1. Provider and scope

Effective date: October 10, 2026. The Service is offered only for use in the United States.

Reliable Betel Corp. ("we" or "Provider"), operates Care Staff Manager. This Policy covers our website, web and mobile applications, APIs, account administration, and support.

Customer organizations use the Service for workforce and, where enabled, patient, visit, care, and billing workflows. We handle their workspace information on their behalf under their lawful instructions and agreements. Customers determine operational purposes and access. For our own account administration, subscription transactions, support, and security, we determine the purposes described here.

This Policy does not replace a customer's privacy practices notice, employment notices, or BAA. Acknowledgment does not authorize PHI disclosure or supply consent to advertising, optional tracking, or charges. HIPAA-covered processing remains governed by the applicable BAA and law.

2. Information handled

Information depends on enabled modules, permissions, and use:

• Organization and accounts: organization, representative name and title, work email, contacts, tenant/user identifiers, roles, account status, authentication and recovery records.
• Workforce and recruitment: staff and caregiver profiles, availability, languages, skills, credentials, applicants, documents and review history, assignments, hours, tasks, rates, and payroll exports where used.
• Patient and service records: identity and contacts, date of birth, addresses, representatives, emergency contacts, care instructions and plans, authorizations, visits, coverage, payers, claims, remittances, and supporting records where enabled. These may contain health and other sensitive information.
• Visit verification: check-in/out times, corrections, and, when the mobile visit workflow requests location and permission is granted, device latitude, longitude, and accuracy. Unavailable or denied capture results may be recorded. Collection occurs for visit actions and is not intended as continuous background tracking.
• Files and communications: selected uploads, metadata, document acknowledgments, notifications, preferences, delivery/read states, support requests, and contact messages. Do not put passwords, card details, or patient records in ordinary public contact forms.
• Subscription and acceptance: plan/add-ons, recurring amount, subscription/invoice status, payment processor identifiers, accepted legal versions, and representative identity and authority. Subscription payment credentials are entered through Stripe; our administration uses transaction details rather than full card credentials.
• Technical/security data: sessions, access/audit events, network/browser information, platform, app version, errors, and diagnostics. Some identifiers are hashed; hashing does not necessarily anonymize information. Configured mobile diagnostics may go to Sentry, including diagnostic sessions and hashed user/tenant identifiers.

Sources include users, customer administrators, customer-authorized integrations, service providers, and interactions with the Service. Required account fields support registration; other information may be necessary only for a selected workflow.

3. Uses

We use information to deliver authorized workflows, authenticate users, enforce permissions, administer subscriptions, preserve acceptance evidence, communicate operational notices, deliver selected notifications, support users, investigate errors and misuse, protect accounts, and meet legal duties. Workspace information is used within Customer's instructions and agreements.

We do not sell personal information, share it for cross-context behavioral advertising, use Customer Data to train general-purpose artificial intelligence models, or use PHI for independent marketing. Policy changes do not supply consent for materially different uses of previously collected information.

Where law requires a legal basis, we rely on the basis appropriate to the activity, such as performing an agreement, complying with law, legitimate interests where permitted, or consent where required. Customer is responsible for processing it instructs. This statement does not itself establish compliance with every jurisdiction's law.

4. Recipients

Disclosures are restricted to the stated purposes and applicable law and agreements:

• Customer and authorized users: permissions govern workspace access. An employer or administrator may control an account and operational records. Patient or representative access depends on Customer's authorized workflow.
• Service providers: hosting, databases, private storage, notifications, payments, diagnostics, and support providers receive what is necessary and are subject to appropriate contractual restrictions. Required PHI subcontractor agreements must precede PHI transfers.
• Customer-directed integrations: payers, clearinghouses, payroll systems, or others receive information when Customer lawfully directs enabled transfers. Their separate duties and notices may apply.
• Legal/protective disclosures: information may be disclosed when legally required or necessary and legally permitted to protect rights/security. PHI disclosures must satisfy the BAA and law; an ordinary subpoena does not automatically remove those restrictions.
• Business succession: a lawful merger, acquisition, or reorganization may transfer information to a successor assuming applicable protection duties. The transaction alone does not authorize unrelated new uses.

We do not make one customer's records available to unrelated customers. Request the applicable processing-provider and location inventory at support@carestaffmanager.com.

5. Storage and device permissions

The web app uses authentication/security cookies and local language/theme preferences. Blocking necessary storage can prevent login or disable features. This Policy does not authorize optional advertising trackers; technologies requiring consent must be separately disclosed before use.

The mobile visit workflow requests location permission. Users can manage it in device settings. Denial may affect verification and require Customer's approved exception process; it does not supply alternative consent or automatically invalidate all access. Selected-file upload permits access for that action rather than scanning the entire library. Other optional device features remain subject to actually requested permissions.

6. Retention

We retain information only as necessary for the applicable service purpose, lawful customer instructions, mandatory recordkeeping, security, disputes, and legal holds. Customer healthcare duties may require retention after a user leaves. Deactivation, archival, and cancellation do not necessarily delete records.

Rules do not authorize PHI retention beyond the BAA. Where disposition is infeasible or a hold applies, we restrict processing, explain the exception to the authorized customer, and maintain protections. Backups are protected and not used for ordinary operations. Required deletions must be reapplied after restoration.

7. Requests and choices

Contact support@carestaffmanager.com for access, correction, export, deactivation, deletion, or other applicable rights. Identify the account/organization without emailing sensitive health records or credentials. We verify identity and authority, use secure channels when needed, respond within legal deadlines, and explain lawful limitations.

For customer-controlled records, contact the organization's administrator or privacy officer. We route directly received requests appropriately and assist under our agreement and law. We cannot disclose another person's records or erase required clinical, billing, or audit history merely on an account user's request. HIPAA access/amendment rights are handled through the applicable Covered Entity and BAA procedures.

Users can change permitted profile fields and notification preferences; some changes require an administrator. Operational/security communications may be necessary. Optional communications and permissions use available preferences/device controls. We do not discriminate for exercising legally protected rights. Where law provides an appeal or complaint right, our response identifies the route.

8. Security and incidents

We maintain administrative, technical, and physical safeguards appropriate to information and legal duties. Access controls, authentication, authorization, and audit mechanisms support protections. No service guarantees prevention of all unauthorized access or loss.

Report suspected compromise to support@carestaffmanager.com. We investigate and take appropriate containment/remediation measures. Required notices follow law and, for customer PHI, the BAA. This Policy is not an independent security certification or a promise that every production control has been independently audited.

9. Locations and special records

Production information is stored or processed in the United States. Provider access locations appear in the applicable inventory. Required cross-border safeguards must precede such processing; accepting this Policy alone does not establish them.

The Service is for organizational use by authorized adults; we do not offer accounts directly to children. Customer records may concern patients of any age where Customer has lawful authority and an appropriate workflow. Child-account restrictions do not exclude pediatric patient records or remove their protections.

Records subject to additional restrictions, including 42 CFR Part 2, require an expressly agreed processing arrangement before submission. Customers must consider requirements applicable to patients, workforce, locations, and configuration.

10. Updates and contacts

We identify versions and effective dates, give reasonable advance notice of material changes through the Service or registered contacts, and obtain additional consent where required. An update cannot amend a BAA, erase prior acceptance evidence, or retrospectively authorize incompatible uses.

Contact: support@carestaffmanager.com

Provider: Reliable Betel Corp.