CCPA Notice at Collection for California Applicants
Imperial Beach Health Clinic (the “Clinic”) collects and uses your personal information, including sensitive personal information, for human resources, employment, and if hired for employment, benefits administration, health and safety. Additionally, the Clinic uses your personal information and sensitive personal information for business-related purposes and to be in legal compliance. We are committed to properly handling the personal information collected or processed in connection with your employment relationship with us.
We will not sell the personal information, including any sensitive personal information, we collect about our applicants for employment nor do we share it with third parties for cross-context behavioral advertising. We may share personal informal or sensitive personal information that we collect with third parties for the business purposes stated below.
You may view our full Privacy Policy on Paylocity.
We may collect the personal information and sensitive personal information categories listed in the tables below. The tables also lists, for each category, our expected retention period, and collection and use purposes. As stated, we do not sell the information or share it with third parties for cross-context behavioral advertising.
Personal Information Category
Retention Period
Business Purpose
Sold or Shared
Identifiers, such as your full name, contact information, gender, date of birth, signature, Social Security number, driver's license or state identification numbers, or similar information for your dependents and beneficiaries.
At least the legal requirement and/or for the time period required for business purposes
· Recruit and process employment applications, including verifying eligibility for employment and conducting background and related checks
· Conduct employee onboarding if hired
· Maintain and administer payroll and employee benefit plans, including enrollment and claims handling if hired
· Maintain personnel records and complying with record retention requirements
· Prevent unauthorized access to or use of the Clinic property, including information systems, electronic devices, network, and data
· Conduct internal audits and investigate complaints, grievances, and suspected violations of the Clinic’s policy
· Respond to law enforcement requests and as required by applicable law or court order
· Exercise or defend the legal rights of the Clinic and its employees, affiliates and agents
Not sold. Shared with Paylocity or other vendors to effectuate business purpose.
California Customer Records employment and personal information, such as your name, signature, Social Security number, photograph, address, telephone number, passport number (if provided by applicant), driver’s license or state identification card number (if provided by applicant), education, current employment, employment history, membership in professional organizations, licenses and certifications, medical or health insurance information (if provided voluntarily by applicant).
At least the legal requirement and/or for the time period required for business purposes
· Same purposes as for identifiers category
Not sold. Shared with Paylocity or other vendors to effectuate business purpose.
Protected classification characteristics under California or federal law, such as age (40 years or older), race, color, ancestry, and national origin (if provided by applicant), citizenship, marital status, medical condition, physical or mental disability (if provided by applicant), sex (including gender [the Clinic does not actively collect information about pregnancy or childbirth and related medical conditions or reproductive health decision making, but will store the information if disclosed voluntarily by the applicant]), military and veteran status only if voluntarily disclosed by the applicant.
At least the legal requirement and/or for the time period required for business purposes
· Comply with federal and state equal employment opportunity laws
· Perform workforce analytics, data analytics, and benchmarking
· Conduct internal audits, grievances, and suspected violations of Clinic policy
· Exercise or defend the legal rights of the Clinic and its employees, affiliates and agents.
Not Sold but maybe shared with vendors such as Paylocity.
Professional or employment-related information, such as employment application information (work history, academic and professional qualifications, educational records, references, and interview notes, background check (post conditional offer of employment), drug testing results (post conditional offer of employment), work authorization, performance and disciplinary records, salary, bonus, commission, and other similar compensation data, benefit plan enrollment, participation, and claims information, health data concerning employee and their family members to the extent provided by applicant.
At least the legal requirement and/or for the time period required for business purposes
· Recruit and process employment applications, including verifying eligibility for employment, background checks, and onboarding
· Design and administer employee benefit plans and programs.
· Maintain personnel records and comply with record retention requirements.
· Comply with applicable state and federal labor, employment, tax, benefits, workers' compensation, disability, equal employment opportunity, workplace safety, and related laws.
· Prevent unauthorized access to or use of the Clinic's property, including its information systems, electronic devices, network, and data.
· Conduct internal audits and investigate complaints, grievances, and suspected violations of the Clinic policy.
