Privacy Policy

Here is what you should know up front. This summary is for convenience only; the full Policy controls.

• We do not sell your personal information. We do "share" it for advertising measurement, and you can turn that off. The Meta advertising pixel (with Meta's Conversions API Gateway) and Google Ads remarketing measure our advertising and help show our ads, across other websites, to people who visited the Platform. Under California law that counts as "sharing" your personal information. It is on by default and you can turn it off at any time from the Your Privacy Choices link in our footer. See Sections 5.5 and 9.
• We name every third-party technology we run, and you control each one. Google Analytics and Google Ads (through Google Tag Manager) and the Meta advertising pixel (with Meta's Conversions API Gateway) measure our advertising; Vercel Analytics counts traffic to our own pages; Contentsquare records how you move through a page. The first three are on by default and you can switch them off. Contentsquare stays off unless you switch it on, because it is the most intrusive of the four. Nothing beyond the strictly necessary loads if your browser sends a Global Privacy Control signal, or if you are in Washington State and have not yet chosen. We do not use browser-fingerprinting technologies. See Section 6 and our Cookie Policy.
• Your health answers, policy numbers, and payment details never enter any of them. That is a limit on what we transmit, and it holds on every page. It is not a claim that these technologies are absent from any part of the Platform — they load site-wide. See Sections 4.5 and 6.2.
• Your health information is handled with care. When you provide health information for an application, your responses are encrypted and kept only briefly while we deliver your application to the carrier. After the carrier confirms receipt, we purge our copy. No Epicare personnel, including staff and agents, can view your specific health questionnaire responses.
• You have privacy rights. Including, depending on where you live, the right to access, correct, delete, obtain a copy of, opt out of certain processing of, and limit the use of your personal information.
• We are implementing HIPAA controls and preparing for a SOC 2 audit. We continuously monitor our security controls.

2.1 Information you provide

When you use the Platform, you may provide:

• Identity information: name, date of birth, address, and contact information.
• Demographic information: age, sex assigned at birth, marital status, and household composition.
• Geographic information: ZIP code, state, and market.
• Application information: information needed for insurance applications, which for certain products may include health-related questions.
• Identity verification information: documents and data you provide for identity verification, which may include a Social Security number (SSN) or Individual Taxpayer Identification Number (ITIN).
• Beneficiary information: names and relationships for applicable policies.
• Payment instrument information: tokenized through a PCI-compliant tokenization vault. We do not store your full payment card data.
• Communication content: messages you send through our in-app support.
• Preferences: notification preferences, language, marketing consents, and your cookie and advertising choices.

2.2 Information collected automatically

When you use the Platform, we automatically collect:

• Device information: device type, operating system, and browser version.
• Usage information: pages and features used and general activity on the Platform.
• Technical information: IP address and user agent. We use your IP address for security and abuse prevention. While advertising measurement is on, your IP address and user agent are also handled by the technologies described in Section 6: the Meta advertising pixel transmits them to Meta. Those technologies load across the Platform, not only on public pages (Section 6.2); what never enters them is your health questionnaire responses, policy numbers and payment details (Section 4.5). Your IP address is not transmitted to Google or Meta from any authenticated, application, medical-questionnaire, identity-verification, payment, or Wallet surface.
• Cookies and similar technologies: we use first-party cookies together with the third-party technologies described in Section 6, according to the choices you make. They load across the Platform, not only on public pages; what never enters them is your health questionnaire responses, policy numbers and payment details. See Section 6 and our Cookie Policy for the full table of cookies, their setters, and their lifespans.

2.3 Information from third parties

In some cases, we receive information from:

• Insurance carriers: the status of your applications and policies.
• Identity verification providers: the results of identity verification checks.
• Consumer reporting agencies: where applicable under the Fair Credit Reporting Act (FCRA), in connection with identity verification or carrier underwriting.
• Advertising and analytics platforms: where you arrived from an advertisement, we may receive ad-click identifiers (such as Google's GCLID, gbraid, or wbraid parameters, and Meta's fbclid) that let us and the platform attribute a registration or app download to a campaign. These identifiers are pseudonymous and are described in Section 6 and our Cookie Policy.

2.4 Information about agent attribution

If you reached the Platform through an agent's referral link or were referred by an agent, we associate your account with that agent for service and attribution purposes.

3.1 To provide the Platform

We use information to create and maintain your account, authenticate you, display relevant insurance options, process applications and submit them to carriers, manage your policies and Wallet, send transactional communications, provide support, and resolve disputes.

3.2 To improve the Platform

We use aggregated and de-identified information to understand how features are used, identify and fix issues, and develop new features. Some of that measurement is first-party and stays within our systems; the rest goes through Vercel Analytics and, if you have switched it on, Contentsquare (Section 6).

3.3 To comply with legal obligations

We use information to comply with insurance and financial regulations, maintain required records, respond to regulatory inquiries, detect and prevent fraud, and meet tax and reporting requirements. Where we offer Medicare-related products, we follow applicable Centers for Medicare & Medicaid Services (CMS) marketing and privacy requirements.

3.4 For marketing and advertising measurement, with your consent

If you opt in, we may use information to send you promotional communications about products and offers and to surface relevant content within the Platform. We also measure the effectiveness of our advertising and organic-search efforts using the technologies described in Section 6 — for example, whether an advertisement led to a registration or an app download. We measure advertising results from visits and steps on the Platform, such as viewing plans, starting an application, creating an account, and app downloads. Advertising measurement is on by default and you can turn it off at any time from the Your Privacy Choices link in our footer; when you turn it off, we stop loading the pixel and do not send advertising conversion events attributable to you. Marketing text messages require separate, explicit, TCPA-compliant consent that is never a condition of purchase.

We follow strict practices for health information collected during insurance applications.

4.1 Temporary retention

Health information you provide during an insurance application is encrypted and retained only for the time necessary to deliver the application to the carrier, to retry a failed transmission, or to allow re-submission if the carrier requests a correction (which requires your re-input). After the carrier confirms receipt, we purge our copy. We also purge upon application rejection, cancellation, or expiry of the application.

4.2 Encryption

Health information is encrypted at rest using application-level encryption, with keys managed in our key management system, and is encrypted in transit.

4.3 Access restrictions

No Epicare personnel, including agents, staff, support, or management, can view your specific health questionnaire responses. This information flows from your input to the carrier and is not exposed to our people.

4.4 Recovery and re-input

If a carrier requests additional information after your initial submission, we will notify you. You must re-enter the requested information yourself; we cannot retrieve your original responses.

4.5 What we never place into an advertising or analytics technology

We never place health questionnaire responses, policy numbers, or payment details into any analytics or advertising technology. That limit is about the data itself, and it applies everywhere on the Platform. Advertising conversion measurement reads the structure of a page — its URL and the identifiers of visible elements — and does not read the name, health answers, or anything else you type into a form.

What we do not claim. We do not claim that these technologies are confined to our public marketing pages. They are loaded from the application's root layout, which means they are present across the Platform, including the insurance application, the medical questionnaire, identity verification, payment, and your Wallet. An earlier version of this Policy described a technically enforced boundary — a content-security policy and a route allowlist — that keeps them off those surfaces. Those mechanisms were never implemented, and that claim has been withdrawn. The protection we do rely on is the payload limit above, together with keeping session recording off by default (Section 6.2).

4.6 HIPAA framework

We operate under HIPAA Security Rule principles where they apply to health information we handle, and we require Business Associate Agreements (BAAs) from service providers before they process health information on our behalf (channels whose BAA is pending execution operate in a restricted, health-information-withheld mode until it is signed). We do not have a HIPAA BAA with Google, Meta, Contentsquare, or Vercel for the technologies described in Section 6, and they are not our business associates: they receive page and event information, not protected health information, because we do not place health questionnaire responses into them (Section 4.5). That rests on the payload limit, not on those technologies being absent from health-related pages — an earlier version of this Policy gave the latter as the reason, and it was not accurate.

5.1 With insurance carriers

When you apply for a policy, we share the information necessary to obtain that insurance with the relevant carrier. Carriers process your information under their own privacy practices.

5.2 With service providers and advertising/analytics recipients

We use third-party service providers to operate the Platform. They are bound by contracts requiring confidentiality and security, and we require every provider that processes health information on our behalf to be under a Business Associate Agreement before it handles that information; where a provider's agreement is pending execution, we operate that channel in a restricted mode that withholds health information from it until the agreement is in place. Categories of service providers include:

• Cloud infrastructure and database hosting;
• Authentication and session management;
• Email, text message, and push notification delivery;
• PCI-compliant tokenization vault for payment instruments;
• Identity verification (including, where applicable, consumer reporting agencies under FCRA);
• Customer relationship and agency management;
• Continuous security and compliance monitoring;
• Mapping and address validation;
• Artificial-intelligence assistance, where offered and subject to your consent.

In addition, we run four third-party technologies on the Platform, which act as recipients of the data described in Section 6. We name them here because transparency about who receives your data requires it:

• Google LLC — Google Tag Manager, the tag-orchestration layer that loads and fires the other advertising tags, and through it Google Analytics 4 and Google Ads conversion tracking and remarketing audiences(Google Ads uses visits to the Platform so our ads can be shown to those visitors on other sites, which is also "sharing", Section 5.5). All three are subject to the same choices and the same limits described here;
• Meta Platforms, Inc. — the Meta advertising pixel, delivered through the Google Tag Manager container, which transmits events, page URLs, device/browser information, IP address, and user agent to Meta, and which measures advertising results across other websites. The pixel is configured with Meta's Conversions API Gateway: it also sends a copy of the same events to a gateway server (hosted on Google Cloud, with a backup on Amazon Web Services), which passes them to Meta server-side without adding customer data. The pixel, the Gateway and Google Ads remarketing are what make California's "sharing" definition apply (Section 5.5);
• Contentsquare — session recording: which areas of a page you see, click, and scroll. This is the one technology that is off unless you switch it on; and
• Vercel Inc. — Vercel Analytics, aggregate counts of traffic to our own pages.

These recipients receive page and event information, device/browser information, pseudonymous identifiers, and (for Meta) IP address. They do not receive health questionnaire responses, policy numbers, or payment details (Section 4.5). We send no conversion events from our own servers; the only server-side copy is the Meta Gateway described above. Google Enhanced Conversions and Meta Advanced Matching are the only features that could send hashed customer data (a hashed email, phone, or name), and they are off. Hashed data is not anonymous — the receiving platform can re-identify it — which is one reason we keep those features off; Meta additionally restricts such matching for regulated verticals like insurance.

We do not use a third-party Consent Management Platform. The consent notice and the preference controls are part of our own application. TikTok is not a recipient: an earlier version of this Policy named the TikTok Events API as a recipient; no such integration exists, and it has been removed rather than corrected.

The categories above describe the service providers we use. Individual vendors are maintained in our internal subprocessors registry; you may request additional information about our service providers through the privacy contact in Section 17. See also Section 18.

5.3 With agents and Epicare personnel

Where applicable, your information is accessible to your agent of record (if your account is attributed to a specific agent), to our licensed personnel for service operations, and to our Member Support team for support requests. Access is governed by role-based permissions and is audited. As described in Section 4, agents and personnel cannot view the health questionnaire responses you submit during applications.

5.4 With government and regulators

We may share information when required by state or federal insurance regulators, law enforcement or court orders, tax authorities, or other government agencies with proper legal authority.

5.5 We do not sell. We do "share" for advertising measurement, and you can turn it off

We do not sell your personal information. We do not receive money or other valuable consideration for it.

We do "share" it, in the cross-context behavioral advertising sense defined by the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA) and comparable state laws: the Meta advertising pixel (and its Conversions API Gateway) enables advertising measurement that works across other websites, and Google Ads builds remarketing audiences from visits to the Platform. It is on by default, and you can turn it off at any time from the Your Privacy Choices link in our website footer, described in Section 9. We also honor the Global Privacy Control as an opt-out of sharing for the browser that sends it. When you opt out, the advertising technologies stop loading in that browser.

An earlier version of this Policy stated in four places that we do not "share" personal information while, in the section describing the technology, stating that we do. The denial was the inaccurate half and has been removed. See the Notice at Collection at Section 8.2 and Sections 6 and 9.

5.6 Business transfers

If we are involved in a merger, acquisition, or sale of assets, your information may be transferred. We will provide notice of any transfer that materially affects your privacy rights.

This section describes our use of cookies and of advertising and analytics technologies. Our Cookie Policy at eppigo.com/cookie-policy carries the full cookie/identifier table and controls in the event of any conflict about cookie details.

6.1 What we use

Strictly necessary and functional. Session management, authentication, security, fraud prevention, and remembering your language and market preferences. These are first-party and load automatically, because the Platform cannot operate without them.

Traffic and advertising measurement — on by default, and you can turn it off.

• Google Tag Manager — the tag-orchestration layer that loads and fires our advertising tags, including Google Analytics 4 and Google Ads conversion tracking and remarketing. It sets no tracking cookies of its own, other than temporary cookies used by an administrator previewing the configuration.
• The Meta advertising pixel, delivered through that container — measures how our advertising performs, and does so across other websites, which under California law counts as "sharing" your personal information (Section 5.5). It sets the first-party cookies _fbp and _fbc, and it is configured with Meta's Conversions API Gateway, which sends a copy of its events to Meta from a server (Section 5.2).
• Vercel Analytics — aggregate counts of traffic to our own pages.

Session recording — off unless you switch it on.

• Contentsquare — records how you move through a page: which areas you see, click, and scroll. We treat it differently from the other three and keep it off by default, because it is the most intrusive of the four and because recording a session is the subject of the case law described in Section 8.5.

Two situations override those defaults, and then nothing beyond the strictly necessary loads at all: your browser sends a recognized opt-out preference signal such as the Global Privacy Control, or you are in Washington State, where we ask for your choice before loading anything.

We measure advertising results from visits and steps on the Platform — for example, viewing plans, starting an application, creating an account, and app downloads. They are measured in your browser; the only server-side copy is the Meta Gateway's copy of the pixel's events (Section 5.2). A conversion event does not include your health information, your policy details, or your payment information, and it is not sent where you have turned advertising measurement off or sent a recognized opt-out preference signal.

6.2 Where these technologies run, and what never enters them

They run across the Platform.These technologies are loaded from the application's root layout, so they are present on public pages and on signed-in pages alike, including the insurance application, the medical questionnaire, identity verification, payment, and your Wallet.

What never enters them. We never place health questionnaire responses, policy numbers, or payment details into any analytics or advertising technology, and we do not use browser-fingerprinting technologies. Conversion triggers read the structure of a page, not what you type into it.

An earlier version of this Policy said these technologies never load on sensitive surfaces, and named a content-security policy and a route allowlist as the controls enforcing that. Those controls do not exist, and the claim has been withdrawn (Section 4.5).

6.3 Your choices, and how they are recorded

The first time you visit, a notice tells you what we use and lets you decide. You can accept everything, keep only the essentials, or choose category by category: strictly necessary (always on), traffic analytics, advertising measurement, and session recording. Strictly necessary cookies are not part of that choice, because the Platform cannot operate without them.

You can change your decision at any time, long after that first visit, from the Your Privacy Choices link in the footer of every page, which carries the official California opt-out icon. We record your choice together with the date on which you made it, so that we can evidence it.

Global Privacy Control.We honor recognized browser-based opt-out preference signals, including the Global Privacy Control. When we receive one, we load none of the technologies in Section 6.1, we send no conversion events, and we treat the signal as an opt-out of marketing and of the "sharing" of your personal information for cross-context behavioral advertising.

Washington State. If you are in Washington — or if we cannot determine where you are — the notice appears before we load anything beyond the strictly necessary, and we wait for your answer. The reason is in Section 8.5.

A declined choice or a Global Privacy Control signal stops the technologies from loading at all.

6.4 Hashed-data features are off

Certain features are designed to send hashed customer data (for example, an email address, phone number, or name transformed with SHA-256) to Google or Meta to improve match quality: Google Enhanced Conversions and Meta Advanced Matching. These features are off, and Eppigo does not enable them. Hashed data is not anonymous — the receiving platform can re-identify it — which is one reason we keep these features off; Meta additionally restricts such matching for regulated verticals like insurance. Turning any of them on would require a fresh legal evaluation and, for Meta, written confirmation that the feature is permitted for this vertical.

6.5 Session recording and fingerprinting

We do use a session-recording technology: Contentsquare, described in Section 6.1. It is off unless you switch it on. An earlier version of this Policy stated that we used no session-replay, heatmap, or fingerprinting tool on any surface; the session-recording half of that statement was false from 2026-08-19, when Contentsquare became a production dependency, and it has been corrected here.

On fingerprinting specifically: we do not use browser-fingerprinting technologies, and no dedicated fingerprinting library is part of the Platform.

For the full cookie/identifier table, browser caps, and details of what each recipient receives, see our Cookie Policy at eppigo.com/cookie-policy.

7.1 Permissions

Our mobile app requests permissions only when needed:

• Push notifications: to send you alerts about your applications, policies, and account.
• Camera and photo library: when you choose to upload a document.
• Device biometrics (Face ID, Touch ID, or fingerprint): for sign-in. Biometric data is handled by your device's operating system; we never receive or store your biometric template, and we use only native operating-system interfaces with no third-party biometric software.

We do not request access to your location, contacts, microphone, or calendar.

7.2 Advertising identifiers and app-store measurement

The mobile app does not use cookies in the traditional web sense, and third-party advertising and analytics technologies are kept off the app's sensitive surfaces (application, medical questionnaire, identity verification, payment, and Wallet).

Advertising-driven installs of the Eppigo apps are measured by software inside the apps together with the app stores' aggregated, privacy-preserving attribution frameworks — Apple SKAdNetwork and AdAttributionKit on iOS, the Google Play Install Referrer on Android, and app-measurement methods from Meta (Aggregated Event Measurement on iOS, Meta Install Referrer on Android) and Google (install-referrer methods on Android). These frameworks measure campaign performance in aggregate, not the individual who downloaded the app, and they do notuse the website's Pixel or Google tag.

• On Apple devices, apps must ask permission before accessing the device advertising identifier (IDFA) under App Tracking Transparency; you are opted out by default unless you grant permission.
• On Android, the advertising identifier (GAID) can be reset or deleted in your device settings.

Our disclosures here are consistent with the privacy information we publish on the app stores (Apple Privacy "Nutrition" Labels and the Google Play Data Safety form).

