Quantum Health California Employee and Job Applicant Notice

QUANTUM HEALTH, INC.

PRIVACY POLICY AND NOTICE OF COLLECTION OF PERSONAL INFORMATION OF CALIFORNIA EMPLOYEES AND APPLICANTS UNDER THE CALIFORNIA CONSUMER PRIVACY RIGHTS ACT (CPRA)

Quantum Health and its subsidiaries, affiliates and related entities (including but not limited to Embold Health, Inc. and Cirrus, M.D. (collectively “Quantum Health,” “we,” “us,” and “our”) collects and uses your personal information for human resources, employee benefits, payroll, health and safety, information security, regulatory compliance and other legitimate business purposes. We are committed to using reasonable safeguards to maintain the privacy and security of our employees’ and job applicants’ personal information in compliance with applicable law.

For purposes of this Privacy Notice, we refer to personal information according to the following definition given in the CCPA: “personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household. Personal information does not include publicly available information, information that is de-identified or aggregated information, or other information that is outside the scope of the CCPA.

We may collect the personal information and sensitive personal information categories listed in the tables below. The tables also lists, for each category, our use purposes and whether we share it with third parties for cross-context behavioral advertising. This description also sets out the personal information we have collected over the last twelve (12) months. Please note Quantum Health does not sell personal information or sensitive personal information. As noted in the chart below, our “sharing” of job applicant/employee personal information is limited only to information collected via cookies and other tracking technologies when an applicant or employee visits Quantum Health’s public website, such as your IP address, browser information, and device information.

Table
Personal Information Category	Business Purpose	Shared?
Identifiers, such as name, alias, postal address, and email address.	To communicate with you throughout the hiring process To assess your qualifications, skills, and suitability for the considered job To verify your provided information and carry out background checks To comply with applicable laws, regulations, legal processes or enforceable governmental requests, e.g. immigration and visa laws and requirements To administer the employment relationship (including employee lifecycle activities, internal system access, payroll purposes, benefits enrollment) Investigate and respond to misuse of our websites or related applications	No
California Customer Records Personal Information, such as name and contact information	To communicate with you throughout the hiring process To assess your qualifications, skills, and suitability for the considered job To verify your provided information and carry out background checks To comply with applicable laws, regulations, legal processes or enforceable governmental requests, e.g. immigration and visa laws and requirements To administer the employment relationship (including employee lifecycle activities, internal system access, payroll purposes, benefits enrollment)	No
Protected classification characteristics under California or federal law, such as age and race	To comply with applicable laws, regulations, legal processes or enforceable governmental requests, and compliance reporting Benefit enrollment (date of birth and gender) Perform workforce analytics, data analytics, and benchmarking Engage in human capital analytics, including to identify correlations about individuals and job success, analyze data to improve retention and productivity, and analyze employee preferences to inform human resources policies and procedures	No
Internet or other similar network activity, such as your browsing history on Quantum Health devices and networks	Improve efficiency, logistics, and supply chain management Ensure employee productivity and adherence to Quantum Health policies Conduct internal audits and investigate complaints, grievances, and suspected violations of the Quantum Health’s policies Ensure the security of our website and systems	Yes (only in the context of job applicants / employees visiting Quantum Health’s websites)
Geolocation data, such as the IP address of the device from which you access our website or systems	Improve safety of employees, customers, and the public regarding use of the Company property and equipment Prevent unauthorized access, use, or loss of Quantum Health devices Improve efficiency, logistics, and supply chain management Ensure employee productivity and adherence to Quantum Health policies Conduct internal audits and investigate complaints, grievances, and suspected violations of the Quantum Health’s policies Ensure the security of our website and systems	Yes (only in the context of job applicants / employees visiting Quantum Health’s websites)
Professional or employment-related information, such as your employment history	Recruit and process employment applications, including verifying eligibility for employment, background checks, and onboarding Maintain personnel records and comply with record retention requirements Comply with applicable state and federal labor, employment, tax, benefits, workers' compensation, disability, equal employment opportunity, workplace safety, and related laws Ensure employee productivity and adherence to Quantum Health policies Conduct internal audits and investigate complaints, grievances, and suspected violations of Quantum Health policy	No
Non-public education information	Background check purposes Tuition Reimbursement approval Evaluate an individual’s appropriateness for hire or promotion to a new position at Quantum Health	No
Inferences drawn from other personal information	Engage in human capital analytics, including to identify correlations about individuals and job success, analyze data to improve retention and productivity, and analyze employee preferences to inform human resources policies and procedures To comply with applicable laws, regulations, legal processes or enforceable governmental requests, and compliance reporting	No

