LuluCare Privacy Policy

Last Updated: October 7, 2026

1. Introduction

Lulu Staffing LLC, doing business as LuluCare ("LuluCare," "we," "our," or "us"), operates a technology-enabled marketplace that connects healthcare facilities with independent healthcare professionals seeking flexible work opportunities. The Platform is currently accessible at https://mylulucare.com.

This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit our website, create or use a LuluCare account, access our mobile or web applications, communicate through the Platform, participate in the LuluCare marketplace, or otherwise interact with us (collectively, the "Services").

This Privacy Policy applies to healthcare professionals, facility representatives, website visitors, applicants, account administrators, and other individuals who interact with LuluCare. It should be read together with the LuluCare Marketplace Terms of Service and any other agreement or policy that applies to your use of the Services.

By using the Services, you acknowledge the practices described in this Privacy Policy. Where consent is required by law, we will request it separately.

2. Scope and Important Healthcare Privacy Boundary

2.1 No Patient Records or PHI

The LuluCare Platform is not designed or authorized to receive, store, or transmit patient medical records, protected health information ("PHI"), or patient-identifying clinical information.

Users must not include patient names, medical record numbers, diagnoses, treatment details, photographs, clinical notes, or other patient-identifying information in Shift postings, Platform messages, Timecards, support requests, dispute submissions, photographs, uploads, or any other Platform field.

Facilities and Healthcare Professionals must use the Facility's approved clinical systems for patient information and remain responsible for complying with applicable patient privacy laws. If patient information is submitted to LuluCare in violation of this policy, we may restrict access to, remove, or securely delete it and may take other appropriate action.

2.2 Professional Health and Credential Information

LuluCare may collect limited health-related documentation about Healthcare Professionals when required for credentialing, Facility eligibility, occupational health, or legal compliance, such as vaccination records, tuberculosis (TB) screening or chest X-ray results, CPR/BLS certification, or similar workforce eligibility records. This information concerns the professional, not a patient, and is used only for legitimate marketplace, credentialing, safety, and compliance purposes.

3. Personal Information We Collect

The information we collect depends on how you interact with LuluCare and the role you hold on the Platform.

3.1 Information You Provide Directly

We may collect:

• Account and contact information, including name, email address, telephone number (including a verified United States mobile number confirmed by SMS one-time passcode), mailing address, date of birth, username, password, and account preferences.

• Identity information, including government-issued identification, photographs, identity-verification results, and information needed to confirm that you are authorized to use an account.

• Professional information, including licenses, certifications, registrations, education, training, work history, skills, professional classifications, references, and continuing education information.

• Credential and eligibility information, including license status, expiration dates, sanction or exclusion screening results, background screening status, occupational health documentation, and Facility-specific requirements.

• Facility information, including legal and trade names, business contact information, Facility locations, licensing information, ownership or administrator information, operational details, insurance information, and authorized users.

• Shift and Assignment information, including availability, applications, confirmations, scheduled hours, role requirements, pay rates, bill rates, cancellations, attendance, and completion status.

• Timekeeping information, including clock-in and clock-out times, meal periods, corrections, attestations, electronic signatures, Facility approvals, and supporting documentation.

• Payment and tax information, including payout account details, billing methods, transaction information, and payment history. Our payment processor (Stripe) collects tax information and issues any tax forms (such as 1099s) directly, and collects and stores this financial information directly; LuluCare does not store raw payment card numbers, bank account numbers, Social Security numbers, taxpayer identification numbers, tax-form details, or 1099s, and may receive only tokens, account status, limited display details (such as the last four digits), or transaction records.

• Communications, including Platform messages, emails, text messages, telephone communications, support requests, survey responses, dispute submissions, reviews, and feedback.

• Emergency contact information provided by Healthcare Professionals.

• Electronic acceptance records, including the timestamp, IP address, device and browser (user-agent), and version of each document you accept, maintained as an audit trail of your electronic signature and consent.

• User Content, including documents, photographs, files, and other material you upload or submit.

3.2 Information Collected Automatically

When you use the Services, we may automatically collect:

• Device information, including device type, operating system, browser type, application version, device identifiers, and language settings.

• Network and technical information, including IP address, internet service provider, log files, error reports, security events, and diagnostic information.

• Usage information, including pages or screens viewed, features used, links selected, search activity, session duration, interaction timestamps, and navigation paths.

