of the third parties from which the covered entity has obtained personal information at any time on or after the effective date of this Act. (7) The articulated basis for the collecting, processing, disclosing, and maintaining of personal information, as required under section 201(a). (c) Exemption for personal information for particular purposes The privacy policy required by subsection (a) is not required to contain information relating to personal information that is collected, processed, maintained, or disclosed exclusively for any of the purposes described in paragraph (1) of section 109(a) (or a combination of such purposes), except as provided in paragraph (2) of such section. (d) Availability of privacy policy (1) Form and manner The privacy policy required by subsection (a) shall be— (A) clear and in plain language