NEBRASKA DATA PRIVACY ACT NOTICE
Last Updated: [06/01/2025]
INTRODUCTION
This NEBRASKA DATA PRIVACY ACT NOTICE (“NDPA Notice”) supplements and expands upon the information contained in The Mindful Group’s Privacy Policy and applies solely to residents of the State of Nebraska who interact with us in an individual or household context (“residents” or “you”). We adopt this NDPA Notice to comply with the Nebraska Data Privacy Act (the “NDPA”) and any terms defined in the NDPA have the same meaning when used in this NDPA Notice. For the avoidance of doubt, our Privacy Policy is incorporated by reference, and any terms used that are not defined in this NDPA Notice or in the NDPA, shall have the meaning assigned to them in our Privacy Policy.
This NDPA Notice is being provided to you to inform you of, among other things, how we, in our capacity as a “Controller”, collect, use, and share your personal data, that we may collect from you or that you may provide to us through our (i) Website or (ii) Channels, and the rights you have with respect to your personal data.
PLEASE REVIEW THIS NDPA NOTICE CAREFULLY TO UNDERSTAND OUR POLICIES AND PRACTICES REGARDING YOUR PERSONAL DATA AND HOW WE WILL TREAT IT. IF YOU DO NOT AGREE WITH OUR POLICIES AND PRACTICES AS STATED HEREIN, THEN PLEASE DO NOT ENGAGE OUR SERVICES, AND PLEASE DO NOT VISIT OUR WEBSITES OR ACCESS OUR CHANNELS. BY ACCESSING AND/OR USING OUR WEBSITE OR CHANNELS, YOU ARE AGREEING TO THE TERMS OF THIS NDPA NOTICE.
This NDPA Notice is effective as of the Last Updated date set forth at the top of this NDPA Notice. By accessing our Website and/or Channels, you agree to the terms of this NDPA Notice. We reserve the right to update, revise, and/or modify this NDPA Notice at any time and at our sole discretion. Your continued use of our Website or Channels shall constitute your acceptance of the amended NDPA Notice. The amended NDPA Notice supersedes all previous versions. If you do not agree with the amended NDPA Notice or if you do not wish to be bound by such amended NDPA Notice, you should cease using our Website and/or Channels immediately.
YOU CAN WITHDRAW YOUR CONSENT AT ANY TIME.
INFORMATION WE COLLECT AND PROCESS
For the purposes of this NDPA Notice, the term “personal data” shall have the meaning ascribed to it under the NDPA. The NDPA defines personal data as “any information, including sensitive data, that is linked or reasonably linkable to an identified or identifiable individual, and includes pseudonymous data when the data is used by a controller or processor in conjunction with additional information that reasonably links the data to an identified or identifiable individual.” Sensitive data is a subset of personal data, which is denoted with an Asterix (“*”), below. Personal data does not include de-identified data or publicly available data.
The chart below sets forth the categories of personal data we have collected from residents within the last twelve (12) months, which is based on those sources listed in the Sources Of Which We Collect Information section of our Privacy Policy. We process personal data for those purposes set forth in the Use of Information Collected section of our Privacy Policy.
CATEGORY, EXAMPLES, COLLECTED
Identifiers
A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address (“IP Address”), e-mail address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.
Yes
Customer Records Personal Information Categories
Name, signature, address, telephone number, education, employment.
Yes
Protected Classification Characteristics Under Nebraska or Federal Law*
Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).
No
Commercial Information
Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
Yes
Genetic or Biometric Information*
Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.
No
Internet or Other Similar Network Activity
Browsing history, search history, information on a resident’s interaction with a website, application, or advertisement.
Yes
Precise Geolocation Data*
Information derived from technology, including but not limited to global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of a natural person with precision and accuracy.
No
Sensory Data
Audio, electronic, visual, thermal, olfactory, or similar information.
No
Professional or Employment-Related Information
Current or past job history, job title, occupation, practice type/specialty, year of school graduation, professional provider number, performance evaluations.
Yes
Non-Public Education Information (per The Family Educational Rights And Privacy Act)
Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.
No
Inferences Drawn From Other Personal Information
Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
No
DISCLOSURE OF PERSONAL DATA FOR OUR BUSINESS OR COMMERCIAL PURPOSES
Mindful Age does not and will not sell aggregated information, including information that is defined as personal data, about our Users, which specifically includes Nebraska residents. We may use or disclose the personal data we collect and, over the prior twelve (12) months, or disclosed the personal data we have collected for business or commercial purposes, for the reasons set forth in the Use of Information section of our Privacy Policy. Mindful Age will not collect additional categories of personal data or use the personal data we collected for materially different, unrelated, or incompatible purposes without providing you notice.
We, however, may share your personal data by disclosing it, for a business or commercial purpose, to third parties that provide services on our behalf to support our business, who are contractually obligated to keep personal data confidential and to use it solely for the purposes for which we disclose it, including our website administrators, mailing vendors, and analytical service providers. In the preceding twelve (12) months, Mindful Age has disclosed personal data for a business purpose to the categories of third parties indicated in the chart below.
CATEGORY, CATEGORY OF RECIPIENT
Identifiers
Service providers and business partners.
Customer Records Personal Information Categories
Service providers and business partners.
Protected Classification Characteristics Under Nebraska or Federal Law*
Not Applicable
Commercial Information
Service providers and business partners.
Genetic or Biometric Information*
Not Applicable
Internet or Other Similar Network Activity
Service providers (such as analytics providers).
Precise Geolocation Data*
Not Applicable
Sensory Data
Not Applicable
Professional or Employment-Related Information
Service providers and business partners.
Non-Public Education Information (per The Family Educational Rights And Privacy Act)
Not Applicable
Inferences Drawn From Other Personal Information
Not Applicable
SALES OF PERSONAL DATA
As mentioned above, Mindful Age does not and will not sell aggregated information, including information that is defined as personal data, about our Users, which specifically includes Nebraska residents.
PRIVACY FOR RESIDENTS UNDER THE AGE OF 13
As stated in Privacy For Children Under The Age Of 13 section of our Privacy Policy, our Website is designed for a “general audience” and is not intended for use by children under 13 years of age. Under the NDPA, personal data of a child under 13 years of age is considered sensitive data, which requires a resident’s consent to process. We do not knowingly collect personal data from children under 13 years of age, unless such information has been obtained in accordance with COPPA. For more information on this matter please refer to the Privacy for Children under the Age of 13 section of our Privacy Policy. If you are under 13, do not use our Website or provide any information about yourself to us, including your name, address, telephone number, e-mail address, or any screen name or user name you may use.
YOUR RIGHTS AND CHOICES
In addition to those rights set forth in the Choices About How We Use And/Or Disclose Your Information section of our Privacy Policy, the NDPA provides you with specific rights regarding your “personal data.” This section describes your rights under the NDPA and explains how you can exercise those rights.
RIGHT TO ACCESS INFORMATION/CORRECT INACCURATE PERSONAL DATA
You have the right to request access to personal data collected about you and information regarding the purposes for which we collect it and the third parties and service providers with which we share it. In addition, you have the right to correct inaccurate or incomplete personal data. To make a request to correct inaccurate or incomplete personal data, please submit your request to us at any method set forth in Contact Us; Submit A Request, below.
RIGHT TO OBTAIN A COPY OF PERSONAL DATA
You have the right to request a copy of the personal data that you previously provided to us in a portable format (a “Data Portability Request”), ONCE WITHIN A 12-MONTH PERIOD. For each Data Portability Request, we will select a format to provide your personal data that should allow you to transmit the information from one entity to another entity without hindrance. We do not charge a fee to process or respond to your Data Portability Request, unless it is excessive, repetitive, or manifestly unfounded. If we determine that the Data Portability Request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your Data Portability Request. In order to process your Data Portability Request, we must be able to verify your identity or authority to make the Data Portability Request and confirm the personal data relates to you. For more information regarding verification of your identity, please see Verification of Identity and Processing of Requests, below. To make a Data Portability Request, please submit your request to us at any method set forth in Contact Us; Submit A Request, below.
RIGHT TO DELETE PERSONAL DATA
You have the right to request that we delete any personal data that we have collected directly from you or from a third-party, subject to certain exceptions. Once we receive and verify your identity or authority, as set forth in Verification of Identity and Processing of Requests below, we will delete (and direct our service providers to delete) your personal data from our records in accordance with your request, unless an exception applies. We may deny your deletion request or not delete some of your personal data, if retaining the information is necessary for us or our service provider(s) to:
Complete the transaction for which we collected the personal data, provide a service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
Debug products to identify and repair errors that impair existing intended functionality.
Exercise free speech, ensure the right of another resident to exercise their free speech rights, or exercise another right provided for by law.
Enable solely internal uses that are reasonably aligned with Client expectations based on your relationship with us.
Comply with a legal obligation.
We may also limit deletion to the extent permitted by applicable law. For more information regarding verification of your identity, please see Verification of Identity and Processing of Requests, below. To make a deletion request, please submit your request to any method set forth in Contact Us; Submit A Request, below.
RESPONSE TO YOUR REQUEST: TIMING AND FORMAT
We will confirm receipt of your request within ten (10) business days. If you do not receive confirmation within the 10-day timeframe, please contact [info@mindfulage.com and/or 781-987-4107]. We will attempt to respond to a verifiable resident request within forty-five (45) days of receiving that request. If we require more time, we will inform you of the reason and extension period in writing.
If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.
Any disclosures we provide will only cover the 12-month period preceding our receipt of your verifiable resident request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For Data Portability Requests, we will select a format to provide your personal data that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.
We do not charge a fee to process or respond to your verifiable resident request unless it is a second or repetitive request within a 12-month period. If we determine that the request warrants a fee, we will tell you why we made that decision
RIGHT TO APPEAL DENIAL OF REQUEST REGARDING YOUR PERSONAL DATA
If we decline your request, in connection with your rights set forth in this Your Rights and Choices section of this NDPA Notice, you have the right to appeal such decision by submitting your appeal request to at any method set forth in Contact Us; Submit A Request below. We will confirm receipt of your request within ten (10) business days. If you do not receive confirmation within the 10-day timeframe, please contact [info@mindfulage.com or 781-987-4107].
We will attempt to resolve your appeal request within forty-five (45) days of receiving your appeal request. If we require more time, we will inform you of the reason and extension period in writing. We will inform you in writing of any action taken or not taken in response to your appeal, including a written explanation of the reasons for the decision.
If we deny your appeal request, you have the right to File a Complaint with the Nebraska Attorney General. To learn more about how you can File a Complaint with the Nebraska Attorney General please visit File a Complaint. Do note that the information provided at these links is third party information, and as such, we are not responsible for the completeness or accuracy of such information.
NON-DISCRIMINATION
We will not discriminate against you for exercising any of your rights under the NDPA. Unless permitted by the NDPA, we will not:
Deny you services.
Increase the cost for services.
Provide a different level of quality of services.
VERIFICATION OF IDENTITY AND PROCESSING OF REQUESTS
Only you, or someone legally authorized to act on your behalf (an “Authorized Agent”), may make a request set forth in Your Rights and Choices above. To protect Nebraska residents’ personal data and to comply with the NDPA, as required or permitted under applicable law, before we act on a request, we may take steps to authenticate your identity or authority to make such request, before processing any request set forth in Your Rights and Choices above. In order for your request to be processed, you must provide us with enough information to reasonably authenticate you are the Nebraska resident about whom we collected personal data or an Authorized Agent of that Nebraska resident. To designate an Authorized Agent, see Designating Authorized Agents below.
In authenticating requests, we employ reasonable measures to detect fraudulent requests and prevent unauthorized access to your personal data. To meet our obligations under the NDPA, we are required to authenticate your identity and the identity of your Authorized Agent. You do not need to create an account with us to submit a request. However, we do consider requests made through your password protected account sufficiently verified when the request relates to personal data associated with that specific account. You may also make a request set forth in Your Rights and Choices above on behalf of your child by any of the methods set forth in Contact Us; Submit A Request, below.
We will confirm receipt of your request within ten (10) business days and provide information about how we process your request. We will attempt to respond to an authenticated request within forty-five (45) days of receiving that request. If we require more time, we will inform you of the reason and extension period in writing.
We cannot respond to your request or provide you with personal data if we cannot authenticate your identity or authority to make the request and confirm the personal data relates to you. We will only use personal data provided in the request to authenticate the requestor’s identity or authority to make it.
DESIGNATING AN AUTHORIZED AGENT
You can authorize your Authorized Agent to exercise your rights under the NDPA by registering them with the Nebraska Secretary of State or pursuant to a power of attorney. If you authorize an Authorized Agent to exercise your rights under the NDPA, we may require your Authorized Agent to submit proof of identity and authorization. As stated in Verification Of Identity And Processing Of Requests above, we may deny a request from your Authorized Agent if we cannot authenticate its authority to make such requests on your behalf.
CONTACT US; SUBMIT A REQUEST
If you have any questions, comments, or concerns about this NDPA Notice, the ways in which Mindful Age collects and uses the information described herein or about our Privacy Policy, your choices and rights regarding such use, wish to exercise your rights under the NDPA, need to access this NDPA Notice in an alternative format due to having a disability, or about any other matter, please do not hesitate to contact use at one of the following methods:
Phone:
[781-987-4107]
Website:
[www.mindfulage.com]
Email Address:
[info@mindfulage.com]
Mail:
The Mindful Group, LLC (d/b/a Mindful Age)
20 Tremont Street, Suite 31
Duxbury, MA 02332
Attention: [Privacy Officer]