Academic HealthPlans, Inc. Privacy Policy

Last Updated: January, 2023

This privacy policy (“Privacy Policy”) describes how RSC Insurance Brokerage, Inc. and its affiliates and subsidiaries, including its subsidiary Academic HealthPlans, Inc. (collectively, “Risk Strategies”, “we”, “us”, or “our”) collect, use and disclose the personal information processed in relation to:

• The use our websites and associated services that link to this Privacy Policy, including www.risk-strategies.com, www.ahpcare.com and other websites controlled by Risk Strategies (the “Sites”);
• Our former, current and prospective clients;
• Individuals who communicate with us; and
• Individuals who use our products and services (collectively with our Sites, the “Services”) and individuals whose personal information we receive in providing the Services.

This Privacy Policy also describes the choices available to you regarding our use of your personal information and how you can access and update this information. We recommend that you review the Terms of Use governing your use of this Site and its content by clicking here.

Please note that this Privacy Policy does not apply to our processing of information about employees, staff, or contractors. We may provide additional privacy disclosures where the scope of the personal information processing falls outside the scope of this Privacy Policy. In that case, the additional privacy disclosures will govern how we may process the information you provide at that time.

Consumers with disabilities may access this notice by using a standard screen reader or contacting us at (617) 330-5700.

Our Sites

The processing of personal information in relation to the Sites is controlled by Risk Strategies, unless a Site identifies (in its privacy policy, terms of use or otherwise) that it is controlled by another Risk Strategies entity. Risk Strategies, as well as individual divisions of Risk Strategies, may have their own websites with their own privacy policies, in which case this Privacy Policy will not apply to such websites unless such website provides a link to this Privacy Policy.

Information We Collect

When we use the term “personal information” in this Privacy Policy, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual or household. It does not include aggregated or deidentified information that is maintained in a form that is not capable of being associated with or reasonably linked to an individual or household.

We may collect personal information about you and related third parties, including beneficiaries, dependents, employees or other participants in the Services offered to you. By providing us with the personal information of any third party, you confirm that you have the authority to do so on their behalf and have provided them with the information set out in this Privacy Policy.

The categories of personal information we collect can include:

• Personal identifiers such as your name, email address, mailing address, phone number, date of birth, and government-issued identifiers (e.g., social security or national insurance number, passport number, ID number, tax identification number or driver’s license number).
• Customer records such as your identification documents, account credentials, and payment and billing information (credit or debit card or other financial information).
• Commercial information such as your communication with us or interest or participation in an insurance product, risk consulting service or other Services.
• Demographics such as race, ethnicity, gender, marital status, date and place of birth.
• Health or medical information such as health and medical history, conditions, diagnoses, services received, claims, coverage, medications, allergies, accommodation needs and any other information related to health insurance Services.
• Sensory information such as photos and videos of you and audio recordings of phone calls between you and us, where permitted by law
• Preferences you provide to us or generated through your use of the Services, including inferences we may make based on our experience with you.
• Internet, network and device information from the browser or device you use to access our Services, which could include your IP address, device ID, cookie identifiers, browser type, internet service provider, referring/exit pages, operating system, date/time stamp and or clickstream data.
• Professional information in connection with your role as a brokerage or carrier partner, agent, vendor or research partner.
• Background check information that we may receive from third-party sources, such as criminal and sex offender registry information.

Keep reading to learn more about how we collect personal information you provide to us directly through the Sites, information we collect through your use of the Services, and information we receive through third parties.

Disclosure of Personal Information

AHP uses Plaid Technologies, Inc. (“Plaid”) to gather an insured’s data from financial institutions. By using our service, you grant AHP and Plaid the right, power, and authority to act on your behalf to access and transmit your personal and financial information from the relevant financial institution. You agree to your personal and financial information being transferred, stored, and processed by Plaid in accordance with the Plaid Privacy Policy.

Information You Provide Through the Sites

When using our Sites, you may voluntarily provide information about yourself. We collect this information when you contact us through our Sites, create an account, provide us with personal information required to fulfill Services, or interact with us for any other purpose.

We may collect the following personal information about you through our Sites:

• Personal identifiers such as contact information;
• Customer records such as billing information and user name, account number, and password;
• Preference information such as preferences about marketing publications and your interests in relation to our Services; and
• Commercial information associated with your inquires to us, including information you may voluntarily submit to us by completing forms on our Sites.

Information Processed Through the Services

We may also collect additional personal information (subject to applicable U.S. legal requirements and restrictions) in providing our Services, operating our business, and interacting with individuals in the course of our business, which may include:

• Personal identifiers such as government issued identification numbers;
• Customer records such as billing information, Income and other financial information, and records of real property;
• Commercial information about the insurance quotes individuals receive and the policies they obtain, current and/or previous claims;
• Demographic information;
• Health and medical information and other Information necessary to secure insurance products, provide risk consulting services, offer guidance on other Services to you, process claims;
• Sensory information such as voice recordings when you call us;
• Preferences such as inferences we may make based on our experience with you;
• Professional information such as employer, job title and employment history; and
• Background check information such as criminal records data and other information from credit and background checks.

Information Automatically Collected When You Use our Services

Like most digital platforms, we collect certain personal information automatically when you visit our online Services, including:

• Internet, network and device information. We may place, or allow to be placed, cookies, web beacons and similar technologies (“cookies”) on our Services to give you the best experience, perform analytics, analyze traffic, personalize content, offer a range of features and functionality, and offer ads that match your interest. The information collected through cookies may include your IP address, browser type, Internet service provider, device type/model/manufacturer, operating system, date and time stamp, and a unique ID that allows us to identify your browser or your account (including, for example, a persistent device identifier or an Ad ID), and other similar information. We may also work with third-party partners to employ cookies and analytical tools, including the application of statistical modeling tools, that permit us to recognize and contact you across multiple devices; and
• Preferences such as inferences about your interests that we may make based on your cookie data.

We may use this information to determine the way you access and use our Services and to improve your online browsing experience. This may include, for example, the site from which you came and the site to which you are going when you leave our services, the pages you visit, the links you click (also known as “clickstream data”), whether you open emails or click the links contained in emails, whether you access the services from multiple devices, and other actions you take on the services

We may also conduct analytics based on clickstream data. We may collect analytics data or use third-party analytics tools like Google Analytics to help us measure traffic and usage trends for the Services and to understand more about the demographics of our users. You can learn more about Google’s practices with Google Analytics by visiting Google’s privacy policy here. You can also view Google’s currently available opt-out options here.

Please see the Your Choices section below for information on how to block or delete cookies from your browser or device.

Information Provided by Third-Party Sources

In addition to the personal information collected above, we may also collect personal information from the following third-party sources:

• Social media. If you choose to interact with us on social media, we may collect personal information about you from the social media accounts that you make public. We use personal information collected in connection with your social media account to communicate with you, better understand your interests and preferences, and better understand our customer base more broadly.
• Business partners. Our business partners may collect the personal information listed above in connection with the Services and may share some of this information with us. This includes our customers, the insureds, employers, administrators or other participants in the Services offered to you and the other third parties in the supply chain for providing the Services to you.
• Service providers. Our service providers, such as payment processors and marketing providers, collect the personal information and often share it with us. For example, we receive personal information from payment processors to confirm that an individual’s payment for the Services was accepted. We also receive information about the success of our email campaigns, including information about who has opened our marketing communications and when.
• Information providers. We may, from time to time, obtain information from third-party information providers to correct or supplement personal information we collect. For example, we may obtain updated contact information from third-party information providers to confirm an address or reconnect with an individual, or we may receive the results of a background check from a third party provider. We may also enrich the data we own with third-party information, such as demographic information about business contacts to understand our audience and develop better marketing communications.
• Acquired entities or data. We may, from time to time, acquire the equity or assets of a third-party entity in a merger or acquisition, which may include personal information about the entity’s customers, prospects, users, employees, business contacts or any person to which they’ve encountered. We will use this information in accordance with this Privacy Policy.
• Publicly available information. We may collect personal information from publicly available sources, such as government records or public review websites, to help improve our business and services.

How We Use Your Information

In addition to the above, we and our third party partners may use personal information for any lawful purpose, including the following:

• To create, maintain and service your account;
• To respond to your inquiries or otherwise communicate with you;
• To evaluate your eligibility for and provide Services you request, including to provide publications to which you subscribe;
• To operate, personalize, and improve the Sites and their features, including for analytics purposes;
• To send you important information regarding the Services, such as certain changes to our terms, conditions, policies, and other administrative information. Because this information may be material to your use of the Services, you may not opt-out of receiving such communications;
• To administer and manage our vendors and business partners
• To analyze, improve and grow our business;
• For our other business purposes, such as analysis, research, audits, fraud detection and prevention, payment processing, developing new products and features, identifying usage trends, and our internal operational purposes;
• To comply with applicable U.S. law(s) or to respond to valid law enforcement requests and as permitted by applicable U.S. law, court order, or governmental regulations and enforce our corporate reporting obligations and our Terms of Use;
• To help maintain the safety, security, and integrity of our Services, technology assets, and business; and
• With your consent, or as otherwise disclosed at the time information is collected.

We may also use aggregate, deidentified and anonymous information in a manner for any lawful, legitimate purpose such that the information does not uniquely identify you or any other user of the Services. Where we maintain deidentified data, we will maintain and use the data in deidentified form and not attempt to reidentify the data except as required or permitted by law.

Disclosure of Information

Risk Strategies may share your personal information with other parties in the ways that are described in this Privacy Policy, including the following:

• Within Risk Strategies. We share personal information with our subsidiaries and affiliates in the Risk Strategies family of companies, so that they also may use such personal information for the purposes described in this Privacy Policy. For example, we may disclose your information to affiliates who serve a role in supplying the Services;
• Business partners. We share information with our business partners, such as the third party agents, contractors, brokers, carriers, administrators or other third parties involved in providing the Services;
• Service providers. We share personal information with third-party vendors, consultants and other service providers who perform functions or services on our behalf and under our instructions to make our Services available to you. For example, this may include vendors and providers who engage in marketing or advertising activities or provide mailing or email services, tax and accounting services, auditing and compliance, fraud prevention, infrastructure provisioning, analytics services, IT services, product fulfillment, and web hosting;
• Business transaction or reorganization. We may take part in or be involved with a corporate business transaction, such as a merger, acquisition, joint venture, or financing or sale of company assets. We may disclose personal information to a third-party during negotiation of, in connection with or as an asset in such a corporate business transaction. Personal information may also be disclosed in the event of insolvency, bankruptcy, or receivership;
• Legal obligations and rights. We may disclose personal information to third parties, such as legal advisors, auditors and law enforcement:
• in connection with the establishment, exercise, or defense of legal claims;
• to comply with laws or to respond to lawful requests and legal process;
• to protect the rights and property of Risk Strategies, our agents, customers, and others, including to enforce our agreements, policies, and Terms of Use;
• to detect, suppress, or prevent fraud;
• to reduce credit risk and collect debts owed to us;
• to protect the health and safety of us, our customers, or any person; or
• With your consent or at your direction. In addition to the sharing described in this Privacy Policy, we may share information about you with third parties whenever you consent to or direct such sharing or as otherwise disclosed at the time of data collection or sharing.

We may share information that has been anonymized or aggregated without limitation.

Your Choices

Online Advertising

We permit our trusted business partners and third-party advertising companies (including ad servers, ad agencies, technology vendors, or providers of sponsored content, collectively “ad partners”) to collect your browsing information and numerical identifiers associated with your browser or device to provide ads on our behalf that are tailored to your interests. These ads may appear on our website, and on other third-party websites. Using cookies, our ad partners collect data from a particular browser or device about a user’s web viewing behaviors over time, across unrelated websites, and in some cases combine such data with data collected from other browsers or devices associated with the same user or household, and use such data to predict user preferences and to deliver advertisements to that user which are calculated to target that user’s predicted preferences across devices. If you take steps to block advertising cookies or opt out of interest-based advertising, note that this does not mean that you will no longer receive ads from Risk Strategies, as these ads are only one form of digital advertising. Throughout our online advertising practices we support the self-regulatory principles of the Digital Advertising Alliance (“DAA”).

