Westcare Inc — Privacy Policy Effective Date: August 9, 2026 Last Updated: August 9, 2026 Entity Covered: Westcare Inc, Waukee, Iowa 1. Introduction Westcare Inc (“Westcare,” “we,” “our,” or “us”) is committed to protecting the privacy and security of all individuals who interact with our services. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information across our operations, including non‑emergency medical transportation (NEMT), care‑support services, administrative operations, employment activities, and our website. By using our services, you agree to the practices described in this Privacy Policy. 2. Information We Collect We collect information necessary to provide services, comply with regulations, and operate our business effectively. 2.1 Personal Information - Full name - Date of birth - Phone number, email address, physical address - Emergency contact information 2.2 Service & Transportation Information - Trip details (pickup/drop‑off locations, appointment times) - Service eligibility information - Scheduling and routing data - Notes related to service delivery 2.3 Health‑Related Information (PHI) For NEMT and care‑support services, we may receive limited protected health information (PHI), including: - Appointment type or purpose - Mobility or accessibility needs - Insurance or program authorization details This information is handled in accordance with HIPAA and applicable federal/state privacy laws. 2.4 Employment Information - Job applications and resumes - Background checks - Work history and credentials - Training records 2.5 Automatically Collected Information When you visit our website or digital systems: - IP address - Browser type - Device identifiers - Cookies and usage analytics 3. How We Use Your Information We use personal information only for legitimate business and service‑related purposes, including: - Providing transportation and care‑support services - Verifying eligibility and processing service authorizations - Communicating with clients, caregivers, and partners - Scheduling, dispatching, and operational coordination - Billing, claims submission, and payment processing - Compliance with federal, state, and local regulations - Hiring, onboarding, and managing employees - Improving service quality and operational efficiency We do not sell personal information. 4. How We Share Information We may share information only as necessary and permitted by law: 4.1 Service Partners - MTM, insurance companies, Medicaid programs - Clinics, hospitals, and care providers - Case managers and authorized agencies 4.2 Operational Vendors - IT service providers - Cloud hosting platforms - Dispatching and routing systems - Background check vendors All vendors are required to maintain confidentiality and security. 4.3 Legal & Compliance We may disclose information without consent when required by law, including: - Court orders - Mandatory reporting (abuse, neglect, threats of harm) - Law enforcement requests - Public health and safety requirements 5. HIPAA Compliance For PHI received through NEMT or care‑support operations: - We follow HIPAA privacy and security rules. - We limit PHI access to authorized personnel. - We use secure systems to store and transmit PHI. - We provide clients with required HIPAA notices upon request. You have the right to: - Access your PHI - Request corrections - Request restrictions - Revoke consent for disclosures 6. Data Security We use administrative, technical, and physical safeguards to protect personal information, including: - Encrypted data storage and transmission - Access controls and authentication - Staff training and confidentiality agreements - Secure disposal of records - Monitoring and auditing of system access If a data breach occurs, we will notify affected individuals as required by the HITECH Act and Iowa law. 7. Your Privacy Rights Depending on the service and applicable laws, you may have the right to: - Request access to your information - Request corrections or updates - Request deletion where legally permissible - Opt out of non‑essential communication - Receive a copy of this Privacy Policy and related notices 8. Children’s Privacy We do not knowingly collect information from children under 13 without parental or guardian consent. Services involving minors require authorized adult involvement. 9. Website & Cookies Our website may use cookies and analytics tools to improve user experience. You may disable cookies through your browser settings, though some features may not function properly. 10. Third‑Party Links Our website or communications may contain links to third‑party sites. We are not responsible for the privacy practices of external websites. 11. Changes to This Policy We may update this Privacy Policy periodically. The “Effective Date” will reflect the most recent revision. Continued use of our services indicates acceptance of updated terms. 12. Contact Information For questions, requests, or concerns regarding privacy: Westcare Inc Waukee, Iowa Email: daniel@westcareinc.com Phone: (515) 561‑0299 Mailing Address: 5260 NW Beaver Dr, Johnston, IA 50131