Privacy Policy

Effective date: June 24, 2026 Last updated: July 17, 2026 Version: 1.2

Overview

Bonnie HR (the "Service" or "Platform") is operated by Buffer Benefits, LLC ("Bonnie," "we," "us," "our"), a Texas limited liability company headquartered at 550 Reserve Street, Suite 250, Southlake, TX 76092.

This Privacy Policy explains what information Bonnie collects, how we use it, who we share it with, and the rights you have. It covers two groups of people:

• Customers: organizations that subscribe to Bonnie for workforce, benefits, performance, and optional wellness-program administration;
• End users: the employees of those customer organizations who participate in the wellness program through Bonnie.

If you're an employee participating through your employer's Bonnie program, your employer is the controller of most of the data you submit. This Policy explains what Bonnie does with that data on your employer's behalf, and what Bonnie does with information directly for its own purposes (such as account security and product improvement).

**If you participate in Bonnie through an employer-sponsored wellness program, your employer determines what information is collected through the program, which administrators can access it, how long it is retained (within the limits described in this Policy), and how it is used for program administration. Bonnie processes such information solely on behalf of your employer and in accordance with its instructions.** For decisions about what data your employer asks you to provide — and how your employer uses that data internally — your employer's own Notice of Privacy Practices is the controlling document.

Data minimization

Bonnie is designed around the principle of data minimization. We seek to collect, use, retain, and disclose only the information reasonably necessary to operate wellness programs, verify participation, deliver rewards, maintain security, and satisfy legal obligations.

Our role: controller or processor

Depending on what data is being processed, Bonnie acts as either a data controller (we decide what data is collected and why) or a data processor (we process data on behalf of someone else who makes those decisions). Knowing which role applies determines who is responsible for a request — your employer, or us.

• Bonnie is the processor when your employer (the "Customer") subscribes to the Service to administer its workforce and related programs for its employees. In that case, your employer is the controller of data about you that flows through the Service — your activity log, reward redemptions, profile fields chosen by your employer, etc. Your employer's service agreement with Bonnie is our instruction for how we process that data on its behalf.
• Bonnie is the controller for: the information our customers (the organizations) provide when they sign up for the Service; billing and payment data for our customers; device/log data we collect from anyone using our public marketing site; and aggregated, de-identified analytics we generate from the Service for product improvement.

When you ask us to exercise a right (access, deletion, etc.) over processor-data, we will forward your request to your employer (who, as controller, makes the call) and assist them in responding. For controller-data, we respond directly.

Notice of Collection (for California residents)

This section serves as Bonnie's Notice at Collection under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). The categories of personal information we collect, the purposes for which we collect each, and whether each is sold or shared are described throughout this Policy. To summarize:

• Identifiers (name, email, optional phone, IP address) — collected to provide the Service and for security. Not sold. Not shared for cross-context behavioral advertising.
• Customer records (employment status, department, optional address for physical reward shipments) — collected to operate the wellness program. Not sold. Not shared.
• Sensitive personal information (such as Social Security or taxpayer identification numbers, government-document details, benefit enrollment information, and account credentials) — collected only when needed for configured HR, tax, onboarding, benefits, or security workflows. Not sold. Not shared for cross-context behavioral advertising.
• Internet or other network activity (logins, device info, audit logs) — collected to secure the account. Not sold. Not shared.
• Wellness-program activity information (activity types, durations, optional effort ratings) — collected to operate the program. Not sold. Not shared.
• Inferences (engagement scores, leaderboard standings) — derived from the above. Not sold. Not shared.

We retain each category only as long as needed to fulfill the purpose or as required by law (see "How long we keep information").

Information we collect

Account information

When you create or are invited to a Bonnie account:

• Name, email address, optional phone number;
• Job-related context such as department, employment status, and time zone;
• Authentication identifiers and any second-factor configuration you add.

Employment, onboarding, payroll, and benefits information

When your employer configures these Bonnie modules, the Service may process:

• Employment history, job title, manager, department, work location, compensation, time-off records, goals, feedback, performance reviews, and onboarding or offboarding tasks;
• Benefit elections, coverage and eligibility information, dependents, beneficiaries, tobacco status, and supporting enrollment documents;
• Tax and work-authorization information needed for forms such as W-4, I-9, and W-9, which may include a Social Security number or other taxpayer identifier, driver's-license details, visa information, and an electronic signature; and
• Emergency contacts, education, certifications, assets, and other personnel records that you or your employer choose to maintain in the Service.

Full Social Security numbers and equivalent identifiers are encrypted where stored in application records, displayed only in narrowly authorized workflows, and excluded from the instant self-service JSON export. You may request an eligible copy through the privacy-request process, where identity and disclosure authority can be verified first.

Wellness activity and program participation

When you use Bonnie:

• Activities you log (type, duration, optional distance, optional effort rating, optional notes);
• Challenges you participate in and your progress within them;
• Rewards you unlock, claim, and have delivered;
• Engagement signals such as login frequency, streak status, and notifications you have read or dismissed;
• Optional fitness data imported from connected services (Apple Health, Google Health Connect, Strava, Garmin, Fitbit, etc.) — only if you choose to connect them. You can disconnect at any time.

Verification of wellness-program participation

Some wellness programs ask employees to provide proof that a wellness activity took place — for example, a screenshot of a fitness-class booking, a telehealth confirmation, or a one-line attestation that an annual physical occurred. **Bonnie is designed to verify completion of wellness activities while minimizing collection and retention of health information.** When documentation is submitted solely to verify participation in a wellness activity, Bonnie generally retains only the verification outcome (e.g., "verified on 2026-03-04") and deletes the underlying documentation after the verification process is complete, subject to applicable legal and operational requirements. You should not upload medical records, diagnostic reports, treatment records, laboratory results, imaging studies, or other clinical documentation beyond what is reasonably necessary to demonstrate that an activity occurred.

A note on connected wearables and fitness apps

When you connect a third-party service (Apple Health, Google Health Connect, Strava, etc.) to your Bonnie account, that service has its own privacy policy that governs how it collects information from your device. Bonnie receives only the activity summaries you have authorized to be shared. Disconnecting in Bonnie's settings stops new data from flowing in; whether the third-party service continues to hold historical data depends on its own policy. We strongly recommend reading the privacy policy of any connected service before linking it.

Geo-location data

The Service does not require precise location. Some integrations (HealthKit, Health Connect, Strava) may pass through coarse start/end points of an activity if you opted to record them in those apps. We do not use this information for any purpose other than displaying it back to you (e.g., as part of an imported run). We do not infer your home address from this data, do not use it for advertising, and do not share it with your employer.

Profile and contact information

• Home or shipping address (used solely to fulfill physical reward shipments and only when you claim such a reward);
• Optional demographic fields such as gender. These may be supplied by you when you complete your profile, or imported by your employer as part of an employee-census upload at program setup. Available self-service edits and employer approval rules depend on the field.

Device and access information

• IP address, browser type, operating system, and similar standard log data captured automatically when you use the Service;
• Audit log of changes to your account or actions performed by an administrator on your behalf.

Information we do not collect or store

• Biometric identifiers. Bonnie is not designed to collect, store, or use biometric identifiers (such as fingerprints, facial scans, voiceprints, retina scans, or other biological identifiers) for identification purposes. To the extent activity-related measurements are received through connected services (e.g., step counts, heart-rate averages, calories), Bonnie uses them only to support wellness-program functionality and not for identity verification.
• We do not collect payment-card information directly; subscription payment processing is handled by our subprocessor (see "Subprocessors" below).

How we use information

We use the information described above to:

• Provide, maintain, and support the Service;
• Authenticate your account and protect against unauthorized access;
• Compute leaderboards, badges, and challenge progress for the organization you participate in;
• Deliver rewards you unlock through our delivery partners;
• Send transactional notifications (account, security, claim status, challenge updates) to your registered email or phone;
• Improve the Service and develop new features (using aggregated, de-identified data where possible);
• Detect, investigate, and prevent fraud, abuse, manipulation of wellness-program incentives, security incidents, and violations of our Terms — including reviewing activity logs and reward redemptions where patterns suggest gaming, sharing of accounts, or other misuse;
• Comply with legal obligations and enforce our terms.

No employment decisions

Bonnie is intended to support wellness-program participation and engagement. **Bonnie does not make employment decisions and does not recommend hiring, termination, promotion, discipline, compensation, or benefits decisions.** Any such decisions are made solely by the employer.

Accuracy of connected-service data

Bonnie does not guarantee the accuracy, completeness, or availability of information supplied by third-party connected services (such as Apple Health, Google Health Connect, Strava, Garmin, or Fitbit). Activity data imported through these services is displayed and used as received. If you believe data imported into Bonnie is inaccurate, the most reliable fix is in the source service.

What we will not do

We do not use your information to:

• Sell to third parties (we do not sell personal information as defined under any U.S. state privacy law);
• Serve advertising on our Service or on third-party platforms;
• Train large-language models or other AI systems on identifiable end-user data.

What your employer sees

If you participate in Bonnie through your employer:

• Administrators authorized by your employer can access the personnel, employment, compensation, benefits, time-off, performance, onboarding, document, and reporting data needed for the modules your employer uses;
• Your employer's administrators see aggregated participation, engagement, and reward-cost metrics for the wellness module;
• Your employer's administrators see individual activity logs as part of the leaderboard and challenge tracking. This is necessary to operate the program;
• Your employer can configure department-level filters and leaderboards.

**Except where explicitly disclosed as part of a specific wellness-program workflow, Bonnie is designed so that employers receive participation status, activity-completion information, challenge results, reward-eligibility status, and similar program-administration information — rather than underlying medical records, diagnoses, treatment details, laboratory results, imaging studies, or clinical documentation.** For workflows that involve short-term review of provider documentation (e.g., to verify an annual physical), see "Verification of wellness-program participation" above; Bonnie retains the verification outcome only, not the underlying documentation.

The decision about what data flows into Bonnie from your employer (for example, whether department or address is required) is your employer's to make; that's spelled out in your employer's own Notice of Privacy Practices.

**Employers are responsible for determining how they use information made available through the Service and for complying with applicable employment, benefits, privacy, and anti-discrimination laws.**

Who we share information with

Subprocessors

We engage trusted third-party service providers to operate the Service:

A current list of subprocessors is available upon request via privacy@bonniehr.com. We will provide at least thirty (30) days' notice before adding a new subprocessor with access to identifiable end-user data.

Legal disclosures

We may disclose information when required by law (subpoena, court order, lawful government request), to protect Bonnie's rights or property, or to investigate fraud, security incidents, or violations of our Terms.

Business transfers

If Bonnie is acquired, merges, or transfers all or substantially all of its assets, your information may be transferred to the acquirer subject to terms at least as protective as this Policy.

How long we keep information

• Account data: as long as your account is active, plus a reasonable period after deactivation for backup, audit, and dispute resolution.
• Employment, tax, benefits, and personnel records: for the period directed by the employer that controls those records and as needed for applicable employment, tax, benefits, audit, dispute, and record-retention obligations.
• Activity and challenge data: as long as your account is active. Following an approved deletion request, identifiable activity data is deleted within thirty (30) days, subject to employer instructions and the exceptions described below; aggregated, de-identified data may be retained for analytics.
• Audit logs: up to seven (7) years, to meet our compliance obligations.
• Reward redemption records: up to seven (7) years, to meet financial and tax record-keeping obligations.
• Wellness verification documents: documentation is deleted within thirty (30) days after an approval or rejection. A submission that remains pending without a decision is automatically rejected and its documentation deleted after one hundred eighty (180) days.
• Authentication security telemetry: sign-in events, IP address, device, and approximate country signals are automatically deleted after one hundred eighty (180) days.

If you would like your data deleted sooner than these periods (subject to our legal obligations), see "Your rights" below.

Account deletion process

When you (or your employer on your behalf) submit a verified deletion request through Bonnie Settings or by email:

• Bonnie will use commercially reasonable efforts to remove your account and identifiable account data from production systems within thirty (30) days of the request, unless a longer period is required by law or by an active dispute, investigation, security review, or operational necessity.
• Deleting an account may not immediately remove information from backups, disaster-recovery systems, audit logs, or records required by law to be retained. Information in those systems is protected under the same security controls and is overwritten or expired on its ordinary retention cycle.
• Aggregated, de-identified analytics that no longer identify you may be retained indefinitely.

How we protect information

We use industry-standard administrative, technical, and physical safeguards designed to protect your information, including:

• Encryption at rest and in transit using industry-standard security measures;
• Role-based access controls with the principle of least privilege;
• Appropriate personnel screening and access-management procedures for personnel with access to identifiable data;
• Periodic security training for personnel who handle identifiable data;
• An audit log of administrative actions affecting your account.

We may modify our security measures from time to time as technology and industry standards evolve, provided the measures, taken as a whole, remain commercially reasonable and appropriate to the sensitivity of the information.

Your role. Users are responsible for maintaining the confidentiality of their login credentials and for promptly notifying Bonnie of any suspected unauthorized access to their account.

No security program is perfect. If we become aware of a Breach of Unsecured Protected Health Information, we will notify affected individuals as required by HIPAA and applicable state law.

Your rights

Depending on where you live, you may have the right to:

• Access: request a copy of the personal information we hold about you;
• Correction: request that we correct inaccurate information;
• Deletion: request that we delete your personal information, subject to our legal obligations;
• Portability: request a portable copy of your information in a commonly used format;
• Opt out: opt out of certain processing, including any sale or sharing for cross-context behavioral advertising (we do not engage in either);
• Non-discrimination: not be discriminated against for exercising these rights.

To exercise these rights, contact us at privacy@bonniehr.com or use Settings → Privacy in your Bonnie account. In-app requests are acknowledged immediately and show a target response date. We may need to verify your identity before fulfilling a request. We target a response within thirty (30) days after receiving a request and will notify you if applicable law permits and requires additional time.

You can also download a portable JSON copy of core account, employment, benefits, time-off, wellness, reward, document-metadata, and security data directly from Settings → Privacy. If you need information not represented in that download, submit an access or portability request and we will include eligible additional information in the response.

If your employer is the controller of your data (most common case), some requests will be routed to your employer for action.

State-law catch-all

Residents of certain states (including California, Colorado, Connecticut, Virginia, Utah, Texas, and others) may have additional privacy rights under applicable law — such as the right to confirm processing, the right to appeal a denied request, or the right to limit the use of certain sensitive personal information. Bonnie will honor such rights to the extent required by applicable law and subject to applicable exceptions and limitations. To exercise state-specific rights, use the same contact methods above and tell us which state's laws apply to you.

Children's privacy

Bonnie is designed for use by employees of customer organizations and is not intended for individuals under 18. We do not knowingly collect personal information from children under 13.

International transfers

Bonnie is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. We do not currently offer the Service for use by individuals located in the European Union, the European Economic Area, or the United Kingdom.

Cookies and similar technologies

The Service uses cookies and similar technologies for authentication (session cookies), security (CSRF tokens), and basic analytics. We do not use cookies for advertising or for tracking you across other websites.

Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will notify customer-organization administrators by email and post a notice on the Service in advance of the effective date.

Contact us

For privacy questions, requests, or complaints:

• Email: privacy@bonniehr.com
• Postal mail: Buffer Benefits, LLC, 550 Reserve St, Ste 250, Southlake, TX 76092