Privacy

We may modify this Privacy Policy from time to time, in which case we will update the "Last Updated" date at the top of this Privacy Policy. If we make material changes to how we use or disclose information we collect, we will use reasonable efforts to notify you (such as by emailing you at the last email address you provided us or by posting notice of such changes on the Services) and will take additional steps as required by applicable law. If you do not agree to any updates to this Privacy Policy, please do not continue using or accessing the Services.

When you use or access the Services, we collect certain categories of information about you from a variety of sources. In addition to the specific uses discussed below, we may use this information to:

• provide and improve the Services, including by monitoring usage and trends,
• build your Credenza Profile,
• develop new products, services, and commercial offerings,
• maintain our business relationship,
• enhance the safety and security of our Services,
• provide customer support,
• create anonymized and aggregated data sets that may be used for a variety of functions, including research, internal analysis, analytics, and other functions,
• comply with applicable legal obligations,
• enforce any applicable terms of service, and/or
• protect our rights and the rights of our employees, users, or other individuals.

Information You Provide to Us

Some features of the Services may require you to directly provide certain information. You may elect not to provide this information, but doing so may prevent you from using or accessing these features. Information that you directly submit through our Services includes:

• Contact information, such as your name, address, phone number, and email address. We use this information to create and maintain your account and provide the Services, and to communicate with you, including to tell you about products or services that may be of interest to you.
• Account information, such as username, password, security questions that you select and the answers you provide, and other information you add to your account or profile. We use this information to provide the Services, and to create, maintain, and secure your account with us, including your Credenza Profile. If you choose to register an account, you are responsible for keeping your account credentials safe. We recommend you do not share your access details with anyone else. If you believe your account has been compromised, please contact us immediately.
• Payment and billing information, such as bank account, credit or debit card information, and billing address, which may be collected on our behalf by our payment processor, and information about your subscription tier and transaction history. We use this information to process your payment and provide the Services.
• Professional and employment-related information, such as your previous or current employer name, job title, job description, and job history. If you are a healthcare professional we may also collect certain information in connection with your registration for or use of the Services, including your nursing license, photo identification, work authorization documents, background screening results, and related administration and program participation information. We use this information to populate your Credenza Profile, provide the Services, including to evaluate qualifications and facilitate healthcare staffing, and to comply with applicable legal obligations.
• Any other information you choose to provide us or otherwise include in communications with us, for example, when sending a message through the Services or contacting us with questions or comments.

Information Collected Automatically

We and third parties also automatically collect certain information about your interactions with the Services, including through cookies, pixels, or other tracking technologies ("Tracking Technologies"). Where required by applicable law, we obtain your consent to collect and process this information. Such information includes:

• Device information, such as device type, operating system, unique device identifier, user agent, and internet protocol (IP) address.
• Location information, such as approximate location based on IP address.
• Precise geolocation data. If you are a healthcare provider, we collect your precise location through your device's GPS feature from the mobile devices on which you have installed our mobile applications. We use this information to ensure that (i) healthcare providers arrive at their shifts at client facilities on time and stay for the entire time reported and (ii) to verify the accuracy of time entries, including confirming that reported work hours correspond to time spent at the assigned client facility.
• Other information regarding your interaction with the Services, such as browser type, log data, date and time stamps, clickstream data (e.g., page requests, page views, how much time is spent on a page, content viewed or interacted with), and interactions with marketing emails and ad impressions.

For further information on the use of Tracking Technologies and your choices, see the section below, "Cookies and Other Tracking Technologies."

Information Collected from Other Sources

We may obtain information about you from outside sources, including information that we collect directly from third parties and information from third parties that you choose to share with us. Such information includes:

• Information you authorize us to collect as part of onboarding, including from third parties providing payment authorization, fraud screening, and background check services in connection with your registration for or use of the Services.
• Information we receive when you choose to:
  • (i) access the Services through your Credenza Profile, including contact information, account information, payment and billing information, and professional and employment-related information. We use this information to provide the Services, including to evaluate qualifications and facilitate healthcare staffing, and to comply with applicable legal obligations; or
  • (ii) link any social media platforms to your account, such as Google, Facebook, or LinkedIn, which we use to maintain your account and login information. These partners provide information such as your name, email address, and additional account information that is publicly available.
• Information we receive directly from third-party social media platforms, such as when you interact with us on Facebook, Instagram, or LinkedIn, which we use to communicate with you and personalize our Services. Information we receive from career websites and referees, including from LinkedIn or Indeed, which we use to consider and process your application for employment.
• Information we receive from consumer marketing databases or other data enrichment companies, which we use to better customize advertising and marketing to you.
• Information from publicly accessible sources, such as information that is publicly available online, which we use where necessary to provide the Services.
• Information we receive from our subsidiaries, affiliates, and related entities, which we may use to analyze how customers and healthcare professionals use the Services, enhance and improve the Services, support our business operations, and develop new products, services, and commercial offerings.

Information we receive from third-party sources will be treated in accordance with this Privacy Policy. We are not responsible for the accuracy of the information provided to us by third parties and are not responsible for any third party's policies or practices. For more information, see the section below, "Third-Party Websites and Links."

De-identified Information

We may de-identify or anonymize your information such that it cannot reasonably be used to infer information about you or otherwise be linked to you (“de-identified information”), or we may collect information that has already been de-identified or anonymized, and we may use de-identified information for any purpose. To the extent we possess or process any de-identified information, we will maintain and use such information in de-identified form and not attempt to re-identify the information, except as otherwise required by applicable laws and regulations, or for the purpose of determining whether our de-identification process satisfies legal requirements.

As described above, we and third parties use Tracking Technologies to collect certain information about your interactions with the Services. Most browsers accept Tracking Technologies automatically, but you may be able to control the way in which your devices permit the use of certain Tracking Technologies. If you so choose, you may block or delete certain Tracking Technologies from your browser; however, blocking or deleting cookies may cause some of the Services, including login features and general functionality, to work incorrectly.

Your browser settings may allow you to transmit a “Do Not Track” signal, “opt-out preference” signal or other mechanism for exercising your choice regarding the collection of your information when you visit various websites. Depending on where you live, you may have the right to opt out of targeted advertising through a Global Privacy Control (GPC) enabled browser setting. If you have this right, we will treat our initial receipt of the GPC signal as a valid request to opt out of targeted advertising. If you are logged out, our processing of the signal will be limited to the browser that you are using. Some browsers have “do not track” features that allow you to tell a website not to track you. These features are not all uniform and we do not currently respond to “Do Not Track” signals.

For the avoidance of doubt, the Services use third-party service platforms, including Google Analytics and Google AdWords (including for remarketing to users), to help analyze how users use the Services and to deliver advertising services. For information on how Google Analytics collects and processes data, please see the site "How Google uses data when you use our partners' sites or apps," currently located at www.google.com/policies/privacy/partners/. For information on Google Analytics' and Google AdWords' currently available opt-out options, we encourage you to visit Google's website.

We may disclose your information for legitimate purposes subject to this Privacy Policy, including:

• Service providers. Vendors or other service providers who help us provide the Services, including for system administration, cloud storage, security, customer relationship management, marketing communications, analytics, generative AI and content creation, payment networks, payment processing, background screening, payroll processing, scheduling services, and the deployment of Tracking Technologies.
• Affiliates and corporate group. Our affiliates or others within our corporate group, including our subsidiaries, to efficiently provide the Services. As described further in our Platform User Agreement for Independent Healthcare Professionals, you must create an account or link to an existing Credenza Profile to use certain portions of the Services, and we may disclose your information to our affiliates or other members within our corporate group to populate your Credenza Profile.
• Healthcare Professionals and Customers. To connect healthcare professionals and customers, we may disclose healthcare professionals’ information to our customers and our customers’ information to healthcare professionals. This information may include a variety of personal information (some of which may be sensitive) and non-personally identifiable information, including without limitation, name, contact information, government-issued ID, photo, nursing license, CPR certification card, and background screening results.
• Third parties for marketing purposes. Third parties for their own direct marketing purposes, with your consent where required by applicable law. If you do not want us to share your personal information with unaffiliated or non-agent third parties for promotional purposes, you can opt out by contacting us using the information below.
• Business transfers. Third parties in connection with or anticipation of an asset sale, merger, acquisition, or other business transaction, including in the context of a bankruptcy proceeding or other restructuring matter.
• Legal requirements and protection of rights. We may disclose your information if we believe in good faith that we are required to do so in order to comply with an applicable statute, regulation, rule, or law, a subpoena, a search warrant, a court or regulatory order, or other valid legal process. We may disclose information in special circumstances when we have reason to believe that disclosing this information is necessary to identify, contact, or bring legal action against someone who may be violating applicable terms, to detect fraud, for assistance with a delinquent account, or to protect the safety or security of our users, the Services, or the general public.
• With your consent. We may disclose your information with your consent or at your direction.

Sale and Sharing of Personal Information

We disclose, and have disclosed in the preceding 12 months, the following categories of personal information for marketing, advertising, and analytics purposes, in a manner that may be considered "selling" or "sharing" as those terms are defined under applicable law. We have no actual knowledge that we have "sold" or "shared" the personal information of individuals under 16 years of age:

To opt out of the sale or sharing of your personal information, please see the "Privacy Rights" section below.

By creating an account or linking to an existing Credenza Profile, you may receive SMS notifications from us about potential shifts ("Shift Notifications"). Shift Notifications will be sent to remind you of upcoming shifts. You can cancel the SMS Notifications service at any time by texting "STOP" to the short code. After you send "STOP" to us, we will send you a confirmation that you have been unsubscribed. If you are experiencing issues with the SMS Notifications, you can reply with the keyword "HELP" for more assistance, or contact us at sms-support@simplyshifts.com or 1-860-640-4231. Carriers are not liable for delayed or undelivered messages. Message and data rates may apply. If you have any questions about your text plan or data plan, it is best to contact your wireless provider.

If you are a client, you may also opt in to receiving certain SMS notifications. All text messaging originator opt-in data and consent will not be shared with any third parties.

We may provide links to third-party websites or platforms and display or make available content, data, applications, or materials from third parties. If you follow links to sites or platforms that we do not control and are not affiliated with us, you should review the applicable privacy notice, policies, and other terms. We are not responsible for the privacy or security of, or information found on, these sites or platforms, or the accuracy, completeness, or reliability of third-party materials.

Our Services are not intended for children, and we do not seek or knowingly collect any personal information about children. If we become aware that we have unknowingly collected information about a child, in particular any child under 13 years of age, we will make commercially reasonable efforts to delete such information from our database. If you are the parent or guardian of a child under 13 years of age who has provided us with their personal information, you may contact us using the below information to request that it be deleted.

We have implemented commercially reasonable security measures designed to protect your personal information from unauthorized access, use, or disclosure. However, despite our efforts to protect your information, no security measures are impenetrable, and we cannot guarantee "perfect security." Any information you send to us electronically, while using the Services or otherwise interacting with us, may not be secure while in transit. We recommend that you do not use unsecure channels to send us sensitive or confidential information.

We retain your information for as long as is reasonably necessary for the purposes specified in this Privacy Policy. When determining the length of time to retain your information, we consider various criteria, including whether we need the information to continue to provide you the Services, resolve a dispute, enforce our contractual agreements, prevent harm, promote safety, security, and integrity, or protect ourselves, including our rights, property, or products.

We are based in the United States. If you are using the Services from outside the United States, please be aware that the information we collect from you may be transferred to, stored, and processed in the United States or other countries outside your country of residence.

Depending on where you live, you may have certain rights in relation to your personal information. However, please note that a number of these rights only apply in certain circumstances, and all of these rights may be limited by law. These rights may include:

• Access / Know. You may have the right to request access to the personal information we hold about you and to obtain details about what personal information we have collected about you, including the categories of personal information, the categories of sources from which the information was collected, the business or commercial purposes for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about you.
• Deletion. You may have the right to request that we delete personal information we hold about you.
• Correction. You may have the right to request that we correct inaccurate personal information we hold about you.
• Portability. You may have the right to receive a copy of the personal information we hold about you in a portable and, to the extent technically feasible, readily usable format.
• Opt-Out of Marketing. You may opt out of marketing at any time by using the unsubscribe or opt-out instructions provided in our communications to you. If you opt out, we may still send you transactional or administrative messages, such as emails about your account.
• Opt-Out of Sale or Sharing / Processing for Targeted Advertising. You may have a right to direct us not to sell your personal information, or share or process your personal information for targeted advertising. To exercise this right, please submit a request through the following form: Your Privacy Choices. For information on how we process opt-out preference signals, see the section above, "Cookies and Other Tracking Technologies."

Submitting a Request

To make a request described in this section, please email us at privacy@simplyshifts.com or call us at 1-860-640-4231.

We will not retaliate or discriminate against you for exercising any of these rights. Further information may be needed to verify your identity before exercising these rights, such as your email address, phone number, or government-issued ID. You may designate, in writing or through a power of attorney document, an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us.

If we deny your request, you may have the right to appeal our decision by contacting us through the methods described in the "How to Contact Us" section below. When you submit a request or launch an appeal, we will limit our collection of your information to only what is necessary to securely fulfill your request or process your appeal. We will not require you or your authorized agent to pay a fee for the verification of your request or appeal.

This section applies to you if you are a resident of California and we process personal information about you that is subject to the California Consumer Privacy Act ("CCPA"). For purposes of this section, references to "personal information" shall include "sensitive personal information" as defined under the CCPA.

Processing of Personal Information

In the preceding 12 months, we collected and disclosed to service providers (as described in the "Disclosure of Your Information" section above) the following categories of personal information and sensitive personal information (denoted by *):

• Identifiers, such as name, email address, IP address
• Personal information categories listed in the California Customer Records statute, such as name, signature, Social Security number*, physical characteristics or description, address, telephone number, passport number*, driver's license* or state identification card number*, insurance policy number, education, employment, employment history, bank account number, credit card number
• Characteristics of protected classifications under California or federal law, such as race*, color*, religion*, national origin or ancestry*, sex*, age, physical or mental disability*, veteran status, genetic information*, and citizenship
• Commercial information, such as records of products or services purchased
• Internet or other similar network activity, such as information regarding your interaction with the Services
• Geolocation data, such as IP address and precise geolocation data*
• Audio, electronic, visual, thermal, olfactory, or similar information, such as photographs, video recordings, and voice recordings
• Professional or employment-related information, such as title of profession, employer, professional background, job history
• Non-public education information, such as education records
• Inferences drawn from other personal information, such as profile reflecting your preferences
• Government identifiers*, such as Social Security number, driver's license, state identification card, nursing license, CPR card, and passport number
• Account access credentials*, such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to your account
• Personal information concerning an individual's health*, such as health information submitted in connection with healthcare professional registration and credentialing

The categories of sources from which we collect your personal information and the specific purposes for which we collect and disclose your personal information are described in the sections above. We only use and disclose sensitive personal information for purposes specified in the CCPA or otherwise in line with your consent. The criteria we use to determine how long to retain your personal information is described in the section above, "Data Security and Retention."

California Rights

In addition to the rights described in the "Privacy Rights" section above that are applicable to California residents, you may also have the following rights under California law:

We provide California residents with the ability to opt out of the disclosure of their personal information to third parties for the third parties' direct marketing purposes under the California "Shine the Light" law at no cost. To exercise this right, please contact us using the information listed below.

Should you have any questions about our privacy practices or this Privacy Policy, please email us at privacy@simplyshifts.com or contact us at:

Simply Shifts, LLC.
Attn: Privacy Agent
1250 Hancock Street, Suite 501N
Quincy, MA 02169