Legal Policies

1. The Personal Information We Collect About You: When, What, Why, and From Whom

Your privacy is important to us, and this section will describe the “who, what, when, and why” of the personal information we collect about you. We collect information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household, or device("personal information"). Personal information does not include:

• Publicly available information from government records.
• De-Identified or aggregated consumer information.
• Information that you make publicly available.

We collect information from you when you interact with OneStaff Medical in the following ways:

Job Applications

• When:  When you apply for employment.
• What:  We may collect your name, alias, email, phone number, Social Security number, driver’s license number, date of birth, physical address, criminal history, education information, employment history information, self-assessment of skills and qualifications, skills checklist, health records (including but not limited to vaccination status), license and certification information, core competency information, and name and contact information of references from you and from information available as a result of a background check.
• Why:  To complete the application process, to determine your qualifications for different opportunities, to ensure we meet our obligations as your employer, and to manage our relationship with you. We also collect this information because our clients and facilities may require it in order for you to start work, in which case we would share that information with them.
• From Whom:  We will collect this information directly from you when you fill out an application or onboarding forms. Sometimes you might authorize someone else, like the company performing your background check or assessments, to share information with us.

Employment

• When:  Throughout your employment with OneStaff Medical.
• What:  We may collect your name, address, phone number, email, gender, age, information for employment related taxes, education transcripts, Social Security number, citizenship information, veteran status and information, driver’s license number, I-9 information, emergency contact information, any information you provide when you submit a request under the FMLA or another leave, disability, or benefits law, and any other information you have chosen to provide to OneStaff Medical.
• Why:  To determine your qualifications for different opportunities, to ensure we meet our obligations as your employer, and to manage our relationship with you.
• From Whom:  We will collect this information directly from you when you fill out an application or onboarding forms. Sometimes you might want someone else, like your doctor or your previous school, to provide information to us as well.

Travel

• When:  When you book travel through OneStaff Medical.
• What:  We may collect your name, address, email, phone number, birth date, passport number, driver’s license or government-issued ID number, ticket/document number, and other related travel information.
• Why:  To book travel for you or on your behalf as part of your employment.
• From Whom:  We will collect this information directly from you.

Payroll and Benefits

• When:  When we are providing you with payroll and benefits services.
• What:  We may collect your name, address, birth date, age, marital status, Social Security number, email address, phone number, dependent information, beneficiary information, and bank account number, routing number, and account type.
• Why:  To pay you for your employment, or to provide you with benefits like insurance and retirement savings.
• From Whom:  We will collect this information directly from you.

Licenses, Credentials, and Certifications

• When:  When we track and maintain your licenses, credentials, and certifications.
• What:  We may collect your name, license number, license type, license state, email, phone number, work address, birth year, and last 4 digits of your Social Security number from you; and from state licensing authorities we may collect the status of your licenses, credentials, and certifications.
• Why:  To make sure your professional licenses, credentials, and certifications are current and to help you stay up to date when we can.
• From Whom:  We will collect information from you that we will use to identify your relevant credentials and track their status, and we will obtain information about the status of your credentials from the accrediting organization (for example, the state licensing board).

Background and Qualification Checks

• When:  When we conduct background checks, drug tests, and occupational health checks.
• What:  We may collect your full name, alias, Social Security number, date of birth, address, phone number, address history, driver’s license number, and signature from you, and we may collect your drug test status, criminal history, and physical information from the third party completing the inquiries.
• Why:  Depending on your position, we might need to get background checks, drug tests, occupational health tests, and competency exam information for you. We may need to do this when you first apply for a job or a round that time, and we may also need to update the information throughout your employment with OneStaff Medical.
• From Whom:  We will collect information from you that we will use to identify you to the vendors that are handling different checks, and we will obtain information about the results of these checks from the vendors who handle them on our behalf.

Audits

• When:  When we need to audit for legal, regulatory, or another type of compliance.
• What:  We may collect any of the information we described in this notice.
• Why:  There are different requirements we must comply with as your employer and as a company that employs medical professionals, as well as more generally. Sometimes, we are asked to prove we are doing the right things and that we are doing them correctly.
• From Whom:  We will collect information from you and from the other companies we described in this section of this letter.

Website

• When:  When you interact with our website, www.onestaffmedical.com as an employee or applicant.
• What:  We may automatically collect your browser type, operating system information, CPU speed, reference or exit webpages, click patterns, session ID, and your computer’s IP address. We may also collect general information about use of our website, such as what pages visitors access, the number of visits, average time spent on the website, and other similar factors. This information is generally collected in aggregate form, without identifying any user individually, although IP addresses and Session ID in relation to downloads may be tracked as part of our fraud prevention efforts.
• Why:  To determine whether and how well our website is working, to learn more about visits to our website, to improve our website, and to prevent fraud.
• From Whom:  This information is collected automatically from the device you use to access our website.

Technology Monitoring

• When:  When you use our systems or applications.
• What:  We may collect your session actions, page visits, and specific user actions you take. This collection may be through the use of session recording software.
• Why:  To maintain the security of our systems, networks, and information.
• From Whom:  We use the information we collect automatically from you.

Employment Marketing

• When:  When we send you information about our employment or potential opportunities.
• What:  We may collect your name, email, and phone number.
• Why:  To provide you with information about our services or potential opportunities that is relevant to you.
• From Whom:  We use the information we collect from you.

