EMPLOYEE/APPLICANT PRIVACY NOTICE FOR RESIDENTS OF CALIFORNIA

January 1, 2023

Omada Health, Inc. (“Omada,” “we,” “us,” “our”) provides this supplemental privacy notice (“Notice”) to comply with the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020, the “CCPA”). For the purposes of this Notice, “you” and “your” refers to you as an employee of or applicant for employment with Omada.  
This Notice explains how we collect, use, and disclose information about you in the context of your employment or job application, including when you interact with our websites (www.omadahealth.com and www.physera.com) and applications. 


Please note that the CCPA does not cover PHI collected by a covered entity or business associate that is governed by the Health Information Portability and Accountability Act of 1996 (“HIPAA”). Accordingly, this Notice does not apply to individuals as they apply for, register for, and/or participate in one or more of our digitally-based health care programs (including interactions with the related mobile applications). For information on how Omada, as a health care provider, uses and shares information from the applicants and members in our health care programs, please refer to our Notice of HIPAA Privacy Practices and Privacy Policy. Because these state consumer privacy acts do not cover PHI, this Notice also does not apply to personal information that you may share with Omada’s employee  welfare benefit plans that are covered entities under HIPAA. 


Please read this Notice carefully. By continuing with your application for and/or employment with Omada, you agree to the collection, use, and disclosure of your information as described in this Notice. 


We may modify this Notice from time to time, in which case we will update the “Last Updated” indicated in this Notice. If we make material changes to the way we use information that we collect, we will use reasonable efforts to notify you (such as by posting notice of such changes on the website(s) or application(s) where employees or applicants interact with Omada, by emailing you at the last email address you provided us, or by other means consistent with applicable law), and we will take any additional steps required by applicable law. Your continued application for or employment with Omada will act as acceptance of these updates.


Collection and Processing of Personal Information


We collect information that you provide directly to us and/or which we are required by law to collect about you. For example, we collect information when you apply for employment on our website, are hired, or otherwise communicate with us. We also collect certain information from you automatically when you interact with our website, including through tracking technology like cookies and scripts. Finally, we collect certain information from career websites like LinkedIn, which we use to process your application for employment. For more information about the types of information that we collect and how, please refer to our Privacy Policy. 

  • In the preceding 12 months, we collected and disclosed, for Omada’s business purposes (and including in some cases where required by law), the following categories of personal information (“Personal Information”) about job applicants and employees:
  • Identifiers such as real name, email address, and IP address; 
  • Personal information categories listed in the CCPA such as real name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number; 
  • Characteristics of protected classifications under California or federal law such as race, color, religion or creed, national origin or ancestry, sex (including gender, pregnancy, sexual orientation, and gender identity), age, physical or mental disability, veteran status, and citizenship;
  • Audio, electronic, visual or similar information such as photographs or videos;
    Internet or other similar network activity such as information regarding your interaction with the website; 
  • Geolocation data such as IP address;
  • Professional or employment-related information such as professional title, industry, role type, employer, and professional background; and 
  • Inferences drawn from other personal information.


The following categories of information that we collected and disclosed in the preceding 12 months for Omada’s business purposes are also considered sensitive personal information under certain state consumer privacy regulations (“Sensitive Personal Information”):

  • Government Identifiers, such as Social Security, driver’s license, state identification card, or passport number;
  • Racial or ethnic origin, religion or philosophical beliefs; 
  • The contents of a resident’s email; 
  • Personal information concerning a resident’s health, such as information submitted in relation to a request for workplace accommodations; and
  • Personal information concerning a resident’s sexual orientation or gender identity.


We may use the Personal Information and Sensitive Personal Information that we collect for one or more of the following business purposes:

  • to communicate with you about your employment or application; 
  • to evaluate your candidacy and process your application for employment;
  • to perform auditing for purposes of our compliance program;
  • to maintain cybersecurity;
  • to comply with legally required reporting requirements, such as EEO-1 filings and California Department of Civil Rights pay data reporting; 
  • to perform services on behalf of the business, including verifying employment information, providing analytic services, or providing similar services on behalf of the business.


In addition, we have or may disclose Personal Information and Sensitive Personal Information to certain of our vendors for the above purposes. We only use and disclose Personal Information and Sensitive Personal Information for purposes permitted by applicable law, or otherwise with your consent.


The period of time that we may retain Personal Information and Sensitive Personal Information is based upon a number of criteria, including: 

  • The length of time necessary to fulfill the purpose(s) for which we collected the personal information; 
  • The length of time it is reasonable to keep records to demonstrate that we have fulfilled our business and legal obligations; and
  • Any retention periods prescribed by law or recommended by regulators, professional bodies, or associations.


Selling or Sharing of Personal Information


We are in the business of delivering health care, not sharing Personal Information for advertising purposes or purposes unrelated to our business. When we share Personal Information with cloud storage providers, security vendors, and other parties core to our business, we share this information in order to perform the services and related purposes like the prevention, detection, and investigation of security incidents - not with a goal of enabling cross-context behavioral advertising or uses unrelated to our business in a manner that would be considered “sharing” (as that term is defined under the CCPA). 

We also do not sell Personal Information or Sensitive Personal Information, nor have we done so in the preceding 12 months.


Further, we do not have actual knowledge that we sell or share for targeted advertising purposes Personal Information of individuals under 16 years of age.


Your Rights 


As a California residents you  have the following rights:

  • Right to Know. You have the right to request that we disclose to you the personal information we collect, use, or disclose as part of your application for or employment with Omada and information about our related data practices. You may ask that we provide you with a copy of the following:
    • categories of and specific pieces of Personal Information we have collected about you;
    • categories of sources from which we collect Personal Information;
    • the business or commercial purposes for collecting Personal Information; 
    • categories of third parties to whom the Personal Information was disclosed for a business purpose; and 
    • categories of Personal Information disclosed about you for a business purpose.  
  • Right to Request Correction. You have the right to request that we correct inaccurate Personal Information from the records that we maintain about you related to your employment or job application, subject to certain exceptions.
  • Right to Request Deletion. You have the right to request that we delete your Personal Information that we have collected from or about you during your application for or employment with Omada, except where the law may require that we not delete that information because of our obligations to maintain business records. 
  • Right to Object to Targeted Advertising and Profiling. In some jurisdictions, where Personal Information is used for certain types of targeted advertising (or profiling in furtherance of similar uses), you may have the right to opt out of your Personal Information being used in this way. However, as described above, we are in the business of delivering health care, not sharing Personal Information for advertising purposes or purposes unrelated to our business.
  • Right to Limit Use and Disclosure of Sensitive Personal Information. For California residents, where Sensitive Personal Information is collected and used, you have the right to limit our use and/or disclosure of Sensitive Personal Information to only what is necessary to perform those services or provide the goods reasonably expected by an average resident (except to certain limited purposes permitted by law). 
  •  Right to Non-Discrimination. We will not discriminate against you for exercising any of these rights.


Where Personal Information is used for certain types of targeted advertising (or profiling in furtherance of similar uses), individuals may use various technologies to send opt-out signals. However, as described above, we are in the business of delivering health care, not sharing Personal Information for advertising purposes or purposes unrelated to our business. Accordingly, we do not recognize these opt-out preference signals. In addition, where certain Personal Information is shared with third parties for direct marketing purposes, California law permits users in California to request certain details about that use. For the reasons mentioned above, we expect that our applicants and employees would not need to make any such requests.


Under U.S. privacy laws, when you have the legal right to make a request, you may also designate an authorized agent to make the request on your behalf. When you submit a request to exercise one of your rights, or if you use an authorized agent to submit a request, please note that we may need to collect additional information, such as a valid government-issued ID, to verify your identity before processing your request to protect your information and the integrity of our services. In addition, where applicable, we will provide you with more information about our appeal process. When you submit a request or launch an appeal, we will limit our collection of your Personal Information to only what is necessary to securely fulfill your request or process your appeal. We will not require you or your authorized agent to pay a fee for the verification of your request or appeal. 


How to Contact Us


Should you have any questions about this Notice, our privacy practices or our Privacy Policy, please email us at privacy@omadahealth.com or contact us at the following telephone number or address: 


Phone: 888-409-8687
Omada Health, Inc.
500 Sansome St., Suite 200
Attn: Privacy Officer
San Francisco, CA 94111
We will make every effort to respond to your questions, concerns, complaints, and requests within a reasonable time.


January 1, 2023