Privacy Preferences

You have some choices regarding how we use your personal information, including those in this section and, depending on where you live, please see the Region-Specific Disclosures section below for additional information that may apply to you.

• Correcting and updating your information. You may change any of your personal information in your account by editing your profile within your account. If you have questions about reviewing, changing, or deleting your information, you can contact us directly using the contact information below. We may not be able to change or delete your information in all circumstances.
• Marketing emails. If you decide that you do not wish to receive marketing emails from Risk Strategies, you may opt-out of receiving further e-mails by clicking “Unsubscribe” in such emails. You may also opt out or unsubscribe from future emails by sending a request to privacyofficer@ahpcare.com using the subject line “Unsubscribe from email communications.” To ensure your opt-out request is properly processed, be sure to send your message using the same email account to which we sent our correspondence.
• Cookies and Online Advertising: Most browsers accept cookies automatically, but you can block or delete cookies at any time to prevent the collection of your browsing information for purposes of delivering interest-based ads and tracking visitor behavior. You can block or opt out of cookies or collection of data for interest-based advertising by adjusting settings within your device or browser. For instructions, check your browser’s technical information. You can also find options for restricting cookies placed by some of our ad partners, on the DAA’s opt-out page (http://optout.aboutads.info/) or the by using the NAI’s opt-out tool (https://optout.networkadvertising.org/?c=1).

If you are using a mobile device, your device may also include a feature ("Limit Ad Tracking" on iOS or "Opt Out of Ads Personalization" on Android) that allows you to opt out of having certain information collected through mobile apps used for behavioral advertising purposes. If you block cookies at a browser- or device-level and use a different computer or browser to access our platforms, you should review your cookie settings again. Please be aware that blocking or deleting cookies may also disable or interfere with shopping features on our services and other sites that you may visit.

Third-Party Links and Tools

Our Sites may provide links to third-party websites or applications. We do not control the privacy practices of those websites or applications, and they are not covered by this Privacy Policy. You should review the privacy notices of other websites or applications that you use to learn about their data practices.

Our Sites may also include integrated social media tools or “plug-ins,” such as social networking tools offered by third parties. If you use these tools to share personal information or you otherwise interact with these features on the Sites, those companies may collect information about you and may use and share such information in accordance with your account settings, including by sharing such information with the general public. Your interactions with third-party companies and your use of their features are governed by the privacy notices of the companies that provide those features. We encourage you to carefully read the privacy notices of any accounts you create and use.

Minors

Risk Strategies is committed to protecting the privacy needs of children and encourages parents and guardians to take an active role in their children’s online activities and interests. We do not knowingly collect information from children under the age of sixteen (16), and Risk Strategies does not target or direct its Sites to children.

Changes to Our Privacy Policy

We may update this Privacy Policy to reflect changes to our information practices and will post the updated Privacy Policy with a modified “Effective Date” at the top. Any changes or modifications will be effective immediately upon posting of the changes or modifications, and, to the extent permitted by law, retroactively to all personal information we have already collected. We encourage you to periodically review this Privacy Policy for the latest information on our privacy practices. If our information practices change, we will post these changes on this page.

Contact

If you have questions, comments, or concerns about this Privacy Policy, please contact us:

• By phone at (617) 330-5700.
• Email at privacyofficer@ahpcare.com

Region-Specific Notices

Additional privacy terms may be applicable depending on your location. These terms (our "region-specific notices") are incorporated into, and should be read in conjunction with, this Privacy Policy. Unless otherwise indicated, the region-specific notices have the same effective date as the Risk Strategies Privacy Policy and all terms have the same meaning as defined in our Privacy Policy.

Notice to Certain U.S. State Residents

Residents of the U.S. states of California, Virginia, Colorado, Connecticut, and Utah who have interacted with us in the ways described in this Privacy Policy have certain privacy rights granted under the applicable laws in their state (respectively, the California Consumer Privacy Act of 2018 as a mended by the California Privacy Rights Act, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, and any similarly constructed U.S. state law enacted in the future; collectively, the “U.S. state privacy laws”). This notice does not apply to personal information that is exempted from the U.S. state privacy laws, such as personal information covered by sectoral privacy laws like the Health Insurance Portability and Accountability Act, the Confidentiality of Medical Information Act, the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act, or the California Financial Information Privacy Act.

Sensitive Information. The following categories of personal information we collect may be classified as “sensitive” under the U.S. state privacy laws (“sensitive information”):

• Government-issued identifiers;
• Username and password;
• Demographics such as race, ethnicity, citizenship status, sexual orientation or sex life;
• Information about a known child under the age of 13;
• Health and medical information; and
• Payment card and financial account information.

We use this sensitive information in determining your eligibility for and the provision of the Services as described in our Privacy Policy. We do not sell sensitive information, and we do not process or otherwise share sensitive information for the purpose of targeted advertising. We do not collect or process sensitive information, for inferring characteristics about you other than as necessary to provide the Services.

Your Privacy Rights. Depending on your state of residency and subject to certain legal limitations and exceptions, you may be able to exercise some or all of the following rights:

Depending on your state of residency, you also have the right to not receive retaliatory or discriminatory treatment in connection with a request to exercise the above rights. However, the exercise of the rights described above may result in a different price, rate or quality level of Service where that difference is reasonably related to the impact the right has on our relationship or is otherwise permitted by law.

Do Not Sell or Share My Personal Information. Under the laws of California, Colorado, Connecticut and Utah, the definition of “sale” is broad and covers many common business activities, even when the personal information used is not exchanged for money, or when it has been partially de-identified. Risk Strategies shares personal identifiers, or internet, network and device information, and preferences for data analytics including fraud detection, marketing and advertising purposes, for example, to better understand engagement with our Services, to match your interests with similar products you may also be interested in, to offer advertising for our products across other devices that you use, and to identify other potential customers with interests similar to yours who may also be interested in our products.

Under Virginia law, “selling” is the exchange of your personal information for monetary consideration only. Risk Strategies does not sell your personal information to third parties for money for their independent business use.

When we use the term “share” or “sharing” we mean sharing, renting, releasing disclosing, disseminating making available, transferring or otherwise communicating orally, in writing, or by electronic or other means, your personal information by us to a third-party for cross-context behavioral advertising as well as targeted advertising as defined under the U.S. state privacy laws.

We do not “sell” or “share” sensitive information. We do not sell the personal information of consumers we know to be less than 16 years of age. If we wish to do so in the future, we will first seek affirmative authorization from either the minor who is between 13 and 16 years of age, or the parent or guardian of a minor less than 13 years of age. Please contact us at privacyofficer@ahpcare.com to inform us if you, or your minor child, would like to opt-in to “sales”.

Exercising Your Rights. To exercise the rights described above, please choose one of the following options:

