Hailo Privacy Policy

Effective Date: August 17, 2026 Supersedes the version dated August 8, 2026

1. Who We Are and What This Policy Covers

This Privacy Policy ("Policy") is issued by Hailo LLC, a California limited liability company with its principal place of business at 25283 Cabot Rd, Ste 212, Laguna Hills, CA 92653 ("Hailo," "we," "us," or "our").

This Policy describes how we collect, use, disclose, and protect personal information in connection with the following products and services (collectively, the "Services"):

• hailocare.com and app.hailocare.com — our consumer website and client web experience, including the "Find Care" request tool, resources, and events pages;
• hailoagency.com and app.hailoagency.com — our website and software platform for home care agencies, including the agency web portal;
• help.hailocare.com — our help center;
• the Hailo client mobile application (for clients and families);
• the Hailo Caregiver mobile application (for caregivers);
• the Hailo Agency mobile application (for agency personnel);
• our AI-powered voice and messaging features, including our phone intake line and agency-configured AI phone assistants;
• public forms we host on behalf of agencies, including client interest forms, caregiver job application forms, offer and onboarding pages, client portals, and electronic signature pages; and
• related communications, support channels, and events.

This Policy applies to everyone who interacts with the Services: website visitors; clients and their family members; care recipients; caregivers and caregiver applicants; home care agency owners and staff; referral partners; and callers to phone numbers operated through the Services.

This Policy does not replace agency privacy notices. Home care agencies that use Hailo are independent businesses. When an agency uses Hailo to run its operations — for example, to receive your job application, manage your care, store your records, or send you documents for signature — that agency is responsible for its own privacy and employment practices, and its own privacy notice governs in addition to this Policy. Section 3 explains these roles in more detail.

2. Summary of Key Points

This summary is provided for convenience; the full Policy controls.

• We collect the information needed to arrange and deliver home care, including identity and contact details, care needs and health information about care recipients, caregiver credentials and employment-related information, scheduling and visit records, payment information, and communications.
• We collect precise location at specific moments only. Caregivers' GPS coordinates are captured at clock-in and clock-out to verify visits (Electronic Visit Verification). We do not continuously track caregivers in the background during scheduled shifts.
• Some of our phone lines are answered by AI, and calls may be recorded. Callers hear a disclosure at the start of the call, our AI assistants will always confirm they are AI if asked, and callers may object to recording during the call.
• If you submit a care request through our "Find Care" tool, we share your information with home care agencies that serve your area, and agencies pay us to receive your full contact details. Depending on your state's law, this may be considered a "sale" of personal information. You can opt out at any time. See Sections 11 and 20.
• Mobile information and text-messaging consent are never shared with or sold to third parties or affiliates for marketing or promotional purposes. See Section 12 for our full SMS disclosures (message frequency varies; message and data rates may apply; reply STOP to opt out or HELP for help).
• We do not use third-party advertising cookies or analytics trackers on our websites and apps as of the Effective Date.
• We use vetted service providers — including Google (cloud hosting), Stripe (payments and identity verification), Twilio (phone and SMS), xAI (voice AI), and Brevo (email) — to operate the Services. See Section 10.
• Health information is protected. Care recipients' health details are stored in a segregated, access-controlled record; access by caregivers is limited to assigned care and is logged; and our AI features are engineered to exclude health information from AI model context. See Sections 5, 7, and 16.
• You have rights over your personal information, including rights to access, correct, and delete it. See Sections 19 and 20.
• Questions? Contact us at info@hailocare.com or by mail at the address above.

3. Our Roles: When Hailo Is Responsible for Your Information

Hailo operates in three distinct capacities. Which one applies determines who is primarily responsible for your information and where you should direct requests.

(a) Hailo as the responsible business ("controller"). We act for our own purposes when we operate our websites and marketing pages; when we receive care requests through our "Find Care" tool and marketplace; when consumers, caregivers, or agencies create accounts directly with us; when we bill agencies for our software; and when we operate our own support, help center, and communications. For these activities, this Policy is the operative notice and requests should come to us.

(b) Hailo as a service provider / processor for agencies. When an agency uses the Services to manage its clients, caregivers, applicants, schedules, payroll, invoices, documents, CRM records, or phone lines, we process that information on the agency's behalf and at its direction. The agency determines why and how that information is used. If you are an agency's client, caregiver, employee, or job applicant, the agency is the primary party responsible for your information, and you should direct requests to the agency; we will assist the agency in honoring them.

(c) Hailo as a HIPAA business associate. Where an agency is a covered entity under the Health Insurance Portability and Accountability Act ("HIPAA") and protected health information ("PHI") is processed through the Services, we act as the agency's business associate and handle PHI in accordance with HIPAA and our Business Associate Agreement ("BAA") with that agency. See Section 16.

4. Information We Collect

A. Information You Provide to Us

Clients and family members (the Hailo client app and web experience):

• Account and identity information: name, email address, phone number, and password; sign-in through Apple or Google where offered; email one-time verification codes.
• Care recipient information: the name, date of birth, gender, primary language, and relationship of the person needing care (which may be you or a family member).
• Health information (sensitive): health conditions (for example, diabetes, dementia, Parkinson's disease, limited mobility, stroke recovery, heart conditions, COPD, vision or hearing impairment), free-text health notes, and — when managed through an agency — medications, allergies, care plans, physician information, and related clinical details. See Section 5.
• Home and address information: the care address, home type, and home access details you choose to provide (for example, gate codes, parking instructions, pets, or safety notes). Please share only the access details necessary for care visits.
• Emergency contacts: name, phone number, and relationship.
• Funding and coverage information (sensitive): how care will be paid for (for example, private pay, long-term-care insurance, Medicaid/Medi-Cal, VA benefits) and, where applicable, program details such as a Medicaid identification number.
• Scheduling and preferences: requested schedules, care tasks, and caregiver preferences (such as language or experience).
• Payment information: processed by Stripe; see Section 14.
• Messages and reviews: messages you exchange with caregivers and agencies through in-app chat, and feedback you provide.

Caregivers and caregiver applicants (the Hailo Caregiver app and agency application forms):

• Identity and contact information: legal name, email, phone number, date of birth, home address, profile photo, bio, languages, and emergency contact.
• Government identifiers (sensitive): Social Security number (collected for background screening and tax reporting; we retain only the last four digits in our systems), and government-issued ID details and images (ID card, passport, or driver's license).
• Credentials and qualifications: certifications (such as HHA, CNA, LPN, RN, CPR/First Aid), certification numbers and expiration dates, uploaded certificate files, state registry or license numbers (for example, California HCA registry number, IHSS provider number), skills, experience, and availability.
• Background screening information (sensitive): your consent to background screening and the status and results of screenings performed by our screening providers; identity verification performed through Stripe Identity (government ID and selfie processed by Stripe — we receive verification status, not the underlying images).
• Employment and compliance records (when employed or engaged by an agency): tax classification (W-2/1099), W-4/W-9 information, direct deposit details, offer letters and onboarding documents, references, and health-related work compliance records the agency requires (for example, TB test, vaccinations, drug screening, physical exam, fit testing). These are collected by and for the agency; see Section 3(b).
• Driving and vehicle information: driver's license number and state, vehicle details, auto insurance information and uploaded documents, and self-reported mileage for reimbursement.
• Payout information: collected through Stripe Connect's hosted onboarding (we do not store your full bank account details); some legacy application forms collected bank routing and account numbers directly on behalf of agencies.
• Visit records: clock-in/clock-out events, visit notes, task completion, photos you take during visits to document care, and messages.

Agency owners and staff:

• Account information: name, work email, phone, password or Google/Apple sign-in, role and permissions, and one-time login verification codes.
• Business information: agency legal name and DBA, state, address, service areas, care types, payroll and billing settings, and subscription and payment details.
• Content you enter about others: agencies enter and manage information about their clients, caregivers, applicants, leads, and referral partners. Agencies are responsible for having the right to enter that information; see Section 3(b).

Website visitors, callers, and leads:

• Care requests ("Find Care"): funding type, provider preference, care tasks, who care is for, timing, hours, schedule, the care address, and your name, phone, and email; and, if you choose, consent to be contacted by phone/text (including by automated or AI-assisted calls). See Sections 11 and 12.
• Interest and application forms hosted for agencies: the fields the agency's form requests, typically name, email, phone, care types or qualifications, and a message.
• Demo, contact, newsletter, and event forms: name, work email, phone, organization details, message content, newsletter email address, and event details you submit.
• Callers: if you call a phone line operated through the Services, we collect your phone number, call metadata, and — subject to the disclosures in Section 8 — call recordings and transcripts.

B. Information Collected Automatically

• Device and app information: device type and operating system, app version, push notification tokens (Apple/Firebase), language, and time zone.
• Usage and log information: log data generated by your use of the Services, such as timestamps, feature usage, IP address, and user-agent (browser/device) strings. IP address and user-agent are specifically recorded for security and evidentiary purposes on public form submissions (bot protection), consent records, and electronic signature events.
• Precise geolocation (caregivers only, sensitive): GPS coordinates captured at clock-in and clock-out for Electronic Visit Verification, and live location during optional on-demand ("instant") tasks. See Section 9.
• Cookies and local storage: see Section 15.

We do not deploy third-party advertising trackers, ad pixels, or third-party analytics SDKs in the Services as of the Effective Date.

C. Information from Other Sources

• Sign-in providers: if you sign in with Google or Apple, we receive your name and email address from that provider.
• Verification and screening providers: identity verification results from Stripe Identity; background screening status from our screening providers; and caregiver registry status from public state registries (for example, the California HCA registry).
• Agencies: agencies may enter information about you into the Services (for example, when an agency adds you as a client or caregiver, or imports records from another system).
• Integrated systems: if an agency connects a third-party system (for example, CareSmartz360), records may be exchanged between that system and the Services at the agency's direction.
• Referral partners: agencies may record referral source information about leads.

5. Sensitive Information

We collect the following categories of sensitive personal information, only for the purposes described and never for advertising:

Health information receives additional safeguards: it is stored in a segregated health record with restricted access; caregivers can access a care recipient's health details only for care they are assigned to, through a controlled channel; every such access is logged (including who accessed it, when, and from what IP address) in an audit log that cannot be deleted; access by our internal administrators is restricted to the most privileged administrative role; and health information is excluded from AI model context as described in Section 7.

6. How We Use Information

We use personal information to:

1. Provide the Services — create and administer accounts; match care requests with agencies and caregivers; build and manage schedules and care plans; enable clock-in/clock-out and visit documentation; power in-app messaging; generate invoices, payroll, and payouts; and operate the client, caregiver, and agency apps and portals.
2. Verify visits and support program integrity — confirm that visits occurred at the right place and time (EVV), detect out-of-geofence or manually-adjusted clock events, preserve original time records for audit, and flag anomalies.
3. Verify identity and qualifications — verify caregiver identity and credentials, run consented background screenings, and check public registries.
4. Process payments — through Stripe, as described in Section 14.
5. Communicate with you — send transactional emails (welcome, verification codes, invoices, reminders, password resets, offers, invitations), push notifications (for example, shift reminders), SMS where you have consented, and support responses.
6. Operate AI features — as described in Section 7.
7. Maintain safety, security, and integrity — authenticate users (including one-time codes and trusted-device checks), prevent bots and abuse (Cloudflare Turnstile, honeypots, rate limits), detect fraud (including flagging phone numbers associated with abuse), enforce role-based access controls and cross-agency data isolation, and maintain audit logs.
8. Create records with legal effect — capture and preserve consent records (for example, telephone consent under the TCPA and e-signature consent under the ESIGN Act), and generate sealed, tamper-evident signed documents with signature certificates (Section 13).
9. Comply with law — meet our legal, tax, EVV, and regulatory obligations, respond to lawful requests, and establish or defend legal claims.
10. Improve and develop the Services — troubleshoot, analyze aggregate usage, and develop features. We do not use care recipients' health information to train AI models.

We do not use personal information for third-party behavioral advertising, and we do not send marketing on behalf of third parties.

7. Artificial Intelligence Features

The Services include AI features. We design them with specific guardrails, described here so you know what to expect.

(a) AI phone assistants. Our main phone line, and phone lines that agencies configure through the Services, may be answered by an AI voice assistant. The assistant:

• discloses at the start of the call that it is an automated assistant and that the call may be recorded and transcribed;
• will always confirm that it is an AI if you ask, and will never claim to be human;
• is instructed not to collect health details, Social Security numbers, or payment information over the phone;
• is instructed not to provide medical, legal, or financial advice; and
• will direct you to call 911 in an emergency, as AI assistants cannot provide emergency help.

Calls handled by AI assistants are processed in real time by our voice AI provider (xAI); per that provider's real-time interface, audio is processed live rather than stored by the provider. We store call records, transcripts (capped in length), and AI-generated call summaries so agencies can follow up on your request. If you object to recording during a call, see Section 8.

(b) Outbound AI calls. Agencies may use the Services to place outbound calls, including AI-assisted calls, only to people who have given prior express written consent to receive them (Section 12). Every outbound program honors opt-out requests, and we maintain a platform-wide do-not-call suppression list: if you ask not to be called, your number is suppressed across the platform.

(c) Atlas, the agency operations assistant. Agencies can use an in-app AI assistant ("Atlas") for operational questions (scheduling, staffing, billing readiness, hiring pipeline, and similar). Atlas is engineered with a health-information boundary: the operational data snapshot provided to the AI model is built through a single controlled pathway that excludes health information; results returned to the model pass through a field-level allow-list; and Atlas's memory feature screens out and refuses to store health details, government identifiers, and clinical information. Atlas requests are processed by third-party AI model providers under contract (see Section 10). Atlas conversations within an agency workspace may be visible to other authorized staff of that agency.

(d) No AI training on your health information. We do not use care recipients' health information to train AI models, and our contracts with AI providers restrict their use of data to providing the service to us.

(e) Human review and automated decisions. AI features assist people — agency staff and our team — and are not used to make legally significant decisions about you without human involvement. Care, hiring, and billing decisions are made by people at the responsible agency.

8. Call Recording, Monitoring, and Transcription

• Calls to and from phone lines operated through the Services may be recorded and transcribed. Where recording occurs, a disclosure is played at the beginning of the call before the conversation begins.
• You may object to recording. If you ask not to be recorded during a call with an AI assistant, recording stops, the recording artifact is discarded, and a verbatim transcript is not retained; only a non-verbatim summary and a record of your objection are kept.
• Authorized agency staff with specific permissions may listen to recordings, review transcripts, or monitor live calls for quality and training. Access to recordings is permission-gated and uses short-lived, single-use access links.
• Inbound text messages to agency phone lines are captured and shown to the agency as messages/notes.
• Recordings, voicemails, transcripts, and call metadata are stored in access-controlled records, with recording media held in restricted storage not directly accessible to client applications.

9. Location Information and Electronic Visit Verification (EVV)

Home care programs (including federal and state EVV requirements under the 21st Century Cures Act) require verification that visits occurred. Here is exactly how location works in the Services:

• When: the Hailo Caregiver app captures a single GPS point (latitude, longitude, and accuracy) at clock-in and at clock-out of a visit, with the caregiver's device-level permission. Location is captured in the foreground at the moment of the action; the app does not continuously track caregivers in the background during scheduled shifts.
• What we do with it: we convert the coordinates to an approximate street address, measure the distance from the client's home, and record whether the event occurred within the expected radius (approximately 1,500 feet by default; agencies may adjust this). Visits verified at both ends are marked EVV-verified; discrepancies are flagged for the agency to review rather than silently altered.
• Manual entries are labeled: when office staff record or adjust a clock time manually, no GPS is attached, the entry is flagged as a manual EVV exception, the original captured times are preserved in an audit snapshot, and a reason code is recorded.
• On-demand tasks: for optional, on-demand ("instant") tasks that a caregiver accepts, live location may be shared during the task with the requesting client and the platform, similar to a rideshare experience. This applies only to instant tasks, and only while the task is active.
• Mileage: mileage for reimbursement is self-reported by the caregiver; we do not track odometry or driving routes.
• Care addresses are geocoded (converted to coordinates) using Google's geocoding service to support the checks above.

10. How We Share Information

We do not sell personal information for advertising, and we do not share personal information with third parties for cross-context behavioral advertising. We do not share, sell, or provide mobile phone numbers, text-messaging originator opt-in data, or SMS consent to third parties or affiliates for marketing or promotional purposes (see Section 12). We share personal information only as follows:

(a) Between participants in care. Sharing information among the right people is the core function of the Services:

• Agencies see the clients, caregivers, applicants, leads, schedules, and records within their own workspace. Cross-agency access is technically isolated: each agency can access only its own records.
• Caregivers see the visit details they need for assigned care: schedule, tasks, client name, address, and relevant care instructions. Access to a care recipient's health record is limited to assigned, agency-approved care and is logged (Section 5).
• Clients and families see their schedules, assigned caregiver profiles (including first name, photo, and relevant qualifications), visit notes, and invoices.
• Messages you send through the Services are visible to the people and workspace you send them to.

