California Employee Privacy Policy

Effective Date: January 1, 2026

Last Updated: January 1, 2026

This California Employee Privacy Notice describes how shrinkMD Health Inc. and its affiliates ("shrinkMD," "we," "us," or "our") collect, use, disclose, and protect Personal Information of individuals who reside in California and interact with us in a workforce capacity.

This Notice applies to:

• Employees
• Independent contractors
• Job applicants
• Temporary workers
• Professional service providers working in an individual capacity

(collectively, "California Workforce Members")

This Notice does not apply to information governed by the Health Insurance Portability and Accountability Act ("HIPAA") or the Fair Credit Reporting Act ("FCRA"), which are covered under separate notices.

1. CATEGORIES OF PERSONAL INFORMATION WE COLLECT

We may collect the following categories of Personal Information, as defined under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CPRA"):

A. Identifiers

Name, alias, postal address, email address, phone number, government identifiers (e.g., Social Security number, driver's license), and similar identifiers.

B. Personal Records

Employment history, compensation, benefits information, payroll data, tax forms, timekeeping records, and performance evaluations.

C. Characteristics of Protected Classifications

Information such as age, sex, gender identity, marital status, military or veteran status, or other characteristics protected by law, where legally required or voluntarily provided.

D. Education Information

Education records not publicly available, such as transcripts or certifications.

E. Professional and Employment Information

Job applications, resumes, licensing information, credentialing, disciplinary records, and contracts.

F. Internet or Network Activity

Access logs, device identifiers, usage of company systems, and interactions with internal platforms.

G. Sensitive Personal Information

Where applicable, we may collect Sensitive Personal Information (e.g., Social Security numbers, financial account information) solely for lawful employment-related purposes.

2. PURPOSES FOR COLLECTION AND USE

We collect and use workforce Personal Information for the following purposes:

• Recruiting, hiring, onboarding, and workforce management
• Payroll, compensation, benefits, and tax compliance
• Credentialing, licensing, and regulatory compliance
• Security, fraud prevention, and IT system management
• Legal compliance, investigations, and audits
• Business operations and continuity
• Emergency communications

We do not sell workforce Personal Information or use it for cross-context behavioral advertising.

3. DISCLOSURE OF PERSONAL INFORMATION

We may disclose Personal Information to:

• Payroll and benefits providers
• Background check vendors (where authorized)
• Professional advisors (legal, accounting, compliance)
• Government authorities as required by law
• Service providers under written agreements that restrict use of information

We do not disclose workforce Personal Information for commercial advertising purposes.

4. DATA RETENTION

Personal Information is retained only for as long as reasonably necessary to fulfill the purposes described above, including compliance with legal, tax, employment, and regulatory obligations.

Retention periods vary depending on the type of information and applicable law.

5. YOUR CALIFORNIA PRIVACY RIGHTS

Under the CPRA, California Workforce Members have the right to:

• Know what Personal Information is collected and how it is used
• Access their Personal Information
• Correct inaccurate Personal Information
• Delete Personal Information, subject to legal exceptions
• Limit the use of Sensitive Personal Information (where applicable)
• Not be retaliated against for exercising privacy rights

Certain rights may be limited where retention or processing is required by law.

6. HOW TO EXERCISE YOUR RIGHTS

You may submit a privacy rights request by contacting shrinkMD through the contact methods listed on our website.

We may need to verify your identity before fulfilling a request. Authorized agents may submit requests on your behalf with appropriate documentation.

7. NO RETALIATION

shrinkMD will not retaliate against any California Workforce Member for exercising their privacy rights.

8. SECURITY AND MONITORING

shrinkMD maintains administrative, technical, and physical safeguards designed to protect workforce Personal Information.

Use of company systems, devices, and networks may be monitored for security, compliance, and operational purposes, consistent with applicable law.

9. CHANGES TO THIS NOTICE

We may update this Notice from time to time. The most current version will be available on our website and will apply to information collected after the effective date. This California Employee Privacy Notice is provided in accordance with the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

10. CONTACT INFORMATION

If you have questions about this Notice or our privacy practices, please contact us using the methods listed on our website.