Granite Recovery Centers (“GRC” or “we”) recognizes the importance of protecting the privacy needs of users of our websites and social media pages (the “Service”) and through other interactions by email, surveys, or telephone. As used in this Privacy Policy, “personal information” means information that identifies, relates to, or describes an identified or identifiable natural person.

This Privacy Policy also does not apply to the personal information, including health information, that we collect in the course of providing treatment services.  Please see our HIPAA Notice of Privacy Practices for more information about how we receive and process that personal information.

Information We Collect and Use

Through the Service. We collect and store the following personal information and use it for typical business purposes (including security and anti-fraud purposes), as described more specifically below, and where required by law, we will rely on consent (including implied consent) as a basis for processing your personal information.

• Personal identifiers. We receive personal identifiers (such as your name, phone number, and e-mail address social media username) and use them to respond to your requests, and to communicate with you for partnership, marketing, surveys, and informational purposes. We may also collect and use this information to respond to feedback and complaints.

• Message content. We receive messages you submit through contact us or partnership forms on the Service, including in connection with customer service requests, partnership requests, surveys, and complaints. We use this information to respond to your requests and to improve the Service and our service.

• Business-related information. We may receive business-related information (such as the name of your practice). We use this information to respond to your partnership requests.

• Clinic information. We receive the name of the clinic that you submit through the contact us form on the Service. We use this information to respond to your requests, to improve the Service and our service, and for internal reporting purposes.

• Location information. We may use some of the information we collect, such as IP addresses, to estimate an approximate location of the device you are using to access our Service in order to enhance and personalize the features and functionality of the Service and service offerings.

• Anonymous or aggregated information. We de-identify or aggregate data we receive and may use and disclose it for any business purpose.

• Inferences. We may draw inferences from the categories of information described above. This information may be used so that we can improve future user experiences with BayMark and to provide a more personalized experience.

From Job Applicants. Job application information may be collected by us directly through the Service.  This Job Applicant Privacy Notice applies to the information submitted through Service by job applicants.

Social Media.  If you post information on our social media pages, we may use the information to respond to your post, to promote our business and services, and in the normal course of our business operations. We may collect personal identifiers, such as your social media username, and other personal characteristics that you have made publicly available on the social media website. Note that the third-party operators of social media websites also receive such information and your posts, and their use of your personal information is governed by their own privacy policies.

Automatically Through the Service. When you visit our Service, we and our third-party partners, such as advertising partners and analytics providers including Google Analytics, collect information by automated means. Such means include the use of cookies, web beacons, web server logs, and other similar technologies.

We may use such technologies to collect personal identifiers (such as your IP address), information about your device (such as your browser characteristics, device IDs and characteristics, operating system version, and language preferences) and information concerning your usage of our Service (including the link you used to reach a given webpage). For example, we use this information to determine how many users have visited particular webpages, viewed particular content, or opened messages or alerts, and we may also use such information to improve the performance of the Service, to improve our marketing activities, and to enforce our website service terms, prevent malicious conduct, and for anti-fraud and security purposes.

In some cases, our third-party partners may process information collected by cookies and related technologies that we permit them to use on the Service. Please see our Cookie Policy stated below for more details. With respect to any social network pages that we may use, please see the privacy policies and any cookie policies of the applicable social network providers as to their automated data collection practices.

As indicated above, we, similar to many other website operators, currently use Google Analytics to collect and process certain Service usage data. To learn more about Google Analytics and how to opt out, please see our Cookie Policy stated below.

You may be able to change a web browser’s settings to block and delete cookies when you access the Service through that web browser. However, if you do that, the Service may not work properly; also, we will still receive basic information (such as last URL visited) when you navigate to the Service. The Service does not respond to browser do-not-track signals.

Information Disclosures

We may provide third parties with the personal information we collect (as described above) for our business purposes to assist us in providing products and services to you, including to put you into contact with a partner or to help us market.

To Provide, Protect, and Improve Our Service and Services. We disclose personal information as necessary to operate our business, such as with third-party providers in connection with providing services to you or processing your transactions. For example, we may provide your name, telephone and e-mail address information, to our partner programs. We require that third-party providers use personal information only for that purpose, and we also require assurances that they will appropriately protect personal information entrusted to them. We also may access, preserve, and disclose information if we believe that such action is necessary in our judgment to comply with a legal obligation or to protect and defend our rights or property, or those of others. For example, we may provide information, including IP address information, to our service providers to protect the Service, such as for fraud detection purposes.

To Comply with the Law and Legal Process. We may access, preserve, and disclose information concerning you if required to do so by law or if we believe that such action is necessary in our judgment to comply with a legal obligation.

Other Sharing. We may share information as described under “Information We Collect and Use” above and for other business purposes as otherwise explained in this Privacy Policy.

Sales, Mergers, and Acquisitions. In the event of a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another entity (whether by private sale, through operation of law, as part of a divestiture plan, or otherwise), we will provide personal information and transaction history associated with each such business unit to the persons and/or entities assuming control of such business unit or as otherwise necessary to complete the transaction as permitted by law or contract.

You May Share with Social Networking Websites. The Service may provide options allowing you to share information with social networking websites, such as LinkedIn. Their use of the information you share will be governed by the social networking websites’ privacy policies, and we are not responsible for how they treat the information you share.

Retention of Personal Information

As a general matter, we only keep information for as long as necessary to fulfill the purposes for which it was collected, as stated in our retention policies, and permitted or required by law, such as to comply with recordkeeping and other legal obligations. There may also be residual information that will remain within our backup files, databases, and other records, which will not be removed or changed, except in accordance with retention policies.

Protection of Personal Information

We employ reasonable security measures to secure and protect the information we receive. No method of electronic transmission or storage is 100% secure.

Links to Third-Party Websites

The Service may contain links to other websites, and other websites may link to the Service. This Privacy Policy does not apply to personal information that you submit to the websites of our business partners or any other third-parties or that are collected by them from you, even if those third-party websites are linked to our Service or listed in our Cookie Policy. We are not responsible for the privacy practices of such other websites. When you visit another website – via a link from the Service or otherwise – you should review the privacy policy of that other website. This Privacy Policy applies solely to information provided or obtained on our Service.

No Use by Children Under the Age of 18

The Service is not intended for use by children under the age of 18. If you are under the age of 18, you may not use our Service. We do not knowingly collect, maintain, or use personal information from children under 18 years of age. If we believe that any information has been posted by a child under the age of 18, we will promptly delete that information. Parents may contact us using the methods set forth below to request that information concerning their child be removed from our Service.

How to Contact Us with Questions

Customer questions, comments, and feedback are very important to us. If you have questions about this Privacy Policy please contact us at:

BayMark Health Services

Attn: BayMark Privacy Officer

1720 Lakepointe Drive, Suite 117

Lewisville, TX 75057

or by e-mailing us at [email protected].

Privacy Rights

Generally

Certain jurisdictions, including in the U.S., impose specific legal requirements and privacy rights with respect to personal information, and we will comply with restrictions and any requests you submit as required by applicable law. For example, consumers may have one or more of the following privacy rights: to request additional information about our data collection, use, and disclosure practices in connection with the consumer’s personal information; to request access to the specific personal information collected about the consumer; to request the deletion of personal information we have about the consumer; to request a restriction on certain processing of personal information; and to request correction of inaccurate information. Also, certain consumers have the right not to receive discriminatory treatment if they exercise the rights list above.

You may be able to use the Service to access and update the information that you have provided to us through your use of the Service or otherwise. If you would like to request access to such information or that we update, correct, or delete any such information, you may call us at 214-379-3300, or email us at: [email protected]. We will comply with requests you submit as required by applicable law.

When you make a request, we may require that you provide information (such as your name, email address and/or zip code) and follow procedures so that we can verify a request you make and your jurisdiction before responding to it. The verification steps we take may differ depending on your jurisdiction and the request you make. We will match the information that you provide in your request to information we already have on file to verify your identity. If we are able to verify your request, we will process it. If we cannot verify your request, we may ask you for additional information to help us verify your request.

We will respond to your request within the time period required by applicable law. However, we may not always be able to fully comply with your request, and we will notify you in that event.

Certain privacy laws permit consumers to use an authorized agent to make privacy rights requests. We require the authorized agent to provide us with proof of the consumer’s written permission (for example, a power of attorney) that shows the authorized agent has the authority to submit a request for the consumer. An authorized agent must follow the process described below to make a request, and we will additionally require the authorized agent to verify his/her own identity and we will confirm the agent’s authority with the consumer about whom the request was made.

U.S. Privacy Rights

We do not sell your personal information for money or other consideration, including as defined under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the “CPRA”). We do not perform targeted advertising across unaffiliated websites. We also do not rent, sell, or share “personal information” as defined by California Civil Code §1798.83 about you that we collect on the Service with other people or unaffiliated companies for their direct marketing purposes.

The Service does not request sensitive personal information and we do not offer the ability to limit the use or disclosure of such information. Please do not submit sensitive personal information, such as health information to the Service.

Canada Privacy Rights

If you are a Canadian resident, you have the right to make a complaint at any time to the Privacy Commissioner of Canada (www.priv.gc.ca). We would, however, appreciate the chance to address your concerns or comments before you approach the Privacy Commissioner, so please contact us first.

Notification of Change to the Privacy Policy

We reserve the right to modify this Privacy Policy. Whenever we decide to change this Privacy Policy, notice of the change will be posted on the Service for a reasonable period of time or provided to you using other means. Nevertheless, you should review the Privacy Policy from time to time to be sure you are aware of the most recent version. Please be assured that we will only use information in accordance with the Privacy Policy in effect at the time the information was collected, unless we receive your consent.

Effective: September 2, 2022.