Hinge Health Personnel and Candidate Privacy Policy

Effective Date: August 3, 2023 

Hinge Health, Inc. and our affiliates (collectively, “Hinge Health,” “we,” or “our”) are deeply committed to protecting the privacy and security of our customers’ - and our employees’, applicants’, and independent contractors’ (collectively “Personnel”) data. This Personnel Privacy Notice (the “Notice”) describes how Hinge Health collects, uses, and discloses (collectively, “Processes”) personal information about Hinge Health Personnel.

CONTENTS

Who Does This Notice Cover?

Are Other Notices Applicable to You? 

What Personal Information Does Hinge Health Collect about You?

Where Does Hinge Health Obtain Your Personal Information?

How Does Hinge Health Use Your Personal Information?

To Whom Does Hinge Health Disclose Your Personal Information?

Questions and Queries

Notice Updates

Hinge Health, Inc. Addendum and Notice at Collection for California Personnel

WHO DOES THIS NOTICE COVER?

This Notice sets forth Hinge Health’s Privacy Policy (“Privacy Policy”) and describes the practices that we will follow with respect to the privacy of the information of job applicants, directors, employees, contractors, consultants, and other individuals who currently work or previously have worked for Hinge Health (collectively, “Personnel,” “you,” or “your”) and any third parties whose information is provided to us in connection with any Personnel’s application for employment, employment, or engagement relationship with Hinge Health (e.g., emergency contact information).  We encourage you to review this Privacy Policy regularly to stay informed about our information practices and the choices available to you. 

Where we refer to “Personnel,” “employment” or “engagement” in this Notice, we do so for convenience only, and these terms should in no way be interpreted as purporting to confer employment status on non-employees such as applicants or independent contractors to whom this Notice also applies. This Notice does not form part of any contract of employment or engagement, does not confer any employment status or contractual right on any Personnel, and does not place any contractual obligation on us.

This policy does not apply to the actions of any company or entity that we do not control and to individuals who we do not directly employ or manage. 

As used in this Privacy Policy, the terms “using” and “processing” information may include, amongst other things, subjecting such information to analysis, using cookies or web beacons, and managing information in a number of ways, including but not limited to: collection, storing, evaluating, modifying, deleting, using, combining, and/or disclosing.

Some of the individually identifiable information we collect may constitute protected health information (“PHI”) under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended from time to time.  PHI is subject to special protections under HIPAA. If you are a member of Hinge Health, Inc. Group Health Plan, for more information about your rights under HIPAA, please refer to Hinge Health, Inc. Group Health Plan’s Notice of Privacy Practices. To the extent other state or local privacy and data protection laws apply to your data, we will comply with those requirements as well.  The Notice of Privacy Practices does not apply to information that is not PHI.  This Privacy Policy supplements the Notice of Privacy Practices for PHI.  If there is ever any conflict between this Privacy Policy and the Notice of Privacy Practices, the Notice of Privacy Practices will apply.

Should you have any questions about this policy or our practices or to get a copy of our Notice of Privacy Practices, please send an email to hr@hingehealth.com.

ARE OTHER NOTICES APPLICABLE TO YOU?

This Notice does not cover our Processing of personal information collected from you as a Hinge Health customer or a visitor of our websites or mobile applications. To learn more about Hinge Health’s data collection practices in these cases, please read our online Privacy Policy available at https://www.hingehealth.com/about/privacy/. Over the course of your employment or engagement with us, you may provide personal information to third parties that partner with Hinge Health. This could be, for example, when you voluntarily sign up for certain services or benefits programs provided by third parties to our Personnel. By participating in such services or benefits programs, you understand that your personal information will be treated in accordance with the privacy policies of the third parties that provide these services and programs, and Hinge Health has no control over their privacy practices. Please carefully review the applicable privacy policies before signing up for or interacting with third-party services or programs and contact the third-party providers directly with questions regarding their privacy practices.

WHAT PERSONAL INFORMATION DOES HINGE HEALTH COLLECT ABOUT YOU?

We collect personal information in order to manage our relationship with you during the course of your application, employment, or engagement with us.The categories of personal information we collect include:

• Identifiers, such as a name, alias, postal address, signature, unique personal identifier, online identifier, internet protocol address, email address, account name, social security number, driver’s license number, passport number, date of birth, citizenship, and other similar identifiers;

• Eligibility to work information, such as citizenship, work permit, or visa application information;

• Financial information, such as banking and direct deposit forms, salary, tax forms, and expense reimbursement records;

• Information related to health insurance and other benefits, which relates to the application for, changes to, and enrollment in employee health and welfare benefits, life insurance, and retirement accounts, details on such benefits such as contribution and deferral levels, the names and other legally required information of beneficiaries, information about your spouse, partner, and dependents, and emergency contact information; 

• Characteristics of protected classifications under state or federal law, such as age and gender, marital status, race or ethnicity, sexual orientation, veteran status, and disability status;

• Internet or electronic network activity information, including, but not limited to, browsing history, search history, information regarding your interaction with our websites, applications, and platform, and other information collected via cookies, web beacons and similar technologies;

• Geolocation data when you use certain Hinge Health-issued devices on Hinge Health properties, such as our distribution centers; 

• Audio, visual, or similar information, such as photos and information gathered via cameras and CCTV; 

• Professional and employment-related information, such as performance reviews and disciplinary reports; your applications, resumes, curriculum vitae, and cover letters, personal information provided by references or included in criminal background checks, and our assessment of recruitment information; job title, picture, and employee number; work-related documentation including records, forms, logs, and agreements and benefits elections;

• Health and health-related information, such as medical conditions and health records or information related to symptoms of, or risk of exposure to, certain illnesses (e.g., contact with others who may be sick or relevant travel history);

• Education information, such as names and graduation dates of educational institutions attended; 

• Employee-only social networking platform interactions, including, but not limited to, profile information, content submitted to the platform, and usage activity; and 

Monitoring: We reserve the right to monitor the use of our premises, equipment, devices, computers, network, applications, software, and similar assets and resources. In the event such monitoring occurs, it may result in the collection of personal information about you. Some Hinge Health facilities are equipped with surveillance equipment, such as cameras and CCTV, which may capture your image or information about your movements, and which may be used to protect the safety of Hinge Health staff, visitors, and property, to monitor and troubleshoot issues with equipment or technology, or otherwise for any lawful purpose. In addition, any and all telephone conversations or transmissions, electronic mail or transmissions, or internet access or usage by Personnel by any electronic device or system, including but not limited to the use of a computer, telephone, wire, radio, or electromagnetic, photoelectronic, or photo-optical systems may be subject to monitoring at any and all times by any lawful means. This is not meant to suggest that all Personnel will in fact be monitored, but to alert you that, when using Hinge Health equipment and resources, you should not have any expectations of privacy with respect to your use of such equipment or resources. We will ensure that any personal information generated by this monitoring is treated in accordance with this Notice.

Sensitive Information: In some cases, we may collect sensitive personal information about Personnel, which requires a higher level of protection. Please note that, where permitted by law, we may collect, store, and use sensitive personal information about you, including race, ethnicity, veteran status, disability status, gender, sex, age, marital status, and health and medical conditions. We collect this information for specific purposes, such as to accommodate a disability or illness, provide benefits, comply with legal obligations such as anti-discrimination or diversity regulations (where applicable), protect the health and safety of our employees, and facilitate internal programs relating to diversity, equity, inclusion, and anti-discrimination. Please be assured that we will only use such sensitive information for the purposes set out in this Notice, or as otherwise described to you at the time such information is collected -- and in accordance with applicable law.

WHERE DOES HINGE HEALTH OBTAIN YOUR PERSONAL INFORMATION?

Generally, we collect personal information directly from you in circumstances where you provide it (for example, when you applied to work for us, during the onboarding process and benefits enrollment, as part of health or safety screenings, and through participation in voluntary employee programs or platforms). 

If you choose to apply for a job opening or create an account on our career websites (or if you are a third-party agency or recruiter submitting an application on behalf of an applicant), we obtain the personal information and other information you submit in connection with your application and/or account creation. This information may vary depending on the requirements of a specific position. You may choose to provide us with access to certain information maintained by third-party websites or services, such as by asking us to import information contained in your employment network or social network profiles (e.g., LinkedIn). The information we may receive varies by website or service and is controlled by the third-party provider and your privacy settings. By authorizing our access to this information, you agree that we may collect, store, and use this information in accordance with these terms. We are not responsible for the privacy or security practices of any non-Hinge Health-operated websites or services, including those that may be linked through our career websites, and we encourage you to review the privacy policies and other terms of use applicable thereto.  When you visit and use our career websites, we may automatically collect or log certain information about your visits and usage, using technologies such as cookies, server logs, and web beacons. This information may include your internet protocol (IP) address, technical information about browsers and devices used to access the career websites, and information about crashes or other technical issues. This information is generally aggregated to analyze and improve the quality and reliability of the career websites; it is not used to make employment-related decisions. At this time, the career websites are not designed to respond to “Do Not Track” signals, or similar mechanisms, from browsers.

We may also collect personal information automatically, such as when monitoring the use of our premises, equipment, devices, computers, network, applications, software, or similar assets and resources. We may also obtain personal information from your previous employers or educational institutions, from other employees (e.g. performance reviews), third-party service providers (e.g. benefit providers), your named references, medical professionals, legal bodies, and publicly accessible sources such as your LinkedIn profile and other social media platforms. Once we have obtained your personal information, we may store it outside of the United States in accordance with our data privacy and security policies.

HOW DOES HINGE HEALTH USE YOUR PERSONAL INFORMATION?

We use personal information for human resources and other business purposes, including establishing, managing, and terminating employment relationships and to manage our business, keep our systems secure, and to comply with specific legal obligations. In particular, we use personal information for the following purposes:

• Recruitment purposes, such as communicating with you about your interest in a role with Hinge Health, job opportunities, and your job applications; processing job applications; assessing your suitability for a role with Hinge Health; identifying candidates for open roles with Hinge Health; to conduct a background check on you, but only after extending a conditional offer of employment; 

• Personnel management, such as monitoring assignments, evaluating performance, making compensation determinations, training Personnel, communicating with you and responding to your requests, inquiries, and comments, carrying out disciplinary and grievance investigations, hearings, and appeals, making and recording disciplinary decisions, and considering those decisions in subsequent relevant employment and business decisions; 

• Operational purposes, such as distributing payroll and company benefits, updating Personnel files, conducting audits and training, reimbursing business expenses, providing IT support, facilitating participation in voluntary employee programs and platforms, and managing shifts, working hours, and attendance;

• Benefits administration purposes, such as administering and maintaining group health insurance benefits and additional wellness programs, retirement plans, life insurance, disability insurance, leave programs, and other Hinge Health-offered benefit programs;

• Marketing activities, such as using Personnel photos, videos, social media posts, and other content for internal and external marketing activities;

• Statistical and analytical purposes to understand and improve worker satisfaction, engagement, and performance;

• Administration of our applications, software and systems, including ensuring the security of our workforce, guests, property and assets and to monitor and audit network traffic and information in such applications, software and systems as permitted under applicable law;

• Legal and compliance purposes, such as implementing internal policies, detecting, investigating, and responding to suspected fraud, security incidents, or other activity that is illegal or violates Hinge Health’s policies, protecting Hinge Health’s and others’ rights and property, exercising a legal claim, cooperating with law enforcement investigations and complying with applicable laws, regulations, legal processes, or governmental requests;

• To protect the health, safety, and vital interests of Personnel or of another natural person, such as during an emergency where the health or security of Personnel is in danger, to prevent physical harm or financial loss, or to comply with our legal obligations or public health recommendations;

• To comply with legal obligations and internal policies relating to diversity, inclusion, and anti-discrimination; 

• As necessary and appropriate to provide reasonable workplace accommodations; 

• As necessary for the performance of a contract or in order to take steps at the request of our Personnel prior to entering into a contract (if you do not provide certain information when requested, we may not be able to perform the contract we entered into with you, such as paying you or providing a benefit); and

• To enable solely internal uses in a lawful manner that are reasonably aligned with expectations of Personnel based on our work relationship and that are compatible with the context in which the information was provided to Hinge Health.

TO WHOM DOES HINGE HEALTH DISCLOSE YOUR PERSONAL INFORMATION?

Within Hinge Health: We disclose personal information to Personnel and affiliates who need to know the information for the purposes described above, including Human Resources, Payroll, and Information Technology departments. We also disclose personal information with legal affiliates to the extent necessary. 

Third-Party Service Providers: We use third party service providers and contractors to perform services on our behalf. For example, we disclose certain information with service providers who assist with talent acquisition, the administration of payroll, pension, benefits, performance management, training, communication platforms, and expense management, and facilitate internal programs relating to diversity, inclusion, and anti-discrimination.

Professional Advisors: We disclose information with our professional advisors, including accountants, auditors, lawyers, insurers, and bankers, if needed. We only permit these advisors to Process your personal information for specified purposes and, as appropriate, in accordance with our instructions and the provisions of this Notice and applicable law. Law Enforcement, Government Authorities, Regulators, and Similar Third Parties: We disclose personal information to courts, government authorities, independent external advisers, and internal compliance and investigation teams if we believe such disclosure is in accordance with, or is otherwise required by, any applicable law regulation, or legal process.  Other Third Parties: In certain limited circumstance, we may disclose personal information with other third parties, including (a) to comply with our legal obligations, to protect the rights and property of Hinge Health, our customers and the public, to cooperate with law enforcement investigations, and to detect and respond to suspected illegal activity and threats to the health or safety of any person or of our systems or services; (b) in connection with, or during negotiations of, any merger, joint venture, sale of company assets, financing, or acquisition of all or a portion of our business, assets or stock by another company (including in connection with any bankruptcy or similar proceedings); and/or (c) with your consent and at your direction. In certain circumstances and only as necessary in connection with business operations, work contact details may be provided to customers, potential customers, and other third parties, where the disclosure is required by role.  We may also disclose aggregated or de-identified information, which cannot reasonably be used to identify you. Hinge Health Processes, maintains, and uses this information only in a de-identified fashion and will not attempt to re-identify such information except as permitted by law. 

QUESTIONS AND QUERIES

If you have any questions regarding this Notice or questions regarding your privacy rights, please contact us at hr@hingehealth.com or (855) 902-2777.

NOTICE UPDATES

We may change this Notice from time to time. Each version of this Notice is identified by its effective date. If we make changes to this, we will notify you by revising the date at the top of this Notice. If we make material changes, we will provide you with additional notice, such as by sending you a notification. 

HINGE HEALTH, INC. ADDENDUM AND NOTICE AT COLLECTION FOR CALIFORNIA PERSONNEL

This Hinge Health Addendum for California Personnel (“Addendum”) supplements the Hinge Health Personnel Privacy Notice (“Notice”) and provides additional information about our privacy practices and your privacy rights, as required by California law. If you are a California resident, this Addendum applies to you.

ADDITIONAL DISCLOSURES

In the preceding 12 months, we have collected the following categories of personal information: identifiers; characteristics of protected classifications under California or U.S. law; internet and electronic network activity; geolocation data; audio, visual, or other sensory information; professional or employment-related information; education information; and sensitive personal information. We collect such categories of personal information directly from you when you submit information to us, indirectly from parties such as references and emergency contacts, automatically through surveillance equipment or other devices, and we also develop data during our interactions with you.

We collect, use, and disclose personal information for the following business purposes: general administration of Personnel, payroll processing, recruiting and hiring, human resources purposes, benefits administration, to protect the interests of Hinge Health and others, legal compliance purposes, to operate third party relationships to conduct our business, and as otherwise explained in our Notice. We do not use or disclose your sensitive personal information for purposes other than those expressly permitted by California law. 

In the preceding 12 months, we have disclosed the following categories of personal information for business purposes to the following categories of recipients:

YOUR PRIVACY RIGHTS

California residents have certain rights with respect to their data, including the following: 

• Right to Access: You may ask us to confirm whether we are processing your personal information and, if so, to provide you with a copy of the personal information we hold about you (along with certain other details). 

• Right to Correction: If the personal information we hold about you is inaccurate or incomplete, you are entitled to ask for correction or completion. 

• Right to Deletion: You may ask us to delete or remove your personal information in some circumstances—for example, if we no longer need it. 

To request access, correction, or deletion of your personal information, please contact us at hr@hingehealth.com, (855) 902-2777, or via mail at 455 Market Street, Suite 700, San Francisco, CA 94105. You may designate an authorized agent to exercise privacy rights on your behalf by providing the authorized agent signed permission to submit the request on your behalf. If an authorized agent submits a request on your behalf, we may need to contact you to verify your identity and protect the security of your personal information. If you are an authorized agent seeking to make a rights request, please contact us at hr@hingehealth.com or (855) 902-2777.

Any request to exercise one of these rights will be assessed by Hinge Health on a case-by-case basis. There may be circumstances in which we are not legally required to comply with your request because of a relevant legal exemption provided for under applicable law. We will not discriminate or retaliate against you for exercising your privacy rights. If you choose not to disclose certain personal information, this may limit our ability to perform certain activities, such as administer your payroll or benefits. 

“SALES” AND “SHARING” OF PERSONAL INFORMATION

We do not “sell” or “share” your personal information as those terms are defined under California law. We also do not have any knowledge of any “sales” or “sharing” of the personal information of minors under 16 years of age.

DATA RETENTION

The length of time we retain your personal information depends on the status of our relationship with you and the requirements of applicable law. We will retain your personal information for as long as your employment or engagement with us lasts and for a certain period thereafter, after which point it will be deleted or archived in accordance with applicable law. To determine that period, we take into account a number of factors, including our legal and regulatory obligations (such as financial reporting obligations and equal opportunity or anti-discrimination reporting obligations) and whether we may need to retain personal information to resolve disputes, make and defend legal claims, conduct audits, pursue legitimate business purposes, and/or enforce our agreements.