• Cookie and similar technology information, including identifiers stored through cookies, software development kits, local storage, pixels, and similar technologies.

• Approximate location information derived from IP address.

• Location information associated with Clock Events, as described below.

3.3 Location Information

When a Healthcare Professional records a Clock Event, LuluCare may collect device location information to verify attendance at the Facility location (including through geofenced clock-in), support Timecard accuracy, prevent fraud, resolve disputes, and protect marketplace integrity.

Location collection is intended to occur in connection with specific timekeeping actions, such as clock-in or clock-out. LuluCare does not represent that the Platform continuously tracks a User's location. The precision available may depend on device permissions, hardware, network conditions, and operating-system settings.

Where required, we will request device permission before collecting location information. Users may be able to change location permissions through device settings, but disabling required permissions may prevent use of certain timekeeping features.

3.4 Information From Other Sources

We may receive information from:

• Healthcare Facilities, including Assignment status, attendance, Timecard approvals, workplace incidents, performance concerns, and Facility-specific eligibility requirements.

• Healthcare Professionals, including information relating to Assignments or other Users.

• Identity, credential, and background screening providers.

• Professional licensing boards, sanction lists, exclusion databases, government agencies, and public records.

• Payment processors and financial service providers.

• Mapping, geolocation, communication, analytics, cloud hosting, customer support, and security providers.

• References, educational institutions, former employers, and other verification sources where authorized.

• Referral partners or other Users who invite you to the Platform.

4. How We Use Personal Information

We may use personal information to:

• create, maintain, authenticate, and secure Accounts;

• verify identity, eligibility, licenses, certifications, and Credentials;

• conduct or facilitate Background Checks, sanction screenings, and exclusion screenings;

• connect Healthcare Professionals and Facilities;

• display, recommend, apply for, confirm, manage, and complete Shifts and Assignments;

• operate messaging and communication features;

• record, review, correct, approve, and dispute Timecards and Clock Events;

• facilitate payouts, billing, refunds, adjustments, collections, tax reporting, and payment support;

• provide customer support and respond to requests;

• send transactional, operational, security, legal, and account communications;

• personalize and improve the Services;

• monitor Platform performance, usage, reliability, and feature effectiveness;

• investigate fraud, account misuse, false documentation, payment issues, safety events, and policy violations;

• enforce our agreements, Community Standards, and other policies;

• protect Users, LuluCare, Facilities, patients, and the public;

• comply with legal, regulatory, licensing, tax, accounting, and recordkeeping obligations;

• establish, exercise, or defend legal claims;

• support audits, corporate transactions, financing, due diligence, and business operations;

• create aggregated or de-identified information that cannot reasonably be used to identify an individual.

We may use aggregated or de-identified information for lawful business purposes, including analytics, forecasting, marketplace planning, product improvement, and research. We will not attempt to re-identify information that is maintained as de-identified except as permitted by law to test our de-identification processes.

5. How We Disclose Personal Information

We may disclose personal information as described below. We do not disclose personal information merely because it is available to us; disclosure must support a legitimate business, marketplace, legal, or safety purpose.

5.1 Between Marketplace Participants

We may disclose information between Healthcare Professionals and Facilities as reasonably necessary to evaluate, coordinate, perform, verify, and administer Assignments.

For example, a Facility may receive a professional's name, profile, license and credential verification status, professional qualifications, availability, Assignment history, and other information relevant to determining eligibility for a Shift. A Healthcare Professional may receive Facility identity, location, Shift details, requirements, instructions, rates, and authorized contact information.

Facilities receive a Healthcare Professional's credential verification status. In addition, when a Healthcare Professional is booked (confirmed) for a shift at a Facility, that Facility may view and download the credential and compliance documents the Healthcare Professional has provided to LuluCare — including professional licenses and certifications; health and compliance records (for example CPR/BLS, TB test, physical, and vaccination records); and government-issued identification (for example a driver's license or passport) — for that Facility's licensing, compliance, credentialing, and recordkeeping purposes. A Facility may access these documents only for Healthcare Professionals booked on one of that Facility's shifts; Facilities with which the Healthcare Professional has not booked a shift cannot access them. LuluCare records each time a Facility views or downloads these documents. These documents are not made public. A Facility's bill rate for a Healthcare Professional is not shown to Healthcare Professionals.

We seek to limit marketplace disclosures to information reasonably necessary for the applicable purpose.

5.2 Service Providers and Contractors

We may disclose information to vendors and contractors that provide services on our behalf, including:

• cloud hosting and database services;

• identity verification;

• background and credential screening;

• professional license monitoring;

• payment processing and payout services;

• tax documentation and reporting;

• mapping and geolocation;

• email, SMS, telephone, and push notifications;

• customer support;

• analytics and product performance;

• cybersecurity, fraud prevention, and monitoring;

• document storage and electronic signatures;

• legal, accounting, insurance, and professional advisory services.

As of the date of this Policy, LuluCare's principal service providers include Stripe (payment processing and connected-account/Connect payouts), Supabase (cloud database hosting and authentication), Resend (transactional email delivery), Twilio (SMS/text messaging, including one-time passcodes and operational texts), and Checkr (third-party consumer reporting agency performing background screening).

These providers may process information under their own privacy policies as well as contractual obligations to LuluCare.

5.3 Stripe and Payment Processing

LuluCare may use Stripe and its affiliates to provide payment processing, connected-account onboarding, identity verification related to payments, billing, and payout services.

When you provide personal information in connection with payment services, Stripe may receive and process that information in accordance with Stripe's Privacy Policy and applicable service agreements. Stripe collects payment, banking, and tax information directly and issues any tax forms (such as 1099s) directly, and LuluCare does not receive or store complete bank account, debit card, or payment credential information, tax-form details, or 1099s.

5.4 Legal, Regulatory, and Safety Disclosures

We may disclose information when we reasonably believe disclosure is necessary to:

• comply with law, regulation, subpoena, court order, or legal process;

• respond to government, licensing board, law enforcement, or regulatory requests;

• investigate suspected fraud, criminal conduct, patient safety concerns, or threats;

• protect the rights, property, safety, or security of LuluCare, Users, Facilities, patients, or others;

• enforce agreements and collect amounts owed;

• detect or respond to security incidents;

• establish, exercise, or defend legal claims.

5.5 Business Transactions

We may disclose or transfer information in connection with an actual or proposed merger, acquisition, financing, restructuring, bankruptcy, sale of assets, change of control, or similar corporate transaction. Where required, we will take reasonable steps to require the recipient to use personal information consistently with this Privacy Policy or provide appropriate notice.

5.6 With Your Direction or Consent

We may disclose information when you direct us to do so, request a feature that requires disclosure, or provide consent.

6. Sale, Sharing, and Targeted Advertising

LuluCare does not sell personal information for money.

LuluCare does not currently share personal information for cross-context behavioral advertising as those terms are defined under California law. We also do not use sensitive personal information to infer characteristics about individuals for advertising purposes.

If our practices change, we will update this Privacy Policy and provide any legally required opt-out method, notice, or preference-signal support before engaging in the changed practice.

7. Cookies and Similar Technologies

We and our service providers may use cookies, software development kits, pixels, local storage, and similar technologies to:

• keep Users signed in;

• remember preferences;

• operate security and fraud-prevention controls;

• understand Platform performance;

• diagnose errors;

• measure feature usage;

• improve the Services;

• support communications and analytics.

You may be able to control certain technologies through browser, device, or Platform settings. Blocking essential technologies may affect Platform functionality.

Because LuluCare does not currently sell or share personal information for cross-context behavioral advertising, we do not currently treat browser-based opt-out preference signals as applicable to such activity. If we begin engaging in activity to which those signals apply, we will honor legally required signals.

8. Communications

We may send transactional and operational communications about Accounts, Assignments, credentials, Timecards, payments, billing, disputes, safety, security, legal notices, and Platform changes. These communications are delivered using service providers including Supabase and Resend for email and Twilio for SMS/text messaging (including one-time passcodes).

We may also send marketing communications where permitted by law. You may opt out of marketing emails using the unsubscribe method included in the message. You may opt out of marketing text messages by following the instructions provided in the message. Opting out of marketing communications does not prevent us from sending essential transactional, legal, security, or account communications.

Message and data rates may apply. Your mobile carrier is not responsible for LuluCare messages.

