Privacy Policy

At Expa (a service of Expanential Inc., also referred to as "we", "us" or "our"), we are committed to protecting the privacy and security of personal information. This Privacy Policy explains how we collect, use, disclose and safeguard the personal information of users of our websites expahealth.com and getexpa.com (each a "Site"), our recruiter dashboard at org.expahealth.com, our mobile application ("App"), and associated services (collectively, the "Services"). This one Privacy Policy applies to all of them.

By using our Site, App or Services, you agree to the collection, use and disclosure of your personal information as described in this Privacy Policy. If you do not agree, please discontinue use of our Services.

Information We Collect

We collect personal information from you directly, automatically when you interact with our Services, and from third-party sources including government entities and public records databases.

Information Provided Directly

• Registration data like name, email, phone number, username, password when creating an account
• Profile data like resume, work experience, licenses, certifications for clinicians
• Contact details and communications when you contact us for support
• Payment information for purchases or premium services
• Content you post on community forums or submit for courses

Automatically Collected Data

• Usage data like browser type, IP address, pages visited, time spent
• Approximate location data derived from your IP address
• Cookie data and online identifiers
• Interaction data with our website, app, and digital channels
• Messaging data: When you communicate with us via third-party messaging platforms (such as WhatsApp), we collect your phone number, the content of your messages, and the timestamp of each interaction

Data From Third Parties

• Public records data about clinician licenses and certifications from government entities
• Data from references or employers identified by clinicians
• Social media profile data if you login via a social account
• Data from analytics partners that help us understand website and application engagement (these partners do not receive WhatsApp message content or metadata)

How We Use Information

We use the information we collect for the following purposes:

• Providing our Services and facilitating matching of clinicians with employers
• Processing transactions and customer support
• Personalizing content and experiences
• Marketing and advertising our offerings (we do not use WhatsApp message content to build advertising profiles or target ads; if we send marketing messages on WhatsApp, we do so only with required opt-in and honor opt-out requests)
• Research, product development and improvement
• Legal compliance and protecting rights and safety
• Identifying and evaluating potential job candidates for our customers through analysis of interactions with our owned channels (website, app, agents)
• Building profiles of users who engage with our Services to better match candidates with employment opportunities
• Sending you job alerts, interview confirmations, application updates, and support messages via SMS, email, or instant messaging platforms (such as WhatsApp), subject to your consent where required
• As otherwise disclosed at the time of collection

We may anonymize or aggregate data, which we may use and share for analytics, research, and service improvement purposes.

Candidate Identification and Matching

We use third-party services to analyze how users interact with our website, app, and other digital channels. This analysis helps us identify individuals who may be suitable job candidates for our customers. This process involves:

• Tracking user engagement across our owned digital channels
• Creating profiles based on interaction patterns and submitted information
• Using algorithms to match potential candidates with employment opportunities
• Sharing anonymized or aggregated candidate data with our customers

This candidate identification process uses interactions with our owned web and app channels only. It does not rely on WhatsApp message content for profiling or candidate matching purposes.

Sharing and Disclosure

We are committed to protecting your privacy and personal information. We share personal information in the following limited circumstances:

• With service providers that assist in operating our Services, including cloud hosting providers and communication platforms (such as Meta/WhatsApp) that facilitate message delivery on your behalf
• With third-party analytics and candidate identification services that help us match job candidates with employers (these services do not receive WhatsApp message content or metadata)
• In corporate transactions like mergers or acquisitions
• To comply with legal requirements and protect rights and safety
• With consent or as otherwise disclosed at the time of collection

We do not share our users' names, email addresses, or mobile numbers with third parties or affiliates for their own marketing purposes. Furthermore, text messaging originator opt-in data and consent will not be shared with any third parties. We may share mobile numbers with communication service providers (such as WhatsApp) solely for the purpose of delivering messages you have requested or consented to receive. We do not share contact information with employers on our platform or recruiters unless the user explicitly consents to such sharing.

We do not sell personal information. We may share anonymized or aggregated data that cannot be used to identify individual users.

Your Choices and Rights

You can update your account details by logging in. Under the California Consumer Privacy Act (CCPA), California residents have the right to:

• Opt-out of sales of their personal information by us
• Request access to the personal information we have collected about them
• Request deletion of their personal information, subject to exceptions
• Not be discriminated against for exercising these rights

California residents may submit requests related to their CCPA rights by filling out the form or emailing [email protected]. We will verify requests before processing.

Most browsers provide options to restrict tracking technologies like cookies. Note this may impact some functionality.

You may unsubscribe from marketing emails using the link provided.

How to Request Data Deletion

You have the right to request deletion of your personal data. To submit a data deletion request, you can:

• Use our online form: Submit a Data Deletion Request
• Email us directly: Send your request to [email protected] with the subject line "Data Deletion Request"

We will respond to your request within 30 days. Once we have verified your identity, we will delete your personal information from our live systems (our production databases, search indexes and file storage) within 30 days of verification, unless an exception applies under applicable law.

