Pomelo Care Employee Privacy Notice

POLICY FOR CALIFORNIA RESIDENTS – NOTICE OF COLLECTION OF PERSONAL INFORMATION – EMPLOYEES

Pomelo Care, Inc. (“Pomelo Care” or “we”) is committed to protecting the privacy and security of personal information of Employees and takes very seriously its legal obligations with respect thereto. This Notice of Collection of Personal Information – Employees (“Notice”) sets out the categories of personal information of Employees that Pomelo Care may process and its purposes for doing so and provides additional information required under California law. In this Notice references to “Pomelo Care” shall mean Pomelo Care and its affiliates and subsidiaries, and references to “Employees” shall be to any (i) Pomelo Care employee, whether full-time, part-time, or temporary, (ii) Pomelo Care director or officer, (iii) contractor, or (iv) job applicant seeking to become a Pomelo Care employee. This Notice applies solely to Employees who reside in the State of California (“consumers” or “you”).

Note: Pomelo Care reserves the right to revise, supplement, or rescind any portion of this Notice as management deems appropriate, in its sole and absolute discretion.

“Personal Information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal Information does not include publicly available information that is made available from federal, state, or local government records.

Collection of Employee Personal Information

In the course of its regular business, Pomelo Care may collect the following categories of Personal Information related to Employees (“Employee Personal Information” or “Personal Information”):

• Professional or employment-related information, such as wage and benefit information; licensing, credentialing, certification, qualification information, trade organization data, and training that you receive from Pomelo Care, or from third parties; employment records; recruitment information, including copies of right to work documentation such as work permit or visa; references and other information included in a CV, resume, work sample, or cover letter or as part of the application process; skills and assessment information such as case study submissions or assessment scores and results; criminal background and exclusion screenings; interview notes; letters of offer and acceptance of employment, and employment agreements; and details of any disciplinary investigations and proceedings;
• Audio, Electronic, Visual, or Similar Information, such as photographs, CCTV footage, recordings of calls and video interviews, and other information obtained through electronic means such as swipe card records, and printer logs;
• Characteristics of protected classifications under California or federal law, such as information about your gender, race, ethnicity, sexual orientation, religious beliefs, health and disability data, date of birth, age, sex, marital status, military status, and when applicable, nationality and citizenship;
• Identifiers, such as your name, alias, unique personal identifier, address, telephone number, e-mail address, social security number, taxpayer identification number, driver’s license and passport number, provider identifiers (e.g., NPI number), hotel confirmation number, flight and transportation information, emergency contact information, and other similar identifiers;
• Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)), including your name, social security number, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, 401k enrollment data, and health insurance information;
• Internet or other electronic network activity information, such as information about your use of Pomelo Care information and communications systems (e.g., browsing and search history, information regarding your interaction with a website, application, or advertisement);
• IT and Facilities information such as system and application access data (System ID, LAN ID, Email account, Instant messaging account, Mainframe ID, System passwords, Access logs, Activity logs, Country code, IP address (including the PC to which the IP address belongs), online traffic, and employee access code;
• Biometric information, such as your fingerprints;
• Geolocation data, such as information about your physical location or other geolocation data;
• Education information, such as the level of your education and academic records (e.g., grades, transcripts, verification or listing of attendance);
• Inferences that we draw from other Personal Information; and
• Other information voluntarily and incidentally disclosed by you through your interactions with Pomelo Care that falls under one of the enumerated categories above.

Collection of Employee Sensitive Personal Information (“Employee Sensitive Personal Information”)

In the course of its regular business, Pomelo Care may collect the following categories defined as sensitive personal information under California law (“Sensitive Personal Information”):

• Social Security number, driver’s license number, tax ID number, visa number, or passport number;
• Account log-in, financial account, credit card number in combination with required security or access code, password, or credentials allowing access to an account;
• Racial or ethnic origin, political opinions, religious or philosophical beliefs, or union membership;
• Contents of mail, email, and text messages unless Pomelo Care is the intended recipient of the communication;
• The processing of biometric information for the purpose of unique identification; and
• Health information (e.g. specific information about illness in connection with sickness absence or to register accidents), vaccine status and related health information (e.g. symptoms, date of onset of symptoms) in the circumstances where this becomes relevant, as permitted and required by local law, disability status.

Sources of Personal Information

The Company may obtain Personal Information from the sources listed below:

• Directly from the Employee, such as during the application process or via other forms or information you provide to Pomelo Care in connection with your employment or service engagement;
• Other Employees, including managers
• Indirectly from you, such as when we automatically collect Personal Information on our website or other online properties as described in our website Privacy Policy;
• Through internal generation based on your activities in the course of employment or service engagement, such as through an Employee’s performance evaluations;
• Through Pomelo Care systems monitoring, on computer equipment, networks, communication devices, mobile devices issued by Pomelo Care or CCTV;
• From third parties, including references and other background screening sources, current or former employers, employment recruitment agencies, academic institutions or publicly available resources and any supplier with which you have entered into the consultancy agreement subject to the requirements of applicable law; and/or
• Other vendors providing services to us in relation to the processing of human resources data.

Business or Commercial Purposes for Collecting, Using, and Disclosing Personal Information

The purpose of processing your personal data is general personnel administration. This includes various tasks such as compensation administration, performance management (including appointments, promotions and demotions), recording and maintaining employment history, absence and disciplinary records, facility management including work environment and related security as well as IT security and provision and support of IT systems, user profiles, investigations etc. Also, handling of claims and disputes, and compliance with legal, regulatory and other obligations. In special circumstances, Pomelo Care may also need to process your sensitive personal data, such as health information e.g. to register accidents and to reduce the risk of exposure and spread of diseases.

Third Parties to Whom We Disclose Personal Information

• Other Employees;
• Future employers or prospective employers requesting references;
• Any governmental, administrative, judicial or regulatory authorities, including law enforcement, as needed to cooperate with proceedings, inquiries or investigations by such authorities or in response to any requests made by such authorities, or to otherwise comply with legal or regulatory obligations;
• Third parties as needed to protect the legitimate interests of Pomelo Care, including to establish or defend Pomelo Care’s legal rights;
• Third parties providing services to Pomelo Care, including Pomelo Care’s professional advisors and service providers that provide Pomelo Care with products and services, such as benefits administration, payroll administration, pension providers, leave administration, accounting, auditing, and information technology support or infrastructure (such as hosted or managed applications); or
• Third parties in the event that Pomelo Care sells any part of its business and/or integrates with another organization.

Retention of Personal Information

Pomelo Care will keep your personal data for as long as is necessary to carry out the task it was collected for. Once that purpose has been achieved, Pomelo Care will delete all information about you unless required by applicable laws to keep your data for a longer period. For further information about retention periods, please contact your HR team at hr@pomelocare.com.

Sale or “Sharing” of Personal Information

Other than as described in our website Privacy Policy with respect to online advertising technology activities, we have not sold or shared (for cross-context behavioral advertising) Employee Personal Information or Sensitive Personal Information within the past twelve (12) months.

Your Rights

Employees who are residents in California have certain rights regarding their Personal Information. Those rights include:

• The right to know what Personal Information we collect, including the right to request information regarding the categories of Personal Information we collect along with other information such as the categories of sources from which the information is collected and third parties with whom it is shared
• The right to request a copy of the specific pieces of Personal Information we collect;
• The right to delete Personal Information that we collect from you, subject to certain exceptions;
• The right to correct inaccurate Personal Information that we maintain about you;
• The right to opt-out of the sale or sharing of Personal Information;
• The right to limit the use of Sensitive Personal Information in some circumstances; and
• The right not to be retaliated or discriminated against for exercising any of these rights in good faith; however, we reserve all rights we may have under law with respect to requests made in bad faith or that are manifestly unfounded or excessive.

If you want to exercise any of these rights, please submit a request to privacy-inquiries@pomelocare.com or by contacting your Compliance team. We will review your requests and respond accordingly. The rights described herein are not absolute and we reserve all our rights available to us at law in this regard. If you make a request with respect to your Personal Information, you will be required to validate your identification as a security precaution. If it is necessary to collect additional information, Pomelo Care will use the information only for verification purposes and will delete it as soon as practicable after complying with the request. If you make a request through an authorized agent, we will require written proof that the agent is authorized to act on your behalf. We will process your request within the time provided by applicable law.

Use, Access, and Monitoring of Technology Resources

Pomelo Care provides technology resources to Employees to assist them in performing their duties.

Policy Modification

Subject to applicable law, this Notice may be modified, amended, or rescinded at any time without prior notification.

General Privacy Policy

Our Privacy Policy, which includes disclosures for California residents, can be accessed online at https://www.pomelocare.com/privacy-policy. That Privacy Policy applies to California consumers who interact with Pomelo Care outside of their capacity as an Employee.

Last Updated: This Notice was last updated on 10/23/2026.