· Exercise or defend the legal rights of the Clinic and its employees, and affiliates, customers, contractors, and agents
Not sold. Shared with Paylocity or other vendors to effectuate business purpose.
Non-public education information, such as education records, degrees and vocational certifications obtained.
At least the legal requirement and/or for the time period required for business purposes
· Evaluate an individual's appropriateness for hire, or promotion or transfer to a new position at the Clinic.
Not sold. Shared with Paylocity or other vendors to effectuate business purpose.
Sensitive personal information is a subtype of personal information consisting of specific information categories. We may collect or use information that falls within the sensitive personal information categories listed in the table below.
Sensitive Personal Information Category
Retention Period
Business Purpose
Sold or Shared
Government identifiers, such as your Social Security number, driver's license (if provided by applicant), state identification card (if provided by applicant), passport (if provided by applicant) and visa information, or immigration status and documentation.
At least the legal requirement and/or for the time period required for business purposes
· Recruit and process employment applications, including verify eligibility for employment and conducting background and related checks
· Process and administer payroll and employee benefit plans, including enrollment and claims handling if hired
· Maintain personnel records and comply with record retention requirements
· Prevent unauthorized access to or use of the Clinic property, including information systems, electronic devices, network, and data
· Respond to law enforcement requests and as required by applicable law or court order
Not sold. Some identifiers may be shared with third party vendors such as for background checks or payroll functions. Employee may be asked to furnish information to third party vendors for background checks.
Racial or ethnic origin (if disclosed by employee).
At least the legal requirement and/or for the time period required for business purposes
· Comply with federal and state equal employment opportunity laws
· Perform workforce analytics, data analytics, and benchmarking
· Conduct internal audits and investigate complaints, grievances, and suspected violations of Clinic policy
Not sold. Shared with Paylocity or other vendors to effectuate business purpose.
Citizenship or immigration information
At least the legal requirement and/or for the time period required for business purposes
· Comply with federal and state equal employment opportunity laws
· Verify employment eligibility (Form I-9)
Not sold. Shared with Paylocity or other vendors to effectuate business purpose.
Health information, including job restrictions.
At least the legal requirement and/or for the time period required for business purposes
· Comply with federal and state laws equal employment opportunity laws
Not sold. Shared with Paylocity or other vendors to effectuate business purpose.
Note that while the Clinic does not collect biometric information such as, fingerprints, the Clinic may engage services of third party vendors to complete background checks using fingerprints.
If you have any questions about this Notice or need to access this Notice in an alternative format due to having a disability, please contact Eric Wray or Human Resources at please contact (619) 429-3733 or ewray@ibclinic.org.
Acknowledgment of Receipt
I, _________________(applicant name) acknowledge that on ______________ (date), I received a copy of Imperial Community Clinic’s Notice at Collection to California Applicants, dated July 1, 2025, and that I read and understood it.
________________________
Applicant's Signature
________________________
Applicant's Printed Name
________________________
Date
California Applicant Privacy Policy
This California Applicant Privacy Policy describes how Imperial Beach Community Clinic (collectively, the "Clinic," "we," or "us") collects and processes personal information about our California applicants. To the extent that the California Consumer Privacy of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA) may apply to the Clinic, we are required to provide our California applicants with a privacy policy that contains a comprehensive description of our online and offline practices regarding our collection, use, sale, sharing, and retention of their personal information, along with a description of the rights they have regarding their personal information. This Applicant Privacy Policy provides the information the CCPA requires, together with other useful information regarding our collection and use of personal information, and any terms defined in the CCPA have the same meaning when used in this policy.
This Applicant Privacy Policy applies to applicants who are California residents when the CCPA covers our collection and use of your personal information in the employment context.
This Applicants Privacy Policy does not apply to our collection and use of personal information in a consumer or business-to-business capacity. For more information on our collection and use of consumer personal information, including how we process opt-out preference signals, please see our online privacy policy available at www.ibclinic.org
A. Personal Information Collected
We collect and use information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular applicant or household ("personal information"). Personal information does not include:
a. Personal Information Categories Chart
The chart below identifies which categories of personal information we collected from our applicants within the last 12 months and the expected retention period.
Category
Examples
Collected
Retention Period
A. Identifiers.
A real name, alias, postal address, unique personal identifier, Social Security number, driver's license number (if provided by applicant), passport number (if provided by applicant), or other similar identifiers, and similar information for your dependents and beneficiaries.
Yes
At least the legal requirement and/or for the time period required for business purposes
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).
A name, signature, Social Security number, photograph, address, telephone number, passport number (if provided by applicant), driver's license or state identification card number (if provided by applicant), education, employment, employment history, membership in professional organizations, professional licenses and certifications. We only collect medical information, or health insurance information if it is disclosed by an applicant during the application and interview process.
Some personal information included in this category may overlap with other categories.
Yes
At least the legal requirement and/or for the time period required for business purposes
C. Protected classification characteristics under California or federal law.
Age (40 years or older), national origin, citizenship, marital status (if disclosed by applicant), race, color, ancestry or national origin (if disclosed by applicant), medical condition (if disclosed by applicant), physical or mental disability (if disclosed by applicant), sex, including gender, (gender identity, gender expression, pregnancy or childbirth and related medical conditions, if disclosed by applicant), reproductive health decision making (if disclosed by applicant), military and veteran status (if disclosed by applicant).
Yes
At least the legal requirement and/or for the time period required for business purposes
D. Professional or employment-related information.
Current or past job history or performance evaluations, such as employment application information (work history, academic and professional qualifications, educational records, references, and interview notes, background check, drug testing results, work authorization, performance and disciplinary records, health data concerning applicant and their family members to the extent disclosed by applicant.
Yes
At least the legal requirement and/or for the time period required for business purposes
E. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).
Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as verification of certain certificates or degrees.
Yes
At least the legal requirement and/or for the time period required for business purposes
H. Sensitive personal information.
As defined in the Chart below
Yes
At least the legal requirement and/or for the time period required for business purposes
b. Sensitive Personal Information Categories Chart
Sensitive personal information is a subtype of personal information consisting of the specific information categories listed in the chart below. Importantly, the CCPA only treats this information as sensitive personal information when we collect or use it to infer characteristics about an applicant.
The chart below identifies which sensitive personal information categories, if any, we have collected information from our applicants. We do not infer characteristics about them.
Sensitive Personal Information Category
Collected to Infer Characteristics?
Retention Period
S.A. Government identifiers, such as your Social Security number (SSN), driver's license (if provided by applicant), state identification card(if provided by applicant), or passport number (if provided by applicant).
No
At least the legal requirement and/or for the time period required for business purposes
S.B. Racial or ethnic origin (if provided by applicant)
No
At least the legal requirement and/or for the time period required for business purposes
S.C. Citizenship or immigration status.
No
At least the legal requirement and/or for the time period required for business purposes
S.D. Health information, including job restrictions (if provided by applicant).
No
At least the legal requirement and/or for the time period required for business purposes
c. Sources of Personal Information
We obtain the categories of personal information listed above from the following categories of sources:
B. How We Use Personal Information
a. Personal Information Collection, Use and Disclosure Purposes
We may use and disclose the personal information, including sensitive personal information, we collect to advance the Clinic's business purposes, specifically to:
b. Sensitive Personal Information Use and Disclosure Purposes
We may use or disclose sensitive personal information for the following statutorily approved reasons (Permitted SPI Purposes):
Collecting or processing sensitive personal information not for the purpose of inferring characteristics about an applicant.
We do not use or disclose sensitive personal information for purposes other than the Permitted SPI Purposes and as listed in the section above.
c. Additional Categories or Other Purposes
We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice and, if required by law, seeking your consent, before using your personal information for a new or unrelated purpose. We may process your personal information without your knowledge or consent where required by applicable law or regulation.
We may collect, process, and disclose aggregated or deidentified information about our applicants for any purpose, without restriction.
C. Disclosing, Selling, or Sharing Personal Information
a. Business Purpose Disclosures
We may disclose the personal information we collect, including sensitive personal information, to others for the business purposes described in the Personal Information Collection, Use, and Disclosure Purposes section and the table below, such as to engage service providers to help us administer our human resources functions, payroll, benefits, or plans, administer workers compensation plans or services, or other employment functions or to operate the Clinic’s business. For example, we may disclose information from the Clinic's equipment or your use of our network, systems, or equipment to a service provider that provides us with data and cybersecurity services.
We only make these business purpose disclosures under written contracts that describe the purposes, require the recipient to keep the personal information confidential, and prohibit using the disclosed information for any purpose except performing the contract.
The chart below identifies the categories of entities to whom we have disclosed our applicants' personal information for a business purpose over the past 12 months, along with the personal information categories disclosed and the disclosure's business purposes.
Business Purposes Disclosure Recipient Category, Personal Information Category, and Purposes Chart
Category of Business Purpose Disclosure Recipients
Personal Information Categories Disclosed
Sensitive Personal Information Categories Disclosed
Business Purpose Disclosures
PAYROLL/TIMEKEEPING SERVICE PROVIDERS (IF HIRED)
Identifiers.
Personal information categories listed in the California Customer Records statue.
Protected classification characteristics under California or federal law.
Professional or employment-related information.
Government identifiers.
Citizenship or immigration status.
To process payroll and perform other human resources functions.
HUMAN RESOURCES SERVICE PROVIDERS
Identifiers.
Personal information categories listed in the California Customer Records statue.
Protected classification characteristics under California or federal law.
Professional or employment-related information.
Government identifiers.
Racial or ethnic origin.
Religious or philosophical beliefs.
Mail, email, or text messages contents not directed to the Clinic.
Health information.
To perform human resources management services and employee support services.
HEALTH INSURANCE CLINIC SERVICE PROVIDERS
Identifiers.
Personal information categories listed in the California Customer Records statue.
Protected classification characteristics under California or federal law.
Government identifiers.
Health information.
To provide and manage benefits.
D. Your Rights and Choices
If you are a California applicant, you have the following rights under the CCPA regarding your personal information:
a. Right to Know and Data Portability
You have the right to request that we disclose certain information to you about our collection and use of your personal information (the "right to know"), including the specific pieces of personal information we have collected about you (a "data portability request"). Our response will cover the 12-month period preceding the request, although we will honor requests to cover a longer period that do not extend past January 1, 2022, unless doing so would be impossible or involves disproportionate effort. You may make two right to know and data portability requests in any 12-month period. Once we receive your request and confirm your identity (see How to Exercise Your Rights below), we will disclose to you:
b. Right to Delete
You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions and limitations, such as to allow the Clinic to effectuate its business needs (the "right to delete").
c. Right to Correct
You have the right to request correction of personal information we maintain about you that you believe is inaccurate. We may require you to provide documentation, if needed, to support your claim that the information is inaccurate. Unless an exception applies, we will correct personal information that our review determines is inaccurate and direct our service providers to take similar action. For more information, see Exercising the Rights to Know, Delete, or Correct.
d. Right to Limit Sensitive Personal Information Processing to Permitted SPI Purposes
You have a right to limit our use or disclosure of your sensitive personal information to only the Permitted SPI Purposes if we use or disclose it for purposes other than the Permitted SPI Purposes.
e. Right to Non-Discrimination
You have the right not to be discriminated or retaliated against for exercising any of your privacy rights under the CCPA.
E. How to Exercise Your Rights
a. Exercising the Rights to Know, Delete, or Correct
To exercise the right to know, data portability, delete, or correct described above, please submit a verifiable request to us by either:
Please describe your request with sufficient detail so we can properly understand, evaluate, and respond to it. You or your authorized agent may only submit a request to know or for data portability twice within a 12-month period.
b. Exercising the Right to Limit or Opt-Out
You can submit your request to limit through:
c. Verification Process and Authorized Agents
Only you, or someone legally authorized to act on your behalf, may make a request to know, delete, or correct related to your personal information. To designate an authorized agent, contact Human Resources at ewray@ibclinic.org to obtain a “Designate Authorized Agent Form.” We may request specific information from you or your authorized representative to confirm your or their identity before we can process your right to know, delete, or correct your personal information.