Table
Sensitive Personal Information Category	Business Purpose	Shared?
Government identifiers (social security, driver's license, state identification card, or passport number)	Communicate with you throughout the hiring process Assess your qualifications, skills, and suitability for the considered job Verify your provided information and carry out background checks (i.e., employment eligibility verification, background checks, etc.) Administer the employment relationship (including employee lifecycle activities, internal system access, payroll purposes, benefits enrollment) Investigate and respond to misuse of our websites or related applications Communicate with employees and their emergency contacts and plan beneficiaries Respond to law enforcement requests and as required by applicable law or court order	No
Complete account access credentials (user names, account numbers, or card numbers combined with required access/security code or password)	Support employee access to business applications. Prevent unauthorized access to or use of the Quantum Health information systems, electronic devices, network, and data	No
Racial or ethnic origin	Comply with federal and state equal employment opportunity laws Perform workforce analytics, data analytics, and benchmarking Conduct internal audits and investigate complaints, grievances, and suspected violations of Quantum Health policy	No
Religious or philosophical beliefs	Review and process religious reasonable accommodation requests Exercise or defend the legal rights of Quantum Health and its employees	No
Mail, email, or text messages contents not directed to us	For any employee relations and/or compliance investigations and to comply with any other legal requests Support effective knowledge management after employee transition Exercise or defend the legal rights of Quantum Health and its employees	No
Health, sex life, or sexual orientation information	For reasonable accommodation purposes, if applicable Investigate and process workers' compensation claims	No

Our Retention of your Personal Information and Sensitive Personal Information. If your application leads to you becoming an Quantum Health employee, relevant information we collect about you during the hiring process will become a part of your employment record and retained in accordance with applicable law.

If you did not become a Quantum Health employee, and you do not want to be considered for future job opportunities, we retain your personal data for as long as necessary:

to comply with our legal obligations such as immigration and visa requirements, or
to resolve any disputes related to the hiring process.

If you have consented to being considered for future job opportunities, we may retain your personal data as needed for this purpose. After this period, you will be asked to renew your consent. All personal data retained by Quantum Health will be stored in a secure and confidential manner with limited access rights.

We collect, use and disclose the categories of your personal information for the following purposes:

· To administer to the employment relationship, including administering and managing employee recruitment, hiring, qualifications, performance, promotions, payroll, timekeeping, discipline, training, taxes, leave, vacation and termination.

· To communicate with you and reach your emergency contacts when necessary.

· To administer to employee benefits, such as health insurance.

· To monitor access to company facilities, equipment, accounts and systems and to maintain the security of our information systems.

· To conduct a corporate transaction, including a sale or transfer of our assets.

· To perform workforce analytics and EEO reporting.

· To maintain the health and safety of our workplace.

· To comply with applicable laws and regulations.

· To maintain records required by law.

· To conduct workplace investigations.

· To prosecute or defend legal claims, and respond to court orders, subpoenas or governmental information requests.

· To operate the company’s businesses and maintain compliance with its workforce and other corporate policies and procedures.

We have collected your personal information from the following categories of sources:

· From you directly, when you apply and/or interview for a job, or fill out other employment-related paperwork;

· From a third party who referred you;

· Publicly available information from publicly available sources relevant for the hiring process (e.g., your LinkedIn profile);

· Information received from internal and external reference and background checks, including criminal records at offer stage only (if applicable for the position you have applied for, and as permitted by applicable laws); and

· Outcomes of any recruiting exercises you complete, including personality/reasoning ability tests and, for certain roles, recordings of presentational based interviews.