We do not edit our backups. Copies of your information that remain in our routine backups are removed automatically when those backups expire, and every routine backup expires within 15 days of being made, so these copies are gone within 45 days of verification. Our application logs, which can contain contact identifiers, are kept for no more than 15 days. This timeline does not cover storage volumes we have retired from service; they are not used to provide the Services, and data on them may be kept for longer than 45 days.

Some professional information we hold is compiled from public records and other third-party sources. After a deletion, information about you may be collected again from those sources. If that happens, contact us at [email protected] and we will delete it again.

What We Delete Upon Request

Upon a valid deletion request, we will delete:

• Your account profile and registration data
• WhatsApp and messaging conversation transcripts
• Professional profile information we compiled about you from public records and other third-party sources
• Contact identifiers (phone numbers, email addresses) from active systems
• Message metadata and timestamps
• Any attachments or media you shared via messaging platforms

What We May Retain

We may retain certain data as required by law or for legitimate business purposes:

• Audit logs and transaction records required for legal compliance
• Billing and payment records as required by tax and accounting regulations
• Data necessary to resolve disputes or enforce our agreements
• Anonymized or aggregated data that cannot identify you
• A record of your request, and of any request not to be contacted, so that we can show how we handled it and continue to honor it

Social Media Login (Facebook, Google)

If you choose to connect or log in to our Services using a social media account such as Facebook or Google, we may receive certain information from that platform, including:

• Your public profile information (name, profile picture)
• Email address associated with your social media account
• Any other information you have made publicly available on that platform

We use this information solely for authentication and to create your account on our Services. We do not post to your social media accounts or access your friends list. We do not share your social media data with third parties except as described in this Privacy Policy.

Connecting a Gmail Account (Google User Data)

Recruiters may connect a Gmail or Google Workspace mailbox so that candidate outreach is sent from, and replies are received in, their own inbox. When you connect a Google account, you grant us access through Google's OAuth consent screen, and we access your Google user data as follows:

• Sending email (gmail.send): we send the outreach emails that you write, review or schedule in our Services from your mailbox, on your behalf.
• Reading messages (gmail.readonly): we read the headers (sender, recipients, subject, date and message identifiers) of new messages in your mailbox, including messages you send. We read the full content of two kinds of message only: messages in conversations Expa started on your behalf, whoever sends them (a candidate, a colleague who replies to all, or an automatic reply), and messages from delivery-failure senders (such as mailer-daemon or postmaster), because their headers alone cannot tell which email they are about. We use delivery-failure messages only for emails sent through Expa and disregard the rest. Any other message is not read beyond its headers and is not stored. Messages in conversations Expa started are shown to you, and to authorized members of your organization, in your dashboard, and are used to stop or continue your outreach sequence and to alert you. Delivery-failure messages are used to stop sending to addresses that no longer work.
• Your email address and basic profile: used to identify which mailbox is connected to your account.

When you connect Gmail through Google's consent screen for Expa, your Google user data is accessed by Expa directly and is not shared with any other mailbox-connection provider. Some Gmail and Outlook mailboxes, and all LinkedIn accounts, are connected through Unipile, a separate service provider; for those connections you authorize Unipile's own application, and the data it relays to us is handled as described in this Privacy Policy.

We store the content of messages in conversations Expa started and the metadata of messages we sent (recipient, subject, time, thread identifier) so that you can see the conversation history. To keep your mailbox connected we also store your Google account identifier, the permissions you granted, and a refresh token that is encrypted at rest. We keep conversation data for as long as your account is active or until you ask us to delete it; tokens are deleted as soon as you disconnect.

We do not use Google user data for advertising, we do not sell it, and we do not use it to train generalized artificial intelligence or machine learning models. A candidate's reply may be processed by an AI service provider to summarize it and assess the candidate's interest so that we can alert you; the AI does not send replies from your mailbox. The reply is processed only to provide that feature, under contractual terms that prohibit the provider from using it to train its models. Apart from that AI service provider and the providers that host our infrastructure, we do not transfer Google user data to anyone. No person at Expa reads your email unless you ask us to for support, it is necessary for security or to comply with the law, or the data has been aggregated and anonymized.

Expa's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect your Google account at any time from your dashboard, or revoke our access at myaccount.google.com/permissions. When you disconnect, we delete your Google access and refresh tokens and stop reading or sending from your mailbox. You may request deletion of the stored conversation data as described in "How to Request Data Deletion" above.

Connecting an Outlook or Microsoft 365 Account

Recruiters may connect an Outlook or Microsoft 365 mailbox so that candidate outreach is sent from, and replies are received in, their own inbox. When you connect it through Microsoft's consent screen for Expa, you grant Expa's own Microsoft application access, and we use it as follows:

• Sending email (Mail.Send): we send only the outreach emails that you write, approve or schedule in our Services, from your mailbox, on your behalf.
• Reading messages (Mail.Read): for new mail we read the headers only (such as sender, recipients, subject, date and message identifiers). We read the full content of two kinds of message only: messages in conversations Expa started on your behalf, and messages from delivery-failure senders (such as mailer-daemon, postmaster or Microsoft Exchange's own delivery reports), because their headers alone cannot tell which email they are about. We use delivery-failure messages only for emails sent through Expa and disregard the rest. Any other message is not read beyond its headers and is not stored. We also read back the copy of each email we send from your Sent Items, to record its message identifier and conversation.
• Your basic profile (User.Read, openid, email) and staying connected (offline_access): used to identify which mailbox is connected to your account and to keep it connected without asking you to sign in again.

