Privacy Policy

Last updated: May 12, 2025

Introduction

BenOsphere Inc (referred to as “Company,” “we,” “us,” or “our”) is committed to protecting your privacy and maintaining the confidentiality of your personal and health information. This Privacy Policy describes how we collect, use, disclose, and protect personal information through our software-as-a-service platform and related websites and services (collectively, the “Services”). It also explains your rights regarding your information and how you can exercise those rights.

By using our Services, you acknowledge that you have read and agree to the practices described in this Privacy Policy. If you do not agree, please do not access or use the Services. This Privacy Policy is incorporated into our Terms of Service and is effective as of the date posted. We may update this Policy from time to time and will notify users of material changes as required by applicable law.

Information We Collect

We collect personal and sensitive information in order to provide and improve our Services, particularly in the context of employee health benefits. The types of information we collect include:

Personal Information You Provide

We collect personal information that you or your employer provide to us directly. This may include:

Contact Information: Name, email address, telephone number, date of birth, postal address, and other identifiers. For example, you may provide contact details when creating an account, requesting a demo, or contacting customer support.
Employment and Demographic Data: Information about your employment or role (e.g. job title, department, employer name) and demographic details (such as age, marital status, number of dependents) as part of employee census data used for benefit administration. Your employer or benefits broker may submit this information to our platform to set up and manage your benefits.
Account Credentials: If our Services require account registration, we collect login credentials (such as username and password) that you create.
Communications: If you contact us or submit inquiries, we will collect the content of your communications along with your contact details and any other information you choose to provide. This includes information you provide when requesting information about our Services or responding to surveys or forms on our site.

Health and Benefits Information

Through the course of providing our health-related Services, you may voluntarily provide health information, including Protected Health Information (PHI), or such information may be provided by your employer or benefits provider. This can include details such as:

Health and Medical Data: Information on medical history, health conditions or diagnoses, treatment or care received, prescriptions, or any health-related details you share with us. For example, you might input information about past or present medical conditions, doctor visits, or specific healthcare needs into our platform.
Benefits Plan and Usage Data: Information about your health benefits plan elections and usage, such as the plans you enroll in, coverage levels, claims or utilization data, and history of medical benefits and services used. We may collect this to help manage your benefits and provide personalized tools (e.g. decision support or recommendations regarding plan options).
Employee Benefits Census Data: As part of implementing our Services for an employer, we may receive bulk data about employees eligible for benefits. This data can include employee names, ages or birth dates, gender, employment status, dependents information, and other enrollment-related details. Such data is typically provided by an employer, benefits administrator, or broker to facilitate benefits plan setup and analysis.
Lifestyle Information: In certain cases, you may provide lifestyle and financial information relevant to benefits, such as your income range or family status, which can influence benefit recommendations. We treat all health and benefits information as confidential and apply administrative, technical, and physical safeguards in compliance with HIPAA, where applicable.

We recognize that health information is sensitive. We will only collect and use health and benefits data as needed to deliver the Services and as permitted by law, and we handle all such data in accordance with applicable privacy and security regulations (see HIPAA and Health Information below).

Information Collected Automatically

When you use our Services or visit our website, we automatically collect certain information about your device and usage of the Services. This information helps us understand how our platform is used and improve your experience. Automatically collected data may include:

Device and Technical Information: IP address (which may indicate general location), device type, browser type, operating system, device identifiers, and software version used to access our Services.
Usage Data: Details about how and when you interact with our Services, such as date and time of visits, pages or features accessed, clickstreams, and referring web page/source. For example, we may log when you log in, which features you use, and your actions within the platform.
Cookies and Similar Technologies: We and our service providers may use cookies, web beacons, and similar tracking technologies to collect usage data and remember your preferences. Cookies are small text files placed on your device to store information. They help us recognize you, customize your experience (for instance, retaining your preferences), and perform analytics. You can control cookies through your browser settings; however, disabling cookies may affect functionality of the Services.

Information from Third Parties

We may also obtain information about you from third-party sources, consistent with your privacy rights and this Policy. For example:

Employer or Benefits Providers: If your employer, insurance carrier, or benefits broker uses our Services to administer benefits, they may provide us with personal and benefits information about you (as noted above) so that we can operate the platform on their behalf. We treat this information per our agreements with those parties and this Policy.
Service Providers and Partners: We might receive information from vendors or partners assisting us in providing services, such as data validation services, analytics providers, or single sign-on authentication services.
Referral and Marketing Partners: If you were referred to our Services through a third-party or if you integrate our Service with another platform, those third parties may send us your information with your consent.
Public Sources: We may also collect information from publicly available sources such as professional networking sites or public databases, but only where lawful.

We will combine information from these sources with information we directly collect in order to update or enhance our records, improve personalization, and fulfill the purposes described in this Privacy Policy. In all cases, we only collect and use such third-party-provided data in a manner consistent with applicable privacy laws and our contractual obligations..

How We Use Your Information

We use the collected information, including personal data and health-related data, for the following business purposes and operational needs:

To Provide and Improve Services: We use your information to deliver our SaaS platform functionality, process your requests, and ensure the Services work as intended. This includes using data to set up your account, manage benefit enrollments, process transactions or calculations, and maintain and enhance the features of our platform. We also analyze usage trends to improve and refine our products, develop new features, and enhance user experience.
Personalization: We may use your information (including health and benefits data) to personalize the Services for you. For example, the platform may provide tailored content, benefit recommendations, or decision support tools based on your specific profile, benefits eligibility, or health needs. Personal data helps us customize interfaces and communications to be more relevant to you.
Communication and Customer Support: We use contact information like your email address or phone number to communicate with you about the Services. This includes sending service-related announcements, alerts about changes or issues (e.g. security or maintenance notifications), responses to inquiries or support requests, and administrative emails. If you provide a phone number, we may use it to send you service notifications or to call you for support purposes (including via text/SMS with your consent).
Marketing and Newsletters: We may use your email or contact info to send you newsletters, product updates, and marketing communications about our services or new features, but only in accordance with applicable law. If you are an existing user or have signed up to receive such communications, we will send you promotional emails or other messages that may be of interest (for example, information about new benefit tools or upcoming webinars). You can opt out of marketing communications at any time (see Your Rights and Choices below).
Analytics and Product Development: We analyze usage data and feedback to understand how our Services are used. This helps us troubleshoot problems, perform data analytics, research and track the effectiveness of features, and improve functionality. For instance, we might analyze aggregated usage patterns to determine which features are most useful, or to generate insights that help employers optimize their benefit programs (using de-identified or aggregated data when possible).
Security and Fraud Prevention: Your information is used to maintain the security of our Services, including detecting and preventing fraudulent activity, abuse, and other harmful actions. For example, we may monitor logins and transactions for suspicious activity and use information to verify accounts and combat malware or security risks.
Compliance with Legal Obligations: We may process and use personal information to comply with applicable laws, regulations, and contractual obligations. This includes using data to respond to lawful requests by public authorities, comply with HIPAA requirements (for health data), fulfill tax or financial reporting duties, or to enforce our agreements and Terms of Service. We also may use information as necessary to exercise or defend legal claims.
Other Purposes with Notice or Consent: We may use your information for any other purpose that we disclose to you at the time of collection, or for which we obtain your consent. We will not use your personal information in a manner that is incompatible with the purposes outlined above without letting you know and, if required, obtaining your permission.

We do not use sensitive personal information (such as health or medical data) for purposes other than providing the Services, maintaining our relationship with you, and as otherwise described in this Policy or required by law. In particular, we do not use or disclose PHI except as allowed under HIPAA or with proper authorization.

How We Share and Disclose Information

We understand the importance of your privacy. We do not sell your personal information to third parties for their own marketing purposes. However, we do share your information with certain trusted parties under the following circumstances, in order to run our business and provide the Services:

