State Privacy Law Addendum
Additional privacy rights available to residents of states with comprehensive privacy laws
Effective Date: April 24, 2026
Entity: CaliberRx LLC
Website: caliberrx.co
1. Scope
This State Privacy Law Addendum (the “Addendum”) supplements the CaliberRx Privacy Policy and describes additional
privacy rights available to residents of U.S. states with comprehensive consumer privacy statutes in effect as of the
Effective Date. Rights described below apply only to categories of personal information that are governed by the
applicable state statute. Information that constitutes Protected Health Information (PHI) under the Health Insurance
Portability and Accountability Act of 1996 (HIPAA) is governed primarily by HIPAA and is addressed in the Notice of
Privacy Practices issued by the CaliberRx-affiliated provider group.
This Addendum does not create privacy rights for residents of states not listed below. Residents of unlisted states may
still contact us at privacy@caliberrx.co with privacy questions or concerns.
2. Covered States
Residents of the following states have rights under their state’s comprehensive consumer privacy law.
| State | Statute | General Effective Date |
|---|---|---|
| California | CCPA / CPRA — California Consumer Privacy Act, as amended by the California Privacy Rights Act | 2020 / 2023 |
| Virginia | VCDPA — Virginia Consumer Data Protection Act | January 2023 |
| Colorado | CPA — Colorado Privacy Act | July 2023 |
| Connecticut | CTDPA — Connecticut Data Privacy Act | July 2023 |
| Utah | UCPA — Utah Consumer Privacy Act | December 2023 |
| Texas | TDPSA — Texas Data Privacy and Security Act | July 2024 |
| Oregon | OCPA — Oregon Consumer Privacy Act | July 2024 |
| Montana | MCDPA — Montana Consumer Data Privacy Act | October 2024 |
| Iowa | CDPA — Iowa Consumer Data Protection Act | January 2025 |
| Delaware | DPDPA — Delaware Personal Data Privacy Act | January 2025 |
| New Hampshire | NHPA — New Hampshire Privacy Act | January 2025 |
| New Jersey | NJDPA — New Jersey Data Privacy Act | January 2025 |
| Nebraska | NDPA — Nebraska Data Privacy Act | January 2025 |
| Tennessee | TIPA — Tennessee Information Protection Act | July 2025 |
| Minnesota | MCDPA — Minnesota Consumer Data Privacy Act | July 2025 |
| Maryland | MODPA — Maryland Online Data Privacy Act | October 2025 |
| Rhode Island | RIDTPPA — Rhode Island Data Transparency and Privacy Protection Act | January 2026 |
| Indiana | IDPA — Indiana Consumer Data Protection Act | January 2026 |
| Kentucky | KCDPA — Kentucky Consumer Data Protection Act | January 2026 |
3.Consumer Rights
Subject to the specific provisions and exemptions of each applicable state law, residents of covered states generally have
the following rights with respect to personal information CaliberRx collects from them (excluding PHI governed by
HIPAA):
- Right to know / right of access. The right to confirm whether we are processing your personal information and to obtain a copy of that information.
- Right to correct. The right to request correction of inaccurate personal information.
- Right to delete. The right to request deletion of personal information we have collected, subject to applicable exceptions (including records we are required to retain by law).
- Right to data portability. The right to obtain a copy of your personal information in a portable, machine-readable format where technically feasible
- Right to opt out of targeted advertising. The right to opt out of the use of your personal information for targeted advertising.
- Right to opt out of sale. The right to opt out of the sale of personal information. CaliberRx does not sell personal information in the traditional sense but discloses how information is shared in our Privacy Policy.
- Right to opt out of profiling. The right to opt out of profiling that produces legal or similarly significant effects.
- Right against discrimination. The right not to be subjected to discriminatory treatment for exercising any of the rights described above.
- Right to appeal. Where provided by state law, the right to appeal our denial of a privacy request.
California residents have additional rights under the CCPA/CPRA, including the right to limit the use of sensitive personal
information and the right to know specific categories of information collected, sold, or shared in the prior twelve (12)
months. Detailed information about how CaliberRx collects, uses, and discloses California residents’ personal information
— including the categories of information collected and disclosed in the preceding twelve (12) months — is set forth in
our Privacy Policy.
4. Exercising Your Rights
To submit a privacy rights request, email privacy@caliberrx.co with your full name, state of residence, and a description
of your request. We will verify your identity before responding to substantive requests and will respond within the
timeframe required by applicable state law (generally 45 days, subject to extension where permitted). There is no charge
for requests submitted in good faith and at reasonable frequency.
You may designate an authorized agent to submit a request on your behalf. We may require verification of the agent’s
authority and of your identity before responding.
5. HIPAA Preemption
Protected Health Information (PHI) collected and maintained in connection with your telehealth encounter with a
CaliberRx-affiliated provider group is governed by HIPAA. Rights with respect to PHI are described in the Notice of
Privacy Practices issued by the provider group. Where state privacy law and HIPAA would impose conflicting obligations,
HIPAA typically controls.
6. Contact
Privacy rights requests and questions about this Addendum may be directed to privacy@caliberrx.co.