(b) Agencies you ask to be connected with. When you submit a care request through "Find Care," we share it with home care agencies serving your area — see Section 11 for exactly how this works, including what is masked until an agency accepts your request.

(c) Service providers (processors). We use a small set of contracted providers to operate the Services. As of the Effective Date:

Service providers are bound by contracts limiting their use of personal information to providing services to us, and — where PHI is involved — by BAAs where required.

(d) Integrations an agency enables. If an agency connects an external system (for example, CareSmartz360), we exchange the relevant records (such as prospect and client contact and care details) with that system at the agency's direction. The agency's and integration provider's terms govern that system's use of the data.

(e) Corporate events. If we are involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction, subject to this Policy and applicable law. We will provide notice of any resulting change in control or use.

(f) Legal and safety. We may disclose personal information to comply with law or legal process; to respond to lawful requests from public authorities; to enforce our agreements; to protect the rights, safety, or property of clients, caregivers, agencies, the public, or Hailo; or in an emergency involving danger to a person.

(g) With your direction or consent. We share personal information for any other purpose you direct or consent to.

11. The Hailo Care Marketplace and "Sale" of Personal Information

When you submit a care request through our "Find Care" tool (on the website or by phone through our intake line), you are asking us to connect you with home care agencies. Here is exactly what happens:

1. Your request is stored securely, with your contact details held server-side and never exposed publicly.
2. Agencies whose service area covers your ZIP code are notified and shown a masked preview: your initials, your city/region and ZIP code, the care needs, schedule, funding type, and any message you included — but not your name, phone number, email address, or street address.
3. An agency that wants to serve your request pays us a flat fee (currently $49) to accept it. Only the first accepting agency receives your full name and contact details and, where provided, the care address. The request is then closed to other agencies.
4. The accepting agency receives your request — including your consent record, if you consented to calls/texts — in its customer relationship system so it can contact you about your care needs.

Because the accepting agency pays us in connection with receiving your contact information, this disclosure may be treated as a "sale" of personal information under some state privacy laws (such as the California Consumer Privacy Act), even though it happens only at your direction, only to fulfill your request, and never for advertising. We therefore provide the following:

• Notice: we "sell" (in this narrow, statutory sense) the identifiers, contact details, location, and care-request details of consumers who submit care requests, to the single home care agency that accepts the request. We do not sell any other personal information, we do not sell information about clients, caregivers, or agency staff, and we do not sell to data brokers or advertisers. Mobile phone numbers and text-messaging opt-in and consent records are never shared with, sold to, or provided to third parties or affiliates for marketing or promotional purposes: this disclosure happens solely at your direction, to the single agency you asked to be connected with, so that it can respond to your care request (see Section 12).
• Opt-out: you may opt out of this disclosure at any time before your request is accepted by emailing info@hailocare.com with the subject "Do Not Sell My Personal Information," or by asking us to delete your care request. If you opt out, we will not share your request with agencies — which means we will not be able to connect you with care through the marketplace.
• Minors: we do not knowingly sell the personal information of anyone under 16.

12. Communications, Telephone Consent, and Opt-Outs

• Transactional communications. We send service emails and push notifications necessary to operate the Services (verification codes, schedule reminders, invoices, password resets, offers and onboarding links, support replies). You can manage push notification preferences in the apps; some service messages (like security codes) cannot be opted out of while you use the Services.
• Calls and texts (TCPA). Where our forms offer it, you may consent to receive calls and text messages — including autodialed, prerecorded, or AI-assisted calls — from us and/or from the agency your request is routed to. Consent is optional and is never a condition of receiving services. We keep a precise record of each consent: the exact disclosure text shown (versioned and cryptographically hashed), whether you granted or declined it, and the time, IP address, and browser details of the submission.
• Mobile information and text messaging (SMS). When you provide your mobile phone number and opt in to receive text messages — for example, one-time verification codes, responses to your care request or inquiry, scheduling and visit notifications, and support replies — we collect and use your mobile number, your opt-in/consent record, and the resulting message history to send, deliver, and document those messages. Message frequency varies based on your activity and settings. Message and data rates may apply. You can opt out at any time by replying STOP to any text, and you can get help by replying HELP or contacting info@hailocare.com. We do not share, sell, rent, or provide your mobile phone number, text-messaging originator opt-in data, or SMS consent to any third parties or affiliates for marketing or promotional purposes. Mobile information is disclosed only to our telephony and SMS service provider (Twilio), acting on our behalf to deliver the messages you requested — and, solely where you asked us to connect you with a home care agency and consented to be contacted, to that single accepting agency so it can respond to your request (Section 11). It is never disclosed to anyone for marketing or promotional purposes. Our standalone SMS Privacy Notice, collecting these text-messaging disclosures in one place, is available at hailocare.com/sms-privacy.
• Opting out. You may revoke telephone consent at any time by replying STOP to a text, telling any of our AI or human agents not to call you, or emailing us. Do-not-call requests are honored platform-wide through a global suppression list keyed to your phone number.
• Newsletter. You may unsubscribe from newsletter emails at any time via the link in the email or by contacting us.

13. Electronic Signatures and Records

Agencies may use the Services to send you documents (for example, service agreements or onboarding paperwork) for electronic signature. When you use our signature portal:

• You will be shown an ESIGN consent disclosure and must affirmatively consent to transact electronically before signing; you may withdraw that consent as described in the disclosure.
• We verify your identity with a one-time code sent to your email.
• To make signed documents legally durable and tamper-evident, we create an audit trail of the signing session that includes your name and email, the document's cryptographic fingerprint (hash), timestamps for each event, your IP address and browser details, your consent record, and your signature image. A signature certificate summarizing this evidence is embedded in the final sealed PDF.
• Audit records are append-only: they cannot be edited or deleted, by design.
• You are entitled to a copy of every document you sign.

14. Payments

• Card and bank details go to Stripe, not to us. When you add a card or bank account, the details are collected by Stripe's secure components and tokenized; full card numbers and full bank account numbers do not touch our servers. We store only references (such as card brand, last four digits, and expiration) needed to display and manage your payment methods.
• Caregiver payouts are handled through Stripe Connect. Bank and identity details for payouts are collected in Stripe-hosted onboarding; we store your Stripe account reference and payout status, not your full bank details.
• What we do store: invoices and line items, amounts, payment status, subscription plan, mileage reimbursement submissions, payroll run records, and (for caregivers) tax classification and last-four SSN as needed for tax reporting.
• Stripe acts as a payment processor and, for some services (such as identity verification and Connect onboarding), as an independent controller under its own privacy policy.

15. Cookies and Similar Technologies

We keep our tracking footprint deliberately small. As of the Effective Date:

• No third-party advertising or analytics cookies. Our websites do not run Google Analytics, advertising pixels, or similar third-party trackers.
• Strictly necessary technologies only:
  • Authentication state (Firebase Auth) to keep you signed in;
  • Local storage preferences (for example, dark-mode setting);
  • Cloudflare Turnstile on public forms, which evaluates your browser to distinguish humans from bots (it processes your IP address and browser signals for that purpose);
  • Google Fonts, Google Places, and similar embedded services, which receive your IP address when your browser loads them;
  • Calendly, if you book a demo, which operates under its own privacy policy.
• Because we use only strictly necessary technologies, we do not currently display a cookie consent banner. If we ever add analytics or advertising technologies, we will update this Policy and deploy an appropriate consent mechanism first.
• On-device storage in the Hailo Caregiver mobile app: so the app keeps working where there is no mobile signal — a basement, a rural road, a building with thick walls — it saves a limited copy of your upcoming visits on your phone. That copy includes the client's name and the visit address, and, for visits starting within the next 12 hours, the entry instructions your agency provided. It does not include health information, visit notes, or emergency contacts. The copy is deleted when you sign out, and expires automatically after 72 hours (entry instructions after 24 hours). Clock-ins recorded without a signal are also saved on your phone until they sync. On-device data is protected by your device's operating-system encryption and your device passcode; Hailo does not add a separate layer of encryption on the device, so keep your phone locked and sign out before handing it to anyone else.
• Do Not Track / opt-out signals: our sites do not respond to "Do Not Track" browser signals because we do not track users across third-party sites. Where state law requires recognition of opt-out preference signals (such as the Global Privacy Control) for sales/sharing, we honor them for the marketplace disclosure described in Section 11 to the extent technically applicable, and you can always opt out directly (Section 11).

16. HIPAA

• Where a home care agency using the Services is a covered entity (or a business associate of one) under HIPAA, Hailo processes PHI as that agency's business associate, under a BAA, and uses and discloses PHI only as permitted by HIPAA and the BAA — for treatment, payment, and health care operations purposes of the agency, and for the proper management of our Services.
• PHI is stored in a segregated health record with the access restrictions and immutable audit logging described in Section 5.
• Not all information in the Services is PHI, and not every relationship is governed by HIPAA (for example, a care request you submit directly to our marketplace before engaging an agency is generally governed by this Policy and applicable state consumer health privacy laws, not HIPAA). Where HIPAA applies, the agency's Notice of Privacy Practices — not this Policy — governs the agency's use of your PHI, and HIPAA rights (access, amendment, accounting of disclosures) should be exercised with the agency; we support agencies in fulfilling them.
• We maintain administrative, technical, and physical safeguards for PHI, including role-based access controls, encryption in transit and at rest, access logging, and workforce access limitations, and we will report and handle breaches of unsecured PHI as required by the HITECH Act and our BAAs.

17. Data Retention

We retain personal information for as long as needed for the purposes described in this Policy, and we determine retention periods based on: the nature of the relationship (for example, active account vs. closed account); our legal obligations (tax, employment, EVV, and health-record retention laws, which can require multi-year retention); the evidentiary role of the record (consent records, signature audit trails, and access logs are retained long-term because their purpose is proof); and the sensitivity of the data.

Specific practices to know:

• Care and visit records (schedules, clock events, EVV data, visit notes) are retained for the periods required by applicable home-care, Medicaid/EVV, and employment laws, and as needed by the responsible agency.
• Health records and health-record access logs are preserved and protected against deletion while retention obligations apply; when no longer required, health information may be deleted or de-identified.
• Consent and e-signature audit records are retained as long-term evidence and are append-only by design.
• Call recordings and transcripts are retained for the agency's quality-assurance and record-keeping purposes; recordings are discarded immediately if you object during the call (Section 8).
• One-time codes and short-lived tokens are deleted upon use or expiration; presence and live-location data expires within seconds to minutes; unaccepted marketplace visibility, offer links, and signature portal links expire automatically (signature links after 30 days).
• Account deletion is available on request (Section 19); some records survive deletion where the law requires retention or where the record belongs to an agency's regulated files, in which case we retain the minimum necessary, access-restricted. Caregivers can delete their account self-serve — in the Hailo Caregiver app (Profile → Delete account) or at hailocare.com/delete-account — with a 7-day grace period during which the request can be cancelled.

18. Security

We use administrative, technical, and physical safeguards appropriate to the sensitivity of the data, including:

• encryption of data in transit (TLS) and at rest;
• application-level encryption (AES-256-GCM) for stored integration credentials;
• role- and permission-based access control throughout the platform, with per-agency tenant isolation enforced at the database security layer;
• segregated health records with function-mediated, logged access (Section 5);
• multi-factor and one-time-code authentication, and trusted-device checks for administrative access;
• server-side-only handling of sensitive collections (for example, marketplace contact details, call recordings, and signature audit events are not directly readable by client applications);
• bot protection, rate limiting, and honeypots on public endpoints;
• append-only audit logs for health-record access, administrative deletions, and signature events; and
• vendor due diligence and contractual safeguards with service providers.

No system is perfectly secure. If we learn of a breach affecting your personal information, we will notify you and regulators as required by applicable law and, where applicable, our BAAs.

19. Your Privacy Rights and Choices (All Users)

Regardless of where you live, you may:

• Access and update much of your information directly in the apps and portals (profile, contacts, preferences, payment methods).
• Request a copy of the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your account and personal information, subject to the retention obligations in Section 17. Caregivers can do this self-serve in the Hailo Caregiver app or at hailocare.com/delete-account.
• Withdraw consents (telephone consent, e-sign consent, background-check consent going forward) as described in the relevant sections.
• Control app permissions (location, camera, photos, notifications) in your device settings; note that declining location permission will prevent GPS-verified clock-in/out.

To exercise any of these rights, email info@hailocare.com or write to us at the address in Section 1. Account deletion specifically can be completed without emailing us — caregivers can use the Hailo Caregiver app (Profile → Delete account) or hailocare.com/delete-account. We will verify your identity (typically by confirming control of the email or phone number on the account) and respond within the time required by applicable law — and in any event we aim to respond within 30 days. If your information is held in an agency's workspace (Section 3(b)), we will refer your request to the agency and assist it in responding.