Mobile Information and Text Messaging. We do not sell or share your mobile phone number, SMS opt-in, or consent to receive text messages with third parties or affiliates for their own marketing or promotional purposes. We may share information with service providers who act on our behalf to deliver messages and operate the Platform (for example, Twilio for SMS/text-message delivery), subject to confidentiality obligations. Text messaging originator opt-in data and consent will not be shared with any third parties, excluding aggregators and providers of the Text Message services. Message frequency varies and depends on your use of the Services; for example, we send a one-time verification code when you request one.

9. Background Checks and Credential Verification

LuluCare may obtain or facilitate identity verification, professional credential verification, criminal background checks, sanctions screening, exclusion screening, employment or education verification, and similar eligibility reviews.

As the final step of onboarding, LuluCare presents a Healthcare Professional with a standalone disclosure and captures the Professional's authorization for Background Checks, and upon that authorization initiates screening through a third-party consumer reporting agency (Checkr). Marketplace eligibility depends on the results.

Where a consumer report or investigative consumer report is used, LuluCare will provide any disclosures, authorizations, notices, and rights required by applicable law (including the Fair Credit Reporting Act) through a separate process. The results of screening may be used to determine eligibility, impose account restrictions, satisfy Facility requirements, investigate discrepancies, or comply with law.

Screening information may be received from third-party providers, public records, government sources, licensing boards, or other authorized sources. Separate terms and privacy notices may apply to those providers.

10. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Privacy Policy, including to operate the marketplace, complete transactions, provide support, maintain security, investigate fraud, resolve disputes, enforce agreements, and satisfy legal, tax, accounting, licensing, insurance, and recordkeeping obligations.

Retention periods vary based on the type of information, the relationship involved, legal requirements, risk, and operational needs. For example:

• Account and identity records may be retained while an Account is active and for a reasonable period afterward.

• Credential and screening records may be retained to document eligibility decisions and compliance.

• Timekeeping, payment, billing, and tax records may be retained for legally required business-record periods.

• Communications and dispute records may be retained while needed for support, investigations, enforcement, or legal claims.

• Security logs and backups may be retained according to security and disaster-recovery schedules.

When information is no longer reasonably necessary, we may delete, anonymize, or securely dispose of it, subject to technical limitations, backup cycles, and legal exceptions.

11. Data Security

We use commercially reasonable administrative, technical, and organizational safeguards designed to protect personal information. These measures may include access controls, authentication, encryption in transit where appropriate, logging, monitoring, vendor oversight, data minimization, and incident-response procedures. Sensitive identity, health, payment, and tax records are subject to restricted, administrator-only access, and sensitive payment and tax data is held by our payment processor rather than stored by LuluCare.

No system, transmission method, or security program is completely secure. We cannot guarantee that unauthorized access, cyberattacks, data loss, or other incidents will never occur.

Users are responsible for protecting Account credentials, devices, authentication methods, and payment accounts and for promptly notifying LuluCare of suspected unauthorized access.

12. Your Choices and Rights

12.1 Account Information

You may review or update certain Account information through the Platform. Some information may require verification or assistance from LuluCare before it can be changed.

12.2 Location Permissions

You may control location permissions through device settings. Disabling location may prevent use of GPS-supported Clock Events or other location-dependent functionality.

12.3 Communications Preferences

You may opt out of eligible marketing communications as described in Section 8. You cannot opt out of communications that are necessary to operate your Account, administer Assignments, process payments, provide legal notices, or protect security.

12.4 Privacy Requests

Depending on where you reside and whether applicable law applies to LuluCare, you may have the right to request:

• access to or confirmation of personal information we maintain about you;

• categories or specific pieces of personal information collected;

• correction of inaccurate personal information;

• deletion of personal information, subject to exceptions;

• a portable copy of certain personal information;

• information about categories of sources, purposes, and recipients;

• restriction or limitation of certain processing;

• withdrawal of consent where processing is based on consent;

• appeal of a privacy-request decision where required by law;

• non-discrimination for exercising privacy rights.

You may submit a privacy request by emailing support@trylulucare.com with the subject line "Privacy Request" or through any privacy-request method made available in the Platform.

We may need to verify your identity and authority before completing a request. Verification may require matching information associated with your Account or requesting additional information reasonably necessary to prevent unauthorized disclosure or deletion.

You may use an authorized agent where permitted by law. We may require proof of the agent's authority and may independently verify your identity.

Certain information may be exempt from a request or retained as permitted by law, including information needed to complete transactions, detect fraud, maintain security, comply with legal obligations, exercise legal rights, preserve records, or protect other individuals.

13. California Privacy Notice

This Section supplements the remainder of this Privacy Policy for California residents. It is intended to provide disclosures required by the California Consumer Privacy Act, as amended ("CCPA"), to the extent the CCPA applies to LuluCare and the information involved.

13.1 Categories of Personal Information

During the preceding twelve months, LuluCare may have collected the following categories of personal information:

• Identifiers, such as name, contact details, IP address, device identifiers, government identification, and account identifiers.

• Customer-record information, such as signature, address, telephone number, employment information, financial account information, and professional history.

• Characteristics of protected classifications where voluntarily provided or required for lawful compliance.

• Commercial information, such as transaction, Assignment, billing, payout, and service history.

• Internet or electronic network activity, such as usage, device, browser, interaction, and log information.

• Geolocation data associated with Clock Events and approximate location derived from network information.

• Audio, electronic, visual, or similar information, such as support calls, photographs, documents, and Platform communications.

• Professional or employment-related information, including licenses, Credentials, work history, availability, Facility affiliation, and performance-related information.

• Education information, such as training and educational records used for credentialing.

• Sensitive personal information, such as government identification, account login credentials, financial account information, precise geolocation where applicable, and limited professional health or occupational screening information.

• Inferences derived from information described above, such as eligibility, fraud-risk, account-security, or marketplace recommendations.

We collect these categories from the sources described in Section 3, use them for the purposes described in Section 4, and disclose them to the categories of recipients described in Section 5.

13.2 California Rights

Subject to legal limitations and verification requirements, California residents may have the right to know, access, delete, correct, and obtain information about the collection and disclosure of personal information; to opt out of the sale or sharing of personal information; to limit certain uses of sensitive personal information; and to receive equal service and pricing when exercising privacy rights.

LuluCare does not currently sell personal information or share it for cross-context behavioral advertising. LuluCare does not currently use or disclose sensitive personal information for purposes that require a right-to-limit link under the CCPA.

13.3 California Request Metrics and Updates

If LuluCare becomes subject to legal obligations requiring publication of request metrics or additional notices, we will provide them as required. We will review and update this Privacy Policy at least annually when required by California law.

14. Other State Privacy Rights

Residents of certain U.S. states may have additional privacy rights under applicable state law. Depending on the jurisdiction and legal applicability, these may include rights to access, correct, delete, obtain a portable copy, opt out of certain sales, targeted advertising, or profiling, and appeal a denied request.

LuluCare will process verified requests in accordance with applicable law. Because state privacy laws contain different thresholds, definitions, exceptions, and effective dates, not every right applies to every individual or every type of information.

15. Children's Privacy

The Services are intended for adults who are at least eighteen years old. LuluCare does not knowingly create Accounts for or collect personal information directly from children under thirteen.

If we learn that personal information was collected directly from a child in violation of applicable law, we will take appropriate steps to delete it. A parent or guardian who believes a child submitted personal information may contact support@trylulucare.com.

16. Third-Party Sites and Services

The Services may contain links to or integrations with third-party websites, applications, payment services, background-screening providers, mapping services, or other platforms.

This Privacy Policy does not govern the independent privacy practices of third parties. We encourage Users to review the privacy policies and terms of any third-party service they use.

17. International Use

LuluCare is currently intended primarily for use in the United States. If you access the Services from another country, your information may be transferred to, stored in, and processed in the United States, where privacy laws may differ from those in your jurisdiction.

18. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our Services, practices, technology, legal requirements, or business operations.

When we make changes, we will update the "Last Updated" date. If changes are material, we may provide additional notice through the Platform, email, or another legally sufficient method.

Continued use of the Services after an updated Privacy Policy becomes effective constitutes acknowledgment of the revised policy, except where applicable law requires additional consent.

19. Contact Us

Questions, concerns, or privacy requests may be directed to:

Lulu Staffing LLC d/b/a LuluCare

Website: https://mylulucare.com

Email: support@trylulucare.com

For privacy requests, use the subject line "Privacy Request" and include enough information for us to identify your Account and understand the request. Do not email sensitive identity documents unless LuluCare specifically requests them through a secure method.

ACKNOWLEDGMENT

BY ACCESSING OR USING THE SERVICES, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY.