This notice applies to individuals who live in the State of California and whose data is subject to the California Consumer Privacy Act of 2018 (CCPA). This notice includes a description of:
- what information Wellmark collects that is subject to the CCPA,
- your rights under the CCPA, and
- how you can enforce those rights under the CCPA.
When used in this notice, any terms defined in the CCPA have the same meaning. Please note that Wellmark and its subsidiaries are registered to conduct business in Iowa and South Dakota. We do not market our products and services in California.
What information Wellmark collects
Wellmark collects information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device ("Personal Information").
Personal Information does not include:
- Publicly available information from government records.
- Deidentified or aggregated consumer information.
- Information excluded from the scope of the CCPA, such as:
- health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
- personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.
Certain types of information are exempt from the CCPA. If that is the case, other Wellmark policies would apply (i.e. Wellmark's Privacy Practices Notice). Information on that policy as well as others can be found on our website at Wellmark.com/privacy-and-legal/privacy-policy.
Wellmark has collected the following categories of Personal Information from its consumers within the last twelve (12) months:
Information that is protected against security breaches such as: name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.
Some personal information included in this category may overlap with other categories.
Any of the above information collected for the purposes of providing healthcare coverage is considered health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
Where Wellmark may obtain your personal information
We may obtain personal information about you in the following manner:
- Directly from you from forms you complete and submit on our website or other online interactions.
- Indirectly from you by tracking or observing actions you take on our website.
We may also obtain information from third parties such as vendors or other businesses that perform services on our behalf.
How Wellmark may use your personal information
We may use, or disclose the personal information we collect from or about you in the following ways:
- To carry out the purpose for which you provided the information. For example, if you share information in order to become a Wellmark vendor or a provider we may use that information during our procurement or contracting process and to manage the relationship going forward
- To provide you with information, products or services that you request from Wellmark.
- To provide you information regarding Wellmark's services including updates or news that may be of interest to you.
- To carry out our obligations and enforce our rights arising from any contracts entered into between you and Wellmark or our subsidiaries.
- For testing, research, analysis, and product development.
- To provide, support, personalize, and develop our website, products, and services
- As necessary or appropriate to protect the rights, property, or safety of Wellmark and its employees, Wellmark's clients or others.
- To help maintain the safety, security, and integrity of our website, products and services, databases and other technology assets, and business.
- To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
- As described to you when collecting your personal information or as otherwise set forth in the CCPA or other applicable laws.
We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.
How Wellmark shares your personal information
Wellmark does not sell your personal information. However, Wellmark may disclose your personal information to a third party for a business purpose allowed by law or regulation. When we disclose information for a business purpose, we may enter a contract that describes the purpose for which the information is being disclosed and require the recipient to:
- Protect the personal information by applying appropriate privacy and security safeguards,
- Maintain its confidentiality and prohibit further disclosure, and
- Only use the information for the business purpose for which it was intended.
In the preceding twelve (12) months, Wellmark has not sold any personal information, but has disclosed the following categories of personal information for a business purpose:
- Category A — Identifiers
- Category B — California Customer Records
- Category C — Protected classification characteristics under California or federal law.
- Category F — Internet history
- Category I — Professional or employment-related information
We disclose your personal information for a business purpose to the following categories of third parties:
- Service providers
- Data brokers or aggregators
- Advertisers
- Affiliates
- Parent or subsidiary organizations
- Internet cookie data recipients, like Google Analytics
Deletion request rights
Unless otherwise prohibited by applicable law, you have the right to request that we delete any of your personal information that we collected from you and retained. Once we receive and confirm your verifiable consumer request we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:
- Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or otherwise perform our contract with you.
- Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
- Debug products to identify and repair errors that impair existing intended functionality.
- Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
- Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
- Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
- Comply with a legal or regulatory obligation.
- Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
We do not provide these deletion rights for business to business personal information.
Access to specific information and data portability rights
You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable request, we will disclose to you:
- The categories of personal information we collected about you.
- The categories of sources for the personal information we collected about you.
- Our business or commercial purpose for collecting that personal information.
- The categories of third parties with whom we share that personal information.
- The specific pieces of personal information we collected about you (also called a data portability request).
- If we disclosed your personal information for a business purpose, a list disclosing:
- disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.
We do not provide these access and data portability rights for business to business personal information.
How to submit a request
Should you wish to exercise your rights under the CCPA, you will need to submit a "verifiable consumer request." This means that you, or a person registered with the California Secretary of State that you have authorized to act on your behalf, may make request related to your personal information. As a parent or legal guardian, you may make a consumer request on behalf of your minor child.
A verifiable consumer request must:
- Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
- Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.
Making a verifiable consumer request does not require you to create an account with us.
The information provided for verification will only be used for that purpose.
Response timing and format
We endeavor to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. If you have an account with us, we may deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.
Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request's receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit the information from one entity to another entity without hindrance.
We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
Non-Discrimination for exercising CCPA rights
If you choose to exercise your rights under the CCPA we will not discriminate against you in the provision of goods, services, charging of rates, products or customer services.
Changes to our privacy notice
We reserve the right to amend this privacy notice at our discretion and at any time. When we make changes to this privacy notice, we will post the updated notice on the Website and update the notice's effective date. Your continued use of our Website following the posting of changes constitutes your acceptance of such changes.
Effective date
This Privacy Notice for California Residents is effective 1/1/2020 and was last reviewed 1/15/2020. Certain rights granted by the CCPA will not be effective until 1/1/2021.
Contact information
If you have any questions or comments about this notice, the ways in which Wellmark collects and uses your information described here, and in the Notice of Privacy Practices, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at:
Phone: Toll Free – 877-610-6395
Email: privacyoffice@wellmark.com
Postal Address:
Wellmark, Inc.
Privacy Office, Station 5W590
1331 Grand Avenue
Des Moines IA 50309-2901