California Privacy Notice and Consumer Health Data Addendum
M3 Mental Health and Pain Review · M3MentalHealth.org
M-3 Information, LLC · 155 Gibbs Street, Rockville, MD 20850
Effective Date / Last Modified: July 8, 2026
This California Privacy Notice and Consumer Health Data Addendum (this “Notice”) supplements our general Privacy Policy and applies to California residents (“you”). It is provided under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 and its implementing regulations (“CCPA”), and the California Confidentiality of Medical Information Act, Cal. Civ. Code § 56 et seq. (“CMIA”), as amended by AB 2089 (2022) and AB 352 (2023). In the event of a conflict regarding the information of a California resident, this Notice controls over the general Privacy Policy.
1. The M3 Review as a Mental Health Digital Service Under the CMIA
Under AB 2089, a “mental health digital service” — a website or mobile application that collects mental health application information from a consumer, markets itself as facilitating mental health services, and uses that information to facilitate mental health services — is deemed a provider of health care for purposes of the CMIA. To the extent the M3 Review meets that definition, the information you provide through the M3 Checklist and the resulting scores and reports (“mental health application information”) are treated as “medical information” under the CMIA, and we assume the confidentiality obligations of a provider of health care with respect to that information. Accordingly:
we do not disclose your medical information without your written authorization meeting the requirements of Cal. Civ. Code § 56.11, except as the CMIA expressly permits (for example, disclosures required by law or made to our contractors and service providers as permitted by § 56.10);
we do not sell your medical information, and we do not share it for cross-context behavioral advertising;
we do not use your medical information for marketing without the separate authorization the CMIA requires; and
we maintain your medical information in a manner that preserves its confidentiality, consistent with Cal. Civ. Code § 56.101.
2. Sensitive Services Protections (AB 352)
Assessment information relating to mental or behavioral health is medical information on the provision of “sensitive services” under AB 352. Consistent with Cal. Civ. Code §§ 56.101(d) and 56.108, we:
apply access controls that limit internal access to sensitive services information to persons who need it to provide the service;
maintain the capability to segregate sensitive services information within our systems and to limit its disclosure, consistent with the statute;
do not cooperate with inquiries, investigations, or legal process from other states that seek information about lawful sensitive services received in California, except as required by law; and
do not disclose sensitive services information in response to out-of-state subpoenas or warrants except as California law permits or requires.
3. Categories of Personal Information: Collection, Use, and Disclosure (CCPA)
In the preceding 12 months we have collected the following categories of personal information, from the sources, for the purposes, and with the categories of recipients described in Sections 2, 3, and 5 of our general Privacy Policy:
Identifiers (name, email address, phone number, IP address, account credentials);
Personal information categories listed in Cal. Civ. Code § 1798.80(e) (contact information; medical information as described above);
Characteristics of protected classifications (age, sex or gender, where you provide them);
Commercial information (payment and insurance or Medicare eligibility details, where applicable);
Internet or other electronic network activity information (device, log, and usage data; cookies as described in the general Privacy Policy);
Sensitive personal information (your Assessment responses, scores, and reports, which reveal or concern mental health; log-in credentials); and
Inferences (screening scores and severity ranges derived from your responses).
We do not sell personal information, we have not sold personal information in the preceding 12 months, and we do not share personal information for cross-context behavioral advertising. We do not knowingly collect or sell the personal information of consumers under 16 years of age; the Services are limited to individuals 18 and older. We do not use or disclose sensitive personal information for purposes other than those permitted by Cal. Civ. Code § 1798.121(a) and 11 C.C.R. § 7027(m) (that is, providing the services you request, security, quality assurance, and other exempt purposes). We retain each category of personal information as described in Section 11 of our general Privacy Policy.
4. Your California Rights
Subject to applicable exceptions and verification, you have the right to:
Know and Access: request disclosure of the personal information we have collected about you, the categories of sources, the purposes, and the categories of third parties to whom it was disclosed, and receive a copy in a portable format;
Delete: request deletion of personal information we collected from you (the CMIA and other laws may require or permit us to retain certain records);
Correct: request correction of inaccurate personal information;
Opt Out of Sale or Sharing: we do not sell or share personal information; if that ever changes, we will post a “Do Not Sell or Share My Personal Information” link and honor opt-outs, including the Global Privacy Control;
Limit Use of Sensitive Personal Information: because we already use sensitive personal information only for permitted service purposes, no separate “Limit” action is required; if our practices change, we will post a “Limit the Use of My Sensitive Personal Information” link;
CMIA rights: request an accounting of certain disclosures of medical information and revoke any authorization you have given, prospectively, at any time; and
Non-Discrimination and Non-Retaliation: we will not discriminate against you for exercising any of these rights.
5. How to Exercise Your Rights
Submit requests by emailing support@m3mentalhealth.org or privacy@m3information.com, by calling 301-641-8045, or through the tools in your account. We will verify your identity using information associated with your account and will respond within 45 days, extendable once by 45 days with notice. You may designate an authorized agent to submit requests on your behalf; we will require proof of the agent’s authority and may require you to verify your own identity. You may exercise your rights free of charge up to twice in any 12-month period.
6. Enforcement Note
The CMIA is enforceable through administrative fines and civil penalties of up to $250,000 per violation and provides individuals a private right of action, including statutory damages, for unlawful disclosure of medical information. The CCPA is enforced by the California Privacy Protection Agency and the California Attorney General. We maintain the practices described in this Notice with reference to both regimes.
7. Contact
Privacy Officer, M-3 Information, LLC · 155 Gibbs Street, Rockville, MD 20850 · 301-641-8045 · privacy@m3information.com · support@m3mentalhealth.org
See also our general Privacy Policy, Terms and Conditions, Notice of Privacy Practices, and Washington Consumer Health Data Privacy Policy, each posted at M3MentalHealth.org. Changes to this Notice will be posted with an updated Effective Date.
IF YOU ARE IN CRISIS OR THINKING OF HARMING YOURSELF, CALL OR TEXT 988 (SUICIDE & CRISIS LIFELINE), CALL 911, OR GO TO YOUR NEAREST EMERGENCY ROOM.