Privacy Policy

1. Introduction

CVRD Health, Inc. ("the Company," "we," "us," or "our") operates becvrdhealth.com (the "Service"). The Company provides AI-powered payroll and fringe-benefit compliance automation for federal contractors, helping payroll teams satisfy their Service Contract Act (SCA), Davis-Bacon Act, and Department of Labor (DOL) reporting obligations without rebuilding compliance spreadsheets at every audit.

Because the Service involves the processing of sensitive employee wage and fringe-benefit records submitted by federal contractor clients, we take privacy obligations seriously. This Privacy Policy explains what information we collect, how we use it, and the rights you have. It applies to information collected through the Service and through direct communications with us.

For the avoidance of doubt, this Policy covers two distinct categories of personal information: (a) information about our direct platform users and prospective customers, and (b) employee payroll data submitted to the Service by contractor clients on behalf of their covered workforce. The Company processes the latter category solely as a data processor, acting on behalf of and at the direction of the contracting organization that submitted it.

The Company is based at 1100 Wilson Boulevard, Suite 1400, Arlington, VA 22201, United States, and can be reached at [email protected].

2. Information We Collect

2.1 Information You Provide Directly

We collect information you or your organization submits to us, including:

• Contact and demo-request details: name, work email address, company name, estimated covered-contract count, and payroll system (Costpoint, Unanet, ADP, or other) when you fill out a demo request form or contact us;
• Account credentials and profile information when your organization activates a platform subscription;
• Organization onboarding data including employer name, contract vehicle identifiers, and applicable wage determination (WD) numbers from SAM.gov;
• The content of messages you send to our compliance team.

2.2 Employee Payroll Data Processed on Behalf of Contractor Clients

When a federal contractor organization uses the Service to automate SCA or Davis-Bacon compliance, the contracting organization submits data that may include personal information about their covered employees. This data typically includes:

• Employee names and job classifications for purposes of wage determination mapping;
• Pay rates, hours worked, and earnings data per contract vehicle and pay period;
• Fringe benefit election records, including Health and Welfare (H&W) rates, vacation accrual, and equivalent fringe-benefit contributions per covered contract;
• Contract-level information such as NAICS codes, WD numbers, period of performance, and prime contractor details;
• WH-347 certified payroll report data generated by the Service for the contracting organization's review and DOL submission.

The Company processes this employee data solely to generate compliance outputs for the submitting contractor. We do not use employee payroll data to train machine-learning models, for advertising, or for any purpose beyond producing the compliance documentation requested by the contracting organization. Employees whose data appears in contractor-submitted payroll records should direct privacy inquiries to their employer, which is the primary data controller for that data.

2.3 Information Collected Automatically

When you visit becvrdhealth.com, we automatically collect limited technical information:

• IP address and approximate location at city or region level;
• Browser type, operating system, and device class;
• Pages visited, referring URLs, and time on page;
• Cookie and similar identifiers (see Section 5 and our Cookie Policy).

2.4 We Do Not Knowingly Collect Children's Data

The Service is a business-to-business compliance platform not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact [email protected] and we will delete it promptly.

3. How We Use Information

We use the information described in Section 2 to:

• Respond to demo requests, answer compliance questions, and provide requested product information;
• Operate, maintain, and improve the Service, including the wage determination mapping engine and WH-347 report generation features;
• Ingest SAM.gov wage determination data and apply it to each submitted employee-contract pair per SCA and Davis-Bacon requirements;
• Generate audit-ready compliance packages, fringe-benefit equivalency calculations, and WH-347-equivalent payroll reports for contracting organizations;
• Maintain DOL audit trail records so contractors can demonstrate compliance during a DOL Wage and Hour Division review;
• Send service updates and, where required, compliance alert notifications (such as when a wage determination is updated by the DOL);
• Detect and prevent unauthorized access, fraud, or abuse;
• Comply with legal and regulatory obligations.

We do not sell personal information for monetary value. We do not use employee payroll data submitted by contractor clients for any purpose other than generating compliance outputs for that specific contractor. Where applicable state law treats certain advertising arrangements as a "sale" or "share," see your state's section below.

4. Sharing of Information

We share personal information only in the following circumstances:

• With infrastructure, hosting, and analytics service providers acting on our behalf under contractual confidentiality and data-processing terms;
• With government authorities when required by law, court order, or to protect the rights, safety, or property of the Company, its users, or the public (including disclosure to the Department of Labor if compelled by valid legal process);
• With a successor entity in the event of a merger, acquisition, or asset sale, subject to this Policy continuing to apply to previously collected information;
• With the contracting organization that submitted it, in the form of compliance reports and audit documentation generated by the Service.

We do not sell personal information to third parties. We do not share employee payroll data submitted by contractor clients with any party other than the submitting contractor.

5. Cookies and Tracking

We use cookies and similar technologies to operate the site, maintain authenticated sessions for platform users, and measure usage. For details and choices, see our Cookie Policy.

6. Data Retention

We retain personal information only as long as necessary for the purposes described in this Policy, to satisfy legal and accounting obligations, and to resolve disputes:

• Demo and contact inquiry data: purged 24 months after last activity;
• Platform account data: retained for the duration of the subscription plus 90 days following account termination, after which it is deleted or anonymized;
• Employee payroll data submitted by contractor clients: retained for three years following the completion of the covered contract, consistent with Department of Labor recordkeeping obligations under 29 C.F.R. Part 4 (SCA contracts) and 29 C.F.R. Part 5 (Davis-Bacon Act contracts). Contractor clients may request earlier deletion; we will honor such requests unless a legal hold or ongoing DOL audit requires retention;
• Server access logs: retained 90 days, then aggregated and anonymized.

7. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including TLS encryption in transit, restricted-access databases, and least-privilege access controls. Payroll data submitted to the Service is stored in encrypted form at rest. No system is perfectly secure; we cannot guarantee absolute security, and users should not transmit particularly sensitive data (such as raw Social Security Numbers) except through the platform's secure data submission channels.

8. Your General Rights

Depending on your jurisdiction, you may have rights including the right to access, correct, or delete personal information we hold about you, and the ability to limit or object to certain processing. To make a request, email [email protected]. We will respond within the timeframe required by applicable law. If you are an employee of a federal contractor and wish to exercise rights with respect to payroll data submitted to the Service by your employer, please contact your employer directly.

9. Virginia Residents (VCDPA)

Under the Virginia Consumer Data Protection Act ("VCDPA"), Virginia residents have rights with respect to personal data we control or process. This section supplements the rest of the Policy.

9.1 Your VCDPA Rights

• Right to Confirm and Access: confirm whether we are processing your personal data and access that data.
• Right to Correct: correct inaccuracies in your personal data, taking into account the nature of the data and our processing purposes.
• Right to Delete: request deletion of personal data provided by, or obtained about, you.
• Right to Data Portability: obtain a copy of your personal data in a portable, readily usable format, where technically feasible.
• Right to Opt Out: opt out of (a) targeted advertising, (b) the sale of personal data, and (c) profiling in furtherance of decisions that produce legal or similarly significant effects. We do not engage in (a), (b), or (c).

9.2 How to Exercise

Submit a request by emailing [email protected]. We respond within 45 days; an additional 45-day extension is available if reasonably necessary, with notice to you.

9.3 Appeal

If we deny your request, you may appeal by replying to our response email. We will respond to the appeal within 60 days. If the appeal is denied, you may contact the Virginia Attorney General at oag.state.va.us to submit a complaint.

9.4 Authorized Agents

You may use an authorized agent for opt-out requests, subject to our verifying the agent's authority.

10. California Visitors (CCPA/CPRA)

If you are a California resident, you may also exercise the rights granted under the California Consumer Privacy Act ("CCPA") and California Privacy Rights Act ("CPRA"), including the right to know, the right to delete, the right to correct, and the right to opt out of sale or sharing. We do not sell personal information and do not "share" personal information for cross-context behavioral advertising.

To submit a CCPA/CPRA request, email [email protected] with the subject line "California Privacy Request."

11. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by a new "Last updated" date and, where appropriate, a notice on the Service. We encourage you to review this Policy periodically, particularly if you use the Service to process employee payroll data, as changes to our data-handling practices may affect your organization's compliance records.

12. Contact

Questions, requests, or complaints regarding this Privacy Policy can be sent to: