or maintaining personal information secured using privacy-preserving computing. Nothing in this paragraph shall be construed to exempt the covered entity from the requirement of subsection (a) to provide notice to such individual with respect to such collecting, processing, or maintaining. (c) Service providers excluded This section does not apply to a service provider if such service provider has a reasonable belief that a covered entity for which it processes, maintains, or discloses personal information is in compliance with this section. 211. Privacy policy (a) Policy required A covered entity shall maintain a privacy policy relating to the practices of such entity regarding the collecting, processing, maintaining, and disclosing of personal information. (b) Contents The privacy policy required by subsection (a) shall contain the following: (1) A general description of the practices of the covered entity regarding the collecting, processing, maintaining, and disclosing of personal information. (2) A description of how individuals may exercise the rights provided by title I. (3) A clear and concise summary of the following: (A) The categories of personal information collected or otherwise obtained by the covered entity. (B) The business or commercial purposes of the covered entity for collecting, processing, maintaining, or disclosing personal information. (C) The categories and a list of third parties to which the covered entity discloses personal information. (4) A description of the personal information that the covered entity maintains that the covered entity does not collect from individuals and how the covered entity obtains such personal information. (5) A list of the third parties to which the covered entity has disclosed personal information. (6) A list of the third parties from which the covered entity has obtained personal information at any time on or after the effective date of this Act. (7) The articulated basis for the collecting, processing, disclosing, and maintaining of personal information,