Privacy Policy

• Personal Information: Name, address, phone number, email address, and payment details.
• Account Information: Username, password, and account preferences.
• Child Information (provided by parent or legal guardian): Child's first name, age or date of birth, and support needs relevant to matching with a suitable provider. This information is provided by and remains under the control of the parent or legal guardian. Clinical session notes, treatment plans, and similar records are maintained by the individual provider in their own systems and are not stored by Jounce.
• Job Post Information: When families submit Job Posts to find a Provider, we collect the content of the Job Post, typically including service category, scheduling preferences, location and availability, and a free text description of the family's needs. Families should not include diagnoses, medical history, or other Protected Health Information in Job Post text fields. Sensitive health information is collected separately at the booking and intake stage, where HIPAA safeguards apply.
• Health Information: For families using Jounce's insurance billing integration (Phase II), formal diagnosis documentation and ICD-10 diagnostic codes provided by the family's healthcare provider, which are required by the insurance carrier for claims processing through Office Ally. Jounce operates as a HIPAA Business Associate for any Protected Health Information it receives in this capacity.
• Provider Information: Professional license numbers, certifications, credential documentation, service specialties, and availability.
• Provider Application Information: When Providers submit Applications in response to family Job Posts, we collect the content of the Application, including any message to the family, proposed availability, and indication of credentials and experience relevant to the request.
• Provider and Practice Financial Information: For all providers and Practices who accept payments through the Platform, legal name, address, business type, tax identification number (SSN or EIN), banking information, and identity verification documents are collected and held by our payment partner Stripe, Inc. Jounce uses this information through Stripe to prepare, file, and deliver required tax forms. See Section 3 for details.
• Background Check Information: For Respite Care, Home Health Aide (HHA), Personal Care Aide (PCA), and Academic and Learning Support providers, background check reports and supporting documentation, including criminal history search results, sex offender registry checks, applicable state child abuse and neglect registry checks, and identity verification records. Background checks are processed by our screening partner Checkr. See Section 5 for details.

• Usage Data: Device type, operating system, IP address, browser type, session duration, referring URLs, and feature interactions for analytics and Platform improvement.
• Booking and Transaction Data: Session dates, service types, payment amounts, session confirmations, and cancellation records.
• Cookies and Tracking Technologies: We use cookies, pixel tags, and similar technologies for essential site functionality (session management, authentication), product analytics, and platform performance monitoring. See Section 11 for details on managing cookie preferences.

Booking details and the child's support need information are shared with the matched provider at the time a session is booked, to enable the provider to deliver services. For sessions delivered through a clinic, center, or group practice ("Practice"), booking details are shared with the Practice and the affiliated professional delivering the session. When a family submits a Job Post, the content of the Job Post (excluding the family's full identity, until selection) is shared with eligible Providers who may submit an Application. When a family selects a Provider in response to an Application, the family's contact and booking information is shared with the selected Provider only. Providers are bound by confidentiality obligations and, where applicable, HIPAA. Providers may only use this information to provide services to you and are contractually prohibited from using it for any other purpose. Clinical documentation generated during or after the session is maintained solely by the provider.

All payments are processed through Stripe, Inc. ("Stripe"), a PCI-DSS Level 1 certified payment processor. Payments are processed on behalf of the provider or Practice delivering the service, and their name may appear on your card or bank statement.

Specifically, Stripe handles:

• Payment processing: Family credit card and debit card information is transmitted directly to Stripe and is never stored on Jounce servers. Jounce receives only tokenized references.
• Connect accounts: All providers and Practices who accept payments create Stripe Connect accounts. Stripe performs Know Your Customer (KYC) verification, collects tax identification numbers, bank account information, and identity documents, and holds funds on behalf of providers and Practices.
• Funds management: Provider and Practice funds are held by Stripe, not by Jounce. Jounce is not a money services business or money transmitter.
• Tax reporting: Jounce uses Stripe to prepare, file, and deliver the applicable IRS Form 1099 (1099-NEC, 1099-MISC, or 1099-K) and any required state forms to eligible providers and Practices. Forms are available in the Stripe Express Dashboard.

Stripe's privacy practices are governed by its own privacy policy, available at stripe.com/privacy.

For Respite Care, HHA, PCA, and Academic and Learning Support providers only, background check data is processed through Checkr, Inc. ("Checkr"), our FCRA-compliant screening partner. Checkr collects provider identifying information (including Social Security Number and date of birth) directly and conducts:

• National criminal database search
• County-level criminal records searches
• Sex offender registry checks
• State-specific child abuse and neglect registry checks (where applicable)
• Identity verification
• Global watchlist screening

Providers must provide separate consent to Checkr as part of the background check process. Completed reports are shared with Jounce for adjudication. Checkr's privacy practices are governed by its own privacy policy, available at checkr.com/privacy.

