Privacy Policy

Effective Date: August 6, 2026

This Privacy Policy explains how HURO LLC, doing business as HURO ("HURO," "Company," "we," "us," or "our"), collects, uses, discloses, retains, and protects personal information when you access or use the HURO website, mobile applications, software, workforce marketplace, communications, and related services (collectively, the "Platform").

This Policy applies when you create an account, post or request a Shift, engage a Clinician, activate a Flex Shifts Subscription or Job Board Subscription, submit credentials or screening information, complete identity verification or a background check, process a payment, participate in a referral reward program, contact us, use our AI-assisted features, or otherwise interact with HURO by website, app, email, telephone, SMS, chat, push notification, or another digital channel.

Please read this Policy carefully. If a separate notice is presented when information is collected, that notice supplements this Policy. Capitalized terms not defined here have the meanings given in the HURO Terms of Service.

1. Scope of This Policy

This Policy applies to personal information HURO processes about:

• Clinicians and prospective Clinicians;
• Facility representatives, administrators, employees, and other authorized users;
• Website and mobile-app visitors;
• Individuals who contact HURO, request information, or receive communications from us;
• Vendors, contractors, and business contacts; and
• Other individuals whose information is submitted to the Platform lawfully.

This Policy does not apply to information processed solely by a Facility, Clinician, payment processor, screening provider, or other independent third party under its own privacy notice. It also does not apply to de-identified information that cannot reasonably be linked to an individual, except where applicable law provides otherwise.

2. HURO's Role and Facility-Controlled Information

HURO generally acts as the business or controller responsible for personal information collected to operate accounts, provide the Platform, verify users, facilitate Shifts, process transactions, secure the Platform, and communicate with users.

In some circumstances, HURO may process information on behalf of a Facility or another organization. When that organization determines why and how the information is processed, it may be the responsible business or controller, and its privacy notice and instructions may also apply. Requests involving information controlled by a Facility may be referred to that Facility.

HURO is a healthcare workforce technology marketplace and is not itself a healthcare provider. The Platform is not designed or authorized to receive, store, maintain, or process patient medical records or Protected Health Information ("PHI") except to the limited extent expressly permitted under a separate written Business Associate Agreement.

For purposes of this Policy, "PHI," "Covered Entity," and "Business Associate" have the meanings assigned to those terms under the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations, collectively referred to as "HIPAA." Each Clinician and Facility is responsible for its own compliance with HIPAA and all other applicable privacy, security, confidentiality, and data protection laws.

Neither this Policy nor the HURO Terms of Service constitutes or creates a Business Associate Agreement. If services requested from HURO would require HURO to create, receive, maintain, or transmit PHI on behalf of a Covered Entity or Business Associate, HURO and the applicable Party must execute a separate written Business Associate Agreement before those services are provided or PHI is made available to HURO.

Unless such a Business Associate Agreement has been executed, users must not upload, enter, transmit, store, exchange, or otherwise disclose PHI through the Platform. A user who submits PHI without authorization is responsible for that submission and must promptly notify HURO at support@thehuro.com and cooperate in securing, removing, or otherwise addressing the information. If an applicable Business Associate Agreement conflicts with this Policy, the Business Associate Agreement controls with respect to PHI covered by that agreement.

3. Definitions

Personal Information means information that identifies, relates to, describes, is reasonably capable of being associated with, or can reasonably be linked to an individual or household.

Sensitive Personal Information may include Social Security and other government identification numbers, account credentials, financial information, precise geolocation, communication contents, background-screening information, biometric identifiers used for identification, and health or medical-compliance information.

Consumer Health Data means personal information that identifies or can reasonably be linked to a consumer and identifies the consumer's past, present, or future physical or mental health status, as defined by applicable law. It may include vaccination records, tuberculosis testing, drug-screen results, disability-related information, and inferences concerning health status.

Sell, Share, Targeted Advertising, and Profiling have the meanings assigned to them by applicable privacy laws. A disclosure may legally qualify as a sale or sharing even when no money is exchanged.

4. Personal Information We Collect

Depending on how you interact with HURO, we may collect the following categories of personal information:

We may also collect other information disclosed at the time of collection or submitted voluntarily. When reasonably necessary to provide Platform services, verify compliance, prevent fraud, process payments, or resolve disputes, HURO may process submitted documents and information in complete and unredacted form. Please do not provide information that HURO has not requested, PHI that is not authorized under a separate Business Associate Agreement, or information that you are not legally authorized to disclose.

5. Sources of Personal Information

We collect personal information from:

• You directly, including through account registration, profiles, forms, Shift activity, uploads, messages, and support requests;
• Facilities, Clinicians, references, and other authorized Platform users;
• Your browser, mobile device, and the HURO App;
• Cookies, pixels, SDKs, logs, analytics tools, and similar technologies;
• Identity-verification, credentialing, background-screening, drug-screening, payment, communications, and fraud-prevention providers;
• Licensing boards, registries, exclusion lists, government agencies, public records, and other lawful public sources;
• Business partners, vendors, integrations, and services you authorize HURO to access; and
• Corporate affiliates or parties involved in a merger, acquisition, financing, reorganization, or similar transaction.

6. How We Use Personal Information

HURO may use personal information to:

• Create, authenticate, administer, and secure accounts;
• Operate, maintain, personalize, and improve the Platform;
• Connect Facilities and Clinicians for posting, reviewing, requesting, accepting, and managing Shifts;
• Display Facility-Set Rates and process Flex Shifts Subscriptions, Job Board Subscriptions, transaction fees, background-check payments, Clinician payouts, referral rewards, and other Charges;
• Verify identity, licenses, credentials, education, qualifications, screening results, and eligibility;
• Allow authorized Facilities to evaluate Clinicians for Shifts or potential full-time opportunities;
• Support Shift check-in, check-out, attendance confirmation, timekeeping, Shift Reports, Facility review, weekly invoicing, invoice approval or disputes, payment reconciliation, and other dispute resolution;
• Display nearby Shift opportunities and provide location-based operational notifications;
• Process weekly invoices, invoice approvals and disputes, Facility payments, Clinician payouts, referral rewards, background-check transactions, tax documentation, refunds, overpayment recovery, account suspensions, cancellations resulting from nonpayment, and collections;
• Provide customer service and respond to questions, requests, and complaints;
• Send account, security, credential, Shift, payment, scheduling, and other transactional communications;
• Send marketing communications when consent or another lawful basis permits;
• Detect, investigate, and prevent fraud, misuse, unsafe conduct, security incidents, and violations of our agreements;
• Monitor performance, troubleshoot problems, conduct research, develop features, and improve user experience;
• Provide AI-assisted responses, recommendations, routing, scheduling, fraud detection, and support;
• Enforce our Terms of Service and other agreements;
• Establish, exercise, or defend legal claims;
• Comply with tax, licensing, safety, reporting, court, regulatory, and other legal obligations; and
• Complete a corporate transaction or organizational change.

Where required by law, HURO relies on consent for particular processing activities, including certain marketing communications, precise location access, collection or sharing of Consumer Health Data, call recording, and use of device permissions. You may withdraw consent as described in this Policy, but withdrawal does not affect processing completed lawfully before withdrawal.

HURO collects and uses location, time, attendance, credential, document, payment, and Platform activity data for Platform operation, identity and credential verification, billing support, attendance confirmation, Facility review, fraud prevention, compliance support, and dispute resolution. The collection and use of such data for these purposes does not, by itself, constitute supervision, direction, control of work hours, control of clinical services, or employment management by HURO. HURO does not use such data to direct the manner, method, or means by which a Clinician performs professional services.

7. Identity Verification, Background Screening, Credentials, Health Information, Camera Access, and Photo Access

HURO may collect identity information, government-issued identification, screening authorizations, verification results, background-screening information, registry results, and related status information to authenticate accounts, verify identity, assess Platform eligibility, prevent fraud, satisfy Facility requirements, and support compliance. Screening providers may collect and process information under their own privacy notices and terms.

Consistent with the HURO Terms of Service, Clinicians are responsible for paying the costs of their required background checks. HURO or an authorized screening or payment provider may process payment information, transaction records, and payment status associated with a background check. Payment for a background check does not guarantee approval, continued Platform access, or eligibility to request or perform Shifts.

Clinicians may choose or be required to upload professional credentials and medical-compliance information, such as licenses, certifications, vaccination records, tuberculosis test results, and drug-screen documentation. HURO uses this information to verify eligibility, support credentialing, meet Facility requirements, prevent fraud, and make relevant documentation available to authorized Facility users.

When you choose to photograph a document, the App may request access to your device's camera. HURO activates the camera only when you initiate that function. When you choose an existing image, the App may request access to your photo library or file picker. HURO receives only the files or images you select and does not browse or index the remainder of your photo library.

You may change camera, photo, file, and location permissions through your device settings. If you decline camera or photo-library access, another upload method may be available, although some Platform features may not function as intended.

Health and credential information is not used for targeted advertising. HURO does not sell Consumer Health Data. Additional rights and disclosures appear in the Consumer Health Data Privacy Policy included at the end of this document for separate publication where required.

8. Precise Location Information

When a Clinician enables required location permissions, HURO may collect precise location information shortly before, during, and for a limited period after a scheduled Shift, including while the App is operating in the background or is closed. The applicable permission screen or in-App notice will describe the requested access. Location data may be used to confirm arrival at and departure from a Facility.

HURO uses location information to:

• Identify Shift opportunities near the Clinician;
• Generate reminders and operational notifications;
• Support automatic or manual check-in and check-out;
• Verify arrival, attendance, and time worked;
• Investigate attendance, timekeeping, fraud, or safety disputes; and
• Protect Clinicians, Facilities, patients, and Platform integrity.

Location-based features may not operate correctly if the device is turned off, permissions are disabled, network or GPS services are unavailable, or the App or operating system is outdated. Precise location information is not used to infer a consumer's health condition or target advertising based on visits to healthcare facilities. HURO does not use geofencing around healthcare facilities to identify or track individuals seeking healthcare services for advertising purposes. HURO does not use location information to direct or control the manner or means by which a Clinician performs professional healthcare services.

9. AI-Assisted Features and Automated Processing

HURO may provide AI-assisted functionality through web, chat, voice, SMS, or other channels. When you interact with these features, HURO may collect the content of your communications and related metadata, such as date, time, channel, device information, and general location derived from IP address.

HURO may use AI-assisted systems to:

• Respond to common questions;
• Route inquiries and support requests;
• Assist with scheduling and account administration;
• Recommend relevant Shifts or Platform features;
• Review documents and extract credential information;
• Detect fraud, abuse, security threats, or policy violations; and
• Evaluate and improve response accuracy, quality, and safety.

Authorized personnel and vetted service providers may review a limited sample of interactions to investigate issues, prevent misuse, and improve quality. HURO does not permit third-party general-purpose AI providers to use customer-identifiable transcripts, recordings, or uploaded documents to train their general foundation models unless HURO provides a separate disclosure and obtains any consent required by law.

HURO does not use solely automated processing to make a decision that produces a legal or similarly significant effect concerning an individual without meaningful human review. Where applicable law provides rights relating to profiling or automated decisions, you may exercise those rights as described below.

10. Cookies, Analytics, and Advertising Technologies

HURO and its providers may use cookies, pixels, SDKs, local storage, session-replay tools, log files, and similar technologies. These technologies may be used for:

• Strictly necessary functions, such as authentication, security, load balancing, and account operation;
• Functional purposes, such as remembering preferences and improving usability;
• Analytics, such as measuring traffic, feature use, performance, and errors; and
• Advertising, such as measuring campaigns and presenting or limiting relevant advertising.

You may manage cookies through browser or device settings and, where available, through HURO's cookie or privacy controls. Blocking some technologies may prevent certain Platform features from functioning.

11. Sale, Sharing, Targeted Advertising, and Privacy Signals

HURO does not sell personal information in exchange for money. However, certain disclosures of online identifiers, device information, approximate location, website activity, and advertising inferences to analytics or advertising partners may be considered a "sale," "sharing," or processing for targeted advertising under some state laws.

HURO does not sell or use the following categories for targeted advertising:

• Social Security numbers or government identification;
• Financial account or tax information;
• Background-screening results;
• Credential documents;
• Vaccination, tuberculosis, drug-screening, or other health information;
• Precise geolocation collected for Shift operations;
• SMS originator opt-in information or consent records; or
• Customer-identifiable call recordings, AI transcripts, or voice interactions.

Where required by law, you may opt out of sale, sharing, or targeted advertising through HURO's "Your Privacy Choices" or cookie controls, by contacting support@thehuro.com, or by enabling a legally recognized browser-based opt-out signal such as Global Privacy Control ("GPC"). HURO processes recognized GPC signals as required by applicable law. GPC may apply to the browser or device from which the signal is sent and, where required and technically feasible, to an associated authenticated account.

HURO does not respond to browser "Do Not Track" signals that are not recognized as legally binding opt-out mechanisms.

12. How We Disclose Personal Information

HURO may disclose personal information to the following categories of recipients for the purposes described in this Policy:

HURO may also disclose information when reasonably necessary to protect rights, safety, property, patients, Platform users, or the public; investigate fraud or misconduct; enforce agreements; or establish and defend legal claims.

Service providers and contractors are required by contract to use personal information only for authorized services, maintain appropriate protections, and comply with applicable privacy obligations.

13. Communications, Email, SMS, Push Notifications, and Call Recording

HURO may use your contact information to send operational and transactional communications concerning accounts, credentials, Shifts, scheduling, payments, security, and requested services. Where required, marketing and promotional messages are sent only after appropriate consent.

Message frequency varies according to your interactions with HURO. Message and data rates may apply. Consent to receive marketing communications is voluntary and is not a condition of using HURO's services.

You may cancel SMS messages at any time by texting STOP to 8014551859. HURO will send a final message confirming the opt-out. After confirmation, you will no longer receive messages through the applicable SMS program. To rejoin, complete the applicable sign-up or opt-in process again.

For SMS assistance, reply HELP or contact support@thehuro.com. Wireless carriers are not liable for delayed or undelivered messages. You may unsubscribe from marketing emails by selecting the unsubscribe link in the message. Even after a marketing opt-out, HURO may send non-promotional messages permitted or required by law through channels that remain authorized.

HURO may record or transcribe telephone calls, voice interactions, or chats for customer service, quality assurance, training, security, and dispute resolution. HURO will provide notice and obtain consent at the beginning of a recorded interaction where required by law.

14. Mobile Information Sharing

HURO does not share mobile telephone information with third parties or affiliates for their own marketing or promotional purposes. HURO may provide mobile information to subcontractors that support authorized services, such as SMS delivery, customer service, authentication, security, or Platform operations.

Text-messaging originator opt-in data and consent will not be sold, rented, or shared with third parties for their own marketing or promotional use. These restrictions apply regardless of any other disclosure category described in this Policy.

15. De-Identified and Aggregated Information

HURO may create de-identified or aggregated information for analytics, research, security, reporting, workforce insights, and product improvement. Examples include total Platform users, Shift volume, transaction volume, general Clinician or Facility demographics, staffing trends, and Platform growth.

HURO will maintain de-identified information in de-identified form and will not attempt to re-identify it except when reasonably necessary to test whether de-identification methods remain effective or as otherwise permitted by law. HURO may disclose de-identified or aggregated information when it does not reasonably identify an individual.

16. Data Retention

HURO retains personal information only for as long as reasonably necessary for the purposes described in this Policy, including to provide the Platform, maintain accurate business and transaction records, comply with tax and legal requirements, resolve disputes, investigate safety or fraud concerns, and enforce agreements.

Retention depends on the nature of the information and may include:

• Account and profile information for the life of the account and a reasonable period afterward;
• Shift, weekly invoice, invoice approval or dispute, Facility payment, Clinician payout, referral reward, background-check transaction, tax, suspension, cancellation, collection, and other transaction records for applicable accounting, tax, audit, dispute-resolution, collection, and legal periods;
• Credential, screening, and medical-compliance information while required for verification, eligibility, Facility requirements, disputes, and applicable recordkeeping obligations;
• Precise location for the shortest period reasonably necessary for Shift verification, payment, safety, fraud prevention, and dispute resolution;
• Communications, call recordings, AI interactions, and support records for quality, security, complaint handling, and legal purposes;
• Marketing preferences and consent records for as long as necessary to honor choices and demonstrate compliance; and
• Backup copies until overwritten or deleted through HURO's ordinary backup cycle, unless legal preservation is required.

When information is no longer required, HURO deletes, destroys, anonymizes, or de-identifies it according to documented procedures. A deletion request may not require immediate removal from disaster-recovery backups where the information is securely isolated and deleted during the ordinary backup lifecycle.

17. Data Security and Incident Response

HURO uses administrative, organizational, physical, and technical safeguards designed to protect personal information. Depending on the information and system, these safeguards may include:

• Role-based access controls and authentication;
• Encryption in transit and at rest where appropriate;
• Network, system, and security monitoring;
• Logging, vulnerability management, and incident-response procedures;
• Employee privacy and security training;
• Vendor assessment and contractual safeguards;
• Data minimization and retention controls; and
• Backup and recovery measures.

No transmission, storage system, or security program is completely secure. You are responsible for protecting account credentials, maintaining device security, and notifying HURO promptly of suspected unauthorized account activity.

If HURO discovers a qualifying data breach, it will provide notices to affected individuals, regulators, or other parties as required by applicable law, including applicable health-data breach-notification requirements.

18. Your Privacy Rights

Depending on your state or country of residence and subject to applicable exceptions, you may have the right to:

• Confirm whether HURO processes your personal information;
• Access or obtain a copy of personal information;
• Correct inaccurate information;
• Delete personal information;
• Obtain portable information in a usable format;
• Opt out of sale, sharing, or targeted advertising;
• Opt out of certain profiling or automated decision-making;
• Limit certain uses or disclosures of Sensitive Personal Information;
• Withdraw consent for processing based on consent;
• Obtain information about third parties with whom Consumer Health Data was shared; and
• Appeal HURO's refusal to act on a privacy request.

To exercise a privacy right, contact support@thehuro.com with the subject line Privacy Request or use HURO's available privacy-request form. Describe the right you wish to exercise and provide information reasonably necessary to identify your account and verify your identity.

HURO will respond within the period required by applicable law. HURO may request additional information to verify identity, prevent fraud, and protect personal information. If identity cannot be verified, HURO may deny or limit the request. Authorized agents may submit requests when they provide legally sufficient proof of authority, and HURO may still verify the request directly with the individual.

Some information may be exempt from a request or retained when necessary to complete transactions, protect security, prevent fraud, comply with law, exercise legal rights, or meet another permitted purpose. HURO will not unlawfully discriminate or retaliate against you for exercising a privacy right.

To appeal a denied request, email support@thehuro.com with the subject line Privacy Appeal, identify the original request, and explain the basis for the appeal. HURO will review and respond within the timeframe required by applicable law.

19. California Privacy Disclosures

For California residents, the table in Section 4 describes the categories of Personal Information HURO may have collected during the preceding 12 months, the sources, and the business or commercial purposes. Section 12 describes the categories of recipients.

HURO may disclose identifiers, professional information, credentials, screening information, health or medical-compliance information, financial information, Shift information, geolocation, device activity, communications, and inferences for the business purposes described in this Policy.

HURO does not sell Personal Information for money. HURO may disclose online identifiers, device information, approximate location, website activity, and advertising inferences to analytics or advertising providers in a manner that may constitute sharing or sale under the California Consumer Privacy Act. California residents may opt out as described in Section 11.

HURO does not knowingly sell or share the Personal Information of individuals under 16. HURO uses and discloses Sensitive Personal Information only as reasonably necessary to provide requested services, verify and secure accounts, process transactions, meet legal and Facility requirements, and perform other purposes permitted without a right to limit, unless a different use is disclosed and the required choice is provided.

California residents may request access to categories and specific pieces of Personal Information, correction, deletion, and information regarding collection, use, disclosure, sale, or sharing. They may also opt out of sale or sharing and may be entitled to limit certain uses of Sensitive Personal Information. HURO will not discriminate against a California resident for exercising these rights.

California's "Shine the Light" law may allow certain residents to request information regarding disclosures of personal information to third parties for their direct-marketing purposes. HURO does not disclose personal information to third parties for their own direct marketing without the required choice or consent.

20. Consumer Health Data

HURO may process Consumer Health Data, including vaccination records, tuberculosis testing, drug-screen documentation, medical-compliance records, and information or inferences concerning a Clinician's ability to meet credentialing or Facility requirements.

HURO collects and uses Consumer Health Data only as reasonably necessary to provide requested services, verify eligibility, satisfy Facility or legal requirements, prevent fraud, support safety, and operate the Platform, or as otherwise authorized by consent or law.

HURO does not sell Consumer Health Data and does not use it for targeted advertising. HURO may share relevant Consumer Health Data with a Facility selected by the Clinician, credentialing or screening providers, infrastructure and security providers, professional advisers, and government authorities when authorized, reasonably necessary, or legally required.

Residents covered by consumer-health-data laws may have the right to access their data, obtain a list of recipients, withdraw consent, request deletion, and appeal a denial. Requests may be submitted to support@thehuro.com.

Where required, HURO will publish the Consumer Health Data Privacy Policy included as Appendix A as a separate and distinct webpage linked from the HURO homepage. Appendix A should be published separately and not combined with unrelated website content in jurisdictions requiring a standalone notice.

21. Children's Privacy

The HURO Platform is intended only for adults. Users must be at least 18 years old. HURO does not knowingly collect Personal Information from children under 13 or knowingly permit anyone under 18 to create an account or use the Platform.

If HURO learns that it collected Personal Information from a child in violation of this Policy, it will take reasonable steps to delete the information and terminate the associated interaction or account. A parent or legal guardian who believes a child submitted information may contact support@thehuro.com.

22. International Data Transfers

HURO and its providers may process information in the United States and other countries where they operate. These countries may have privacy laws different from those in your jurisdiction. Where required, HURO uses recognized safeguards for international transfers, such as contractual protections, transfer assessments, and supplementary security measures.

23. Third-Party Links, Integrations, and Services

The Platform may link to or integrate with third-party websites, applications, payment processors, screening providers, communication tools, or other services. When you authorize HURO to connect with a third-party service through an application programming interface or another approved method, HURO may copy, store, reproduce, modify, transmit, and transfer Your Information to or from that service as reasonably necessary to provide the authorized integration or Platform feature.

Third-party services operate under their own terms and privacy notices. HURO is not responsible for the privacy or security practices of an independent third party. You are responsible for ensuring that you have authority to grant access to information maintained through a third-party service. Review the applicable third-party terms and privacy notice before authorizing an integration or submitting information.

24. Financial Incentives

If HURO offers a discount, reward, loyalty program, or other financial incentive related to the collection or use of Personal Information, HURO will provide a separate notice describing the material terms, the categories of information involved, the method for opting in and withdrawing, and a good-faith estimate of how the value of the information relates to the offered benefit. Participation will be voluntary.

25. Changes to This Policy

HURO may update this Policy to reflect changes in its practices, technology, services, or legal obligations. The revised Policy will be posted with an updated effective date. When required by law, HURO will provide additional notice or obtain consent before applying a material change to information already collected.

Continued Platform use after an update does not waive any privacy right or replace consent where applicable law requires an affirmative choice.

26. Contact HURO

Questions, complaints, privacy requests, and appeals may be directed to:

HURO Privacy Office
6304 S Margray Dr
Taylorsville, Utah 84129
Email: support@thehuro.com
Telephone: 8014551859

For SMS assistance, reply HELP or contact the email address above. To stop SMS messages, reply STOP.

Appendix A: HURO Consumer Health Data Privacy Policy

Effective Date: August 6, 2026

This Consumer Health Data Privacy Policy supplements the HURO Privacy Policy and describes how HURO LLC, doing business as HURO, collects, uses, and shares Consumer Health Data. It also explains the rights available to consumers under applicable consumer-health-data laws.

A1. Consumer Health Data We Collect

HURO may collect:

• Vaccination status and vaccination records;
• Tuberculosis test status and results;
• Drug-screen status, results, and supporting documentation;
• Occupational or medical-compliance information required for credentialing or Facility access;
• Health-related information voluntarily included in credentials, support requests, or communications;
• Information concerning accommodations or professional limitations when voluntarily provided or legally required; and
• Inferences regarding whether a Clinician appears to satisfy a health-related credentialing or Facility requirement.

HURO does not request patient medical records or PHI through ordinary Platform functions. Unless HURO and the applicable Covered Entity or Business Associate have executed a separate written Business Associate Agreement expressly authorizing the activity, users must not upload, enter, transmit, store, exchange, or otherwise disclose PHI through the Platform.

A2. Sources of Consumer Health Data

HURO may collect Consumer Health Data from:

• The Clinician directly;
• A testing, screening, credentialing, or verification provider authorized by the Clinician;
• A Facility when authorized or legally permitted;
• Professional or government registries and public records; and
• Information generated from documents or records submitted for credentialing.

A3. Why HURO Collects and Uses Consumer Health Data

HURO may collect and use Consumer Health Data to:

• Verify credentials and eligibility for a Shift;
• Determine whether submitted records appear to meet Facility or legal requirements;
• Make relevant documentation available to Facilities selected by the Clinician;
• Prevent fraud and protect Platform, Facility, Clinician, and patient safety;
• Respond to support requests and correct credentialing records;
• Comply with legal, regulatory, reporting, and recordkeeping obligations; and
• Establish, exercise, or defend legal claims.

HURO will not collect or use additional categories of Consumer Health Data for materially different purposes without providing any additional notice and obtaining any consent required by law.

Where required by law, HURO obtains affirmative consent before collecting or sharing Consumer Health Data beyond what is necessary to provide a product or service requested by the consumer. Any legally defined sale of Consumer Health Data would require a separate, valid authorization. HURO does not sell Consumer Health Data.

A4. Consumer Health Data HURO Shares

Depending on the service requested, HURO may share vaccination, testing, drug-screening, credentialing, compliance, and related eligibility information.

HURO may share this information with:

• Facilities selected by or connected with the Clinician for credentialing, Shift evaluation, or engagement;
• Credentialing, testing, screening, and verification providers;
• Cloud-hosting, document-processing, security, and technical-support providers that process information under contract;
• Legal, compliance, insurance, accounting, and professional advisers;
• Government, licensing, regulatory, or law-enforcement authorities when disclosure is legally required or permitted; and
• Parties involved in a corporate transaction, subject to appropriate confidentiality and use restrictions.

Specific HURO affiliates receiving Consumer Health Data: None at this time.

HURO does not sell Consumer Health Data. HURO does not share Consumer Health Data for targeted advertising or allow advertising providers to use it to build advertising profiles.

A5. Location and Geofencing

HURO may collect precise location for Shift discovery, check-in, check-out, attendance confirmation, billing support, Facility review, safety, fraud prevention, payment reconciliation, and dispute resolution as described in the HURO Privacy Policy.

HURO does not use precise location to infer that an individual is seeking healthcare services and does not establish a geofence around a healthcare facility to identify, track, or send advertising to patients or other consumers based on their healthcare visits.

A6. Consumer Health Data Rights

Subject to applicable law and exceptions, you may request to:

• Confirm whether HURO collects, shares, or sells your Consumer Health Data;
• Access the Consumer Health Data HURO maintains about you;
• Obtain a list of third parties and affiliates with whom HURO shared or sold your Consumer Health Data, together with available contact information;
• Withdraw consent for collection or sharing;
• Delete Consumer Health Data from HURO's active systems and direct applicable processors to delete it; and
• Appeal HURO's refusal to act on a request.

To submit a request, email support@thehuro.com with the subject line Consumer Health Data Request. HURO may take reasonable steps to authenticate your request. To appeal, use the subject line Consumer Health Data Appeal and identify the original request.

Withdrawal or deletion may prevent HURO from verifying credentials or providing certain Platform features. HURO will not unlawfully discriminate or retaliate against you for exercising a Consumer Health Data right.

Deletion from archived or backup systems may be delayed where permitted by law, but the information will remain protected and will not be restored to active systems except for security or disaster-recovery purposes.

A7. Contact Information

HURO Privacy Office
6304 S Margray Dr
Taylorsville, Utah 84129
Email: support@thehuro.com
Telephone: 8014551859