• To submit a request to exercise your Right to Know, Access, Portability, Correction, Deletion, Control Over Sensitive Information, or Control Over Automated Decision Making, please call us at (617) 330-5700 or email us privacyofficer@ahpcare.com with sufficient information to identify you in our systems and fulfill your request.
• To submit a request to exercise your Right to Opt-Out of Sales or Opt-Out of Sharing/Use of Your Personal Information for Targeted Advertising, please complete the following steps:
  • Cookie Preference Tool. Please navigate to your browser’s settings and clear your cache and delete all cookies stored on your browser. Then, please visit the Risk Strategies Site you typically interact with, and you will be presented with a cookie banner. You can opt out of the “sales” and “sharing” of your personal information by choosing the “Decline” option on the banner, or by selecting the “Cookie Settings” option and declining “Advertisement” and “Analytics” cookies. Please note that this opt-out is device- and browser-specific and will not be effective on your visits to the Services from other devices, browsers. These requests will only affect cookie-based “selling” and “sharing”. Please note that deleting and opting out of some cookies may result in an inability to take full advantage of the Services.
  • Future “Sales” and “Shares”. To opt out of potential future “sales” and “sharing” of your personal information from our internal databases, please call us at (617) 330-5700 or email us privacyofficer@ahpcare.com with sufficient information to identify you in our systems and fulfill your request.
  • As an additional measure, we also suggest you block or opt out of cookies or collection of data for targeted advertising by adjusting settings within your device or browser. For instructions, check your browser’s technical information. You can also find options for restricting cookies placed by some of our ad partners, on the DAA’s opt-out page (http://optout.aboutads.info/). If you are using a mobile device, your device may also include a feature (" Limit Ad Tracking " on iOS or " Opt Out of Ads Personalization " on Android) that allows you to opt out of having certain information collected through mobile apps used for behavioral advertising purposes.

We will need to verify your identity and confirm your state of residence before processing your request, which will generally require the matching of sufficient information you provide to us to the information we maintain about you in our systems or the successful authentication through your account (if you have one with us).

Making a privacy rights request does not require you to create an account with us. However, we cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.

We will only use personal information provided in a privacy rights request to verify the requestor's identity or authority to make the request, to process the request, and for necessary record keeping.

Authorized Agents. Only you, or someone legally authorized to act on your behalf and with written permission, may make a privacy rights request related to your personal information. In certain circumstances, you are permitted to use an authorized agent to submit requests on your behalf where (i) you provide sufficient evidence to show that the requestor is an authorized agent with written permission to act on your behalf and (ii) you successfully verify your own identity with us. We generally require evidence of either: (i) a valid power of attorney; or (ii) a signed letter containing your name and contact information, the name and contact information of the authorized agent, and a signed statement of authorization for the request. Depending on the evidence provided and your state of residency, we may still need to separately reach out to you to confirm the authorized agent has permission to act on your behalf and to verify your identity in connection with the request.

Appealing Privacy Rights Decisions. Depending on your state of residency, you may be able to appeal a decision we have made in connection with your privacy rights request. All appeal requests should be submitted by emailing privacyofficer@ahpcare.com with the subject line “Privacy Rights Appeal.” We welcome the opportunity to discuss the decision about your privacy rights request with you.

• Colorado Residents: If your appeal is denied, you may contact the Colorado Attorney General to address your concerns here.
• Connecticut Residents: If your appeal is denied, you may contact the Connecticut Attorney General to submit a complaint here.
• Virginia Residents: If your appeal is denied, you may contact the Virginia Attorney General to submit a complaint here.

Notice to California Residents

Retention of Personal Information. We retain personal information only for as long as is reasonably necessary to fulfil the purpose for which it was collected. However, if necessary, we may retain personal information for longer periods of time, until set retention periods and deadlines expire, for instance where we are required to do so in accordance with legal, tax and accounting requirements set by a legislature, regulator or other government authority.

To determine the appropriate duration of the retention of personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of personal information and if we can attain our objectives by other means, as well as our legal, regulatory, tax, accounting and other applicable obligations.

Therefore, we retain personal information for as long as the individual continues to use our Services for the purposes explained in this Privacy Policy. In particular, we will retain their personal information for as long as necessary to comply with our legal obligations, to resolve disputes and defend claims, as well as, for any additional purpose based on the choices you have made, such as to receive marketing communications. We will retain personal information supplied when joining our services, including complaints, claims and any other personal information supplied during the duration of an individual’s contract with us for the services until the statutory limitation periods have expired, when this is necessary for the establishment, exercise or defense of legal claims.

Notice to Nevada Residents

If you are a resident of the State of Nevada in the United States, Chapter 603A of the Nevada Revised Statutes permits Nevada residents to opt out of potential future sales of certain covered information that a website operator has collected or will collect about you. To exercise this right, please contact us:

• By phone at (617) 330-5700.
• Email at privacyofficer@ahpcare.com