendors, and customers, or other instances where we have carried out a legitimate interests assessment and have established an existing legitimate interest;
• the performance of a contract that we have in place with you;
• your consent, where appropriate; or
• compliance with our legal obligations, including to meet national security or law enforcement requirements.

10.3 Where we store your Personal Information

The data that we collect from you is stored on secure servers, as more fully described in Section 2 of our Privacy Policy. By submitting your Personal Information, you agree to this transfer, storing, and Processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Addendum.

The transmission of information via the Internet is not completely secure. Although we take reasonable steps to protect your Personal Information, we cannot guarantee the security of your data transmitted to our Website; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorized access.

10.4 Addendum to how long we store your Personal Information

In some cases, there is a legal requirement to keep Personal Information for a minimum period of time. Except in those circumstances, we do not keep your Personal Information for any longer than is necessary for the purposes for which the Personal Information was collected or for which it is to be further Processed.

10.5 Your rights with respect to your Personal Information

Subject to certain exceptions, you have the following rights with respect to your Personal Information:

• To receive or access a copy of the Personal Information that we hold about you;
• To request that any inaccurate or incomplete Personal Information be corrected or supplemented;
• To have your Personal Information erased, unless we have a legitimate reason to retain the Personal Information (such as if we are required to do so for legal reasons); and
• To ask us not to Process your Personal Information for a particular purpose, including for marketing.

All of these rights are subject to certain conditions and exemptions. For example, Privia will not be obligated to erase your Personal Information if we need to retain it to protect ourselves in the event of a legal claim.

To exercise any of these rights, please submit a written request to us using the contact information set forth in Section 12, below. Privia reserves the right to charge a fee in dealing with such a request as permitted by applicable law and regulations. You may also opt out of receiving additional marketing information by using the unsubscribe feature in any marketing email we send you.

11. Conditions of use and changes to our Privacy Notice

If you choose to receive our Services or visit our Website, any dispute over privacy is subject to this Privacy Addendum and our Terms of Use, including limitations on damages, resolution of disputes, and application of the law of the State of California. If you have any concern about our privacy practices, please contact us with a thorough description, and we will try to resolve it. As our business changes, our Privacy Addendum and Terms of Use may change also. We may e-mail periodic reminders of our notices and conditions, but you should check our Website frequently to see recent changes. Unless stated otherwise, our current Privacy Addendum applies to all information that we have about you and your account.

12. Contacting us

This Website is owned and operated by Privia. If you have any questions or suggestions with respect to this Privacy Addendum or our privacy practices, please e-mail us at privacy@priviahealth.com or you can contact us by mail or telephone at:

Privacy Officer 
950 N. Glebe Rd., Suite 700 
Arlington, VA 22203

CCPA-Specific Requests

Please submit CCPA-specific data requests through the procedures set forth in Section 9.4 above.

GDPR/UK/Swiss-Specific Requests      

For residents of the EEA, the UK or Switzerland, please e-mail us at privacy@priviahealth.com or contact us by mail or telephone at:

Privacy Officer 
950 N. Glebe Rd., Suite 700 
Arlington, VA 22203 
(877)-541-9048

New Jersey Consumer Privacy Rights Addendum

Effective Date: July 30, 2026

Last Updated: July 30, 2026

This New Jersey Privacy Rights Addendum ("NJ Addendum") supplements the main Privacy Policy of Privia Health, LLC ("Privia," "we," "us," or "our"). This NJ Addendum applies solely to residents of the State of New Jersey ("consumers" or "you") and addresses requirements under the New Jersey Data Privacy Act (NJDPA / N.J.S.A. 56:8-166.1 et seq.).

1. Scope and Applicability

A. Resident Scope

This NJ Addendum applies to the personal data of natural persons who are residents of New Jersey acting in an individual or household context. It does not apply to individuals acting in a commercial or employment context.

B. Controller vs. Processor Operational Roles

Privia operates in distinct capacities depending on the nature of the Services provided:

• Privia as a Data Controller: When Privia directly determines the purposes and means of processing your personal data—such as when you interact with our public websites (www.priviahealth.com, www.myprivia.com), request information directly from us, create an account on our patient portals, or receive direct services—we act as a Data Controller. In this capacity, we are directly responsible for honoring your New Jersey privacy rights.
• Privia as a Data Processor: When Privia collects, maintains, or processes personal data strictly on behalf of affiliated medical practices, care centers, health systems, or institutional clients pursuant to a binding written contract, we act as a Data Processor. In such instances, the institutional client acts as the Data Controller. When acting as a Data Processor, Privia assists the Controller in fulfilling its statutory obligations under the NJDPA, and consumers should direct their rights requests directly to the respective Data Controller practice.

