Cocoon Financial Services, Inc. (“Cocoon,” “Company,” “we,”“us” or “our”) cares about protecting the privacy of users of our cloud-hosted Software-as-a-Service (SaaS) platform that provides employees with an easy, understandable and fast way to privately design their leave and helps employers administer and manage parental, medical and caregiver leave (“Services”), and the website located at cocoon.com (the“Site”). This Policy applies to employers (“Employer”), their employees andSite visitors (“individuals” or “you”).  ThisPrivacy Policy explains how we collect, use, share and otherwise process your personal information in connection with the Site and our services, and the rights and choices that may be available to you with respect to your information. Personal information means information that identifies or can identify you personally. 

This Policy does not apply to any information that you or your Employer may provide directly to third parties including via links appearing on the Site. 

By using our Services and Site, you agree to the terms of this Privacy Policy. 

How We Collect Personal Information 

Providing our Services requires Cocoon to collect and process certain personal information provided by employers about their employees, as well as information provided directly by individual employees. Cocoon will only collect as much information as is required to fulfill the purposes of our business and comply with our contractual, legal and regulatory obligations. 

Information About You Collected from Employers 

When we collect personal information about you directly from your Employer, that personal information is controlled by your Employer, and your Employer gives us instructions on how we should be processing your personal information. If you have requests regarding the personal information we process on behalf of your Employer, please direct your inquiries to your Employer. 

The personal information we collect about you from yourEmployer may include: 

• Contact and Profile Data: your name and work email. 

• Government-issued Identification Numbers: your Social Security Number, Taxpayer Identification Number, or Social Insurance Number. 

• Employment Information: your Employer’s name, your job title, work location, start date, salary, and job duties. 

• Insurance Information: your provider and policy number. 

Information Collected Directly from You 

We collect personal information that you provide directly to us through the use of our Services. The information we collect in this manner may include: 

• Contact and Identification Data: your name, email, mailing addresses, and phone number. 

• Government-issued Identification Numbers: your Social Security Number, Taxpayer Identification Number, or Social Insurance Number. 

• Employment Information: your Employer’s name, your job title, office location, start date, salary, and job duties. 

• Account Data: your personal email and password that you may set up to establish an online account with us. 

• Information About Your Pregnancy: your expected due date, adoption or foster child placement date, expected delivery method, name and contact information of delivery hospital and doctor, midwife, or other medical professional, and parental leave preferences. 

• Information About Your Medical Leave Request: condition or diagnosis, name and contact information of medical providers, and expected dates of disability. 

• Insurance Information: your provider and policy number. 

• Documentation: any attachment you upload that contains personal information, such as a birth certificate, insurance card, medical record, or other document. 

• Information about Third Parties: We collect information that you choose to provide regarding your partner, dependents, or other third parties, such as their names, email addresses, and phone numbers. 

• Feedback: information you provide when you contact us with questions, feedback, or otherwise correspond with us online. 

• Usage Data: your preferences for receiving communications about our activities and publications, and details about how you engage with our Site and communications. 

Automatically Collected Data 

We and our service providers may use cookies, beacons, pixel tags and other tracking technologies to automatically log information about you, your computer or mobile device and your activity over time on the Site and our Services, including: 

• Device Data, such as your computer or mobile device operating system type and version number, manufacturer and model, browser type, screen resolution, IP address, device identifier (such as the Google Advertising ID or Apple ID for Advertising), the website you visited before browsing our Site and  general location information such as city, state or geographic area. 

• Online Activity Data: using cookies, the Site tracks additional information that includes your browsing history, search history, whether you clicked on or opened one of our emails, which of our pages or screens you viewed, how long you spent on a page or screen, navigation paths between pages or screens, information about your activity on a page or screen, access times and duration of access. 

Please visit the “Options” section of this Privacy Policy for information on how to disable or opt-out of certain cookies and similar technologies. 

You may refuse to provide certain personal information, but some parts of the Site or our Services may not be fully available or functional without submitting such information. 

Use of Personal Information 

The Personal Information we collect may be used for one or more of the following business purposes: 

1. Delivering our products and services, including maintaining or servicing accounts, providing customer service, processing transactions, or verifying customer information. 

2. To fulfill or meet the reason for which the information is provided. For example, if you provide us with Personal Information in order for us to manage your leave, we will use that information to manage your leave.  

3. To provide you with information about Cocoon’s products and services. 

4. To provide you with email alerts, event registrations and other notices concerning our products or services, or events or news, that may be of interest to you. 

5. To validate user information for fraud and risk detection purposes and prevent or stop any activity that may be illegal, unethical or legally actionable. 

6. To improve our Services and Site and present its contents to you. 

7. For testing, research, analysis, and product development. 

8. To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations. 

9. To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or     similar proceeding, in which Personal Information held by us is among the assets transferred. 

10. We may use the information you provide to us in connection with a job application or inquiry, such as information contained on a resume a curriculum vitae, or interviews for the purpose of employment consideration or responding to your inquiry.  

Disclosure of Personal Information 

We may disclose your personal information with the following parties. In such events, we will use commercially reasonable efforts to help ensure that your Personal Information will be subject to appropriate privacy protections, in accordance with applicable privacy law: 

• State or Federal Agencies that Administer Family or Medical Leave Benefits: We may share your personal information with the state or federal agencies that administer family or medical leave benefits in order to facilitate your application for disability or parental leave and benefits. We do not control how these state agencies may process your personal information. 

• Insurance Companies:  We may share your personal information with insurance companies to facilitate your claim for short term disability benefits. We do not control how insurance companies process your personal information but we take commercially reasonable steps to protect the privacy of your personal information as appropriate. 

• Enterprise Employers:  If you use our Services through an Employers (including your employer), we share your personal information with that Employer (our customer) in order to facilitate your medical, caregiver or parental leave and state and insurance benefits and to ensure proper payment and communication regarding the length and type of leave. We do not control how the relevant Employer may collect, use or disclose your personal information. 

• Service Providers:  We may share your personal information with We may use service providers, contractors and other third parties to operate our Site, provide our Services and cater them to you. When we provide information to service providers and other third parties, we enter a contract that describes the purpose and requires the recipient to both keep that Personal Information confidential and not use it for any purpose except performing the contract. 

• Professional advisors:  We may share your personal information with professional advisors, such as lawyers, auditors, bankers and insurers, where necessary in the course of the professional services that     they render to us and subject to confidentiality obligations.  

• Affiliates and business acquirers: We may disclose your information to our subsidiaries and affiliates to identify business opportunities and market our products and Services to you. We may transfer your Personal Information as part of a sale or transfer of all or a relevant portion of our business or assets, as needed.  

• Authorities and others:  We may share your personal information with law enforcement, government authorities, agencies or departments, and private parties, as we believe in good faith to be necessary or appropriate for the compliance, fraud prevention and safety purposes described above or as otherwise required or permitted by applicable laws. 

• With your consent: In some cases, you may provide your consent or we may specifically ask for your consent to collect, use or share your personal information where your consent is required by applicable laws. 

Personal Information We Collect, Use and Disclose 

This table below summarizes, for each category of personal information we collect, the sources, the business/commercial purposes for collection, whether we disclose the category to third parties, and the retention period. Categories of personal information we have collected, used, disclosed, or shared for a business purpose in the preceding 12months are listed below. 

For the purposes of the California Consumer Privacy Act of2018 (“CCPA”), Personal Information does not include: publicly available information from government records; de-identified or aggregated consumer information; information excluded from the CCPA's scope, like 1) health or medical information covered by the Health Insurance Portability andAccountability Act of 1996 (HIPAA) and the California Confidentiality ofMedical Information Act (CMIA) or clinical trial data; and 2) PersonalInformation covered by certain sector-specific privacy laws, including the FairCredit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or CaliforniaFinancial Information Privacy Act (FIPA), and the Driver's Privacy ProtectionAct of 1994. 

We may create anonymous, aggregated or de-identified data from your personal information and other individuals whose personal information we collect, by removing the information that makes the data personally identifiable to you. We may use and share such anonymous, aggregated or de-identified data for any purpose we deem appropriate, such as to maintain and improve the Site, and our current as well as future products and services. 

We may use anonymous, aggregated, or de-identified data that does not identify any individual person orEmployer in automated processes, including artificial intelligence in connection with and to improve the efficiency of the Site and Services. Cocoon does not provide identifiable personal information to third-party AI systems for model training. 

Some of the personal information described above qualifies as sensitive Personal Information. This includes: Social Security,Taxpayer Identification, and Social Insurance numbers; account log-in credentials in combination with a password; information about your health, medical conditions, and pregnancy or reproductive health (including leave-related health information); and racial or ethnic origin where voluntarily provided. Cocoon collects and uses sensitive personal information only as reasonably necessary to provide the Services, including administering leaves, and comply with applicable law. We limit our use of sensitive Personal Information to circumstances where it is necessary and is used and disclosed for the purposes described in thisPolicy.  

Cocoon does not sell personal information for monetary or other consideration. Depending on the configuration of certain advertising or analytics cookies on our business website (Cocoon.com),the sharing of device or online activity data with third-party advertising or analytics partners may constitute a "sale" or "share" of personal information as broadly defined under the CCPA. A California consumer can exercise the right to opt out by using a web browser that supports do-not-track functionality, or by manually opting out of AdvertisingCookies upon clicking on the Do Not Sell or Share My Personal Information link at the bottom of each page of ourSite.

Retention of Personal Information 

Cocoon retains personal information only for as long as necessary to provide our services and to comply with our legal, regulatory, contractual, and security obligations. Retention periods vary depending on the type of information, the nature of the services provided, and applicable legal requirements. For example, information associated with employee accounts, leave administration, benefit applications, and related communications may be retained for longer periods where required to comply with employment, tax, benefits, audit, or dispute resolution obligations.Cocoon maintains internal retention schedules that define retention periods by category of information and applicable legal requirements. When personal information is no longer required for these purposes, it is deleted or de-identified in accordance with Cocoon’s data governance and security practices. 

Cookies and Do Not Track 

We and our service providers also use technologies such as cookies, beacons, tags, and scripts in order to gather information about your use of the Site. We and our service providers use session cookies to make it easier for you to navigate the Site. We also use persistent cookies. A persistent cookie remains on your hard drive for an extended period of time after you finish browsing  and remembers your preferences. You may opt-out of these technologies (except for essential website cookies) using a web browser that supports do-not-track functionality such as Global Privacy Control,  by manually opting out of AdvertisingCookies upon clicking on the Do Not Sell or Share My Personal Information link at the bottom of each page of ourSite. 

You can learn more about cookies by visitingwww.allaboutcookies.org, which includes additional useful information on cookies and how to block them using different browsers. Please note that if you set your browser to disable certain cookies, the Site may not work properly. Similarly, your browser settings may allow you to clear your browser web storage. 

Some Internet browsers may be configured to send “Do NotTrack” signals to the online services that you visit. We currently do not respond to “Do Not Track” or similar signals. To find out more about “Do NotTrack,” please visit http://www.allaboutdnt.com. 

Marketing Communications  

If you receive promotional communications from Cocoon and no longer wish to receive them, you may contact us at support@cocoon.com to request that we stop sending such communications. Please note that we may continue to send communications related to your account, services, transactions, support requests, or other operational matters where permitted by applicable law. 

Your Rights and How To Exercise Them 

Depending on where you reside, you may have certain legal rights regarding the Personal Information we process about you. Privacy rights that may apply to you and your Personal Information include: 

• Right to know what categories and/or specific elements of Personal Information     is being collected, disclosed or sold 

• Right to access or obtain of copy of your Personal Information 

• Right to correct inaccurate Personal Information 

• Right to delete your Personal Information 

• Right to opt-out of the selling or sharing of your Personal Information 

• Right of no retaliation following opt-out or exercise of other rights 

• Right to opt-out of the use of certain automated decision-making     technologies 

If you are using the Cocoon Services through your Employer, contact your Employer to initiate a rights request. 

If we have collected your information directly for our marketing efforts or you are an agent of an Employer, please contact us at support@cocoon.com. 

We will confirm receipt of a request to know, delete, or correct within 10 business days and will respond substantively within 45 calendar days of receipt, which we may extend once by an additional 45 calendar days (90 days total) where reasonably necessary, with notice to you of the extension. 

Certain requests must be verified. If we cannot verify your identity based on the information provided, a request for a copy of your data will be treated as a request for information and if we cannot verify your identity, a request to delete personal information may be treated as are quest to opt-out of the sale or share of personal information. Requests to opt out of sale or share of personal information do not require identity verification and can be submitted as described above under Cookies and Do NotTrack. 

If you wish to appeal a decision regarding your rights, please contact us atsupport@cocoon.com. 

Authorized Agent 

You may designate an authorized agent to make a request on your behalf. An Authorized Agent must have written documentation of their authority to act on your behalf such as a Power of Attorney, or similar document, signed and dated by the you naming the agent as your authorized representative, which includes your full name and physical address and your month/year of birth. We will also need a valid email address for you for our direct correspondence with you, including to verify your identify; and a signed affidavit attesting that you understand that Cocoon is relying on the information you provide to respond to a data rights request in accordance with applicable law.  

Children’s Privacy

The Site and our Services are not directed to children under the age of 13, or 16 in California. If you are under 16, please do not attempt to register an account or send any information about yourself to us. We do not knowingly collect or solicit personal information from children under 16 on the Site or mobile application.If we discover that we have collected personal information from children under16, we will take commercially reasonable measures to promptly delete such information from our systems.  

If you provide Cocoon with personal information related to your dependents, including children under 16, when using our Services, including uploading Documentation, you are deemed to have consented to our use of this information to provide the Services to you and your Employer. 

Security 

We maintain commercially reasonable technical, physical, administrative safeguards designed to protect the personal information we collect from unauthorized access and use, and to comply with applicable privacy laws. We protect personal information in a manner appropriate to the sensitivity of the information. However, security risk is inherent in all internet and information technologies, and no security measures are impenetrable, and no method of data transmission can be guaranteed to be 100% secure from interception or other type of misuse. 

Third-Party Websites 

The Site contains links to websites, mobile applications, and other online services operated by third parties.These links are not an endorsement of, or representation that we are affiliated with, any third-party and we cannot control, and take no responsibility for, the content or privacy practices of such third-party websites, mobile applications or online services operated by third parties. Please carefully review the Privacy Policy and any other applicable terms for such third-party websites, mobile applications or online services operated by third parties. 

International Data Transfers 

Cocoon currently stores and processes personal information in the United States. We do not transfer personal information outside of theUnited States in connection with providing our Services. If this practice changes in the future, Cocoon will implement  as required by applicable law. 

Policy Updates 

We reserve the right to modify this Privacy Policy at any time without prior notice.  If we make changes to this PrivacyPolicy, we will notify you by updating the date of this PrivacyPolicy and posting it on the Site. If required by law, we will also provide notification of changes in another way that we believe is reasonably likely to reach you, such as via email or another manner through the Site.Any modifications to this Privacy Policy will be effective upon our posting the modified version (or as otherwise indicated at the time of posting). In all cases, your continued use of the Site after the effective date of any modified Privacy Policy indicates your acceptance of the modified Privacy Policy. We encourage you to periodically review this page for the latest information on our privacy practices. 

Contact 

If you have any further questions or complaints concerning this Privacy Policy, please contact privacy@cocoon.com. If you are unable to resolve your concern by contacting us, you may lodge a complaint with your local regulatory authority(ies).  

Cocoon Privacy Policy effective August 20, 2026. 

‍