Jumavo is operated by JŪMA Group, LLC ("Jumavo," "we," "us," or "our"). Jumavo is a closed-loop prepaid wallet for elective, cash-pay care. This Privacy Policy explains how we collect, use, disclose, and protect personal information when you use the Jumavo website, mobile apps, provider portal, APIs, and related services (collectively, the "Services").

Jumavo is not insurance, not a bank, and not financing. It is a prepaid wallet you load and then spend with participating providers.

This Policy applies to two groups of people:

• Members — individuals who use Jumavo to set money aside for, pay for, and keep records of elective, cash-pay care.
• Providers — licensed healthcare and wellness providers and their practices who participate in Jumavo to accept wallet payments from members.

It also applies to visitors of our marketing website at jumavo.com. Where Provider obligations differ from Member obligations, this Policy says so.

A note on health information. When a Provider uses the Services to handle information about an identified patient, some of that information may be Protected Health Information ("PHI") under the Health Insurance Portability and Accountability Act ("HIPAA"). Jumavo's handling of any such PHI is governed primarily by the Business Associate Agreement ("BAA") between Jumavo and the Provider, which supplements — and does not replace — this Policy. [Jumavo's HIPAA status is subject to counsel confirmation per the Compliance Playbook.]

• Identity and contact information — name, email address, phone number, date of birth, mailing address.
• Account information — username, password (stored hashed), profile photo, communication preferences.
• Member wallet activity — the care categories you save or search, participating providers you transact with, appointment dates, wallet loads and balances, and receipts.
• Please do not enter medical records or diagnostic details into free-text fields. We do not require you to upload medical records.
• Provider professional information — practice name, NPI, license numbers and states, insurance carrier, service listings, prices, hours, and photos.
• Payment information — billing address, the card brand, the last four digits of your payment card, and expiration date. Full payment-card numbers are collected and stored by our payment processor, Stripe, Inc. — not by Jumavo.
• Communications — messages you send to Jumavo support, to Providers, or to other members through the Services; survey responses; and beta feedback.

We use personal information to:

• Provide and improve the Services — create and authenticate accounts, help you find and pay participating providers, process wallet loads and payments, store receipts, and deliver in-app and email notifications.
• Process transactions — through Stripe and approved processors, including fraud prevention, chargebacks, and reconciliation.
• Communicate with you — service messages, security alerts, support replies, and (with consent where required) marketing communications. You can opt out of marketing emails at any time.
• Send SMS — appointment reminders and security codes via Twilio Inc., with prior consent and required TCPA disclosures. Consent to marketing texts is never a condition of any purchase.
• Personalize content — surface saved services and participating providers, and tailor your home feed based on your usage.
• Measure and improve — product analytics, A/B testing, performance monitoring, and aggregated reporting.
• Protect the Services — detect fraud, abuse, account takeover, and prohibited conduct.
• Comply with law — respond to legal process, enforce our Terms of Service, and protect the rights, property, and safety of Jumavo, our users, and the public.
• Develop the business — corporate transactions, including financing, due diligence, and mergers or acquisitions, subject to appropriate confidentiality protections.

Where required by law, we rely on legal bases including: performance of a contract with you; our legitimate interests in operating and securing the Services; your consent (for marketing communications, precise location, and certain cookies); and compliance with legal obligations.

• Account information — review and update most information in your account settings, or contact [email protected] for help.
• Marketing communications — unsubscribe via the link in any marketing email; transactional and service messages will continue.
• SMS — reply STOP to opt out at any time, or manage SMS preferences in-app.
• Push notifications — manage these in your device settings.
• Location — revoke precise-location access in your device settings; you can still use the Services without it.
• Cookies — see Section 9. Most browsers let you block or delete cookies and respond to Global Privacy Control ("GPC") signals.
• Account closure — request closure in-app or by emailing [[email protected]]. Some information may be retained as described in Section 6 or as required by law.

We use cookies, SDKs, pixels, and similar technologies to operate the Services, remember your preferences, measure performance, and (in limited cases) support advertising. Categories include:

• Strictly necessary — required for login, security, and core functionality.
• Functional — remember preferences and personalization.
• Analytics — measure usage and improve the product.
• Advertising/attribution — measure marketing effectiveness and limit ad frequency.

You can manage non-essential categories through our in-product cookie preferences and most browsers' settings. We honor opt-out preference signals (including GPC) for users in jurisdictions that recognize them, including California.

The Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13 in violation of the Children's Online Privacy Protection Act ("COPPA"). Parents or legal guardians may use the Services to manage cash-pay care for minor dependents, subject to additional consent flows. If you believe a child under 13 has provided information to us, contact [[email protected]] and we will delete it.

This section provides additional disclosures for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA").

Residents of certain other U.S. states (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and others as laws take effect) may have similar rights to access, correct, delete, and opt out of targeted advertising or profiling. You can exercise these rights through the same channels listed in Section 11.5. We respond as required by applicable state law.

If you have questions about this Privacy Policy or our privacy practices, contact:

JŪMA Group, LLC — Attn: Privacy [Street Address], [City], CA [ZIP] [[email protected]]

Related: see our Terms of Service.

— End of draft. For legal review before publication. —