2. Collection and Processing of Sensitive Data

Privia does not collect or process Sensitive Personal Data under New Jersey law without first obtaining your explicit, affirmative Opt-In Consent.

Sensitive Data under the NJDPA includes:

• Personal data revealing racial or ethnic origin, religious beliefs, mental or physical health condition/diagnosis, sex life, or sexual orientation.
• Genetic or biometric data processed for the purpose of uniquely identifying an individual.
• Personal data collected from a known child under the age of 13.
• Precise geolocation data (within a geographic area defined by a 1,850-foot radius).
• Financial account details in combination with required security credentials allowing access.

A. Explicit Opt-In Protocols

Before collecting or processing any Sensitive Personal Data for non-exempt purposes, Privia will present you with a clear, clear-language opt-in prompt. You may withdraw your consent at any time by contacting us using the methods outlined in Section 5 of this NJ Addendum.

B. Heightened Protections for Minors (Ages 13–17)

In accordance with New Jersey law, Privia strictly prohibits the processing of personal data for the purpose of targeted advertising or the sale of personal data of consumers aged 13 through 17 without obtaining prior, explicit Opt-In Consent from the minor or their verified legal guardian.

3. Your New Jersey Consumer Privacy Rights

Subject to statutory exemptions (such as medical data governed by HIPAA or financial data governed by GLBA), New Jersey residents possess the following legal rights regarding their personal data:

• Right to Access / Confirm Processing: You have the right to confirm whether Privia is processing your personal data and to access such personal data.
• Right to Correction: You have the right to correct inaccuracies in your personal data, taking into account the nature of the data and the purposes of processing.
• Right to Deletion: You have the right to delete personal data provided by or obtained about you.
• Right to Data Portability: You have the right to obtain a copy of your personal data that you previously provided to Privia in a portable, readily usable, and technically feasible format that allows you to transmit the data to another controller without hindrance.
• Right to Opt-Out: You have the right to opt-out of the processing of your personal data for purposes of:
  1. Targeted advertising;
  2. The sale of personal data; or
  3. Profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

4. Universal Opt-Out Preference Signals (GPC)

Privia recognizes and processes automated Universal Opt-Out Preference Signals, including the Global Privacy Control (GPC).

• Automated Processing: When our systems detect an active GPC or compliant universal opt-out signal transmitted by your browser or device, Privia automatically treats the signal as a valid, friction-free request to opt-out of the processing of your personal data for targeted advertising and data sales for that browser or session.
• No Additional Forms Required: Exercising your opt-out rights via a Universal Opt-Out Preference Signal occurs automatically without requiring you to submit a manual form, create an account, or provide additional contact information.

5. Request Timeline, Process, and Appeals

A. Submitting Requests

To exercise your rights under the NJDPA, please submit a verifiable request through one of the following channels:

• Toll-Free Phone: (877)-541-9048
• Email: privacy@priviahealth.com
• Mail: Privacy Officer, Privia Health, LLC, 950 N. Glebe Rd., Suite 700, Arlington, VA 22203

B. Response Timelines

• Opt-Out Requests: Requests to opt-out of targeted advertising, sales, or profiling will be executed and confirmed within fifteen (15) calendar days of receipt.
• General Consumer Rights Requests (Access, Deletion, Correction, Portability): Privia will respond to verifiable requests within forty-five (45) calendar days of receipt. If reasonably necessary due to request complexity or volume, this period may be extended once by an additional forty-five (45) days, provided we notify you within the initial response period with the reason for the extension.

C. Appeals Mechanism

If Privia declines or fails to take action on your consumer rights request, we will notify you without undue delay, explaining the legal basis for our decision. You have the right to appeal our decision within thirty (30) days of receiving our denial notice.

To File an Appeal:

1. Send an email to privacy@priviahealth.com with the subject line: "NEW JERSEY PRIVACY APPEAL REQUEST".
2. Include your original request confirmation number, the specific decision you are appealing, and any supporting context.
3. Privia's legal team will conduct a internal review and provide a written explanation of the appeal outcome within forty-five (45) calendar days of receipt of your appeal.

If your appeal is denied, you may contact or submit a complaint to the New Jersey Office of the Attorney General / Division of Consumer Affairs:

Website: https://www.njconsumeraffairs.gov

Toll-Free (NJ): (800) 242-5846