Last Updated: 2/14/2024

1. Introduction

Epic Staffing Group, Inc., its subsidiaries and affiliates (collectively “Epic”, “us”, “we”, or “our”) provides staffing and recruitment services for healthcare positions in the United States (the “Services”). This Privacy Policy (“Policy”) describes how we collect, process, share and safeguard personal information that we collect from potential candidates for positions with our life science clients (“Candidates”) and other visitors to our website and applications (collectively, “you”). It also tells you about your rights and choices with respect to your personal information, and how you can contact us if you have any questions or concerns.

2. Information we collect We collect personal information from the following categories of sources:

Information you provide to us • Account and profile information, such as your name, email address, phone number, mailing address, and any biographical information you provide on your profile. • Correspondence and other communications with us, such as information you provide via a contact form on our website, by email, via LinkedIn or by other means. • Marketing information, such as your choices for receiving communications about our activities and publications. • Candidate employment and background information, such as your current and former positions and experience, resume or CV, education, professional and training history, details regarding any past medical malpractice claims, and details of any other relevant skills. You may also provide other documentation to support your application. • Payment and transaction information, such as credit card or bank account numbers, in connection with a transaction on the Epic marketplace. Your payment card information is collected and processed by our e-commerce service provider, Authorize.net, and we do not store your payment card information.

Information collected via automated means • Device data: We collect information about your device such as your computer’s or mobile device’s operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, device type (e.g., phone, tablet), IP address, unique identifiers (including identifiers used for advertising purposes), language settings, mobile device carrier, radio/network information (e.g., WiFi, LTE, 4G), and general location information such as city, state or geographic area. • Usage data: When you access and use the Services, we receive and store information about interactions with our Services, including pages or screens you viewed, how long you spent on a page or screen, browsing history, navigation paths between pages or screens, information about your activity on a page or screen, access times, and duration of access, and whether you have opened our marketing emails or clicked links within them.

We may collect this information using the following technologies:

• Cookies, which are text files that websites store on a visitor‘s device to uniquely identify the visitor’s browser or to store information or settings in the browser for the purpose of helping you navigate between pages efficiently, remembering your preferences, enabling functionality, helping us understand user activity and patterns, and facilitating online advertising. • Local storage technologies, like HTML5, that provide cookie-equivalent functionality but can store larger amounts of data, including on your device outside of your browser in connection with specific applications. • Web beacons, also known as pixel tags or clear GIFs, which are used to demonstrate that a webpage or email was accessed or opened, or that certain content was viewed or clicked.

Information we receive from third parties We receive personal information from the third parties below, which may process your personal information in accordance with their own privacy policies. Please review these policies carefully before using their services.

• Social media information: We maintain pages on social media platforms, such as Facebook, Twitter, Instagram and LinkedIn. You or the platform providers may provide us with information through the social media platform, and we will treat such information in accordance with this Policy. • Professional information: We receive names, employment histories and business contact details from recruitment agencies, public LinkedIn profiles, as well as from other business intelligence services, such as Zoominfo. We may also receive information from legal record searches. • Other sources: We may obtain personal information from other third parties, such as marketing partners, publicly-available source and lead generators.

3. How we use personal information We will use personal information for one or more of the purposes set out below.

• Providing the Services, including to operate, maintain and provide you with the Services. This includes allowing you to browse the Services and apply for open positions. • Communicating with you about the Services, including to contact you in case of any issue with your account and to send announcements, updates, security alerts, and support and administrative messages. • Assessing your suitability for job vacancies, including to evaluate Candidates’ applications for open positions. We may also retain personal information to contact Candidates in case of future vacancies that may be relevant. • Providing support and responding to requests and complaints, including to resolve queries and facilitate support requests. • Improve or monitor usage of our Services and to protect, investigate and deter against fraudulent, harmful, unauthorized or illegal activity. This includes: monitoring and analyzing trends and use of our Services; personalizing your use of the Services and our communications; conducting troubleshooting, testing and research; and enforcing any applicable terms and conditions, complying with legal obligations and defending against legal claims or disputes. • Direct marketing. We may send you direct marketing communications as permitted by law, including, but not limited to, sending newsletters, and notifying you of special promotions, offers and events via postal mail, email, telephone, text message, and other means.

• Interest-based advertising. We engage our advertising partners, including third party advertising companies and social media companies, to display ads around the web. These companies may use cookies and similar technologies to collect information about your interactions over time across our Services, our communications and other online services, and use that information to serve online ads that they think will interest you.

4. How we share personal information

We disclose personal information with the following categories of recipients:

• Service providers: We rely on vendors and service providers for the provision of our Services and for the purposes set out above, such as providers of website analytics, e-commerce platforms, hosting and cloud computing services and other IT services, database management and customer support services in addition to other administrative services. These third parties may have access to or process your personal information as part of providing these services. • Affiliates: We may share your personal information among different Epic Staffing Group entities to further support and build our Services and businesses. • Advertising partners: We may share your personal information with third party advertising companies, including for the interest-based advertising purposes described above. • Advisors: we work with various advisors, including tax consultants and legal advisors, with whom we may share your personal information. • Legal: information about our users, including personal information, will be disclosed to law enforcement agencies, regulatory bodies, public authorities or pursuant to the exercise of legal proceedings if we are legally required to do so, or if we believe, in good faith, that such disclosure is necessary to comply with a legal obligation or request, to enforce our terms and conditions, to prevent or resolve security or technical issues, or to protect the rights, property or safety of Epic, Candidates, a third party, or the public. • Business transaction: if Epic is involved in a merger, acquisition or asset sale, financing due diligence, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another provider, your personal information may be sold, transferred or otherwise shared including as part of any due diligence process.

5. How you can share personal information through our platform • Employers: If you are a Candidate, you direct us to share your information with suitable employers.

6. Your rights and choices

Depending on where you reside, you may have the following rights:

• Information. You may have the right to obtain information about we collect, use, and share your personal information. We provide this information within this Privacy Policy. • Access, correction, and deletion. You may also have the right to request access to your personal information, to correct personal information that is out of date or inaccurate, or to delete personal information that is no longer reasonably necessary. • Sharing personal information and targeted advertising. We may share information we collect via our website, such as information about the pages you visit on our website and your purchases, with our advertising and channel partners to support our interest-based advertising, which may qualify as a sale or sharing of personal information, or targeted advertising, under applicable law. To opt-out of these disclosures of your information, you can click the “Your Privacy Choices” link on the footer of our website.

Opt out of marketing communications: You may opt out of marketing communications by following the unsubscribe instructions in any marketing email we send you. Please note, however, that you may continue to receive communications as described in the “Communicating with you about the Services” section above after opting out of marketing communications. Online tracking opt-out. There are a number of ways to opt out of having your online activity and device data collected through our Services, which we have summarized below: • Blocking cookies in your browser. Most browsers let you remove or reject cookies, including cookies used for interest-based advertising. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. For more information about cookies, including how to see what cookies have been set on your device and how to manage and delete them, visit https://allaboutcookies.org/. Use the following links to learn more about how to control cookies and online tracking through your browser: Firefox; Chrome; Microsoft Edge; Safari • Blocking advertising ID use in your mobile settings. Your mobile device settings may provide functionality to limit use of the advertising ID associated with your mobile device for interest-based advertising purposes. • Using privacy plug-ins or browsers. You can block our Services from setting cookies used for interest-based ads by using a browser with privacy features, like Brave, or installing browser plugins like Privacy Badger, DuckDuckGo, Ghostery or uBlock Origin, and configuring them to block third party cookies/trackers. • Advertising industry opt-out tools. You can also use these opt-out options to limit use of your information for interest-based advertising by participating companies: o Digital Advertising Alliance o Network Advertising Initiative

Note that because these opt-out mechanisms are specific to the device or browser on which they are exercised, you will need to opt out on every browser and device that you use.

Do Not Track: Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to “Do Not Track” or similar signals. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.

7. Children’s privacy Our Services are not directed to children, and we do not knowingly collect personal information from anyone under the age of 18. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us as set out in the “Contact Us” section below. If we become aware that we have collected personal information from children without verification of parental consent, we take steps to remove that information from our servers.

8. Data Retention We may retain your personal information for as long as it is reasonably needed in order to maintain and expand our relationship and provide you with our Services; in order to comply with our legal and contractual obligations; or to protect ourselves from any potential disputes. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of such data, the potential risk of harm from unauthorized use or disclosure of such data, the purposes for which we process it, and the applicable legal requirements.

9. Security of personal information

We use reasonable organizational, technical and administrative measures designed to protect against unauthorized access, misuse, loss, disclosure, alteration and destruction of personal information we process. Unfortunately, data transmission over the Internet cannot be guaranteed as completely secure. Therefore, while we strive to protect your personal information, we cannot guarantee its security.

10. How we protect sensitive personal information

In connection with your application for a position, we may collect sensitive personal information, including demographic information (such as ethnicity, national origin, immigration status, disability information, and sexual orientation), health and medical information (including vaccination history, medical history, and results from any physical examinations and drug screenings you take as necessary for a position for which you apply), and fingerprints. We use this information only as reasonably necessary to process your application and manage your employment.

11. Link to other Sites

The Website may contain links to other sites that are not operated by us. If you click a third party link, you will be directed to that third party’s site. We strongly advise you to review the privacy policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

12. Changes and updates to this Policy

We will update this Policy from time to time. You are advised to review this Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page. If we make material changes, we will let you know via email and/or a prominent notice on our Services.

13. Contact Us

If you have any questions or comments about this Policy, our privacy practices, or if you would like to exercise your choices with respect to your personal information, please contact us by email at [email protected].