We have disclosed the following categories of personal information and sensitive personal information to third parties in the last 12 months:

Table
Personal Information Category	Business Purpose Disclosures	Categories of Third Party Recipients
Identifiers, such as name, alias, postal address, and email address.	To verify your provided information and carry out background checks To comply with applicable laws, regulations, legal processes or enforceable governmental requests (e.g., immigration and visa laws and requirements) To administer the employment relationship (including employee lifecycle activities, internal system access, payroll purposes, benefits enrollment)	Service providers in connection with conducting background checks, administering employee benefits and payroll, arranging employee travel Government agencies
California Customer Records Personal Information, such as name and contact information	Performing services for Quantum Health, including to verify your provided information, carry out background checks, and administer the employment relationship (including employee lifecycle activities, internal system access, payroll purposes, benefits enrollment) To comply with applicable laws, regulations, legal processes or enforceable governmental requests, e.g. immigration and visa laws and requirements	Service providers in connection with conducting background checks, administering employee benefits and payroll, arranging employee travel Government agencies
Protected classification characteristics under California or federal law, such as age and race	To comply with the law and Quantum Health’s reporting obligations	Service providers in connection with administering employee benefits and payroll Government agencies
Internet or other similar network activity, such as your browsing history on Quantum Health devices and networks	Performing services for Quantum Health, including to provide, improve, and troubleshoot our website Helping to ensure security and integrity	Outside organizations in connection with providing products and services, completing transactions, supporting our everyday operations, or business management and development.
Geolocation data, such as the IP address of the device from which you access our website or systems	Performing services for Quantum Health, including to provide, improve, and troubleshoot our website Helping to ensure security and integrity	Outside organizations in connection with providing products and services, completing transactions, supporting our everyday operations, or business management and development.
Professional or employment-related information, such as your employment history	Performing services for Quantum Health, including verifying your provided information, conducting background checks for job applicants, and administering employee benefits To comply with the law and Quantum Health’s reporting obligations	Service providers in connection with conducting background checks and administering employee benefits Government agencies
Non-public education information	Performing services for Quantum Health, including verifying your provided information, conducting background checks for job applicants To comply with the law and Quantum Health’s reporting obligations	Service providers in connection with conducting background checks and administering employee benefits Government agencies
Inferences drawn from other personal information	To comply with the law and Quantum Health’s reporting obligations	Government agencies

Table
Sensitive Personal Information Category	Business Purpose Disclosures	Categories of Third Party Recipients
Government identifiers (social security, driver's license, state identification card, or passport number)	Performing services for Quantum Health, including verifying your provided information, conducting background checks for job applicants To comply with the law and Quantum Health’s reporting obligations	Service providers in connection with conducting background checks and administering employee benefits Government agencies
Racial or ethnic origin	To comply with the law and Quantum Health’s reporting obligations	Government agencies

Notice of Rights

Your rights regarding your personal information.

You have the following rights in personal information held by us:

The right to know. You have the right to request that we disclose the personal information we collect, use and disclose about you. You may “request to know”: (i) the categories of personal information that we have collected about you; (ii) the categories of sources from which the personal information is collected; (iii) the business or commercial purpose for collecting, selling or sharing your personal information; (iv) the categories of third parties with whom we disclose your personal information; and (v) the specific pieces of personal information that we have collected about you. Your request may pertain to the personal information collected about you on or after January 1, 2022. If your request covers a time period beyond 12 months from the date of your request, we may deny your request as to that time period where it would be impossible for us to provide you with the information or involve disproportionate effort. We may deny your request to search for certain information under certain circumstances (e.g., where we retain the information solely for legal and compliance purposes).

The right to data portability. You have the right to receive specific pieces of your personal information in a format that is understandable, and to the extent technically feasible, in a structured, commonly used, machine readable format that allows you to transmit the information to another entity.