4. Disclosure of Your Personal Information: Why and With Whom We Share.

This section will tell you about how we disclose your personal information with others for business purposes. We’ll take the “legal categories” of information from Appendix A and match them up with what we share and who we share it with.

Sharing for Business Purposes.  We only share your information for our business purposes. Put another way, we only share your information to operate our business and for the purposes we’ve described for you in this letter (to accomplish the “why” in Section 1).

Clients and Facilities: With your approval, we may share your personal information with our clients and facilities to present you for placement opportunities and to manage your employment relationship. We share the following legal categories of personal information with clients, facilities, and potential employers:

Service Providers: Other companies sometimes provide certain services to us or on our behalf (e.g., payroll services, leave and absence management services, maintenance or IT support, audits, analysis, and benefits). Unless we tell you differently or as described else where in this Privacy Notice, our service providers are not permitted to use your information except to assist us. We share the following legal categories of personal information with our service providers:

Third Parties with Who You Direct Us to Share Your Personal Information: If you direct us to share your personal information with a third party, such as a background check company or social network, we will share only the information that is needed to complete your request. Depending on your request, we may share the following legal categories of personal information with third parties:

Other Third Parties, such as those that facilitate the provision of services, including internet service providers, data analytics providers, and operating systems and platforms. We may share the following legal categories of personal information with other third parties:

Compliance with Leal Obligations: We may need to disclose certain information to auditors, government authorities, law enforcement, regulatory agencies, our legal counsel, third party litigants and their counsel, or other authorized individuals to comply with laws that apply to us, subpoenas, discovery requests, or other legal obligations such as contractual requirements. We may share the following legal categories of personal information to comply with legal obligations:

OneStaff Medical does not sell applicants’ or employees’ personal information to any one and OneStaff Medical does not share applicants’ or employees’ personal information with third parties for those parties’ commercial use, including their cross context behavioral advertising.

OneStaff Medical does not knowingly collect, nor sell or share, personal information from consumers under 16.

6. California Privacy Rights

If you are a California resident, we are required to provide additional notice and information to you about how we collect, use and disclosure your information that may be considered "Personal Information" under the California Consumer Privacy Act of 2018 ("CCPA"), as amended by the California Privacy Rights Act of 2020 and its implementing regulations (collectively, "CPRA") and any terms defined in the CPRA have the same meaning when used in this Policy. This section of our Policy for California Residents("California Policy") supplements the information contained in the remainder of our privacy policy and applies solely to all visitors, users, and others who reside in the State of California ("consumers" or "you").

Right to Know and Data Portability

You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months (the "right to know"). Once we receive your request and confirm your identity (see Exercising Your Rights to Know or Delete), we will disclose to you:

• The categories of personal information we collected about you.
• The categories of sources for the personal information we collected about you.
• Our business or commercial purpose for collecting or selling that personal information.
• The categories of third parties with whom we share that personal information.
• If we sold or disclosed your personal information for a business purpose, two separate lists disclosing:
  • sales, identifying the personal information categories that each category of recipient purchased; and
  • disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.
• The specific pieces of personal information we collected about you (also called a data portability request).

Right to Delete

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions (the "right to delete"). Once we receive your request and confirm your identity (see Exercising Your Rights to Know or Delete),we will review your request to see if an exception allowing us to retain the information applies. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

1. Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or otherwise perform our contract with you.
2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
3. Debug products to identify and repair errors that impair existing intended functionality.
4. Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
5. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
6. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent.
7. Enable solely internal uses that are reasonably aligned with consumer expectations basedon your relationship with us.
8. Comply with a legal obligation.
9. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

We will delete or de-identify personal information not subject to one of these exceptions from our records and will direct our service providers to take similar action.

Exercising Your Rights to Know or Delete

To exercise your rights to know or delete described above, please submit a request by either:

• Calling us at  
  (877) 783-1483
    x 586.
• Emailing us at  
  privacy@onestaffmedical.com

Only you, or someone legally authorized to act on your behalf, may make a request to know or delete related to your personal information. To designate an authorized agent, the agent must be a natural person or a business entity that is registered with the California Secretary of State.

If you would like to designate an agent to act on your behalf, you and the agent will be required to provide us with proof of the agent’s identity and proof that you gave the agent signed permission to submit a request on your behalf. Additionally, you will be required to verify your identity by providing us with certainPersonal Information as described above or provide us with written confirmation that you have authorized the agent to act on your behalf.

Please note that this subsection does not apply when an agent is authorized to act on your behalf pursuant to a valid power of attorney. Any such requests will be processed in accordance with California law pertaining to powers of attorney. You may only submit a request to know twice within a 12-month period. Your request to know or delete must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative, which may include:
  • Our verification of your full legal name, date of birth, home address, and last two job placements.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. You do not need to create an account with us to submit a request to know or delete. We will only use personal information provided in the request to verify the requestor's identity or authority to make it.

Response Timing and Format

We will confirm receipt of your request within ten (10) business days. If you do not receive confirmation within the 10-day time frame, please contact us at  

We endeavor to substantively respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance, specifically pdf format.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive,repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA/CPRA rights. Unless permitted by the CCPA/CPRA, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, we may offer you certain financial incentives permitted by the CCPA/CPRA that can result in different prices, rates, or quality levels. Any CCPA/CPRA-permitted financial incentive we offer will reasonably relate to your personal information's value and contain written terms that describe the program's material aspects. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.