Colorado Resident Privacy Notice

Effective Date: 01.22.26

This Colorado Resident Privacy Notice (“Colorado Notice”) supplements the information contained in Arbor's Privacy Policy and State Privacy Law Addendum and applies solely to individual residents of the State of Colorado (“consumers” or “you”).

This Notice is provided pursuant to the Colorado Privacy Act, C.R.S. §§ 6-1-1301 et seq., and its implementing regulations, 4 CCR 904-3, as amended from time to time (collectively, the “CPA”).

This Colorado Notice describes your rights under the CPA with respect to your Personal Data and explains how to exercise those rights, subject to applicable legal exceptions.

Any capitalized terms not defined in this Notice have the meanings assigned to them under the CPA or Arbor's Privacy Policy.

The Right to Confirm, Access, and Data Portability

You have the right to confirm whether we are processing your Personal Data and to access the specific pieces of Personal Data we have collected about you, subject to verification of your identity. You also have the right to obtain such data in a portable format, no more than twice per calendar year, where technically feasible.

The Right to Correct

You have the right to request that we correct inaccurate or incomplete Personal Data that we maintain about you, taking into account the nature of the data and the purposes of processing. We may request additional information or documentation to evaluate your request. If we deny a correction request in whole or in part, we will explain the reason for the denial.

The Right to Request Deletion

You have the right to request that we delete the Personal Data we have collected from you, subject to certain exceptions permitted by law. Once we receive and verify your request, we will delete your Personal Data from our records and direct our service providers to do the same, unless an exception applies. If we deny a deletion request in whole or in part, we will explain the reason for the denial.

How to Submit a Request

To exercise your rights under the CPA, please contact us at:

Email: legal@startarbor.com

We may request additional information to authenticate your identity and locate your Personal Data within our systems. Information provided for authentication will be used solely for that purpose. If we are unable to verify your identity, we may be unable to fully process your request.

Authentication

To protect Personal Data and comply with applicable privacy laws, we use reasonable measures to authenticate consumer requests. You may submit a request directly or through an authorized agent. If an authorized agent submits a request on your behalf, we may require proof of authorization and verification of your identity.

You are not required to create an account to submit a request. We do not charge a fee for authentication.

Response Timing and Fees

We will endeavor to respond to a verifiable consumer request within 45 days of receipt. If reasonably necessary, we may extend this period once by an additional 45 days and will notify you of the extension and the reason for it.

We do not charge a fee for your first request within a twelve (12) month period. We may charge a reasonable fee or decline to act on a request if it is excessive, repetitive, or manifestly unfounded, as permitted by law.

Right to Appeal

If we deny your request, you may appeal our decision by submitting an appeal request to legal@startarbor.com. We will respond to appeals within 45 days of receipt and explain any action taken or not taken and the reasons for our decision.

If you have concerns regarding the outcome of an appeal, you may contact the Colorado Attorney General.

The Right to Opt Out of Targeted Advertising, Sale of Personal Data, and Certain Profiling

You have the right to opt out of the processing of your Personal Data for purposes of:

Targeted advertising
The sale of Personal Data
Profiling in furtherance of solely automated decisions that produce legal or similarly significant effects

To exercise an opt-out right, please email legal@startarbor.com.

You may designate an authorized agent to exercise an opt-out right on your behalf, subject to verification requirements.

Sensitive Data

Arbor does not sell consumer health data and does not transfer sensitive health data for advertising purposes. Sensitive health-related data is processed solely for purposes permitted by law and as described in the Privacy Policy.

Contact Information

If you have questions about this Colorado Notice or your privacy rights, please contact:

Harbor Health Inc. d/b/a Arbor
8 The Green # 25407
Dover DE 19901
United States
Email: legal@startarbor.com