; (2) a clear and specific description of the rights of individuals with respect to their personal data (including the rights described in section 5) and information on how to exercise those rights; and (3) the information described in subsection (c). (b) Availability of previous versions A covered entity shall make publicly available any previous version of a privacy policy required under subsection (a). (c) Contents A privacy policy required under subsection (a) shall include— (1) the identity and the contact details of the covered entity, including, where applicable, the representative of the covered entity for purposes of privacy inquiries or its privacy officer; (2) a clear description of each category of personal data collected by the covered entity and the purposes for which each such category is collected and processed; (3) a clear description of any relevant retention periods (if possible) and any criteria and other information with respect to the deletion or de-identification of personal data collected and processed by the covered entity; (4) whether, and for what purposes, the covered entity discloses personal data to third parties, each category of personal data disclosed to third parties, and the types of third parties to which those categories of personal data are disclosed; (5) whether, and for what purposes, the covered entity receives personal data from third parties, the categories of personal data received from third parties, and the types of third parties from which the covered entity receives personal data; (6) a clear description of the process by which the covered entity informs individuals of material changes to its policies and practices with respect to its collection and processing of personal data; (7) the specific steps an individual may take to minimize the collection or processing by the covered entity of the individual's personal data, and the relevant implications to the individual from minimizing such collection or processing