We store the content of messages in conversations Expa started and the metadata of messages we sent (recipient, subject, time, conversation identifier) so that you can see the conversation history. To keep your mailbox connected we store your Microsoft account and organization identifiers, the permissions you granted, and a refresh token that is encrypted at rest. When you disconnect, we delete the refresh token and stop reading or sending from your mailbox.

We do not use this data for advertising, we do not sell it, and we do not use it to train generalized artificial intelligence or machine learning models. A candidate's reply may be processed by an AI service provider to summarize it and assess the candidate's interest so that we can alert you; the AI does not send replies from your mailbox, and the provider may not use the reply to train its models. No person at Expa reads your email unless you ask us to for support, it is necessary for security or to comply with the law, or the data has been aggregated and anonymized.

If your organization only lets an administrator approve new apps, Microsoft will ask your IT administrator to approve Expa once for the organization; the approval grants the same permissions described above and nothing more.

You can disconnect your mailbox at any time from your dashboard. Microsoft does not let us remove the app's approval on your behalf, so to also remove Expa's access in Microsoft, visit myapps.microsoft.com (work or school accounts) or account.live.com/consent/Manage (personal accounts). You may request deletion of the stored conversation data as described in "How to Request Data Deletion" above.

Cookies, Tracking Technologies and Your Choices

Our website uses cookies and similar tracking technologies to collect information about your browsing activities. We use this information to improve our Services, personalize your experience, and identify potential job candidates. Third-party analytics and visitor-identification tools run only for visitors located in the United States; outside the United States we collect usage analytics without setting cookies. When your browser sends the Global Privacy Control (GPC) signal, we do not load third-party analytics or visitor-identification tools for you, and you may also submit a request through our Do Not Sell or Share My Personal Information page.

WhatsApp and Messaging Communications

We use WhatsApp and other messaging platforms to communicate with you about our Services. This section explains how we handle data related to these communications.

Data We Process

When you communicate with us via WhatsApp or similar messaging platforms, we process:

• Your phone number
• Messages you send to us and messages we send to you
• Message timestamps and delivery status
• Any information you include in your messages (such as documents or images)

How We Use Messaging Data

We use messaging data solely for the following purposes:

• Providing customer support and responding to your inquiries
• Sending account notifications and service updates
• Delivering job alerts, interview confirmations, and recruiting communications you have requested or consented to
• Facilitating communication between clinicians and potential employers when authorized

We do not use WhatsApp-derived data for advertising targeting or candidate profiling. WhatsApp data is used only for delivering messages, providing customer support, and facilitating communications you have requested, not for candidate matching or targeting decisions.

Consent and Opt-Out

You may opt in to receive WhatsApp messages from us by:

• Providing your phone number through our website or app registration where the intention to receive WhatsApp communications is clearly disclosed
• Initiating a conversation with us on WhatsApp (which provides consent for us to respond and continue that conversation thread)
• Explicitly agreeing to receive messages during the job application process

You can opt out of WhatsApp communications at any time by:

• Replying "STOP" to any WhatsApp message from us
• Contacting us at [email protected]

Messaging Data Retention

We retain WhatsApp conversation records for as long as necessary to provide our Services, comply with legal obligations, and resolve disputes, or until you ask us to delete them. You may request deletion of your messaging data by contacting us at [email protected].

Data Retention and Security

We retain personal information for as long as necessary for our business purposes, subject to legal requirements. We use technical, administrative and physical security measures to protect the information we collect, including:

• Encryption in transit (TLS/HTTPS) for all data transmissions
• Encryption at rest for stored personal data
• Role-based access control (RBAC) with least-privilege principles
• Secure authentication and session management
• Logging and monitoring of system access and security events
• Incident response procedures for security breaches
• Secure key management and secrets storage
• Vendor and subprocessor security assessments
• Regular security reviews and updates

International Data Transfers

Your personal data may be transferred to and processed in the United States by our service providers, including cloud infrastructure and communication platforms. We ensure appropriate safeguards are in place through contractual data protection obligations with our processors that provide protections consistent with applicable privacy laws.

Third-Party Sites and Services

Our Services may link to third-party websites and services that have their own policies. We are not responsible for their privacy practices.

Children's Privacy

Our Services are not directed at children under 13 and we do not knowingly collect personal information from children under 13.

Updates

We may update this Policy from time to time by posting the revised version on our Site. Your continued use constitutes acceptance of the updated Policy. For significant changes, we will provide reasonable notice, such as through a website notice or email.

Contact Us

If you have any questions or concerns about this Policy or our data practices, please contact us at [email protected].