Privacy Notice for California Employees and Job Applicants
Effective Date: January 1, 2020
Last Reviewed on: January 1, 2020
This Privacy Notice for California Employees and Job Applicants applies solely toemployees or job applicants who reside in the State of California (“consumers” or “you”).
Invivoscribe, Inc.’s (“IVS” or “we”) adopts this notice to comply with the California Consumer
Privacy Act of 2018 (CCPA) and any terms defined in the CCPA have the same meaning whenused in this notice.
Information We Collect
We collect information from our employees and job applicants that identifies, relates to,describes, references, is reasonably capable of being associated with, or could reasonably belinked, directly or indirectly, with a particular consumer or device (“personal information”). In
particular, Invivoscribe, Inc. (“IVS” or “we”) has collected the following categories of personal
information from its employees or job applicants within the last twelve (12) months:
Category

Examples 1

Collected

Sources

PurposeThird Parties Shared

A. Identifiers.

A real name, alias, postal
address, unique personal
identifier, online identifier,Internet Protocol address,
email address, accountname, Social Security
number, driver's license
number, passport number,or other similar identifiers.

YES(a) Directly or
indirectlyfrom you(a) Performanceof a contract(a) Human resources
information service
providers(b) From thirdparties(b) Necessary
for ourlegitimateinterests(c) Necessary tocomply witha legalobligation(b) Financial investment
service providers(c) Wellness programservice providers(d) Insurance providers(e) Payroll service
providers(f) Building
management/securityproviders(g) Professional serviceproviders, including
external auditors

B. Personalinformation
categories listed
in the California
Customer

A name, signature, Social
Security number, physicalcharacteristics ordescription, address,telephone number,

YES(a) Directly or
indirectlyfrom you(b) From thirdparties(a) Performanceof a contract(b) Necessary
for ourlegitimate(a) Human resources
information service
providers(b) Financial investment
service providers

1 Examples listed herein are illustrative of the types of personal information included in each category andmay or may not be the specific types of personal information collected on an individual employee or job
applicant. Additionally, some personal information included in these categories may overlap with othercategories.

Category
Records statute(Cal. Civ. Code §1798.80(e)).

C. Protectedclassification
characteristics
under California
or federal law.

Examples 1
passport number, driver's
license or state
identification card number,insurance policy number,
education, employment,
employment history, bankaccount number, credit
card number, debit cardnumber, or any otherfinancial information,
medical information, or
health insurance
information.

CollectedRace (which includeshistorically associatedtraits, such as hair styles
and protective hair styles,e.g., braids, locks, andtwists), religious creed(which includes religious
dress and groomingpractices), color, nationalorigin (which includes, but
is not limited to, nationalorigin groups and aspectsof national origin, such asheight, weight, accent, orlanguage proficiency),
ancestry, physicaldisability, mentaldisability, medicalcondition, genetic
information, marital status,sex (which includes
pregnancy, childbirth,breastfeeding, and related
medical conditions),
gender, gender identity,
gender expression, age,sexual orientation, militaryor veteran status(including state andfederal active and reserve
members as well as thoseordered to duty ortraining),
immigration/citizenshipstatus or related protected
activities (which includes
undocumented individuals
and human trafficking),
protected medical leaves,domestic violence victim
status, political affiliation,or any other category oractivity protected byfederal, state, or local

YES

Sources

Purposeinterests(c) Necessary tocomply witha legalobligation

Third Parties Shared(c) Wellness programservice providers(d) Insurance providers(e) Payroll service
providers(f) Building
management/security
providers(g) Professional service
providers, including
external auditors(a) Directlyfrom you(a) Necessary
for ourlegitimate
interests(b) Necessary tocomply witha legalobligation(a) Human resources
information service
providers(b) Financial investment
service providers(c) Wellness programservice providers(d) Insurance providers(e) Payroll service
providers(f) Building
management/security
providers(g) Professional service
providers, including
external auditors

2CategoryExamples 1
laws, ordinances, orregulations.

Collected

Sources

PurposeThird Parties Shared

D. Commercial
information.

Records of personal
property, products orservices purchased,obtained, or considered, orother purchasing orconsuming histories ortendencies.

NO

N/A

N/A

N/A

E. Biometric
information.

Genetic, physiological,
behavioral, and biologicalcharacteristics, or activity
patterns used to extract atemplate or other identifier
or identifying information,such as, fingerprints,
faceprints, and voiceprints,
iris or retina scans,keystroke, gait, or otherphysical patterns, andsleep, health, or exercise
data.

NON/A

N/A

N/AF. Internet orother similar
network activity.

Browsing history, searchhistory, information on a
consumer's interaction
with a website,
application, oradvertisement.

YES(a) Directly or
indirectlyfrom you(a) Necessary
for ourlegitimate
businessinterests(a) Analytics andbusiness intelligence
vendors

G. Geolocationdata.

Physical location ormovements.

YES(a) Directly or
indirectlyfrom you(a) Necessary
for ourlegitimate
interests

N/A

H. Sensory data.

Audio, electronic, visual,thermal, olfactory, orsimilar information.

NON/A

N/A

N/AI. Professionalor employmentrelatedinformation.

Current or past job history.

YES(a) Necessary
for ourlegitimateinterests

N/AJ. Non-public
education
information (perthe Family
Educational
Rights andPrivacy Act (20U.S.C. Section
1232g, 34 C.F.R.

Education records directly
related to a student
maintained by aneducational institution orparty acting on its behalf,such as grades, transcripts,
class lists, student
schedules, student
identification codes,(a) Necessary
for ourlegitimateinterests

N/A(b) Necessary tocomply witha legalobligation(a) Directlyfrom you(b) From thirdparties

YES(a) Directlyfrom you3(b) Cybersecurity
vendorsCategoryPart 99)).

Examples 1
student financial
information, or student
disciplinary records.

CollectedK. Inferences
drawn from otherpersonalinformation.

Profile reflecting aperson's preferences,characteristics,psychological trends,predispositions, behavior,attitudes, intelligence,abilities, and aptitudes.

YES

Sources

PurposeThird Parties Shared(a) Directlyfrom you(a) Necessary
for ourlegitimate
interests

N/A(b) From thirdparties

Personal information does not include:•Publicly available information from government records.

•Deidentified or aggregated consumer information.

•Information excluded from the CCPA's scope, like:•health or medical information covered by the Health Insurance Portability andAccountability Act of 1996 (HIPAA) and the California Confidentiality of Medical
Information Act (CMIA) or clinical trial data;•

personal information covered by certain sector-specific privacy laws, including theFair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) orCalifornia Financial Information Privacy Act (FIPA), and the Driver's Privacy
Protection Act of 1994.

IVS obtains the categories of personal information listed above from the following categories ofsources:•Directly from you. For example, from forms you complete or information you provide
during the application process.

•Indirectly from you. For example, from observing your actions with computer systems,
software or other platforms offered by IVS.

•Third Parties. For example, from vendors used for background checks or aptitude andability testing.
Use of Personal Information

We may use or disclose the personal information we collect for one or more of the following
purposes:•To fulfill or meet the reason you provided the information. For example, to conduct
payroll and timekeeping activities, administer benefits, or offer wellness programs.

•To investigate and help prevent fraud or otherwise ensure compliance with policies andprocedures.

•To provide you with support and to respond to your inquiries, including to investigate
and address your workplace concerns and monitor and improve our responses.

4

•To help maintain the safety, security, and integrity of our systems, services, databases
and other assets.

•To respond to law enforcement requests and as required by applicable law, court order, orgovernmental regulations.

•As described to you when collecting your personal information or as otherwise set forthin the CCPA.

•To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, orother sale or transfer of some or all of IVS’s assets, whether as a going concern or as partof bankruptcy, liquidation, or similar proceeding, in which personal information held by
IVS about employees or job applicants is among the assets transferred.

IVS will not collect additional categories of personal information or use the personal information
we collected for materially different, unrelated, or incompatible purposes without providing younotice.
Changes to This Privacy Notice
IVS reserves the right to amend this privacy notice at our discretion and at any time. When we
make substantive changes to this privacy notice, we will notify you of the changes via e-mail andpost the updated notice on the IVS website and update the notice's effective date.
Questions About This Privacy Notice
If you have any questions or comments about this notice or the ways in which IVS collects anduses your information, please contact: Kathleen Demarest; email: kdemarest@invivoscribe.com;
telephone: (858) 224-6677 direct.

5