We cannot respond to your request to know, delete, or correct if we cannot verify your identity or authority to make the request and confirm the personal information relating to you. We will only use personal information provided in the request to verify the requestor's identity or authority to make it.
For requests to limit or opt-out, we ask for the information necessary to complete the request, such as the name of the applicant.
d. Responding to Your Requests to Know, Delete, or Correct
We will confirm receipt of your request within ten business days. If you do not receive confirmation within the ten-day timeframe, please Human Resources at IBHR@ibclinic.org.
We endeavor to substantively respond to a verifiable request within 45 days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing. We will deliver our written response to your private email address as provided and verified by you. Our substantive response will tell you whether or not we have complied with your request. If we cannot comply with your request in whole or in part, we will explain the reason, subject to any legal or regulatory restrictions. Applicable law may allow or require us to refuse to provide you with access to some or all of the personal information that we hold about you, or we may have destroyed, deleted, or made your personal information anonymous in compliance with our record retention policies and obligations.
Any disclosures we provide will cover information for the 12-month period preceding the request's receipt date. We will consider requests to provide a longer disclosure period that do not extend past January 1, 2022, unless providing the longer timeframe would be impossible or involves disproportionate effort.
For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.
We do not charge a fee to process or respond to your verifiable request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
e. Response and Timing on Rights to Limit or Opt-Out
In response to your request to limit or opt-out, we will process your request, as soon as feasibly possible, but no later than 15 business days from the date we receive the request. Subject to some restrictions such as the need to use your information to complete business purposes set forth in this Policy, we will comply with your request. We will only use personal information provided from your request to comply with the request.
We will also notify our service providers, contractors, and certain other downstream recipients of your request to limit or opt-out and instruct them to both:
We may deny opt-out requests if we have a good-faith, reasonable, and documented belief that the request is fraudulent and clearly explain our denial decision to the requestor.
Once you make a request to limit or opt-out, we will wait at least 12 months before asking you to reauthorize the use or disclosure of your sensitive personal information for purposes other than the Permitted SPI Purposes. However, you may change your mind and opt back in at any time by contacting Human Resources at IBHR@ibclinic.org.
F. Data Security
We have implemented reasonable measures designed to secure your personal information from accidental loss or destruction and from unauthorized access, use, alteration, and disclosure. These measures may include, for example, storing information on secure servers behind firewalls, encrypting data, and other security measures. We also limit access to personal information to those employees, agents, service providers, and contractors that have a legitimate business need for such access.
The safety and security of your information also depends on you. To the extent we may have given you (or where you have chosen) a password for access to certain parts of our Intranet (if any), Website, or any Clinic systems, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.
Unfortunately, the transmission of information through the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted to our Intranet (if any), Website, or other Clinic systems. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on our systems.
G. Privacy Policy Changes
We reserve the right to update this Applicant Privacy Policy at any time as we continue to develop our compliance program in response to legal developments of the CCPA. If we make any material changes to this Applicant Privacy Policy, we will update the policy's effective date and post the updated policy on our website and/or Paylocity and provide you with the updated policy.
H. Questions Regarding This Policy
If you have any questions or comments about this policy, the ways in which we collect and use your information described here, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at:
Phone: (619) 429-3733
Email: IBHR@ibclinic.org
If you need to access this Employee Privacy Policy in an alternative format due to having a disability, please contact (619) 429-3733 or IBHR@ibclinic.org.
Acknowledgment of Receipt
I, _________________(applicant name) acknowledge that on ______________ (date), I received a copy of Imperial Community Clinic’s Applicant Privacy Policy, dated July 1, 2025, and that I read and understood it.
________________________
Applicant's Signature
________________________
Applicant's Printed Name
________________________
Date