The right to correct. You have the right to correct inaccurate personal information. Once we receive a correction request and confirm your identity (see Exercising Your Rights to Know, Delete, or Correct), we will review the contested information’s accuracy, considering the totality of the circumstances, and determine if it is more likely than not that the personal information we maintain is inaccurate. We will review and consider any documentation you provide to support your correction request and encourage you to make a good faith effort to provide us with all necessary information during the request submission process. If we determine it is more likely than not that the personal information is inaccurate, we will correct such information on our systems and instruct all service providers and contractors to whom such personal information was disclosed to make the necessary corrections in their respective systems. However, not all inaccurate information may warrant correction.

The right to delete. You have the right to request deletion of personal information under certain circumstances. For example, we may not be required to delete personal information if:
We need to retain the information to comply with a legal obligation;
The personal information is needed for employment purposes, such as payroll, government data reporting, and health care;
The personal information is needed to perform a contract between us, such as to award stock options or pension benefits; and/or
Deleting the information prevents Quantum Health from exercising our legal rights.

The right to opt out of personal information sales/sharing. To the extent Quantum Health engages in the sale/sharing of personal information, you have the right to opt out of such disclosures.

The right to non-discrimination. You have the right not to receive discriminatory and non-retaliatory treatment for the exercise of any of these rights. We will not discriminate or retaliate against you because you have exercised your rights.

Further, Quantum Health only uses and discloses your sensitive personal information for statutorily-permitted purposes. Therefore, Quantum Health does not offer you the ability to request that we limit our uses and disclosures of your sensitive personal information.

Exercising Your Rights to Know, Delete, or Correct

You may submit requests concerning your rights to know, data portability, correct, and delete by contacting us by e-mail to Privacy@quantum-health.com or by telephoning us at 800-257-2038. We will use reasonable methods for verifying that the person making a request to know, data portability, request to correct or a request to delete is the individual about whom we have collected personal information.

For requests to delete made electronically, you will be required to submit the request to delete, and then separately confirm that you want your personal information deleted. To the extent that you wish to use an authorized agent to make requests concerning the rights set forth above, you will need to provide us either with a power of attorney or, alternatively, with signed authorization to communicate with your authorized agent, and directly confirm that you provided the authorized agent with permission to submit the request.

We will (i) confirm receipt of requests to know, data portability, to correct inaccurate information or to delete within 10 business days of receiving the request and provide information concerning how we will process the request; and (ii) generally respond to requests to know, data portability or to delete within 45 calendar days of receiving the request. If we need additional time to respond to your request beyond the 45 calendar days, we will provide you with notice explaining the reasons we need more time, and we will then take up to an additional 45 calendar days to respond to your request.

Opting out of Personal Information Sales/Sharing

Quantum Health does not engage in the sale of personal information or sensitive personal information, but we do use cookies and other technologies on our public-facing website for online advertising and analytics. We may disclose certain online identifiers with our advertising partners and analytics providers. Disclosing these identifiers with third parties for advertising or analytics purposes may be defined as the “sale” or “sharing” of your data under the CCPA. You may opt-out of the sale or sharing of your data for marketing or analytics by clicking on Do Not Sell or Share My Personal Information and unselecting targeting cookies. You can also opt out by visiting our website with a legally recognized opt-out preference signal enabled, such as the Global Privacy Control. Please note that you may need to renew your opt-out choice if you visit the website with another device or browser, or if you clear your cookies. You may opt back in to personal information sales or sharing at any time using the same link. If you opt-out of this type of “sale” or “sharing” of your data, we will not deliver customized advertising to you. You may still see non-targeted advertising about our products and services.

Once you make an opt-out request, we will wait at least twelve (12) months before asking you to reauthorize personal information sharing. However, you may change your mind and opt back in to personal information sharing at any time by clicking “Your Privacy Choices” in the footer of our website.

Changes to this Privacy Notice

We may modify this Privacy Notice at any time in order to address our business needs or changes in applicable laws and regulations.

If you have any questions concerning this Notice, please contact us at Privacy@quantum-health.com.

Last Updated: July 10, 2026