uPPo

Datavox LLC dba uPPo

Privacy Policy

Datavox LLC, doing business as uPPo (“uPPo,” “we,” “us,” or “our”), is committed to protecting the privacy and security of personal information we collect, use, and maintain in connection with our proprietary technology platform (the “Platform”) and related benefit administration services. This Privacy Policy explains what information we collect, how we use and share it, your rights with respect to your information, and how to contact us.

This Privacy Policy applies to employees and their dependents who use the Platform to receive benefit plan quotes and enroll in insurance or Individual Coverage Health Reimbursement Arrangement (ICHRA) programs (“Employees”); to employers who access the Platform to administer benefit programs for their workforce (“Employers”); and to any other individual whose personal information is submitted to or processed through the Platform.

By accessing or using the Platform, or by executing our Employee Enrollment Agreement or Employer Platform Services Agreement, you acknowledge that you have read and understood this Privacy Policy and consent to our collection, use, and sharing of your information as described herein. This Privacy Policy is incorporated by reference into the uPPo Employee Enrollment Agreement, Terms, Conditions, and Consent to Contact.

1. Information We Collect

Information You Provide Directly

When you or your Employer submits information through the Platform, we may collect the following categories of personal information: identity information such as your legal name, date of birth, gender, and Social Security number (full or last four digits); contact information including your email address, phone numbers, and residential and mailing addresses; employment information such as your employer's name, job title, hours worked, employment start date, and compensation; household information including household size, household income, and dependent relationships; dependent information such as the names, dates of birth, Social Security numbers, and relationships of any dependents you designate; coverage preferences including plan type preferences, coverage tier elections, and waiver elections; financial information such as payroll deduction amounts and ICHRA allowance designations; and health coverage status information including any existing insurance coverage, Medicare or Medicaid status, and qualifying life event information.

Information We Collect Automatically

When you access the Platform, we may automatically collect certain technical information, including device type and operating system, browser type and version, your IP address and general geographic location derived therefrom, log data such as pages visited and timestamps of activity, and session identifiers and authentication tokens. This information is used to operate, maintain, and secure the Platform and to diagnose technical issues. We do not use automatically collected information to identify you personally except as necessary for security or fraud prevention purposes.

Information We Receive from Third Parties

We may receive information about you from third parties in connection with the services we provide, including from your Employer in connection with benefit enrollment and eligibility administration; from insurance carriers in connection with enrollment confirmations, coverage verification, and plan administration; from healthcare clearinghouses and third-party administrators in connection with claims and reimbursement processing; from government agencies or exchanges to verify eligibility for premium tax credits or other assistance programs; and from identity verification services in connection with account authentication.

2. How We Use Your Information

We use the personal information we collect for the following purposes.

Platform Services and Benefit Administration

We use your information to generate personalized insurance and benefit plan quotes based on your profile and preferences; to submit enrollment applications and elections to applicable insurance carriers on your behalf; to administer your ICHRA account, including tracking allowances, processing reimbursements, and managing account balances; to verify your identity and eligibility to enroll in available Benefit Plans; to process premium payments and ICHRA reimbursements; to communicate with you regarding your benefit elections, enrollment status, plan documents, and renewal notices; and to maintain records of your enrollment history and benefit elections as required by applicable law.

Communications and Notifications

We use your contact information to send enrollment confirmations, benefit summaries, and plan documents; to provide open enrollment reminders, special enrollment period notices, and compliance-related alerts; to deliver rate change notices, renewal communications, and material plan modifications; to respond to customer service inquiries and provide platform support; and to send regulatory and compliance communications required by applicable law.

Legal Compliance and Platform Operations

We use your information to comply with applicable federal and state laws, including HIPAA, ERISA, the Affordable Care Act, and applicable state insurance regulations; to respond to lawful requests from government agencies, regulators, or law enforcement; to detect, prevent, and investigate fraud, security incidents, and unauthorized platform access; to enforce our agreements and protect the rights and interests of uPPo and its users; and to operate, maintain, and improve the Platform and our services.

3. How We Share Your Information

We do not sell your personal information. We share your information only as described below and only to the extent necessary to fulfill the purposes for which it was collected.

Insurance Carriers and Benefit Administrators

We share enrollment information, eligibility data, and other necessary personal information with the insurance carriers, health plans, and third-party administrators through whom your Benefit Plans are issued and administered. This sharing is necessary to complete enrollment, process premiums, administer claims, and fulfill your benefit elections.

Your Employer

We share information with your Employer to the extent necessary to administer your benefit plan, verify eligibility, process ICHRA contributions, and comply with Employer's obligations under applicable law. We do not share your individual health information with your Employer beyond what is permitted by HIPAA and applicable law.

Service Providers

We engage certain third-party vendors and service providers who assist us in operating the Platform and providing our services, including cloud hosting providers, data security vendors, payment processors, identity verification services, and customer communications platforms. These vendors are contractually required to use your information only as directed by uPPo and consistent with this Privacy Policy, and to maintain appropriate security safeguards.

Government Agencies and Regulators

We may disclose your information to federal or state agencies — including CMS, HHS, state Departments of Insurance, and the IRS — to the extent required by law, to respond to lawful requests or legal process, or in connection with regulatory filings, audits, or examinations.

Legal and Safety Purposes

We may disclose your information where we believe in good faith that disclosure is necessary to comply with a legal obligation; to protect and defend the rights or property of uPPo; to prevent or investigate possible wrongdoing in connection with the Platform; or to protect the personal safety of Platform users or the public.

Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of uPPo's assets, your personal information may be transferred as part of that transaction. We will notify you via email or a prominent notice on the Platform prior to such a transfer and any resulting change to this Privacy Policy.

4. Health Information and HIPAA

To the extent that information you submit through the Platform constitutes protected health information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA), we handle such information in accordance with applicable HIPAA requirements. We use and disclose PHI only as permitted or required by HIPAA and as necessary to provide the benefit administration services described in this Privacy Policy. We maintain the administrative, physical, and technical safeguards required by the HIPAA Security Rule for electronic PHI. To the extent uPPo acts as a Business Associate of a Covered Entity such as an insurance carrier or ERISA plan, we operate pursuant to a Business Associate Agreement governing our use and disclosure of PHI. We do not use PHI for marketing purposes without your specific, written authorization.

If you have questions about how your health information is handled, or if you believe your HIPAA rights have been violated, please contact us at the address provided in Section 10 of this Privacy Policy.

5. Data Retention

We retain your personal information for as long as necessary to provide the services described in this Privacy Policy; to comply with our legal obligations, including applicable federal and state recordkeeping requirements; to resolve disputes and enforce our agreements; and to fulfill the purposes for which the information was collected.

In general, we retain enrollment records and benefit administration data for a minimum of seven (7) years following the end of the applicable plan year, or such longer period as may be required by law — for example, ten (10) years for records subject to HIPAA or CMS requirements. Following the expiration of the applicable retention period, we will delete or securely anonymize your personal information.

6. Data Security

We implement and maintain commercially reasonable administrative, technical, and physical security measures designed to protect your personal information against unauthorized access, disclosure, alteration, loss, or destruction. These measures include encryption of data in transit and at rest; role-based access controls limiting access to personal information to authorized personnel with a legitimate need to know; multi-factor authentication for platform administrative access; regular security assessments and vulnerability testing; employee training on data privacy and security practices; and incident response procedures for detecting and responding to security events.

No security system is impenetrable, and we cannot guarantee the absolute security of your information. In the event of a data breach that is likely to result in harm to you, we will notify you in accordance with applicable state breach notification laws and, where required, notify relevant regulatory authorities.

7. Cookies and Tracking Technologies

The Platform uses cookies and similar technologies — such as web beacons, pixel tags, and local storage — to operate and improve the Platform, maintain your session, and gather aggregate analytics. We use strictly necessary cookies that are required for the Platform to function, including session authentication and security tokens; functional cookies that enable personalization and remember your preferences such as language settings and saved plan selections; and analytics cookies that help us understand how users interact with the Platform in aggregate, generally without identifying individual users.

You may control non-essential cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Platform. We do not use cookies to track your activity across unrelated third-party websites or to serve you advertising.

8. Your Rights and Choices

Depending on your state of residence and the nature of your information, you may have certain rights with respect to your personal information. We honor these rights to the extent required by applicable law.

Access and Correction

You may request access to the personal information we hold about you and request that we correct any inaccurate or incomplete information. To submit a request, please contact us using the information provided in Section 10.

Deletion

You may request that we delete your personal information. We will honor deletion requests to the extent permitted by applicable law, subject to our legal obligations to retain certain records. Please note that deleting your information may affect our ability to provide services to you.

Opt-Out of Communications

You may opt out of non-essential marketing communications at any time by following the unsubscribe link included in any email, by replying STOP to any text message, or by contacting us directly. Even if you opt out of marketing communications, we will continue to send you transactional, regulatory, and benefit-related communications that are necessary to administer your Benefit Plan.

California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), including the right to know what personal information we collect about you, the right to delete your personal information, the right to correct inaccurate personal information, the right to opt out of the sale or sharing of personal information (we do not sell personal information), and the right to non-discrimination for exercising your privacy rights. To exercise these rights, please contact us as described in Section 10. We will respond to verifiable consumer requests within forty-five (45) days as required by the CCPA.

Other State Privacy Rights

Residents of other states that have enacted comprehensive privacy laws — including but not limited to Colorado, Connecticut, Virginia, Texas, and Florida — may have similar rights to access, correct, delete, and obtain a portable copy of their personal information. We will respond to requests from residents of these states in accordance with applicable law. Please contact us using the information in Section 10 to submit a request.

9. Children's Privacy

The Platform is not directed to children under the age of thirteen (13), and we do not knowingly collect personal information directly from children under thirteen. If we become aware that we have collected personal information from a child under thirteen without parental consent, we will take steps to delete that information promptly. If you believe a child under thirteen has provided us with personal information, please contact us immediately using the information in Section 10.

To the extent the Platform collects information regarding dependents who are minors, such information is submitted by the Employee — as parent or legal guardian — on behalf of the minor, and the Employee's consent and authorization under the Employee Enrollment Agreement covers such submission.

10. How to Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, or if you wish to exercise any of your rights described in Section 8, please contact us at:

Datavox LLC dba uPPo

Attn: Privacy Officer

Address: Datavox LLC 3399 NW 72 Avenue, Suite 228, Miami, FL., 33122

Email: info@uppobenefits.com

We will respond to all privacy-related inquiries within thirty (30) calendar days of receipt.

11. Changes to This Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time to reflect changes in our data practices, applicable law, or the services we offer. When we make material changes, we will post the updated Privacy Policy on the Platform with a revised “Last Updated” date and notify registered users by email at the address on file where practicable. Where required by law, we will obtain renewed consent for any material changes to how we process sensitive personal information.

Your continued use of the Platform following notice of a material change constitutes your acceptance of the revised Privacy Policy. If you do not agree with a revised Privacy Policy, you must discontinue your use of the Platform and contact us to request deletion of your account.

12. Governing Law

This Privacy Policy is governed by the laws of the State of Florida, without regard to its conflict of law principles, and applicable federal privacy laws. To the extent any provision of this Privacy Policy conflicts with applicable state or federal law, such law shall control.

By using the uPPo Platform or executing the Employee Enrollment Agreement, you acknowledge that you have read, understood, and agree to this Privacy Policy. You further acknowledge that uPPo may update this Policy from time to time and that your continued use of the Platform following notice of any update constitutes your acceptance of the revised Policy.

— End of Privacy Policy —