Privacy Policy

[legal entity name] ("heallium," "we," "us") runs heallium.io, a quoting tool for health insurance brokers. This policy explains what we collect, why, who we share it with, how long we keep it and the choices you have.

It covers two kinds of information: information about you as a user of the Service ("Account Data"), and information about your clients' employees and dependents that you upload ("Client Data"). We handle Client Data on your behalf, to provide the Service to you.

Account Data. Your name, email address, the state you mainly work in, your password (stored only as a one-way hash), the phone number you use for sign-in codes (stored encrypted), whether you use an authenticator app, your brokerage name, the general agents you send quote requests to, the census templates you upload, your sign-in history with IP addresses, and a log of security-relevant actions on your account.

Client Data. What you upload for a group: the census (employee and dependent names, dates of birth or ages, gender, ZIP code, relationship, coverage tier, plan elections, employee ID and employment status), renewal letters, invoices, benefit summaries, claims reports and quotes, the employer's contact email, the group's answers to your questions, and the comparisons and proposals you prepare.

Technical data. Server logs (request paths with identifiers removed, status codes, timings) used to run and secure the Service.

We use Account Data to run your account, sign you in securely, send the emails you ask us to send, answer support requests, keep the Service secure and meet legal obligations.

We use Client Data only to provide the Service to you: cleaning the census, reading documents and quotes, preparing the emails, comparisons and proposals you ask for, and answering your questions about the group. We do not sell Client Data or Account Data, do not use either for advertising, and do not use either to train artificial intelligence models.

Some steps use Anthropic's Claude models, which we reach through Google Cloud Vertex AI inside our own Google Cloud project:

• Reading an unfamiliar census layout: the model sees the header row and a handful of sample rows and returns only which column holds which field. It never returns member data; our own code reads the census.
• Reading renewals and quotes in a format we have not seen: the model sees the text of that document and records plans, rates and benefit design.
• Questions about a group's quotes: the model sees the group's plans, rates and counts by coverage tier, not employee names.

Neither Google nor Anthropic may use this information to train their models under the terms that govern our use of Vertex AI.

Only with the service providers that run the Service for us, each limited to its task:

• Google Cloud: hosting, database, encryption keys, logging, and Vertex AI (including Anthropic's Claude models).
• SendGrid (Twilio): delivering account emails and the emails you send through the Service, with any attachments you choose.
• Twilio: sending sign-in codes to your phone, if you choose SMS.
• Google or Microsoft: only if you choose to sign in with them.

We also share information with the people you send it to through the Service (your general agent, the employer), when the law requires it, to protect the rights and safety of our users or the public, or as part of a merger or sale of our business, in which case this policy continues to apply.

• A cleaned census and its documents: 30 days, so you can apply the employer's answers. Then they are deleted automatically, or sooner when you delete them.
• Sign-in history: 90 days. Account activity log: 1 year.
• Your account: until you close it. If you do not sign in for 12 months we email you; if you still do not sign in within 30 days the account is deactivated, and after 2 years without a sign-in its personal details are removed.

Backups made by our database provider roll off on their own schedule.

Everything travels over HTTPS. Censuses, their documents, your general agents' templates and your phone number are encrypted with AES-256 before they reach the database, which Google Cloud encrypts again at rest. Every tool that shows Client Data requires two-factor authentication, sessions end after 30 minutes without activity, and sensitive account actions ask you to confirm your identity again.

No method of storage or transmission is perfectly secure. If a breach affects your information, we will notify you as the law requires.

From Settings you can update your name, download your account data, review your account activity, and close your account, which deletes your saved censuses, documents, templates and broker settings right away. To change your email address or make another request, write to support@heallium.io. Depending on where you live you may have further rights, such as to access, correct or delete your information; we honor them and will not treat you differently for using them.

Employees or dependents whose information a broker uploaded should contact that broker, who controls it; we will help the broker respond.

We use only the cookies the Service needs to work: one that keeps you signed in, one that protects forms against forgery, and, if you choose it, one that remembers a trusted browser for two-factor authentication. We do not use advertising or tracking cookies.

The Service is for professionals and is not directed to anyone under 18. A census may list dependent children; that information is Client Data, handled as described above.

For a material change we will email you at least 30 days before it takes effect, and ask you to accept the updated policy the next time you sign in.

Questions about privacy: support@heallium.io, or by mail at [mailing address].