Lucina Egg Bank

Your Rights Under GDPR (for individuals in the EEA)

If you are located in the European Economic Area (EEA), you have certain rights under the General Data Protection Regulation (GDPR), including:

• The right to access your personal data and receive information about its processing.
• The right to rectification of inaccurate or incomplete personal data.
• The right to erasure (“right to be forgotten”) of your personal data under certain circumstances.
• The right to restrict processing of your personal data under certain circumstances.
• The right to data portability to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller [As this specific right isn’t explicitly mentioned in the provided excerpts for exercising rights, it’s good practice to include it if applicable, but flag it as potentially external information for verification].
• The right to object to the processing of your personal data under certain circumstances, including for direct marketing purposes.
• The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you [As this specific right isn’t explicitly mentioned in the provided excerpts for exercising rights, it’s good practice to include it if applicable, but flag it as potentially external information for verification].

To exercise these rights, please contact us using the details provided in the “Contact Us” section below. We will respond to your request in accordance with GDPR requirements. Please note that we may need to verify your identity before processing your request. You also have the right to lodge a complaint with a supervisory authority in your country of residence if you believe your rights have been violated [As this specific right isn’t explicitly mentioned, flag it as potentially external information for verification].

Cross-border Data Transfers (GDPR): If we transfer your personal data outside the EEA, we will ensure that appropriate safeguards are in place to protect your data in accordance with GDPR requirements. This may include using Standard Contractual Clauses approved by the European Commission [This is not explicitly in the sources but is a common GDPR practice and should be mentioned for robustness, clearly stating it’s general information].

Your Rights Under CCPA (for California Residents)

If you are a California resident, you have certain rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), including:

• The right to know what personal information we collect about you, including the categories and specific pieces of personal information, the sources of the information, the purposes for collecting it, and the categories of third parties with whom we share it.
• The right to request deletion of your personal information that we have collected from you, subject to certain exceptions.
• The right to opt-out of the “sale” or “sharing” of your personal information. www.lucinaeggbank.com does not sell your personal information. Under CCPA, “sale” is broadly defined and may include sharing personal information for monetary or other valuable consideration. To the extent our data sharing practices are considered a “sale” under CCPA, you have the right to opt-out. Please contact us to exercise this right [The definition of “sale” and the clarification about [company]’s practices address a previous gap].
• The right to correct inaccurate personal information that we maintain about you.
• The right to limit the use and disclosure of your sensitive personal information for purposes other than providing the services or goods [As this specific right isn’t explicitly mentioned in the provided excerpts for exercising rights, it’s good practice to include it if applicable under CPRA, but flag it as potentially external information for verification].
• The right not to receive discriminatory treatment for exercising your CCPA rights [As this specific right isn’t explicitly mentioned, flag it as potentially external information for verification].

To exercise these rights, please contact us using the details provided in the “Contact Us” section below. Please note that we may need to verify your identity before processing your request. You may also designate an authorized agent to make requests on your behalf, subject to verification.

Information on Third-Party Disclosures (CCPA): We may disclose the following categories of your personal information to the following categories of third parties for business purposes:

• [Provide specific categories of personal information disclosed, e.g., contact information, demographic information, etc.] shared with [provide categories of third parties, e.g., healthcare providers, payment processors, IT service providers, etc.] for the purpose of [provide the purpose of disclosure, e.g., providing services, processing payments, website maintenance, etc.].

Your Rights Under HIPAA (if applicable)

As a provider of services that may involve Protected Health Information (PHI), www.lucinaeggbank.com complies with the Health Insurance Portability and Accountability Act of 1996 (HIPAA). You have the following rights regarding your PHI:

• Right to Inspect and Copy: You have the right to inspect and obtain a copy of your health information that we maintain. Your request must be in writing, and we may charge a reasonable fee for copying and mailing. In limited circumstances, we may deny your request, and if so, we will provide a written explanation and information on how to request a review.
• Right to Amend: If you believe your health information is inaccurate or incomplete, you have the right to request an amendment in writing, along with a reason for the request. We may deny your request in certain circumstances and will provide a written explanation. You may submit a statement of disagreement if your request is denied, which will be shared with future disclosures of the relevant information.
• Right to an Accounting of Disclosures: You have the right to request a detailed list of certain disclosures of your health information made in the past six years, excluding disclosures for treatment, payment, healthcare operations, and certain other exceptions. Your request must be in writing, and we may charge a fee if you request an accounting more than once every twelve months.
• Right to Request Restrictions: You have the right to request restrictions on how we use or disclose your health information for treatment, payment, or healthcare operations. Your request must be in writing. We are not required to agree to your request, except that we must agree not to disclose your health information to your health plan if the disclosure is for payment or healthcare operations and the item or service was paid for out-of-pocket in full. We will notify you if we cannot agree to a requested restriction.
• Right to Request Alternative Means of Communication: You have the right to request that we communicate with you about medical matters in a specific way or at a certain location. Your request must be in writing, and we will accommodate all reasonable requests.
• Right to a Paper Copy of the Notice of Privacy Practices: You have the right to receive a paper copy of this Notice at any time. Contact us using the information below to obtain a copy.
• Right to Revoke Authorization: You have the right to revoke your written authorization to use or disclose your health information, except to the extent that we have already taken action in reliance on your authorization. Your revocation must be in writing.
• Right to Notification of a Breach: You have the right to be notified if a breach of your unsecured health information occurs.
• Right to Opt Out of Fundraising Communications: If we engage in fundraising, you have the right to opt out of receiving these communications.

To exercise your HIPAA rights, please contact us using the details provided in the “Contact Us” section below. You also have the right to file a complaint with the Secretary of the Department of Health and Human Services if you believe your privacy rights have been violated. You will not be retaliated against for filing a complaint.

Uses and Disclosures Without Your Authorization (HIPAA): HIPAA permits us to use and disclose your health information without your written authorization for certain purposes, including but not limited to:

• Treatment: Providing and coordinating your healthcare.
• Payment: Billing and collecting payment for healthcare services.
• Healthcare Operations: Activities necessary to run our healthcare operations, such as quality improvement and administrative functions.
• As Required by Law: When federal, state, or local law requires disclosure.
• Public Health Activities: To prevent or control disease, injury, or disability.
• Health Oversight Activities: For audits, investigations, and inspections.
• Research: Under certain circumstances approved by an Institutional Review Board or Privacy Board.
• To Avert a Serious Threat to Health or Safety: To protect your health and safety or the health and safety of others.
• Business Associates: Sharing information with contractors who perform services for us and agree to protect your PHI.
• Individuals Involved in Your Care or Payment for Your Care: Disclosures to family members or others involved in your care, as permitted by HIPAA.

Uses and Disclosures Requiring Your Written Authorization (HIPAA): We must obtain your written authorization for most uses and disclosures of:

• Psychotherapy Notes.
• Marketing purposes.
• Disclosures that constitute a sale of your health information.
• Other uses and disclosures not described in this Notice.

You may revoke your authorization at any time in writing, except to the extent we have already acted in reliance on your authorization.