Effective Date: 2/5/2026

This Privacy Policy explains how Company Nurse, LLC and its affiliated technology platform provider Lintelio, LLC (collectively, “Company Nurse,” “we,” “us,” or “our”) collect, use, disclose, and protect personal information in connection with our websites, intake and triage services, digital reporting experiences (including mobile-friendly web experiences), administrative portal(s), and related communications (collectively, the “Services”).

This Privacy Policy is intended for an external audience, including injured workers, supervisors, clients, and website visitors. If you have questions, contact us using the information in the “Contact Us” section below.

1. What we do

Company Nurse provides workplace incident intake, reporting, and triage services, including nurse triage and related care-direction workflows. We support multiple intake lines (for example, workplace injuries, general liability, commercial auto, property claims, workplace violence logging, and catastrophic escalation) and may offer physician-led telehealth capabilities.

2. Scope and roles

For most Service interactions, Company Nurse acts on behalf of a client organization. When you use the Services because your employer, insurer, third-party administrator, risk pool, school district, or other organization (a “Client”) directs you to do so, that Client generally determines what information is collected, how it is used, and with whom it is shared. In those cases, Company Nurse typically acts as a service provider (or “processor”) to the Client.

For our public websites and marketing activities, Company Nurse typically acts as the business controlling the data. For example, when you submit a “Contact Us” form, request materials, or browse companynurse.com, we determine how that information is handled for those purposes.

If this allocation differs for a particular program, your Client contract and program notices govern.

3. Information we collect

We collect information in three ways: (a) information you provide, (b) information collected automatically, and (c) information provided by others (such as your Client or integrated partners).

A. Information you provide

Depending on the Services you use, you may provide:

• Contact and identifiers: name, phone number, email address, mailing address, preferred language, and similar details.
• Work and program information: employer or Client name, worksite/location, supervisor or manager details, employee ID (if applicable), program identifiers, and related information needed for intake and reporting.
• Incident and care-direction information: incident details, what happened, body part(s), symptoms, severity, timing, first aid steps taken, and other information relevant to triage and reporting.
• Communications: information you share during calls, chats, emails, or forms. Calls and interactions may be recorded, and we may create notes, summaries, or transcripts as part of operations and compliance, subject to Client program configuration and applicable law.
• Account and portal information: usernames, role-based access details, and administrative preferences (for authorized portal users).

B. Information collected automatically

When you visit our websites or use certain digital components of the Services, we may automatically collect:

• Device and usage data: IP address, browser type, device identifiers, operating system, referring URLs, pages viewed, timestamps, and interaction logs.
• Cookies and similar technologies: described in Section 8.

C. Information from Clients and other sources

We may receive information from:

• Your Client and stakeholders involved in the program (for example, employer contacts, claims administrators, insurers, risk pools, brokers, or school administrators), as needed to provide the Services and distribute reports.
• Medical referral sources and provider directories that support care direction or facility referral workflows.
• Affiliates or acquired service lines that support physician-led consult workflows where applicable.

4. How we use information

We use personal information for the following business purposes:

1. Provide the Services
   • Collect incident details and produce incident reports
   • Deliver triage and care-direction services (including referrals to appropriate facilities when applicable)
   • Provide digital reporting experiences (for example, incident logging, report distributions, and exports)
   • Provide secure, role-based access to the administrative portal for authorized users to view incident reports and related program information, manage program configuration (as applicable), and export or retrieve data as permitted by the Client’s setup and user permissions.
2. Distribute reports and program communications
   • Send reports and notifications to configured stakeholders (for example via email, data feeds, or APIs)
   • Communicate about follow-ups, clarifications, and program-related updates
3. Quality, training, and service improvement
   • Review interactions for quality assurance, training, and protocol improvement
   • Analyze service performance and improve workflows, including configurability and responsiveness
4. Security, fraud prevention, and compliance
   • Protect the confidentiality, integrity, and availability of the Services
   • Monitor for suspicious activity, prevent abuse, and enforce access controls
   • Support audits and compliance obligations (including security assessments and program controls)
5. Support, billing, and account management (primarily for Clients and authorized users)
   • Provide customer support and manage account relationships
   • Process billing and payments where applicable (typically Client-side, not injured-worker billing)
6. Legal and contractual needs
   • Comply with legal obligations, respond to lawful requests, and establish or defend legal claims

5. De-identified and aggregated data

We may create de-identified or aggregated information from personal information. De-identified and aggregated information is used for service analytics, benchmarking, and improving our protocols and technology. We do not attempt to re-identify de-identified information except as permitted by law. De-identified and aggregated information is not treated as personal information and is not subject to this Privacy Policy to the extent permitted by applicable law.

6. How we disclose information

We do not sell personal information. We disclose personal information as follows:

1. With your Client and configured stakeholders
   If you use the Services through a Client program, we disclose information to the Client and parties the Client has configured or authorized (for example, employer contacts, claims administrators, insurers, TPAs, risk pools, brokers, school administrators, or other designated recipients) to support incident reporting, triage outcomes, and program operations.
2. With service providers (vendors) that help us operate
   We use vendors for hosting, communications, analytics, security, customer support tooling, and similar functions. They are authorized to process personal information only as needed to provide services to us and are contractually required to protect it.
3. With medical referral and telehealth support participants (when applicable)
   If the program supports facility referral or physician-led consult workflows, we may disclose information to support care direction and consult delivery, consistent with program design and Client instructions.
4. With affiliates
   We may disclose information among Company Nurse and Lintelio affiliated entities for operational, security, and service delivery purposes.
5. For legal, safety, and business transfer reasons
   We may disclose information to comply with law, respond to lawful requests, protect rights and safety, and in connection with a merger, acquisition, financing, reorganization, or sale of assets.

7. Call recordings, transcripts, and archives

Depending on the program configuration, calls and other interactions may be recorded and retained for quality assurance, training, compliance, and operational needs. Some intake lines state that conversations may be recorded and archived for up to 60 months, subject to contractual terms and applicable legal requirements. Retention can vary by Client program, legal requirements, and contract.

8. Cookies and similar technologies

We may use cookies and similar technologies on our websites and some digital experiences to:

• keep sites functioning
• remember preferences
• understand usage and improve content
• support security and fraud prevention
• measure the effectiveness of campaigns (where used)

You can control cookies through your browser settings. If you block cookies, parts of the websites may not function as intended.

9. AI, machine learning, and automated technologies

We may use automated technologies (including AI/ML) to support service delivery and operations, such as virtual agents, call transcription, summarization, redaction, analytics, quality assurance, and workflow automation, consistent with applicable law and contractual obligations.

Where appropriate, we apply human oversight and use controls to reduce the risk of inaccurate or inappropriate outputs. AI-assisted outputs are used as decision-support tools and do not replace required human review or professional judgment.

We may introduce optional products or features that are clearly identified as AI-enabled. If we do, we will provide program-specific notices or disclosures describing how the feature works, the level of automation involved, and applicable safeguards. Any such offerings may be subject to separate terms and/or supplemental privacy notices.

10. Data retention

We retain personal information for as long as necessary to:

• provide the Services and operate Client programs
• meet contractual obligations
• comply with legal requirements
• maintain security and prevent abuse
• resolve disputes and enforce agreements

Retention periods may be defined by Client instruction, regulatory obligations, or operational needs. When retention is no longer required, we delete or de-identify information using reasonable methods.

11. Security

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. Safeguards may include access controls, encryption in transit where appropriate, monitoring, vulnerability management, and security training. Company Nurse has completed a SOC 2 Type 2 audit covering relevant security and availability controls.

No system can be guaranteed 100% secure. If you believe an incident has affected your information, contact us.

12. Your choices and privacy rights

Your choices depend on how you interact with us.

A. If you interact through a Client program

If your information is processed on behalf of a Client, you should direct requests to the Client first. If you contact us directly, we may refer your request to the Client or coordinate with them to respond, consistent with applicable law.

B. If you are a website visitor or direct contact

You may request access, correction, or deletion of certain personal information we hold about you (subject to legal exceptions). You may also opt out of marketing emails by using the unsubscribe link or contacting us.

C. State privacy notices (US)

If you are a resident of a state with privacy laws (for example, California and others), you may have rights such as:

• right to know/access
• right to delete
• right to correct
• right to data portability
• right to opt out of certain processing (such as targeted advertising, depending on usage)

California (CCPA/CPRA): We do not sell personal information. If we engage in sharing for targeted advertising on our public websites, California residents may have the right to opt out. We will not discriminate for exercising privacy rights.

To submit a privacy request, contact us at info@companynurse.com with “Privacy Request” in the subject line. We may need to verify your identity and, if applicable, your authority to act on behalf of another person.

13. Children’s privacy

The Services are not directed to children for general consumer use. Some Client programs may involve student incident reporting or minors under supervision. In those cases, we process information only as instructed by the Client and for the program purpose. If you believe we have collected information from a child inappropriately, contact us.

14. International users

We are based in the United States. If you access the Services from outside the United States, your information may be transferred to and processed in the United States and other jurisdictions where we or our service providers operate, subject to appropriate safeguards.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on our website and update the “Last Updated” date above. If changes are material, we will provide additional notice as required by law or contract.

16. Contact us

For questions, privacy requests, or concerns:

Company Nurse, LLC
8360 E Via De Ventura Blvd., Suite L200
Scottsdale, AZ 85258
Email: info@companynurse.com
Phone: (888) 817-9282