Consumer Health Data Privacy Policy

1. Who We Are and Our Role

InsuraCentral provides customer relationship management and communications software to licensed life insurance agents and agencies. We do not sell insurance and we do not make underwriting decisions.

In most cases the agency or agent that collected a consumer's information decides why it was collected and what happens to it. We process it on their instructions to deliver the Services. Where a consumer's request concerns information an agency collected, we will route the request to that agency and support them in answering it. Where we determine the purposes ourselves, we act as the responsible party and answer directly.

2. What We Treat as Consumer Health Data

Life insurance underwriting involves health information. We treat the following as consumer health data whenever it appears in the Platform:

• Health conditions, diagnoses, symptoms, and medical history
• Prescriptions and medications
• Height, weight, and body measurements
• Tobacco, nicotine, and alcohol use
• Treatment, procedures, and hospitalization history
• Disability status and information bearing on it
• Information about a consumer's efforts to seek health care services
• Any inference we or an agent draw about health status from other data

This information reaches us because a consumer provided it to an agent when applying for or discussing coverage, or because an agency uploaded records it already held.

3. How We Collect It

• Entered by an agent into a lead or client record during or after a conversation with the consumer.
• Submitted by the consumer through a quote request, application, or form an agency runs on the Platform.
• Uploaded in bulk by an agency importing its existing book of business.
• Captured in call recordings and transcripts where the consumer discussed health information on a recorded call.

4. How We Use It

We use consumer health data only to provide the Services:

• Storing it in the agent's record for that consumer
• Passing it to a quoting engine or carrier system when an agent asks us to
• Presenting it back to the agent handling that consumer
• Supporting the agency's workflow, scheduling, and follow-up
• Security, fraud prevention, backup, and legal compliance

We do not sell consumer health data. We do not use or share it for advertising, cross-context behavioral advertising, or profiling unrelated to the Services. We do not use it to train publicly available third-party artificial intelligence models. We do not create voiceprints or other biometric identifiers from recorded calls or transcripts.

5. Who We Share It With

• The agency that collected it, and the personnel that agency authorizes.
• Carriers and quoting systems, only when an agent directs us to send it.
• Service providers that host, secure, and support the Platform, under contracts limiting them to processing on our instructions.
• Legal recipients, where we are required by law or valid legal process, or to protect against imminent harm.

A current list of the categories of service providers that may process consumer health data is available on request at support@insuracentral.com.

6. Your Rights

If you are a consumer whose health data we hold, you have the right to:

• Confirm whether we are collecting, sharing, or selling your consumer health data, and access that data.
• Know the list of third parties and affiliates with whom we have shared it, and how to contact them.
• Withdraw consent to our collection and sharing of your consumer health data, at any time.
• Delete your consumer health data.
• Limit the use and disclosure of sensitive personal information, where your state provides that right.
• Appeal a decision to decline any of the above.

We will not deny you goods or services, charge you a different price, or provide a lower quality of service because you exercised any of these rights.

7. How to Exercise Them

Email support@insuracentral.com with the subject line “Health Data Request” and tell us what you want us to do. Include the phone number or email address an agent would have on file for you so we can locate your record.

• We confirm receipt and verify your identity using information already in the record. We will not ask you for more sensitive information than we already hold.
• We respond within 45 days, extendable once by a further 45 days where the law permits, in which case we will tell you why before the first period ends.
• On a deletion request, we delete the data from our production systems and instruct our service providers to do the same. Where an agency is the responsible party, we notify them of the request and support their compliance.
• On a withdrawal of consent, we stop collecting and sharing your consumer health data going forward.
• An authorized agent may act for you; we may ask for proof of authorization and may verify your identity directly.
• If we decline, you may appeal by replying to our decision. We respond in writing, and if we deny the appeal we will tell you how to complain to your state Attorney General.

8. Retention

We keep consumer health data for as long as the agency's account is active and it remains necessary to provide the Services, and afterwards only as long as we are required to for legal, regulatory, tax, or dispute-resolution purposes. Backups are cycled out on a rolling schedule. When a deletion request is honored, data is removed from production systems immediately and from backups as those backups expire.

9. Security

Consumer health data is encrypted in transit using TLS and at rest using AES-256. Access is limited by role, requires multi-factor authentication, and is logged. Our security practices are described in full in our Privacy Policy.

10. Changes

If we change this policy we will update the effective date above and, where the change is material, notify affected consumers or the agencies responsible for them.

11. Contact