Service Providers (Processors): We share personal information with third-party service providers and vendors who perform functions on our behalf. These include, for example, cloud hosting providers, data center operators, IT and security providers, analytics tools, email and SMS distribution services, customer support software, payment processors (if billing is handled through our site), and other consultants or vendors we engage. These service providers are bound by contractual obligations to keep personal information confidential and use it only for the purposes of providing services to us (and by extension, to you). We require service providers to implement appropriate safeguards and comply with applicable privacy laws.
Business Partners and Benefits Administrators: If your use of the Services is facilitated by an employer, broker, or benefits plan sponsor, we may share relevant information with those parties as needed for plan administration and fulfilling the Services. For example, we might share enrollment information or usage reports with your employer’s HR or benefits team, or exchange necessary data with an insurance carrier or benefits broker that helped arrange your coverage. Such disclosures are made to ensure your benefit selections and claims are properly implemented and managed. We only share what is necessary and expect those parties to safeguard your information.
Affiliates: We may share your information with our corporate affiliates (entities under common ownership or control with us) for purposes consistent with this Policy, such as internal administration, analytics, or to provide you with our services (for example, if we have related products in our corporate family). All affiliates are required to adhere to privacy practices consistent with this Policy.
Legal Compliance and Protection: We may disclose information about you if required to do so by law or legal process, or if we have a good-faith belief that such disclosure is reasonably necessary to comply with legal obligations, government requests, or court orders. This includes sharing information as necessary to: respond to subpoenas or lawful requests by public authorities (including to meet national security or law enforcement requirements); investigate or report illegal activities; enforce our contracts or user agreements; or protect our rights, property, safety, or that of our users or others. We may also disclose information as needed to verify and fulfill data subject requests in accordance with applicable laws if we are legally obligated to do so.
With Your Consent: We may share your personal information with third parties when you direct us to do so or explicitly consent to a specific sharing arrangement. For instance, if you opt-in to an integration that requires exchanging data with another service (like linking our platform with a wellness app, or if you explicitly agree to let us share your contact info with a partner for a consultation), we will share information as needed to fulfill your request. We will make sure you understand what information will be shared, and you can revoke your consent at any time.
With Your De-identified or Aggregated Data: We may use and share information that has been de-identified (stripped of personal identifiers) or aggregated (combined with other data so it no longer relates to an individual) for research, analytics, and product improvement. De-identified data refers to information from which personal identifiers—such as names, email addresses, or other details that could reasonably be used to identify an individual—have been removed. This process ensures that the data cannot be linked back to any specific person. Aggregated data is information combined with data from other users to provide statistical insights, such as trends or averages, without revealing individual identities. We apply commercially reasonable techniques to ensure such data cannot be re-identified and does not pose a privacy risk. Such data cannot reasonably be used to identify you and may be shared with third parties or publicly for analysis of trends, statistics, or other purposes. For example, we might publish reports showing average healthcare cost trends among our users, but these would contain no personal details. Consent: We may share your personal information with third parties when you direct us to do so or explicitly consent to a specific sharing arrangement. For instance, if you opt-in to an integration that requires exchanging data with another service (like linking our platform with a wellness app, or if you explicitly agree to let us share your contact info with a partner for a consultation), we will share information as needed to fulfill your request. We will make sure you understand what information will be shared, and you can revoke your consent at any time.

Except as described above, we do not disclose your personal information to third parties. In particular, we do not rent or sell your information to outside marketers. We also do not share any health or medical information with third parties for their independent use, unless you have given us explicit permission or such sharing is required to provide you with services (and even then, always in accordance with applicable law). All third parties with whom we share personal data are obligated to use it only for the reasons we’ve agreed and to protect it in compliance with this Privacy Policy and applicable laws.

Third-Party Service Providers and Links

Our Services may contain links to websites or services operated by third parties (for example, a link to an insurance carrier’s site or embedded content like videos, maps, or articles). Please note that this Privacy Policy does not apply to information collected on or through any third-party websites or services that we do not control. If you click on a third-party link, or otherwise navigate to an external site, any data you provide to those sites is not governed by our Privacy Policy. We strongly encourage you to review the privacy and security practices of any third-party website or services before providing them with personal information. We do not endorse and are not responsible for the privacy practices, content, or security of such third-party services.However, if you believe a third party linked from our Services is misusing your personal information, you can report it to us and we will take appropriate action if we are able.

Additionally, our Services may integrate third-party services (such as single sign-on via a company directory, or a third-party payment processor). These third-party service providers acting on our behalf will have access to certain information as described in the How We Share section, but they are contractually bound to protect your data and use it only for providing their services to us (not for their own purposes). We review these providers for security and compliance as part of our vendor due diligence process.

Data Retention

We will retain your personal information for as long as necessary to fulfill the purposes for which it was collected, as outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. In general, this means that we keep your information for as long as you maintain an account with us or as long as we are providing Services to you or your employer.
We may retain certain data for longer periods for legitimate business or legal reasons, such as:

Contractual and Business Needs: If you or your employer has an active agreement with us, we will retain personal information for the duration of that relationship and for a reasonable period thereafter to handle any post-termination inquiries or issues. This includes, for example, benefit enrollment records or communication related to support issues.
Legal Obligations: We may need to retain certain information to comply with various laws and regulations. If applicable law or government orders require us to keep data for a specified period (such as record-keeping requirements under HIPAA or tax laws), we will retain the data for that period.
Dispute Resolution and Enforcement: We may also keep data as necessary to resolve disputes, enforce our agreements, or comply with legal holds and court orders. If we are involved in litigation or an investigation, relevant information may be retained until those matters are fully resolved.

Once the retention period expires or the purposes of processing have been achieved, we will securely dispose of or anonymize your personal information. We implement disposal procedures designed to prevent data recovery or misuse. This may involve removing identifying details so that the data can no longer be associated with you, or securely erasing or deleting the data.

Data Disposal: When disposing of personal information, we follow secure disposal practices to prevent unauthorized access to the data (such as using encryption, data wiping techniques, or shredding physical documents).

Please note that due to the way our systems are designed (e.g., backup storage or archival systems), it may not be immediately possible to delete all residual copies of your information from all systems, but we will ensure that no active or further processing occurs with those residual copies beyond retention requirements.

Data Security

We take data security seriously and have implemented a variety of administrative, technical, and physical safeguards to protect your personal information (including sensitive health data) from unauthorized access, disclosure, alteration, and destruction. Our security measures are designed to be consistent with industry standards and regulatory requirements for the types of data we handle. These measures include, but are not limited to:

Encryption: We use encryption technology to protect data in transit (for example, information transmitted between your browser and our servers is secured via Transport Layer Security (TLS)) and encrypt sensitive data at rest where appropriate. This means that personal and health information is encoded to prevent unauthorized reading of the data.
Access Controls: We limit access to personal information to only those employees, contractors, and service providers who need it to perform their job duties or services. All such personnel are subject to confidentiality obligations. We use authentication measures (such as passwords, multi-factor authentication, and role-based access controls) to prevent unauthorized access to user accounts and our systems.
Monitoring and Testing: Our systems are monitored for security vulnerabilities and potential intrusions. We employ firewalls, intrusion detection systems, and anti-malware protections to guard against external threats. Regular security assessments, penetration testing, and audits are conducted to evaluate the strength of our security posture.
Organizational Practices: We maintain an internal security program which includes staff training on privacy and security best practices, periodic review of our policies, and incident response planning. Our team is trained to handle personal data in compliance with this Policy and to respond swiftly to potential security incidents. We also regularly update our systems to address known vulnerabilities.
Certifications and Compliance: We adhere to recognized security frameworks and may undergo third-party audits. For example, our Company is HIPAA compliant and follows the HIPAA Security Rule requirements for safeguarding electronic PHI, including implementing required physical, technical, and administrative safeguards. We also follow frameworks like SOC 2 for data security, where applicable, to ensure a robust security environment.

While we strive to protect your information with these measures, no method of transmission over the Internet or method of electronic storage is 100% secure. Therefore, we cannot guarantee absolute security of your data. You should also take steps to protect your account and personal information, such as choosing a strong password and keeping your login credentials confidential. If you believe that the security of your account or data has been compromised, please contact us immediately.

In the event of a data breach that affects your personal information, we will notify you and/or the appropriate regulatory authorities as required by applicable law. We will act promptly to contain and remedy any security incident, and to minimize any potential harm.

International Data Transfers

BenOsphere Inc. operates exclusively within the United States and does not transfer personal data outside of the country. All personal information collected through our Services is processed and stored on servers located within the United States. We do not knowingly collect data from international users or transfer personal data across borders. As such, we are not currently subject to international data transfer obligations. Our privacy practices are focused on compliance with applicable U.S. federal and state laws.

Your Rights and Choices

We respect your rights to control your personal information. Depending on your relationship with us and where you reside, you may have certain privacy rights under federal or state laws regarding the personal information we maintain about you. These may include:

Access and Transparency: You have the right to request access to the personal information we hold about you and to receive information about how we use and share it. For example, California residents have the right to request that we disclose the specific pieces and categories of personal information we have collected about them, the categories of sources of that information, the business purpose for collecting it, and the categories of third parties with whom we share it. We will provide such information in a portable format (to the extent required by law) so that you can review it.
Rectification/Correction: If any of your personal information is inaccurate or outdated, you have the right to request that we correct or update it. Some of our Services may allow you to directly log in and update certain personal details; for other changes, you can contact us.
Deletion: You can request that we delete personal information we have collected from you, subject to certain exceptions. Upon a verified request and in accordance with applicable law, we will delete (and direct our service providers to delete) your personal information from our records. Please note that we may retain data necessary to complete transactions you’ve requested, detect fraud, comply with legal obligations, or for other uses permitted by law. We will inform you if any such exceptions apply to your deletion request.
Opt-Out of “Sale” or Sharing: We do not sell personal information for monetary consideration. In the context of certain privacy laws like the California Consumer Privacy Act (CCPA), “sell” or “share” can also include certain uses of data for advertising. Although we do not currently engage in selling or sharing personal information for behavioral advertising, California residents have the right to direct us not to sell or share their personal data. If we ever planned to engage in such activity, we would provide a clear opt-out mechanism.
Limit Use of Sensitive Information: We only use sensitive data like health information to provide the Services or as otherwise described (which are considered necessary business purposes). If you believe we are using sensitive info for other purposes, you can request to limit that use.
Marketing Communications: For text/SMS messages, we obtain your prior express consent before sending any marketing or promotional texts, in compliance with the Telephone Consumer Protection Act (TCPA). You can opt out of receiving marketing text messages at any time by texting “STOP” in response to an SMS message or by contacting us directly. You may continue to receive non-promotional communications even after opting out, such as critical service or legal notices.
Cookies and Tracking: You can manage cookies and similar tracking technologies through your browser settings or using opt-out mechanisms provided in our cookie notice (if available). Most browsers allow you to refuse new cookies or delete existing ones. However, as noted, disabling cookies may affect certain functionality of the Services (such as staying logged in).

Exercising Your Rights: To exercise any applicable privacy rights (access, deletion, correction, etc.), please contact us using the information in the Contact Us section below. We will need to verify your identity or authority to make the request, to ensure we do not disclose or delete information to the wrong person.

For example, we may ask you to provide certain information to confirm you are the account holder or an authorized representative. In some cases, we may provide self-service tools that allow you to directly access or delete data; in other cases, we will handle your request manually.

We will respond to verifiable requests within the timeframe required by law (generally within 30-45 days for California residents, unless an extension is needed). If we cannot fulfill your request, we will explain the reasons (such as if an exemption applies or if the request is unduly burdensome).

If you are a California resident and your request is denied in whole or in part, you have the right to appeal our decision by contacting us (we will provide instructions in our response). If you are dissatisfied with how we handled a rights request, you may also contact the relevant state Attorney General or regulatory body.

Authorized Agents: If you wish, you may designate an authorized agent to make requests on your behalf (for example, a legal representative or someone with power of attorney). We will take steps to verify both the identity of the agent and their authority to act on your behalf. We may request written authorization or legal documentation to confirm an agent’s authority.

Please note that many of the rights described here are subject to various limitations under applicable law.. In all cases, we will handle any personal information request in good faith and to the best of our ability in accordance with applicable law.

HIPAA and Health Information

Because our Company operates in the healthcare benefits space, we take special care to comply with the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and its implementing regulations when applicable. Protected Health Information (PHI) is a subset of personal information that relates to an individual’s health status, treatment, or payment for healthcare that is held by a covered entity (such as a health plan or healthcare provider) or their business associate. In many cases, our Company may function as a Business Associate under HIPAA when we provide services to employers’ health plans or other covered entities. This means we have certain legal obligations regarding PHI. Our commitments regarding health information include:

Use and Disclosure: We will only use or disclose PHI for purposes permitted by HIPAA, such as for providing our Services (which may qualify as healthcare operations of a health plan), or as otherwise required by law or authorized by the individual. For example, we might use PHI to facilitate your enrollment in a health plan or to provide personalized decision support regarding your healthcare benefits, but we will not use your PHI for unrelated purposes such as marketing new services to you without your consent. We enter into Business Associate Agreements (BAAs) with our clients (e.g., employer-sponsored health plans or insurers) as required, which contractually bind us to protect PHI and limit its use and disclosure in accordance with HIPAA.
Safeguards: In addition to the security measures described in the Data Security section, we implement all required administrative, physical, and technical safeguards under the HIPAA Security Rule to protect electronic PHI. This includes access controls, audit controls, integrity protections, secure transmission, and workforce training on PHI handling. We treat health data with the highest degree of confidentiality and have policies in place to prevent any unauthorized access or improper disclosures.
Breach Notification: In the event of a breach of unsecured PHI, we will comply with HIPAA’s Breach Notification Rule which requires us to notify the covered entity (and in some cases affected individuals and regulators) without unreasonable delay. We have an incident response plan specifically for PHI incidents and will work diligently to mitigate any harm.
Individual Rights to PHI: If we maintain PHI about you on behalf of a covered entity, we will assist that entity in responding to your exercises of HIPAA rights. Under HIPAA, you have rights to access and obtain a copy of your health records, request amendments to incorrect PHI, request an accounting of disclosures, and place restrictions on certain disclosures. If you send us a request related to your PHI (for example, asking for a copy of data we hold as a business associate), we will either address it if we are able or refer you to the covered entity (such as your health plan administrator), as appropriate, to ensure your rights are fulfilled. We will not use or disclose any PHI in a way that would violate HIPAA, and this Privacy Policy is designed to be consistent with those requirements.

Please note that not all personal information we handle is subject to HIPAA. For example, information we collect directly from you on our website for marketing or general informational purposes may not be PHI if it is not in connection with a covered health plan or provider service. However, regardless of HIPAA status, we treat all health-related information with care and in accordance with applicable privacy laws. If you have questions about whether your information is considered PHI or how we protect it under HIPAA, you can contact us for more information.

Children’s Privacy

Our Services are not directed to children under the age of 13, and we do not knowingly collect or solicit any personal information from children under 13 years of age. Employees and individuals utilizing our platform are generally adults or under the supervision of an adult (such as a parent or guardian for dependents). In the event that we learn we have inadvertently collected personal information from a child under 13, we will promptly delete that information from our records. If you believe that a minor has provided personal information to us without appropriate consent, please contact us so that we can take necessary action.

Parents or guardians submitting information on behalf of minors through family benefits features are responsible for obtaining necessary consent. Any information about minors provided by a parent/guardian through our platform will be treated with the same level of protection as other personal information under this Policy.

For residents of certain states, such as California, additional privacy rights may apply to minors under age 16. We do not sell the personal information of minors under 16 without affirmative authorization as required by the CCPA.

Changes to this Privacy Policy

We may update or revise this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or for other operational reasons. When we make changes, we will post the updated Policy on our website and adjust the “Last Updated” date at the top or bottom of this Policy accordingly. All changes are effective immediately upon posting of the revised Privacy Policy, unless otherwise specified. If we make any material changes to how we collect, use, or share your personal information, we will take additional steps to notify you.

In the event we ever wish to use your personal information for purposes materially different from those stated at the time of collection, we will notify you and, if required by law, obtain your consent prior to the new use.

This may include prominently posting a notice of the changes on our website, sending you an email notification, or providing an in-app alert. We encourage you to review this Privacy Policy periodically to stay informed about our data practices. Your continued use of the Services after any changes to this Policy will signify your acceptance of the updated terms, to the extent permitted by law.

Contact Us

If you have any questions, concerns, or comments about this Privacy Policy or our privacy practices, please contact us. We also welcome requests to exercise your legal rights (as described above) or inquiries related to your personal data. You can reach us by:

Email: hello@benosphere.com – Please include “Privacy Inquiry” in the subject line of your email.

We will respond to your questions or requests as promptly as possible, generally within 30 days. If you contact us to exercise your rights, we may need to request additional information to verify your identity for security purposes.