PayLocums Privacy Policy

Effective Date: November 4, 2026 | Last Updated: November 4, 2026

1. Introduction and Scope

This Privacy Policy explains how PayLocums LLC, a Florida limited liability company ("PayLocums," "we," "us," or "our"), collects, uses, discloses, and protects personal information in connection with our website at paylocums.com (the "Site"), our web application at app.paylocums.com (the "App"), and related services, emails, and integrations (together, the "Service").

PayLocums provides business software to locum tenens staffing companies (our "Customers"). We handle personal information in two different roles:

• When we act for ourselves (as a "business" or "controller"). This covers information about visitors to our Site, people who submit our request-access or contact forms, and the business contact and account information of our Customers' administrators and users, as well as server logs and similar operational data.
• When we act for our Customers (as a "service provider" or "processor"). Our Customers use the Service to manage information about clinicians, facility contacts, and others ("Customer Data"). For Customer Data, the Customer decides what is collected and how it is used, and we process it on the Customer's behalf and under its instructions. The Customer's own privacy notice governs that information. Section 13 (Customer Data Processing Terms) describes our commitments to Customers.

If you are a clinician or facility contact whose information is in PayLocums because a staffing company uses our Service, please direct privacy questions and requests to that staffing company. If you contact us, we will refer your request to the relevant Customer where appropriate.

This Privacy Policy does not apply to third-party websites or services, including integrations a Customer chooses to connect (such as QuickBooks Online), which are governed by their own privacy policies.

2. Information We Do Not Collect

The Service is designed for business records about staffing assignments, not for sensitive personal or patient information. PayLocums does not request or store Social Security numbers, bank account details, or dates of birth, and the Service is not designed to hold patient information or protected health information (PHI). Our Terms of Service prohibit Customers and users from uploading these types of information. If we learn that such information has been submitted, we may delete it.

3. Information We Collect

3.1 Information you provide to us directly

• Request-access and contact forms: your name, email address, company name, and any other information you choose to include in your message.
• Account and sign-in information: the name, business email address, company, role, and Workspace memberships of Customer administrators and users. We use passwordless sign-in, so we process your email address and the one-time sign-in codes we send to it; we do not collect or store passwords.
• Communications: information you provide when you email us, request support, or give feedback.
• Billing information: business billing contact details and records of fees and payments.

3.2 Customer Data we process on behalf of Customers

Depending on how a Customer uses the Service, Customer Data may include:

• Clinician information: names, email addresses, phone numbers, assignment details, timesheets and hours, pay rates, payment calculation records, and credential document details (such as credential type and expiration dates).
• Facility information: facility names, addresses, and billing contact details, and the names, email addresses, and phone numbers of facility contacts, along with their timesheet and invoice approvals.
• Business records: assignments, schedules, bill rates, invoices, split-billing allocations, funding schedules, notes, and related documents.
• Communications: the content and delivery status of emails sent through the Service, and drafts created with AI features.

3.3 Information collected automatically

• Server and security logs: when you access the Site or App, our systems and hosting provider automatically record basic technical information such as IP address, browser type, device information, pages or endpoints requested, referring URL, and date and time of access. We use this information to operate, secure, and troubleshoot the Service.
• App activity: records of actions taken in the App (for example, sign-ins, timesheet approvals, invoice changes, and emails sent) so that Customers have an audit trail and we can support and secure the Service.

3.4 Information from third parties

• Integrations: if a Customer connects QuickBooks Online or another integration, we receive the information the Customer authorizes, such as customer, vendor, invoice, and account records, to provide the integration.
• Customers: we receive information about clinicians and facility contacts from the Customers who enter or upload it.

4. Cookies and Similar Technologies

We keep tracking to a minimum. The Site uses your browser's local storage only to remember your display theme preference (for example, light or dark mode). The App uses essential cookies or similar storage that are necessary to keep you signed in and to secure the Service, and our hosting provider may use strictly necessary technologies to protect the Service against abuse and attacks. We do not use advertising cookies, cross-site tracking, or third-party advertising pixels. If we introduce analytics or other non-essential technologies in the future, we will update this Privacy Policy and provide any choices required by law.

Because we do not sell personal information or share it for cross-context behavioral advertising, there is no tracking for us to stop in response to a browser "Do Not Track" signal. We treat Global Privacy Control (GPC) signals as a request to opt out of sale or sharing where the law requires, although we do not engage in those activities.

5. How We Use Information

We use personal information for the following purposes:

• to provide, operate, and maintain the Service, including authenticating users with one-time codes, performing the calculations and functions Customers request, and syncing with integrations Customers enable;
• to send transactional and reminder emails from notifications@paylocums.com on behalf of Customers when their administrators trigger or configure them (for example, timesheet reminders, approval requests, invoices, and credential-expiration reminders);
• to provide AI features that draft content, such as reminder messages, for a Customer's human review before sending;
• to respond to request-access submissions, inquiries, and support requests, and to communicate with you about your account, the Service, security, and changes to our terms;
• to bill and collect fees;
• to monitor, secure, and protect the Service, our Customers, and others, including detecting and preventing fraud, abuse, and unauthorized access;
• to understand how the Service is used and to improve and develop it, including by creating aggregated or de-identified information that does not identify any individual;
• to comply with law, respond to lawful requests, and enforce our agreements; and
• for any other purpose with your consent or at a Customer's direction.

We process Customer Data only to provide the Service to the relevant Customer and as described in Section 13, and not for our own marketing.

6. How We Disclose Information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We disclose personal information only as follows:

• Service providers (subprocessors) that help us operate the Service under contracts that limit their use of the information, including: Cloudflare (application hosting, database, network, security, and AI features, which run on Cloudflare's infrastructure); and Microsoft (Microsoft 365 business email, used to send and receive our emails and Service notifications). We do not use any other AI company. PayLocums does not use Customer Data to train AI models. We may update this list as described in Section 13.
• At a Customer's direction, for example when an administrator sends timesheet reminders or invoices to clinicians or facility contacts, invites users, or connects an integration such as QuickBooks Online (provided by Intuit Inc., under Intuit's own terms and privacy policy).
• Within a Customer's account, to that Customer's authorized users according to the permissions the Customer sets.
• For legal reasons, if we believe in good faith that disclosure is required by law, subpoena, or legal process, or is necessary to protect the rights, property, or safety of PayLocums, our Customers, or others, or to investigate fraud or security issues.
• In a business transaction, in connection with a merger, acquisition, financing, reorganization, or sale of all or part of our business, subject to customary confidentiality protections. Any acquirer will be required to honor this Privacy Policy with respect to the information transferred.
• With your consent or as otherwise disclosed when the information is collected.
• Aggregated or de-identified information that cannot reasonably be used to identify any individual or Customer.

7. Data Retention

We keep personal information only as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. In general:

• Customer Data is retained for as long as the Customer's account is active and as directed by the Customer. After a Customer's account ends, we make Customer Data available for export for 30 days and then delete or de-identify it within 90 days after the account ends, except that copies in backups may persist for up to 35 days until overwritten, and we may keep limited records as required by law.
• Request-access and contact form submissions are retained for up to 24 months after our last interaction with you, unless you become a Customer.
• Server and security logs are retained for up to 90 days, unless needed longer to investigate a security issue.
• Billing and account records are retained for as long as required for tax, accounting, and legal purposes.

Where we cannot fully delete information for technical reasons, we will take reasonable steps to prevent further use of it.

8. Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information, including passwordless sign-in with one-time codes, encrypted connections (HTTPS) to the Site and App, and access controls that limit who can view Customer Data. However, no system is completely secure, and we cannot guarantee the security of information. You are responsible for keeping your email account secure, because access to your email allows access to your PayLocums account. Please contact us immediately at privacy@paylocums.com if you believe your account has been compromised.

9. Your Privacy Rights (U.S. State Laws)

Depending on where you live, including California, Colorado, Connecticut, Virginia, Texas, Oregon, and other U.S. states with comprehensive privacy laws, you may have some or all of the following rights regarding personal information we control, subject to legal exceptions:

• Access / Know: to confirm whether we process your personal information and to obtain the categories and specific pieces of personal information we hold about you;
• Correction: to correct inaccurate personal information;
• Deletion: to request deletion of personal information;
• Portability: to receive a copy of your personal information in a portable format;
• Opt out: of the sale or sharing of personal information, targeted advertising, or certain profiling (we do not engage in these activities);
• Limit use of sensitive personal information (we do not use sensitive personal information for purposes that would trigger this right); and
• Non-discrimination: we will not discriminate against you for exercising your rights.

How to make a request. Email privacy@paylocums.com with the subject line "Privacy Request" and describe the right you wish to exercise. We will verify your request by confirming that you control the email address associated with the information, and we may ask for additional information if needed to verify your identity. You may use an authorized agent; we may require proof of the agent's authority and may ask you to verify your identity directly. We will respond within the time required by applicable law (generally 45 days, which may be extended where permitted).

Appeals. If we decline your request, you may appeal by replying to our decision or emailing privacy@paylocums.com with the subject line "Privacy Request Appeal." We will respond to your appeal within the time required by law. If you are not satisfied with our response to your appeal, you may contact your state attorney general.

Customer Data. If your request concerns Customer Data (for example, you are a clinician or facility contact), we act as a service provider and will forward or refer your request to the relevant Customer, and we will assist that Customer in responding as required by our agreement and applicable law.

California disclosures. In the preceding 12 months, we have collected the categories of personal information described in Section 3, which correspond to the following CCPA categories: identifiers (such as name, email address, and IP address); professional or employment-related information (such as company, role, assignments, rates, hours, and credential information processed for Customers); commercial information (such as billing records); and internet or network activity (such as server logs). We collect this information from the sources described in Section 3, use it for the purposes described in Section 5, and disclose it for business purposes to the categories of recipients described in Section 6. We do not sell or share personal information, and we have no actual knowledge of selling or sharing the personal information of consumers under 16. California residents may also request information about disclosures for direct marketing under California Civil Code § 1798.83 ("Shine the Light"); we do not disclose personal information to third parties for their own direct marketing purposes.

10. Communications Choices

Emails that Customers send through the Service (such as timesheet reminders) are sent on the Customer's behalf; to stop receiving them, please contact the staffing company that sent them. We may send account, security, and service-related emails to Customer users, which are necessary to provide the Service. If we send marketing emails, you can opt out at any time using the unsubscribe link in the email or by contacting us.

11. Children's Privacy

The Service is intended for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe we have collected information from a person under 18, please contact us and we will delete it.

12. Location of Processing

PayLocums is based in the United States, and the Service is intended for use in the United States. Personal information is stored and processed in the United States and may be processed in other countries where our service providers operate (for example, through a global content delivery and security network). By using the Service, you understand that your information may be processed outside your state or country of residence, where data protection laws may differ.

13. Customer Data Processing Terms

This Section forms part of the agreement between PayLocums and each Customer (including our Terms of Service) and applies to personal information within Customer Data that PayLocums processes on the Customer's behalf ("Customer Personal Data"). If a Customer has signed a separate data processing agreement with PayLocums, that agreement controls to the extent of any conflict.

• Roles. The Customer is the business or controller of Customer Personal Data, and PayLocums is its service provider, contractor, or processor (as those terms are defined under applicable U.S. state privacy laws). The Customer is responsible for having a lawful basis, providing required notices, and obtaining required consents for the collection and processing of Customer Personal Data, and for the accuracy of Customer Personal Data.
• Instructions. PayLocums will process Customer Personal Data only to provide the Service, as documented in the Terms of Service, this Privacy Policy, and the Customer's use and configuration of the Service (including emails its administrators trigger and integrations it enables), or as required by law. The Customer's use and configuration of the Service constitute its documented instructions. PayLocums will inform the Customer if it believes an instruction violates applicable law, and may decline to follow such an instruction.
• Service provider restrictions. PayLocums will not (a) sell or share Customer Personal Data (as "sell" and "share" are defined under the CCPA); (b) retain, use, or disclose Customer Personal Data for any purpose other than the business purposes specified in our agreement with the Customer, or outside the direct business relationship with the Customer, except as permitted by applicable law; or (c) combine Customer Personal Data with personal information received from other sources, except as permitted by applicable law. PayLocums may create and use de-identified or aggregated data, which it will maintain in de-identified form and will not attempt to re-identify. PayLocums will notify the Customer if it determines it can no longer meet its obligations under applicable privacy law. PayLocums certifies that it understands and will comply with these restrictions.
• Confidentiality. PayLocums will ensure that personnel authorized to access Customer Personal Data are subject to confidentiality obligations.
• Subprocessors. The Customer authorizes PayLocums to engage the subprocessors listed in Section 6 and other service providers needed to operate the Service. PayLocums will impose on each subprocessor written data protection obligations that are appropriate to the services it provides, and remains responsible for its subprocessors' performance as required by law. PayLocums will notify Customers of new subprocessors by updating this Privacy Policy and by email to account administrators at least 30 days before the new subprocessor begins processing Customer Personal Data, except in an emergency. If a Customer has a reasonable, data-protection-based objection, it may notify us within that period; if we cannot reasonably address the objection, the Customer's sole remedy is to terminate the affected subscription and receive a pro-rata refund of prepaid fees for the unused term. Integrations that a Customer chooses to connect (such as QuickBooks Online) are not PayLocums' subprocessors; they are third parties engaged by the Customer.
• Security. PayLocums will implement reasonable administrative, technical, and physical measures designed to protect Customer Personal Data, appropriate to the nature of the data and the Service, as described in Section 8.
• Security incidents. If PayLocums becomes aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Customer Personal Data in systems controlled by PayLocums, PayLocums will notify the affected Customer without undue delay, provide information reasonably available to help the Customer meet any notification obligations, and take reasonable steps to contain and remediate the incident. The Customer is responsible for any notifications to individuals or regulators that are its obligation under law. PayLocums' notification of an incident is not an acknowledgment of fault or liability.
• Assistance. Taking into account the nature of the processing, PayLocums will provide reasonable assistance to the Customer in responding to individuals' requests to exercise privacy rights and in meeting its obligations under applicable privacy laws, largely through the self-service features of the Service. PayLocums may charge a reasonable fee for assistance that goes beyond those features.
• Return and deletion. On termination of the Customer's account, PayLocums will make Customer Personal Data available for export and then delete it as described in Section 7, unless retention is required by law.
• Compliance information. On reasonable written request, and no more than once per year, PayLocums will make available information reasonably necessary to demonstrate its compliance with this Section, such as written responses to a reasonable security questionnaire. Any such information is PayLocums' confidential information. On-site audits are not included unless required by law or agreed in a signed writing, and then at the Customer's expense.
• Prohibited data. Customers must not submit protected health information, patient information, Social Security numbers, bank account details, dates of birth, or other Prohibited Data as defined in our Terms of Service. PayLocums does not act as a HIPAA business associate.
• Liability. Each party's liability arising out of or related to this Section is subject to the limitations of liability and other terms of the Terms of Service.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new "Last Updated" date, and if we make material changes, we will notify Customer administrators by email or in the App before the changes take effect. Your continued use of the Service after the effective date means you accept the updated Privacy Policy.

15. Contact Us

If you have questions about this Privacy Policy or wish to exercise your rights, contact:
PayLocums LLC
Email: privacy@paylocums.com (subject: "Privacy")
Mailing address: 1 E Broward Blvd, Ste 1230, PMB 497783, Fort Lauderdale, FL 33301-3330