Consumer Health Data Privacy Policy

"Consumer health data" is personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health status. In our context it covers two things: the health questionnaire answers you give in an insurance application, and information that could reveal an interest in health coverage, such as the coverage pages you visit. This Policy applies to that data. Information regulated by HIPAA, GLBA or other exempted laws is handled under those frameworks, as described in our Privacy Policy.

• Health questionnaire answers. Medical history, conditions, medications, height and weight, tobacco use and similar underwriting questions that the carrier requires. We collect them for one purpose: to submit your application to the carrier you chose, retry a failed transmission, or let you re-submit if the carrier asks for a correction.
• Coverage preferences. The type of coverage you are exploring (for example dental, accident, critical illness, life or health) and the answers you give in our guided flows, such as household size or age range. We use them to show you relevant plans and prices.
• Browsing information that may indicate an interest in coverage. The coverage pages you visit, together with device and browser information such as IP address, browser type and approximate location. We use it to run the site, keep it secure and, outside Washington and unless you turn it off, to measure traffic and our advertising. In Washington we use it for measurement only if you accept.

We do not collect precise geolocation, biometric identifiers or genetic information, and we do not infer health conditions from your activity.

• You, when you complete an application, use a guided flow or contact us.
• Your device and browser, automatically, when you use the Platform.
• Insurance carriers, who tell us whether an application was received, needs a correction, was approved or was declined. Carriers do not return your health answers to us.

Your answers are encrypted in transit and at rest with application-level encryption, with keys held in our key management system. They are kept only for the time needed to deliver the application to the carrier, and we purge our copy after the carrier confirms receipt, or when the application is rejected, cancelled or expires. No Epicare personnel, including agents, staff, support or management, can view your specific answers. If a carrier later asks for more information, you re-enter it yourself; we cannot retrieve what you first typed.

We share consumer health data only as described here.

• Insurance carriers. Your application, including your health questionnaire answers, goes to the carrier whose plan you chose, so that it can underwrite and issue the policy you asked for. The carrier is named on the plan before you apply and is the data controller for what it receives.
• Service providers acting on our instructions. Providers of hosting and databases, encryption and key management, and transactional email and text messaging, bound by contract to process the data only for us. Providers that handle health information sign a Business Associate Agreement with us.
• Legal requirements. Regulators, courts or law enforcement where the law requires it, and in connection with a merger or acquisition, subject to this Policy.

We do not share consumer health data with any affiliate. We never share health questionnaire answers, policy numbers or payment details with Google, Meta, Vercel, Contentsquare or any other advertising or analytics provider. We do not sell consumer health data, and we do not use geofences around health care facilities.

Outside Washington, and unless you turn them off, Google Tag Manager, the Meta pixel and Vercel Analytics receive information about the coverage pages you visit and your device and browser, for advertising measurement and traffic analytics. Contentsquare records how you move through a page only if you switch it on. California law treats the Meta pixel as "sharing" your personal information. You can turn all of them off at any time from Your Privacy Choices in the footer. Details are in our Cookie Policy.

Collecting your health questionnaire answers is necessary to provide the insurance application you requested, and we collect them only when you submit that application. For everything else, if you are in Washington, nothing beyond what the site needs to work loads until you choose. If you accept, information about the coverage pages you visit and your device and browser is used for advertising measurement (Google, Meta), traffic analytics (Vercel) and, only if you switch it on, session recording (Contentsquare). You can withdraw that choice at any time from Your Privacy Choices, and we honor the Global Privacy Control signal everywhere.

You have the right to:

• Know and access whether we collect, share or sell consumer health data about you, and receive a list of the third parties and affiliates with whom we shared it, with a contact for each.
• Withdraw consent to the collection and sharing of consumer health data at any time.
• Delete your consumer health data. We will delete it from our systems, including archives and backups within the time the law allows, and we will notify the service providers and third parties with whom we shared it so that they delete it too.
• Appeal a decision we make about your request, and not be discriminated against for exercising any of these rights.

Health answers are deleted automatically once the carrier confirms receipt, so in most cases there is nothing left for us to delete; the carrier holds its own copy under its own privacy notice and HIPAA obligations, and you can contact it directly. We keep records we are required to keep, such as consent and compliance records.

Send your request to privacy@eppigo.com, through the Member Support chat in the Platform, or by mail to the address below. We will verify your identity using the information in your account and respond within 45 days, extending once by a further 45 days where reasonably necessary and telling you why. If we deny your request, we will explain how to appeal; if the appeal is denied, we will tell you how to contact your state Attorney General. We do not charge for a request unless requests are manifestly unfounded or excessive.

We may update this Policy from time to time. When we do, we will update the "Effective Date" above and, where the change is material, give notice through the Platform. A complete change log is available on request.

For questions or requests about consumer health data: