Privacy Policy

1. Introduction

By using the Service, you accept and expressly consent to the terms of this Privacy Policy and to our use and processing of Personal Information (as defined below) for the purposes set forth here. “You” and “your” refer to you as a user of our Service. By accepting our Privacy Policy during registration, or by using the Service, you expressly consent to our collection, use, disclosure, storage, and processing of your Personal Information in accordance with this Privacy Policy.

2. Information Covered by This Privacy Policy

This Privacy Policy covers how ShareWELL Health Share treats the personally identifiable information that we collect, receive, maintain, store, or transmit, including information you transmit or submit in connection with your use of, or interaction with, the Service (“Personal Information”).

Your Personal Information includes, but is not limited to, information that individually identifies you or can be traced back to you, your IP address, or your location. It may include your name, address, email address, phone number, other contact information, and any information you choose to share via the Service.

3. Information Collected by the Service

ShareWELL Health Share collects Personal Information that you choose to provide to us in connection with your use of the Service, regardless of how you provide it. It is always your choice whether or not to provide us with your Personal Information. If you choose not to, you may not be able to use certain features or functions of the Service. Whenever you use the Service, we also receive and record information in our server logs from your browser, including your IP address, cookie information, and the pages you request, and relate it to the Personal Information you provide.

Examples of how and why we collect Personal Information include:

• Registration — We collect Personal Information as part of the registration process, such as your email, login, password, phone number, date of birth, your interest in the Service, and how you found the Service.
• Self-Reported Personal Information — Information you provide during the course of using the Service, including records relating to your medical or health history, health status, laboratory testing results, prescriptions, and other health-related information.
• Health Care Payer or Company (Employer) — If you receive the Service through your health care payer or company, we may receive information provided by them or by a third party on their behalf.
• Social Information — Information pertaining to people with whom you consent to share your Personal Information (such as a family member or caregiver), as well as communications between you and them.
• User Content — Messages, chats, reviews, photos, videos, images, folders, data, text, and other submissions you provide in connection with the Service.
• Automatically Tracked Information — Information collected through cookies, flash cookies, web beacons, GPS data, and similar technologies regarding your equipment, browsing actions, traffic and location data, the resources you use, and your internet connection (including IP address, operating system, and browser type). When you access the Service from a mobile device, we may collect unique device identifiers, mobile carrier, device type and model, operating system, phone number, and, depending on your settings, geographic location data.
• Demographic Information — Information such as your username and password, mailing address, age, gender, social security number, driver’s license number, geographic location, preferences, and payment information (such as your payment card number, expiration date, and billing address).
• Surveys and/or Assessments — Responses you provide to assessments and survey questions that help us understand and improve the Service.
• Augmenting — From time to time we may augment your Personal Information with information obtained from third parties and other sources, such as our partners, advertisers, and analytics providers like Google Analytics.

Cookies, Web Beacons, and Other Tracking Technologies

We use technology to automatically or passively store or collect certain information when you visit or interact with the Service. These technologies include cookies and web beacons (and later technologies that perform a similar function), which collect and store usage information about your use of the Service.

• Cookies are small text files placed in your browser or device to store your preferences. They may be session-based (removed when you leave a website) or persistent. Cookies themselves do not contain Personal Information, and you can delete them via your browser settings.
• Flash cookies are locally stored objects that may be incorporated into certain features to store information about your preferences and navigation. They are not managed by the same browser settings as ordinary cookies.
• Web beacons (also known as clear gifs, pixel tags, and single-pixel gifs) are small pieces of code placed on a web page to monitor behavior and help us manage online advertising and traffic.

Disabling cookies. You may set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. Please refer to your browser’s “Help” instructions to manage their use. The Network Advertising Initiative provides instructions on how to opt out of communications at networkadvertising.org/choices. If you disable or refuse cookies, some parts of the Service may be inaccessible or may not function properly.

California Do Not Track disclosure. We currently do not support the Do Not Track browser setting or respond to Do Not Track signals.

4. How We Use and Disclose Your Personal Information

In general, we will not rent or sell your Personal Information. We will not share your Personal Information with other people or non-affiliated companies except in connection with providing the Service, when we have your permission, as permitted or required by the Notice of Privacy Practices (the “NPP”), or as expressly permitted or required under this Privacy Policy.

Using Your Personal Information

We, or a third party on our behalf, use the information we collect in a variety of ways to provide the Service and operate our organization, including to:

• Provide you with the Service and the services and information you request;
• Verify your identity and personalize your experience;
• Process payment card transactions;
• Perform engagement, outreach, and call-monitoring activities;
• Inform you about other goods and services similar to those you have signed up for or inquired about;
• Notify you about changes to the Service, the Terms, and this Privacy Policy;
• Operate, maintain, and improve the Service’s content and functionality;
• Administer the Service and support internal operations such as troubleshooting, data analysis, quality assurance, research, and statistical and survey purposes;
• Respond to law enforcement requests, defend against claims, and pursue business-development opportunities such as a merger, reorganization, or sale of assets;
• Respond to user submissions, comments, and questions;
• Create de-identified and aggregated datasets, to the extent permitted by law;
• Protect the personal safety of users and protect our rights, property, employees, customers, and members, and keep the Service safe and secure;
• Develop, display, and track content and advertising tailored to your interests;
• Provide services as a business associate, including disseminating the NPP and sending communications that may contain PII, PHI, and/or PCI-DSS data; and
• Render services or provide information for any other use permitted by applicable law.

Disclosing Your Personal Information

Except as described in this Privacy Policy, we will not disclose Personal Information that we collect to third parties without your consent. However, to the fullest extent permitted by law, we may disclose Personal Information:

• To ShareWELL Health Share or other providers for treatment, payment, or operational purposes;
• To your health plan, employer, sponsor, or third-party administrator for billing and payment;
• To third-party service providers acting on our behalf under confidentiality agreements, such as website and application developers, cloud hosting, payment processors, and analytics providers;
• In response to a legal process, such as a court order or subpoena;
• To a law enforcement agency, or where necessary to investigate or prevent illegal activities, suspected fraud, or threats to physical safety, or to enforce our Terms and protect our legal rights;
• To an entity that acquires, buys, or merges with ShareWELL Health Share, or in connection with a divestiture, restructuring, reorganization, or sale of assets;
• As de-identified, aggregated, or non-aggregated information shared with institutional clients, partners, investors, and contractors for marketing, business, or research purposes;
• In accordance with your prior written consent or authorization;
• To our subsidiaries, affiliates, and related companies; and
• To third-party advertisers to develop and display advertising tailored to your interests or location.

5. Confidentiality, Security & Third-Party Links

We take reasonable steps to ensure that all Personal Information collected remains secure and in its original form. We have put in place appropriate physical, electronic, and administrative safeguards—in compliance with federal and state law, including HIPAA—to help prevent unauthorized access, maintain data security, and ensure correct use of the Personal Information we collect. We cannot, however, guarantee the security of any Personal Information you transmit to us, and you do so at your own risk. Once we receive your information, we use commercially reasonable efforts to secure our systems, though this is not a guarantee against breach.

The Service may contain links to Third-Party Offerings (as defined in the Terms). Before using any Third-Party Offerings, you should review and accept their terms of use and privacy policies. We are not responsible for the privacy practices, content, or performance of any Third-Party Offerings, and this Privacy Policy only governs information collected by our Service. When you access any Third-Party Offerings, you do so at your own risk and are solely responsible for any terms and policies that apply to them.

6. Accessing and Changing Your Information

You may review and request changes to your Personal Information, or request additional information about our collection, use, and disclosure of such information, by contacting us at [email protected]. You may update, correct, or delete your profile information and preferences at any time by emailing [email protected].

Any changes you make will be reflected in active user databases within a reasonable period of time; however, we may retain information you submit for backups, archiving, fraud prevention, analytics, legal obligations, or where we otherwise have a legitimate reason to do so. We may not be able to modify or delete your information in all circumstances. You may also request the information we hold about you, though your rights to access are not absolute and may be limited where required or permitted by law, or where disclosure would reveal personal information about a third party.

7. Children’s Privacy

Our Service is neither intended for nor designed to attract users under the age of 18. If you are under 18, or we are otherwise unable to offer Service functionality to you because you are deemed a minor, do not use the Service. Depending on the functionality available, a parent, guardian, conservator, custodian, or similar legally authorized person (an “Authorized Person”) may register for access and use it on your behalf.

Upon your turning 18, and depending on the functionality available, we may:

• Permanently disable the Authorized Person’s account;
• Require you to register for desired access to the Service;
• Ask whether the Authorized Person may continue to act on your behalf;
• Seek confirmation that you have taken over the account; and/or
• Otherwise communicate with you and/or the Authorized Person in accordance with applicable law and your communication preferences.

Our Service is not directed to children under the age of 13, and we do not knowingly collect information from children under 13 without parental consent. If you are under 13, please do not use or access the Service. If we learn that information has been collected from a person under 13, we will take appropriate steps to delete it. If you are a parent or guardian and discover that your child under 13 has obtained an account or accessed the Service, you may alert us at [email protected] and request that we delete your child’s information from our systems.

8. Opt-Out

You may opt out of receiving future marketing emails from ShareWELL Health Share and remove your name from our marketing mailing lists. These opt-out provisions do not apply to information collected by cookies, information used internally to recognize you or facilitate your use of the Service, or information we retain to comply with legal requirements. Opting out will not prevent your access to the Service, and you will continue to receive administrative messages about the Service.

If you no longer consent to our collecting, using, and sharing your Personal Information in accordance with this Privacy Policy, you may withdraw from the Service at any time by emailing [email protected].

9. Changes to This Privacy Policy

By using the Service, you agree to the current Privacy Policy and to our Terms, into which this Privacy Policy is incorporated. ShareWELL Health Share reserves the right, in its sole discretion, to modify or amend this Privacy Policy at any time. Use of the information we collect is subject to the Privacy Policy in effect at the time the information is used or disclosed.

If we make material changes to how Personal Information is collected, used, or transferred, we will notify you by modifying this Privacy Policy, and the last revision date will be noted. Please review this Privacy Policy periodically. Your continued use of the Service after notice signifies your acceptance of any changes. If the modified Privacy Policy is not acceptable to you, your only recourse is to cease using the Service.

10. Protected Health Information

Some of the information you provide to ShareWELL Health Share, or that is created through your use of the Service, may be considered “Protected Health Information” or “PHI” as defined by the Health Insurance Portability and Accountability Act (“HIPAA”). PHI is subject to ShareWELL Health Share’s Notice of Privacy Practices (the “NPP”), which describes how we use and disclose your PHI and your rights with respect to it. To the extent this Privacy Policy conflicts with the NPP, the NPP will prevail. To the extent a capitalized term is undefined here, it has the meaning given in our Terms of Service; to the extent this Privacy Policy conflicts with the Terms, this Privacy Policy controls. By using the Service, you acknowledge receipt of the ShareWELL Health Share NPP.

To review your rights concerning your PHI, please refer to our full Notice of Privacy Practices, which details how we use and disclose PHI and explains your rights under HIPAA. You may also request a paper or electronic copy by contacting our Privacy Support at [email protected].

PHI is Personal Information that relates to:

• Your past, present, or future physical or mental health or condition;
• The provision of health care to you; and
• Your past, present, or future payment for the provision of health care, which is created, received, transmitted, or maintained by us.

You have additional rights under federal and state law with respect to PHI. In addition to the permitted uses set forth in this Privacy Policy, we may use your Personal Information to send you communications on behalf of ShareWELL Health Share and to invite you to participate in IRB-approved research studies regarding the Service. To the extent permitted by applicable law, and as we deem necessary, we may also disclose your Personal Information to an appropriate health care provider to address concerns regarding the safety and well-being of a user.

11. Special Notice to Residents of Specific States

This section describes the additional rights provided to residents of specific states under applicable privacy laws, including those of California, Colorado, Connecticut, Utah, and Virginia.

• California residents — Under the California Consumer Privacy Act (CCPA), your rights include the right to know, access, delete, or opt out of certain data uses.
• Colorado residents — Your rights include access, portability, correction, and deletion of your Personal Information.
• Connecticut residents — Rights similar to those in California and Colorado apply.
• Utah residents — Effective December 31, 2023, residents have rights regarding access, correction, and deletion.
• Virginia residents — Under the Virginia Consumer Data Protection Act (VCDPA), your rights include access, portability, correction, and deletion.

Details for exercising your rights, as well as contact information for appeals, are available by emailing [email protected].

12. Users Outside the United States

The Service may only be used within certain jurisdictions within the United States, as set forth in the Terms. Accordingly, this Privacy Policy, and our collection, use, and disclosure of your information, is governed by U.S. law, and by using the Service you acknowledge that the Service is governed by U.S. law. Using the Service from outside the United States is prohibited under our Terms and may subject you to termination of your use of the Service. In no event will ShareWELL Health Share or any of its officers, directors, employees, consultants, subsidiaries, agents, or affiliated entities be liable for any losses or damages arising from your use of the Service outside the United States, and you waive any claims that may arise under the laws of your location outside the United States.

13. SMS / 10DLC Messaging Disclosure

As part of our communication strategy, ShareWELL Health Share may send messages via 10DLC (10-digit long code) messaging systems. By providing your contact information and engaging with our Service, you consent to receive messages from ShareWELL Health Share—including updates, reminders, and promotional content—through 10DLC platforms. Standard message and data rates may apply. You may opt out of receiving these communications at any time by following the unsubscribe instructions provided in our messages or by contacting us directly.

14. AI Assistant (Columbus)

ShareWELL Health Share offers an AI-powered assistant named “Columbus” to help answer questions about our programs, membership, and how sharing works. Columbus is available on our website and within the member portal and mobile app. We identify Columbus to you as an automated AI assistant, and it only collects information from a conversation when you choose to send a message—it does not run in the background or capture anything until you send. This section explains how Columbus handles your information.

• What we collect. When you send a message to Columbus, we collect the text of your message, your recent chat history within that conversation, the responses Columbus provides, your IP address, and basic technical details about the request. If you are signed in, we also associate the conversation with your account—including your name and the membership and program information tied to your account, such as the products you are enrolled in and your coverage details—so Columbus can give you accurate, plan-specific answers.
• How your information is used. Your message and the relevant context are sent to our servers and to our third-party AI providers for the sole purpose of generating a response (and, for members, related summaries of your requests). Columbus is for general program and membership navigation only; it is not a medical provider and does not provide medical, diagnostic, or treatment advice.
• Who we share it with. To produce these responses and summaries, we share the necessary data with two named third-party AI service providers: Anthropic, PBC (which powers the Columbus chat) and Microsoft Azure OpenAI Service (which we use to process certain member requests, such as summarizing a sharing request or program document). Each processes the data only on our behalf to return a result.
• Equal protection and no model training. Both providers are contractually required to protect your information at least as strongly as this Privacy Policy requires and to use it only to provide the service to us. Neither provider uses your messages or other data submitted through our accounts to train its AI models.
• How long we keep it. Columbus conversations are retained for up to 24 months and then deleted, unless we are required to keep them longer to comply with the law. We retain them to operate and improve the assistant, monitor answer quality and accuracy, provide customer support, and maintain the security of the service.
• Please don’t overshare. Columbus is designed for program and membership questions. Please avoid entering sensitive medical details or other sensitive personal information you don’t need to share to get help.