We will never discriminate against you — deny services, charge different prices, or provide a different level of service — because you exercised privacy rights. (Note that some requests have functional consequences: for example, deleting a pending care request means agencies cannot contact you about it.)

20. U.S. State Privacy Rights

(a) California (CCPA/CPRA)

This section supplements the rest of this Policy for California residents and serves, together with Section 4, as our Notice at Collection.

Categories collected. In the preceding 12 months we have collected the following categories of personal information (as defined in Cal. Civ. Code § 1798.140), from the sources and for the purposes described in Sections 4 and 6:

Sensitive personal information is used only for the purposes permitted by § 1798.121(a) (providing the requested services, security, verification, and legal compliance) and not to infer characteristics, so a "Limit the Use of My Sensitive Personal Information" right does not currently apply; if that changes, we will provide the required link.

Your California rights: to know/access, to delete, to correct, to opt out of sale or sharing (Section 11), to limit sensitive-information use where applicable, and to non-discrimination. Submit requests as described in Section 19 (caregiver account deletion may also be completed self-serve as described there); you may use an authorized agent with signed permission, and we will verify both your identity and the agent's authority. We do not use dark patterns in our consent or rights flows. Metrics required by § 999.317(g), if applicable, are available on request.

Retention: see Section 17; we disclose retention criteria per category there.

"Shine the Light" (Civ. Code § 1798.83): we do not disclose personal information to third parties for their direct marketing purposes.

(b) Other State Privacy Laws

If you reside in a state with a comprehensive privacy law (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others), you have similar rights of access, correction, deletion, portability, and the right to opt out of targeted advertising (which we do not do), sale (Section 11), and profiling in furtherance of decisions producing legal or similarly significant effects (which we do not perform without human involvement). You may appeal a refusal by replying to our decision email with "Appeal" in the subject; we will respond within the statutory appeal period, and you may contact your state Attorney General if you disagree with the result.

(c) Consumer Health Data (Washington My Health My Data Act, Nevada SB 370, and similar laws)

Some information we collect — for example, health conditions and care needs submitted with a care request — may be "consumer health data" under these laws where they apply and where HIPAA does not.

• What we collect and why: the health-related information described in Sections 4 and 5, to arrange and deliver the care you request.
• Sources and sharing: provided by you or the responsible agency; shared only as described in Sections 10 and 11.
• No selling of consumer health data: the marketplace disclosure in Section 11 shares your care-request details with the accepting agency at your direction to fulfill your request; we do not otherwise sell consumer health data, and we do not use it for advertising.
• Your rights: to access, to withdraw consent, and to have your consumer health data deleted, by contacting info@hailocare.com. We do not geofence health facilities and we do not process consumer health data for targeted advertising.

21. Children's Privacy

The Services are intended for adults. You must be at least 18 to create an account, and we do not knowingly collect personal information directly from anyone under 18 or sell the personal information of anyone under 16. A care recipient under 18 may be the subject of care records only where an adult client (such as a parent or guardian) or a responsible agency establishes and manages the care relationship; that adult or agency is responsible for having the authority to provide the minor's information. If you believe a child has provided us personal information directly, contact us and we will delete it.

22. International Users

The Services are operated from the United States, are directed to users in the United States, and are hosted on U.S. infrastructure. If you access the Services from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, where privacy laws may differ from those of your jurisdiction.

23. Third-Party Sites and Services

The Services link to third-party sites and services (for example, Calendly for demo booking, app stores, state registries, and community resources on our resources pages). Those third parties operate under their own privacy policies, and this Policy does not apply to them.

24. Changes to This Policy

We may update this Policy from time to time. If we make material changes — especially any change to the categories of information collected, the purposes of use, or the recipients — we will update the Effective Date above and provide prominent notice (for example, in-app notice or email) before the change takes effect. Where a change requires your consent under applicable law, we will obtain it.

25. How to Contact Us

Hailo LLC Attn: Privacy 25283 Cabot Rd, Ste 212 Laguna Hills, CA 92653 Email: info@hailocare.com Support: support@hailocare.com Phone: (213) 377-3979

If you have an unresolved privacy concern that we have not addressed satisfactorily, you may contact your state Attorney General or, for HIPAA matters, the U.S. Department of Health and Human Services, Office for Civil Rights.