Notice at Collection and U.S. Multi-State Privacy Notice

Last updated: November 6, 2024

California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Montana, Nebraska, Nevada, New Hampshire, Rhode Island, Texas, Utah, Virginia, and Washington have enacted consumer privacy laws that grant their residents certain rights and require additional disclosures. This U.S. Multi-State Privacy Notice ("Notice") addresses these state-specific requirements and serves as our California notice at collection.

If you are a resident of one of the states listed above, this Notice and our Digital Privacy Policy (DPP) apply to you.

We may update this Notice from time to time. If we make material changes, we will revise the Last Updated date above, which will serve as ongoing notice of such changes. We encourage you to review this Notice regularly to stay informed about our information management practices and the choices available to you.

Personal Information

Personal Information includes information that identifies, relates to, describes, is reasonably capable of being associated with or could reasonably be linked, directly or indirectly with a particular consumer or household.

U.S. State Privacy Laws do not apply to health or medical information regulated by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and this Notice does not apply to such data, or other data types which are excluded under U.S. State Privacy Laws. However, other governing documents, such as a HIPAA Notice of Privacy Practices (NPP), may apply.

Collection, Use, and Disclosure of Personal Information for Business Purposes

The following table provides appropriate details on the categories of Personal
Information that we collect and the purpose for which we collect them:

Category & Sources of Personal Information (PI)	Representative Data Elements	Purpose for Collecting the (PI)	Categories of Parties to whom this type of PI is Provided or Disclosed for a Business Purpose
Contact Information We collect this type of information directly from you: Such information may be retained following our record retention schedule.	Data elements in this category include: Full name, nicknames, or previous names (such as maiden names) Honorifics and titles, and preferred form of address Mailing address Email address Telephone number, including mobile number	We use this type of information to identify you and communicate with you, including: To personalize our communications and provide customer service To respond to your inquiry For our everyday business purposes	We disclose this information to contracted service providers, contractors, and third parties for everyday business purposes.
Survey Data We collect this information directly from you, for example, from forms you complete on our website. Such information may be retained per our record retention schedule.	Data elements in this category include: Any personal information you may choose to supply in response to a survey request	We use this type of information: To improve our service, including online tools and offerings For our everyday business purposes	We disclose this information to contracted service providers, contractors, and third parties for everyday business purposes.
Health Condition/Status We receive claims information from third party administrators (TPAs). Such information may be retained per our record retention schedule.	Data elements in this category include: Name, DOB, plan, and clinical notes.	We use this type of information for: Applicable stop loss reporting and assessment/analysis.	We disclose this information to contracted service providers, contractors, and third parties for reinsurance purposes.

We may use or disclose the Personal Information that we collect for one or more of the following everyday business purposes:

For identity and credential management, including identity verification, authentication, and system and technology administration.
To protect the security and integrity of systems, networks, applications, and data, including detecting, analyzing, and resolving security threats and collaborating with cybersecurity centers, consortia, and law enforcement about imminent threats.
For fraud detection and prevention.
For legal and regulatory compliance, including all uses and disclosures of Personal Information required by law or reasonably needed for compliance with company policies and procedures, security and incident response programs, and intellectual property protection programs, and corporate ethics and compliance hotlines, as well as for compliance with civil, criminal, judicial, or regulatory inquiries, investigations, subpoenas, or summons.
To exercise or defend the legal rights of the business and its employees, affiliates, customers, contractors, and agents.
To comply with applicable laws.
For corporate audit, analysis, and reporting.
To de-identify the data or create aggregated datasets, such as for consolidated reporting, research, or analytics.
To make backup copies for business continuity and disaster recovery purposes.
For corporate governance, including mergers, acquisitions, and divestitures.
Marketing purposes include developing and providing promotional and advertising materials that may be useful, relevant, valuable, or otherwise of interest to you.
Processing your job application.

Other Details About Our Information Practices

We do not sell or share your Personal Information. We will only sell or share your Personal Information if we modify this Notice and take the additional steps required under applicable state law. We do not have actual knowledge that our business sells or shares the Personal Information of consumers under 16 years of age. We do not collect your Sensitive Personal Information.

Consumers Personal Data Rights

State residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Montana, Nebraska, Nevada, New Hampshire, Rhode Island, Texas, Utah, Virginia, and Washington have certain rights concerning the use and disclosure of Personal Information:

Right of Access | Right to Notice. If you are a resident of one of the above states, you have the right to request that we disclose to you:
- the categories of Personal Information we have collected about you, the specific pieces of Personal Information we have collected about you, the categories of sources from which the Personal Information is collected, the business purpose or commercial purpose for collecting, selling, or sharing (if applicable) Personal Information, the categories of third parties with whom we share Personal Information, and the categories of Personal Information we have disclosed about you for a business purpose.
- a copy of the specific pieces of Personal Information we have collected and retained per the organization’s record retention policy.
Right to Deletion. If you are a resident of one of the above states, you have the right to request that we delete the Personal Information we collect from you. However, in certain situations, we are not required to delete your Personal Information, such as when the information is necessary to complete the transaction for which the Personal Information was collected, to provide a good or service requested by you, to comply with a legal obligation, to engage in research, to secure our websites or other online services, or to otherwise use your Personal Information internally in a lawful manner that is compatible with the context in which you provided the information.
Right to Correct Inaccurate Personal Information. If you are a resident of one of the above states, you may have the right to have us correct errors in the Personal Information we maintain about you. Not all states offer the right to correct (Iowa, Nevada, Utah, and Washington); however, we may still choose to correct inaccurate information if possible.
Right to Appeal. You may have the right to appeal our refusal to act on your request. Please enclose a copy of or otherwise specifically reference our decision on your data subject request so that we may adequately address your appeal. We will respond to your appeal in accordance with applicable law.
To exercise the rights described above, you or your authorized agent can call us at 833-777-5785 or visit SUBMIT A U.S. MULTI-STATE PRIVACY REQUEST. We will collect Personal Information about you, such as your name, phone number, physical address, and email address, so we can search this information against our systems to validate your identity.

Nondiscrimination

Right Not to Be Subject to Discrimination. We do not discriminate against any resident because they exercised any U.S. State Privacy rights described above.

Notice of Financial Incentives

We do not offer financial incentives for collecting or selling Personal Information.

Business to Business Information (CA residents)

We treat communications with representatives of companies who are California residents in the same way as we treat the personal information of other California residents. The California Consumer Privacy Act (CCPA (CPRA)) includes a broad definition of “consumer,” which covers all California residents, including those acting as representatives of their employers. To exercise the rights described above, you or your authorized agent can call us at 833-777-5785 or visit SUBMIT A U.S. MULTI-STATE PRIVACY REQUEST.

Contact Us

You can also direct any questions or concerns regarding your rights to us by calling the phone number listed above.

Stop Loss coverage is underwritten by HM Life Insurance Company, Pittsburgh, PA, or Bridge City Insurance Company, Pittsburgh, PA, in all states except New York under policy form series HMP-SL (08/19), HMP-SL (06/20) or BCICP-SL (06/20) or similar. In New York, Stop Loss coverage is underwritten by HM Life Insurance Company of New York, New York, NY, under policy form series HMP-SL (06/20) or similar. In all states except New York, Provider Excess Insurance is underwritten by HM Life Insurance Company, Pittsburgh, PA, or Bridge City Insurance Company, Pittsburgh, PA, under policy form series HMP PEL (09/20) or BCIC PEL (09/20) or similar. In New York, Provider Excess Insurance is underwritten by HM Life Insurance Company of New York, New York, NY, under policy form series HMNY PEL1105 or similar. In all states except New York, Assumed Accident and Health Reinsurance is underwritten or reinsured by HM Life Insurance Company, Pittsburgh, PA, or Bridge City Insurance Company, Pittsburgh, PA, under form HM1005-ELR or similar. In New York, Assumed Accident and Health Reinsurance is reinsured by HM Life Insurance Company of New York, New York, NY. The coverage or service requested may not be available in all states and is subject to individual state approval. Reinsurance agreements only reflect a form number when required by applicable state law. In Oregon, Bridge City Insurance Company does business as BCIC Insurance Company.