8.1 Rights for all users

Regardless of where you live, you can access and update your account information through your settings, request deletion of your account, opt out of marketing communications, manage your cookie and advertising choices (Section 6 and the Your Privacy Choices link in our footer), and withdraw consents (note that withdrawing electronic-communications (ESIGN) consent will suspend your account until you re-accept electronic delivery — reversible and self-service; see the Terms of Service).

8.2 Notice at Collection

This Section is our Notice at Collectionunder CCPA/CPRA and is written to also serve residents of other states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Texas, and Utah, and others as they take effect) and states with consumer health-data laws (Washington's My Health My Data Act, Nevada SB 370, and Connecticut's health-data provisions). It brings together, in one place, the categories of personal information we collect, the purpose of each, whether each is "sold" or "shared," the sensitive-information categories and your right to limit their use, the opt-out of "sharing", and the mechanics for exercising your rights. It should be read together with Section 5 (information we collect and how we share it), Section 5.5 (sale/"sharing"), Section 6 (cookies, tracking, and advertising measurement), Section 9 (Your Privacy Choices), Section 11 (retention), and Section 18 (subprocessors), which this Section references rather than repeats.

The most important point first. We do not sell your personal information. We do "share" it: the Meta advertising pixel (with its Conversions API Gateway) and Google Ads remarketing measure our advertising and show our ads across other websites, which CCPA/CPRA calls "sharing". It is on by default and you can turn it off from Your Privacy Choices in our footer. The technologies described in Section 6 run across the Platform, not only on public pages. What never enters them is the payload: health questionnaire responses, policy numbers, and payment details (Section 4.5). No sensitive personal information is sold or shared for advertising.

8.2.1 Categories collected, purposes, and sale/share

The table below lists the categories of personal information (using the CCPA/CPRA statutory categories) that we collect, the purposes for which we use each category, and whether each category is "sold" or "shared." "Sharing" means disclosure for cross-context behavioral advertising; "sale" means disclosure for monetary or other valuable consideration.

The only categories that are "shared" are the pseudonymous online identifiers and internet/network activity produced by the advertising technologies described in Section 6 — until you opt out. No sensitive personal information, and no health questionnaire response, policy number, or payment detail, is ever sold or shared.

Sources of personal information. We collect personal information directly from you (for example, when you register, complete a questionnaire, or verify your identity); automatically from your device (cookies and similar technologies, per the choices in Section 6); and from service providers and subprocessors that help us operate the Platform (see Sections 2.3 and 18). The specific first-party cookies and identifiers, their setters, and their lifespans are described in Section 6 and our Cookie Policy.

The advertising pixel is "sharing", and it is on by default. As described in Section 5.5, the Meta advertising pixel and Google Ads remarketing work across other websites, which is "sharing" under CCPA/CPRA. Some state laws use broader definitions; turning off advertising measurement in Your Privacy Choices opts you out of all of it. We state that in the affirmative, provide a functional opt-out (Section 9), and honor the Global Privacy Control. Conversion triggers read only the structure of a page (its URL and the identifiers of visible elements); they do not read the name, health answers, or any other content you type into a form. The hashed-data features (Google Enhanced Conversions and Meta Advanced Matching) are off(Section 6.4), and the only server-side copy of events is the Meta Gateway's (Section 5.2).

How long we retain each category. Retention by category is governed by Section 11 and our internal data retention policy, which controls in case of conflict. We do not repeat the retention periods here; see Section 11.

8.2.2 Sensitive personal information and the right to limit its use

The categories of sensitive personal information we collect are: Social Security number / ITIN; health information and medical-questionnaire responses (PHI); financial and payment information; and account log-in credentials. We do not collect precise geolocation (we use your ZIP code and coarse, IP-derived location only). We use and disclose sensitive personal information for service delivery only — underwriting/enrollment support, identity verification, payment, account security, and legal compliance.

Under CCPA/CPRA you may direct a business to limit the use and disclosure of your sensitive personal information ("Limit the Use of My Sensitive Personal Information") to what is necessary to perform the services you requested. We do not use or disclose sensitive personal information to infer characteristics, and we never use it for advertising, cross-context behavioral advertising, or profiling.It is never sold or shared, and never transmitted to Google, Meta, Contentsquare, Vercel, or any other advertising or analytics company. Because our use of sensitive personal information is already confined to permitted service-delivery purposes, the "Limit" right does not change how we handle it; you may still submit a request to limit through the channels in Section 8.2.4 or Section 9, and we will confirm the confined-use posture and honor any additional limitation the law provides.

8.2.3 Your Privacy Choices — opt-out of "sharing", GPC, and service level

You have the right to opt out of the "sale" and "sharing" of your personal information for cross-context behavioral advertising. We do not sell; we do share for advertising measurement, and this is where you stop it. As described in full in Section 9, you can exercise the right through the Your Privacy Choices link in our website footer — which carries the official California opt-out icon — through the category controls in that panel, and through the Global Privacy Control (GPC), which we honor as an opt-out of sharing for the browser that sends it and which suppresses every technology in Section 6.1 in real time.

How the opt-out works and our service level. When you opt out, we stop transmitting advertising and analytics events attributable to your browser by no longer loading the technologies in Section 6 in that browser. We effectuate opt-outs, and honor GPC signals, as soon as feasible and no later than 15 business days from receipt. Because these signals are browser- and device-specific, you may need to renew your choice on each browser or device, or if you clear cookies. We do not require you to create an account to opt out, and we do not charge you or degrade your service for opting out (see the non-discrimination provision in Section 8.2.4).

8.2.4 Exercising your rights: verification, authorized agents, appeal, non-discrimination, and SLAs

How to submit a request. Use the Your Privacy Choices link in the footer for opt-out and limit requests, or submit access, deletion, correction, and portability requests by contacting us using Section 17. We confirm receipt of your request within 10 business days, and tell you at that point how we will process it and when to expect a substantive response. We then respond within the time your state law requires — for California, generally within 45 days, extendable once by an additional 45 days where reasonably necessary, with notice to you within the initial period.

Identity verification. To protect your information, we verify your identity before fulfilling access, deletion, correction, or portability requests, generally by confirming information already associated with your account. We may request additional information if we cannot verify you with reasonable certainty; opt-out and limit requests do not require verification.

Authorized agents. You may use an authorized agent to submit a request on your behalf. We require: (a) your signed, written permission naming the agent (or a valid power of attorney under applicable state law); (b) for access, deletion, correction, or portability requests, verification of your own identity directly with us; and (c) where permitted, direct confirmation with you that you authorized the request. We may deny a request from an agent who does not provide this proof.

Right to appeal. Where your state provides it, you may appeal a denial of a request. We will respond within the time your state law requires and, if we deny the appeal, tell you how to contact your state Attorney General.

No discrimination / no retaliation. We will not discriminate or retaliate against you for exercising any privacy right — we will not deny you the Platform, charge a different price, or provide a different level or quality of service because you exercised a right. Eppigo is free for consumers; pricing is identical to what carriers offer directly, and exercising a privacy right does not change that.

Retention and subprocessors. We retain each category of personal information only as long as necessary for the purposes described in this Policy, or as required by law, and then delete or de-identify it. Retention by category is described in Section 11 and controlled by our internal data retention policy. The categories of service providers and the named advertising/analytics recipients (Google, Meta, Contentsquare, and Vercel) are described in Sections 5.2 and 18.

8.3 Rights under California law (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act, including the right to know what personal information we collect and how we use and disclose it; to access and obtain a copy of your personal information; to correct inaccurate personal information; to request deletion; to opt out of the sale or "sharing" of personal information (we do not sell; you can opt out of sharing at any time from Your Privacy Choices in the footer); to limit the use of sensitive personal information; and to not be discriminated against for exercising your rights. The categories we collect, the purpose of each, and their sale/"sharing" status are set out in the Notice at Collection at Section 8.2. As described in Section 5.5, the Meta advertising pixel constitutes "sharing"; you can opt out through the Your Privacy Choices link in our footer and through the Global Privacy Control.

To exercise these rights, submit a request through your account settings or contact us using the details in Section 17. We will verify your identity before fulfilling the request and will respond within the timeframes required by applicable law (generally within 45 days, with an extension permitted for complex requests). You may use an authorized agent, subject to verification requirements. See Section 8.2.4 for the full verification, authorized-agent, appeal, and non-discrimination mechanics.

8.4 Rights under other state laws

Several states have enacted comprehensive privacy laws (including, among others, Virginia, Colorado, Connecticut, Texas, and Utah). Where applicable, we honor the rights those laws provide, which generally include rights to access, correct, delete, obtain a copy of, and opt out of certain processing of your personal information — including opting out of targeted advertising and the sale of personal data — as well as, where the state provides it, the right to appeal a denial (see Section 8.2.4). To exercise these rights, use the methods described in this Policy, including the Your Privacy Choices link in our footer and our honoring of the Global Privacy Control.

8.5 Consumer health-data laws, and why Washington is different

Certain states have enacted laws specific to consumer health data, including Washington's My Health My Data Act (MHMDA), Nevada's SB 370, and provisions of Connecticut's law. The health information we handle for insurance is processed under HIPAA-aligned controls and, as a licensed insurance agency, under the Gramm-Leach-Bliley Act (GLBA); information governed by HIPAA or GLBA is exempt from those consumer-health-data laws.

We do not rest on that exemption alone. An earlier version of this Policy supported it with a second argument — that no health-related surface was exposed to advertising or analytics technology. That was not accurate: the technologies load across the Platform (Sections 4.5 and 6.2). We have withdrawn that leg rather than restate it.

Washington State is therefore treated differently from the rest of the United States. The My Health My Data Act requires affirmative consent before consumer health data is collected; its definition of consumer health data reaches people who are looking for health coverage; and it carries a private right of action through the Washington Consumer Protection Act, which means any consumer may sue, not only the Attorney General. If you are in Washington, we therefore ask for your choice before loading anything beyond the strictly necessary, and we load nothing until you answer (Section 6.3).

Everywhere else in the United States, the model is opt-out: traffic and advertising measurement are on by default and you can turn them off, and session recording stays off unless you turn it on (Section 6.1). Session recording is singled out because recording a visitor's session before showing a privacy notice is the fact pattern of Javier v. Assurance IQ (9th Cir. 2022) — in which the defendant was itself an insurance agency — and is the subject of a large and growing body of litigation under the California Invasion of Privacy Act and its state analogues.

We do not sell consumer health data, we do not use it for advertising, and we never place health questionnaire responses into any advertising or analytics technology.

How far the HIPAA and GLBA exemptions actually reach. Washington's exemption is written at the level of the data, not the entity (RCW 19.373.100): it exempts information that is protected health information under HIPAA, and personal information governed by GLBA. It does not exempt a company because that company is a licensed insurance agency. So the exemption covers your application and health-questionnaire information — and it does not cover the browsing and advertising information of someone shopping for health coverage on our site, which is neither HIPAA protected health information nor GLBA-governed information. For that information, the Act applies to us in full.

What follows from that, stated plainly. RCW 19.373.020 requires a separate Consumer Health Data Privacy Policy, with its own prominent link on the homepage. An earlier version of this Policy concluded that the protections these laws require were addressed within this document; that conclusion was wider than the exemption supports, and it is withdrawn. That standalone policy is our Consumer Health Data Privacy Policy, which makes the disclosures RCW 19.373.020(1)(a) requires and describes the rights in RCW 19.373.040 and how to use them. It is published with its own prominent link, separate from the link to this Policy. The Washington gate described in Section 6.3 applies in addition, so nothing beyond the strictly necessary loads for a Washington visitor until they choose.

This position, and the Washington treatment, were adopted without counsel review (see the status block at the top of this document).

8.6 How we handle deletion and copies of your data

When you request deletion, we honor verified requests within the time required by applicable law, and we remove identifying information from our active systems, subject to information we are required or permitted to retain (such as insurance, financial, consent, and compliance records). Information may remain in secure backups for a limited period until those backups are automatically purged. When you request a copy of your personal information, we provide it, where required by law, in a portable format within the timeframe the law requires. Health questionnaire responses are not included, because we do not retain them after delivery to the carrier (see Section 4).

8.7 HIPAA

Where HIPAA applies, you have rights under the HIPAA Privacy Rule to access protected health information held by covered entities, which is typically the insurance carrier rather than Epicare. For health information held by a carrier, contact that carrier directly.

We do not sell your personal information.We do "share" it for advertising measurement, as described in Section 5.5: the Meta advertising pixel and Google Ads remarketing measure and target our advertising across other websites, which under CCPA/CPRA and comparable state laws is "sharing". Some state laws use broader definitions; turning off advertising measurement in Your Privacy Choices opts you out of all of it. It is on by default, and you can opt out at any time:

• A "Your Privacy Choices" link is available in the footer of every page, carrying the official California opt-out icon;
• That panel lets you turn each category on or off — traffic analytics, advertising measurement, and session recording — at any time, including long after your first visit; and
• We honor the Global Privacy Control (GPC) as an opt-out of sharing for the browser that sends it, and a GPC signal suppresses every technology in Section 6.1, not only the advertising ones.

When you opt out through any of these methods, we stop loading the associated technologies in that browser. We record your choice together with the date on which you made it. This preference is honored across the Platform within the time required by applicable law — we effectuate opt-outs and honor GPC signals as soon as feasible and no later than 15 business days from receipt. Because these signals are browser- and device-specific, you may need to renew your choice on each browser or device, or if you clear cookies; we do not require you to create an account to opt out.

If you are in Washington State, nothing beyond the strictly necessary loads until you have made that choice (Sections 6.3 and 8.5).

See the Notice at Collection at Section 8.2 for the categories treated as "shared", the "Limit the Use of My Sensitive Personal Information" right, and the request, verification, authorized-agent, appeal, and non-discrimination mechanics.

The Platform is not intended for individuals under 18, and we do not knowingly collect personal information from children under 18. Minors may be covered as dependents on a policy held by an adult, but they cannot create their own accounts. If we learn that we have inadvertently collected personal information from a child under 18, we will delete it promptly. When a dependent reaches adulthood, they may create their own account and request that their information be associated with it, subject to verification.

We keep personal information only as long as necessary for the purposes described in this Policy or as required by law. In general:

• Account and profile information is kept while your account is active and for a limited period afterward.
• Insurance and policy records, and the records we are required to keep as a licensed agency, are kept for the period required by applicable insurance and financial recordkeeping laws, commonly up to seven years.
• Health questionnaire responses are kept only temporarily and encrypted, and are purged after the carrier confirms receipt or the application ends (see Section 4).
• Consent and electronic-signature records, including your cookie and advertising choices and Global Privacy Control signals, are kept for as long as required to evidence them.
• Cookie and advertising identifiers persist for the lifespans shown in our Cookie Policy (subject to browser caps), and Google Analytics 4 detailed data is retained for no longer than 14 months.
• Marketing data is kept until you opt out and for a short period afterward.

After you delete your account, we remove identifying information from our active systems following a short grace period; information may remain in secure backups for a limited time until those backups are automatically purged. Specific retention periods are maintained in our internal data retention policy and may change as our legal obligations change.

We use administrative, technical, and physical safeguards to protect your information, including encryption in transit and at rest (with application-level encryption for sensitive fields), row-level access controls, least-privilege principles, audit logging of administrative access, vulnerability management, continuous security monitoring (we are preparing for a SOC 2 audit and implementing HIPAA controls), and mandatory multi-factor authentication for personnel accounts. An earlier version of this section also listed a content-security policy and a route allowlist as controls enforcing an advertising-technology boundary; those are not implemented and the claim has been withdrawn (Section 4.5).

If you believe you have found a security vulnerability, please contact us at the address in Section 17. In the event of a security incident affecting your information, we will notify you and applicable regulators as required by law.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Communications about your account, applications, and policies are operationally necessary and cannot be opted out of while you maintain an active account. Marketing communications require your opt-in, and marketing text messages require separate, explicit, TCPA-compliant consent. You may opt out of marketing at any time through the unsubscribe link in marketing emails, by replying STOP to marketing text messages, or in your settings.

Where we offer an AI assistant within the Platform and you choose to use it, your messages and the assistant's responses are processed by an AI service provider under a Business Associate Agreement where health information may be involved. We retain conversation content for a limited period and retain conversation metadata for a longer period for analytics, after which identifiers are removed. We do not use your individual conversations to train third-party AI models, and you may delete a conversation at any time. AI features may not be available in all experiences or at all times.

The Platform is intended for use in the United States — all 50 states and the District of Columbia. Information collected through the Platform is processed and stored in the United States. The advertising and analytics recipients described in Section 6 — Google, Meta, Contentsquare and Vercel — process data in the United States and on their own multi-region infrastructure. If you access the Platform from outside the United States, you understand that your information will be transferred to and processed in the United States and subject to United States law.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last Updated" date, set a new Effective Date, notify you through email, in-app notice, or both, and where the change materially affects your rights, request re-acceptance. Minor changes may be made without re-acceptance and will be reflected in our changelog.

For privacy questions, requests, or concerns:

For California residents exercising CCPA/CPRA rights, see Sections 8.2 (Notice at Collection) and 8.3 for specific procedures. We respond to privacy inquiries within the timeframes required by applicable law.

The categories of service providers we use, and the categories of data they process, are described in Section 5.2. Because transparency requires it, we also name Google LLC (Google Tag Manager, and through it Google Analytics 4 and Google Ads conversion tracking and remarketing), Meta Platforms, Inc. (the Meta advertising pixel, delivered through that container, and Meta's Conversions API Gateway), Contentsquare (session recording, off unless you switch it on), and Vercel Inc. (Vercel Analytics) as recipients of the data described in Section 6. We send no conversion events from our own servers; the only server-side copy is the Meta Gateway's (Section 5.2). The hashed-data features (Google Enhanced Conversions and Meta Advanced Matching) are off, so no hashed email, phone, or name — and no health questionnaire response, policy number, or payment detail — is transmitted to any of them (see Sections 4.5 and 6.4).

Removed as a recipient: the TikTok Events API and a third-party Consent Management Platform provider were both named in earlier versions of this Policy. Neither exists: there is no TikTok integration, and the consent notice is part of our own application.

Individual PHI and PII vendors are maintained in our internal subprocessors registry; the PCI-compliant tokenization vault vendor is described by function only. You may request additional information about our service providers through the privacy contact in Section 17. We provide notice of material changes as required by applicable law.

A complete change log is available on request.