See Section 5 below for your rights under the Fair Credit Reporting Act (FCRA) and applicable state laws.

When Jounce enables insurance billing functionality (planned for Phase II), relevant session information, diagnostic codes, and formal diagnosis documentation will be shared with Office Ally, our HIPAA-compliant insurance clearinghouse, for claims processing. A formal diagnosis is required by the insurance carrier before any insurance claim can be submitted. Office Ally is a HIPAA Business Associate and processes data under a Business Associate Agreement (BAA) with Jounce.

We use third-party tools for platform analytics, communications, and operations. At launch, this includes:

• PostHog for product analytics
• Sentry for error monitoring
• Resend for transactional emails
• A push notification provider for app notifications
• Customer support tools for responding to user inquiries

All such tools are vetted for security compliance and data minimization practices. A current list of third-party service providers is available upon request at privacy@jouncein.com.

We may disclose information when required by law, subpoena, or court order; to enforce our Terms of Service; or to protect the rights, property, or safety of Jounce, our users, or the public.

If Jounce is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of the transaction, subject to the commitments in this Privacy Policy. Users will be notified of material changes resulting from any such transaction.

We will update this section as new third-party integrations are added. Users will be notified of any material changes.

Background checks are "consumer reports" subject to the Fair Credit Reporting Act (FCRA, 15 U.S.C. § 1681 et seq.) and applicable state consumer reporting laws. As a provider undergoing a background check, you have the following rights:

• Right to consent: You must provide separate written consent before a background check is initiated.
• Right to a copy: You may request a free copy of your background check report from Checkr.
• Right to dispute: You may dispute the accuracy or completeness of any information in your report directly with Checkr.
• Right to pre-adverse action notice: If Jounce intends to reject or remove you based in whole or in part on a background check, you will receive a pre-adverse action notice, a copy of the report, and a summary of your FCRA rights. You will have at least five (5) business days to respond before a final decision is made.
• Right to adverse action notice: If an adverse decision is made, you will receive a final adverse action notice, including the name, address, and telephone number of Checkr and your right to request further information.

Background checks expire 365 days after the date of clearance. Jounce will notify providers at 60, 30, and 14 days before expiration, and will initiate renewal automatically if not started by the provider. Providers cannot accept new bookings while their background check is expired.

Providers may be subject to state-specific child abuse and neglect registry checks and other state licensing requirements, depending on the state in which they practice. Applicable state checks are included in every screened provider's background check package. As Jounce expands into additional states, we will update our screening packages to include any state-specific checks required by local law.

Credential verification may include:

• Direct verification with state licensing boards (for example, state boards of psychology, behavior analysis, social work, counseling, speech-language pathology, occupational therapy, and nursing).
• Verification with national certification bodies (for example, the Behavior Analyst Certification Board and the American Speech-Language-Hearing Association).
• Review of original credential documentation submitted by the provider.
• Ongoing monitoring of license status, expiration dates, and any disciplinary actions reported by the issuing authority.

By creating a provider account on the Platform, providers consent to Jounce conducting credential verification and ongoing license monitoring, including retrieval of publicly available licensure and disciplinary information from applicable state and national regulatory bodies. Credentialing information collected for verification purposes is stored securely and used only to maintain the integrity of the Platform.

If a provider's license expires, is suspended, or is revoked, Jounce will promptly suspend the provider's ability to accept new bookings and notify the provider of the issue. Providers may appeal or respond to verification findings by contacting support@jouncein.com.

In compliance with the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501 to 6506), parents and legal guardians have the right to:

• Review any personal information collected about their child.
• Request correction or deletion of their child's information at any time.
• Withdraw consent for collection of their child's data, subject to any legal retention obligations.
• Refuse further collection or use of their child's information.

To exercise any of these rights, please contact us at privacy@jouncein.com. We will respond within 30 days.

Where a child's therapy records constitute Protected Health Information (PHI), both COPPA and HIPAA may apply simultaneously. In all cases, the parent or legal guardian controls access to and decisions regarding the child's information, consistent with both regimes.

Some of our service providers (including Stripe, Checkr, and analytics tools) may process or store data on servers located outside your specific state, but within the United States. Jounce does not currently transfer user data outside the United States.

In the event of a data breach that compromises your personal information, we will notify affected users and any required state authorities in accordance with applicable federal and state laws, including the HIPAA Breach Notification Rule and applicable state data breach notification statutes. Notifications will be made without unreasonable delay, generally within 60 days of discovery for breaches involving PHI.

Jounce does not currently respond to "Do Not Track" (DNT) signals transmitted by web browsers, as there is no industry consensus on how such signals should be interpreted. You may manage tracking through browser cookie settings and by opting out of analytics tools directly.