Rights you have
As a California resident, you can:
- Know what categories of personal information we've collected about you, the sources we got it from, what we use it for, and who we share it with
- Access the specific pieces of personal information we hold about you (subject to verification)
- Delete personal information we've collected from you (with certain exceptions, such as legal obligations)
- Correct inaccurate personal information
- Opt out of "sale" or "sharing" of your personal information (more below)
- Limit use of sensitive personal information to what's necessary
- Non-discrimination — we can't deny service, charge you more, or give you a worse experience for using these rights
You can also designate an authorized agent to make a request on your behalf.
Categories of personal information we collect
In the last 12 months, we have collected the following categories of personal information from California residents:
| Category | Examples | Source | Purpose |
|---|---|---|---|
| Identifiers | First name, email address, IP address, device ID | Directly from you, via cookies and analytics | Communication, marketing, analytics |
| Internet activity | Pages viewed, links clicked, time on site | Via cookies and analytics | Site improvement, advertising |
| Inferences | Interest in migraine pattern tracking based on your behavior | Derived from your activity | Marketing, audience research |
We do not collect government identifiers (SSN, driver's license), biometric data, precise geolocation, or financial account numbers on penumbra.health.
Do we "sell" or "share" your information?
Under CCPA, "sale" and "sharing" include sending personal information to third parties for advertising purposes — even if no money changes hands.
Yes — we share your information for advertising purposes, primarily by using cookies from Meta and Google to show you relevant ads and measure their performance. This counts as "sharing" under CCPA.
We do not sell your personal information for money to data brokers.
How to exercise your rights
Opt out of sharing for advertising: Click "Do Not Sell or Share My Personal Information" in the site footer, or use "Cookie settings" to reject advertising cookies. We also honor the Global Privacy Control (GPC): if your browser sends a GPC signal, we treat it as a valid request to opt out of the "sale"/"sharing" of your personal information for that browser.
Any other request (access, delete, correct, limit, etc.): Email legal@smart-it.io with the request. Include enough information for us to verify it's you (typically the email address you used to sign up). We'll respond within 45 days. If we need more time, we'll let you know.
Authorized agents: If you're submitting on someone else's behalf, include a signed permission letter or power of attorney.
Sensitive personal information
In the standard Wave 1 flow, we do not ask you to provide detailed health information such as symptoms, diagnoses, medications, or treatment history. However, because Penumbra relates to migraine pattern tracking, your interaction with the site (which ads you click, which pages you visit, which pricing or feature pages you view) may reveal or imply an interest in health-related topics.
We treat this context carefully. We do not use detailed health information or health-related inferences for advertising or ad targeting, and we do not build advertising audiences based on health interest categories. Our advertising pixels are used only for aggregate conversion measurement of our ad campaigns — we do not retarget visitors to this site, and we do not create lookalike or custom audiences from our visitors or waitlist.
Notice at collection
This Addendum, combined with our Privacy Policy, serves as the notice at collection required by CCPA. We provide it before or at the point we collect your information.