Privacy Policy

1. Scope and Important HIPAA Distinction

This Privacy Policy explains how Serenium collects, uses, discloses, and protects personal information. It does not replace a healthcare facility’s HIPAA Notice of Privacy Practices. Clinician credential, tax, payment, and employment-related records are not automatically PHI merely because Serenium operates in healthcare. PHI processed for a covered entity is governed by HIPAA, the applicable BAA, and authorized healthcare workflows.

2. Information We Collect

• Identifiers and contact information: name, address, email, telephone, date of birth, account identifiers, profile photograph, signatures, and emergency contacts.
• Professional and credential information: role, licenses, certifications, education, experience, references, training, immunizations or health-clearance documents, sanctions, exclusions, insurance, and Facility requirements.
• Sensitive identity and tax information: Social Security number, taxpayer identification number, government identification, work authorization, and information needed for legally required reporting.
• Background-screening information: authorization, report status, eligibility results, disputes, and related compliance records. Full reports may be maintained by an authorized screening provider.
• Financial information: payout account tokens, transaction history, invoices, payment status, tax forms, and fraud-prevention information. Payment processors may collect bank or card details directly.
• Shift and marketplace information: postings, requests, acceptances, compensation displayed, Facility Charges, attendance, time records, cancellations, ratings, incidents, messages, and support interactions.
• Device and usage information: IP address, browser, device identifiers, operating system, app version, logs, pages/screens, actions, crash data, cookie identifiers, and security signals.
• Precise or approximate location: when authorized for shift discovery, directions, fraud prevention, arrival, clock-in/out, and attendance verification. Serenium should configure precise background location collection only when necessary and clearly shown.
• Communications: email, SMS, push, telephone, chat, support tickets, uploaded documents, and call or screen recordings when notice and consent are legally sufficient.
• PHI: limited information submitted through specifically designated authorized healthcare workflows.

3. Sources

We collect information directly from Users; Facilities and Agencies; references; license boards and registries; exclusion and sanctions sources; background-screening and identity-verification providers; payment processors; analytics and communications vendors; public or authorized professional sources; devices; and transactions on the Platform.

4. How We Use Information

• Provide accounts, marketplace matching, shift workflows, timekeeping, support, settlement, tax reporting, and communications.
• Verify identity, licenses, credentials, Facility or Agency authority, eligibility, insurance, sanctions, exclusions, and compliance.
• Prevent fraud, account sharing, unsafe conduct, unauthorized access, payment abuse, and security incidents.
• Process and document Facility Charges, Clinician Compensation, Agency settlement, cancellations, disputes, and records.
• Operate analytics, improve usability and reliability, troubleshoot, audit, forecast marketplace coverage, and develop features using appropriately protected data.
• Comply with legal process, healthcare and professional reporting, tax, privacy, labor, payment, recordkeeping, and safety obligations.
• Send marketing when permitted and honor applicable opt-outs. Consent to marketing is not a condition of receiving marketplace services where prohibited.

5. How We Disclose Information

• Facilities: clinician identity, profile, qualifications, credentials, eligibility, shift, attendance, time, incident, and other information reasonably necessary to evaluate and administer a Shift Opportunity.
• Agencies: information about their own personnel, authorized facilities and shifts, compliance, settlement, incidents, and Platform activity.
• Clinicians: Facility identity, location, requirements, offered compensation, shift status, and information necessary to evaluate and perform an opportunity.
• Service providers: cloud hosting, cybersecurity, communications, identity, background screening, licensing, payment, analytics, customer support, document signing, legal, accounting, and insurance providers under appropriate restrictions.
• Authorities and safety recipients: regulators, licensing boards, law enforcement, courts, government agencies, insurers, counsel, and affected parties when required or reasonably necessary to protect rights, safety, patients, or the Platform.
• Corporate transactions: parties and advisers involved in financing, reorganization, merger, acquisition, sale, insolvency, or due diligence, subject to appropriate protections.
• With consent or direction: other disclosures requested or authorized by the individual or organization.

6. Sales, Targeted Advertising, and Sensitive Data

Serenium does not sell personal information for money and does not use personal information for cross-context behavioral advertising. If these practices change, Serenium will update this Policy and provide any legally required opt-out mechanism before the change takes effect.

Serenium does not use sensitive personal information to infer unrelated characteristics. Where legally required, Serenium obtains consent before processing sensitive data and provides a method to withdraw consent. Small-business exemptions and healthcare-data exemptions vary and will be applied only after counsel confirms eligibility.

7. Location, Camera, Microphone, and Biometrics

Location permissions may be enabled or disabled through device settings, but disabling necessary location may prevent clock-in/out or location-dependent functions. Camera access supports document capture, identity evidence, profile images, or approved clinical workflows. Microphone access is used only for a clearly identified feature with permission.

Serenium will not activate facial recognition, face geometry, voiceprint, fingerprint, or other biometric identification until a separate biometric notice, retention schedule, written consent mechanism, vendor contract, and state-law review are implemented.

8. Cookies and Analytics

Serenium uses essential cookies and similar technologies for authentication, security, preferences, performance, and analytics. Nonessential advertising or cross-context tracking must follow the choices shown in the cookie interface. Users may use browser or device controls, but essential functions may be affected. A current Cookie Notice must identify categories, purposes, durations, and opt-out methods.

9. Retention

Serenium retains information only as long as reasonably necessary for the purposes described, including account administration, credential history, payment and tax records, claims, investigations, legal holds, security, and compliance. Unless law or an active dispute requires longer retention, Serenium generally retains transaction, tax, payment, credential, and executed agreement records for seven years; support and ordinary communication records for three years; precise shift-location records for two years; and marketing preference records for two years after the last interaction. PHI is retained under the applicable BAA and Facility instructions. Serenium may delete or de-identify information earlier when no longer reasonably necessary.

10. Security

Serenium uses administrative, technical, and physical safeguards designed for the nature of the information, including access controls, encryption where appropriate, logging, vendor review, secure development, backups, training, and incident response. No system is completely secure, and Serenium does not promise absolute security. Users must protect credentials and promptly report suspected compromise.

11. Privacy Rights and Requests

Depending on residence and applicable law, individuals may request access, correction, deletion, a portable copy, information about processing, or opt-out of qualifying sale, targeted advertising, or profiling. Requests may be submitted to support@sereniumhealthcare.com or https://sereniumhealthcare.com/delete-account. Serenium may verify identity, use an authorized-agent process, deny or limit requests where an exemption applies, and provide an appeal method when required. Serenium will not unlawfully discriminate for exercising privacy rights.

12. Communications Choices

Operational messages concerning accounts, accepted shifts, safety, credentials, payments, and security may be necessary to provide the service. Users may opt out of marketing email through unsubscribe links and qualifying texts by replying STOP. HELP provides assistance. Message frequency varies; message and data rates may apply. A reasonable revocation request will be honored as required by law.

13. Children and Eligibility

The Platform is for adults and authorized business users and is not directed to children under 18. Serenium does not knowingly permit a minor to register as a Clinician or organizational administrator. If information about a child is included in authorized patient care, it is handled under the applicable healthcare relationship and BAA.

14. International and State-Specific Terms

Serenium is operated in the United States. Information may be processed in U.S. locations where Serenium and its providers operate. State-specific supplements will be posted when required. The Texas Data Privacy and Security Act and other state laws contain thresholds, exemptions, and rights that require periodic review as Serenium expands.

15. Changes and Contact

We may update this Policy prospectively and will post the effective date and provide additional notice for material changes when required. Questions and requests: support@sereniumhealthcare.com; Serenium LLC d/b/a Serenium Healthcare, contact@sereniumhealthcare.com.

Document details

• Business: Serenium LLC d/b/a Serenium Healthcare
• Effective date: May 27, 2026
• Privacy contact: support@sereniumhealthcare.com
• Scope: Serenium websites, applications, portals, communications, and marketplace services