Privacy Policy

1. Introduction

Covet Health ("Covet Health," "we," "us," or "our") is committed to protecting the privacy and security of the personal information and protected health information (PHI) we receive in connection with providing third-party administration (TPA) and health plan administration services. This Privacy Policy describes how we collect, use, disclose, and safeguard information on our website (the "Site") and through our platform services.

This policy applies to information collected through this Site. It does not replace or supersede the Notice of Privacy Practices (NPP) provided to plan members under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), which governs the use and disclosure of protected health information. If you are a plan member or covered individual, please refer to your plan's NPP for information about how your PHI is handled.

2. Information We Collect

We may collect the following categories of information:

• Contact and identity information: Name, email address, phone number, job title, and company name submitted through contact forms, demo requests, or account registration.
• Usage and technical data: IP address, browser type, operating system, pages visited, time spent on pages, and referring URLs, collected automatically through cookies and similar technologies.
• Communications: Records of correspondence if you contact us directly.
• Business relationship data: Information provided by employers, brokers, or plan sponsors in connection with plan administration services, subject to applicable Business Associate Agreements (BAAs).

We do not collect, store, or process protected health information (PHI) through this public-facing website. PHI is handled exclusively within secured, HIPAA-compliant systems governed by applicable BAAs and NPPs.

3. How We Use Your Information

We use the information we collect to:

• Respond to inquiries and provide requested information about our services
• Schedule and conduct demos and sales conversations
• Operate, maintain, and improve our website and platform
• Send administrative communications, such as confirmations and updates
• Analyze site usage and performance to improve user experience
• Comply with applicable legal and regulatory obligations
• Protect against fraud, unauthorized access, and other unlawful activity

4. HIPAA Compliance

Covet Health operates as a Business Associate under HIPAA in connection with its plan administration services. We maintain appropriate administrative, physical, and technical safeguards to protect PHI in accordance with HIPAA and the HITECH Act. We enter into Business Associate Agreements with covered entities and subcontractors as required by law.

Plan members seeking to understand how their PHI is used and disclosed, or wishing to exercise their HIPAA rights (including the right to access, amend, or request an accounting of disclosures), should contact their employer plan sponsor or review their plan's Notice of Privacy Practices.

5. How We Share Your Information

We do not sell your personal information. We may share information with:

• Service providers: Vendors and partners who assist in operating our Site and delivering our services, under confidentiality obligations.
• Plan sponsors and employers: In connection with administering health plan benefits, subject to applicable agreements.
• Legal and regulatory authorities: When required by law, regulation, legal process, or governmental request.
• Business transfers: In connection with a merger, acquisition, or sale of assets, subject to confidentiality protections.

6. Cookies and Tracking Technologies

Our Site uses cookies and similar tracking technologies to enhance functionality and analyze usage. You may configure your browser to refuse cookies or alert you when cookies are being sent. Disabling cookies may affect certain features of the Site.

We do not use tracking technologies to collect PHI or to engage in targeted advertising based on health information.

7. Data Retention

We retain personal information for as long as necessary to fulfill the purposes for which it was collected, to maintain business records, and to comply with applicable legal and regulatory requirements. When information is no longer needed, we securely dispose of it in accordance with our data retention policies.

8. Data Security

We implement industry-standard administrative, technical, and physical safeguards designed to protect your information against unauthorized access, disclosure, alteration, or destruction. These measures include encryption in transit and at rest, access controls, and regular security assessments. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your Rights and Choices

Depending on your location and applicable law, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information, subject to legal retention obligations
• Opt out of marketing communications at any time
• Lodge a complaint with a supervisory authority

To exercise these rights, please contact us at the information provided below.

10. Third-Party Links

Our Site may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies before providing any personal information.

11. Children's Privacy

Our Site is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected such information, we will take steps to delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will post the revised policy on this page with an updated effective date. Your continued use of the Site following any changes constitutes your acceptance of the revised policy.

13. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us: