Privacy Policy

1. Introduction

Everon Technologies LLC ("Everon", "we", "us", or "our") is committed to protecting the personal information of the employees and dependents whose benefits are administered through the Everon Employee Portal and the related enrollment experience reached from an employer invitation (together, the "Portal"). This Privacy Policy explains what information we collect through the Portal, how we use and share it, how we protect it, and the choices and rights available to you.

By using the Portal, you acknowledge the data practices described in this Privacy Policy. This Policy should be read together with the Employee Portal Terms of Service. If you received a separate privacy notice from your employer, a carrier, or a plan administrator, that notice governs their handling of your information.

2. Roles: Whose Data, and On Whose Behalf

Your employer (the "Employer") sponsors the benefits offered to you and invites you to the Portal. The benefits themselves are provided by carriers, plan administrators, and program sponsors made available through the Portal, including those offered through XGB and EHP (the "Vendor Programs").

• Enrollment Information — the personal, dependent, health, and election information you provide, or your Employer provides about you, in connection with eligibility and enrollment. Everon processes this information on behalf of your Employer and the applicable Vendor Programs in order to deliver eligibility, enrollment, billing, and administration services. Those parties determine what is collected and how it may be used for your benefits.
• Account and usage data — information about your Portal account and how you use the Portal. Everon processes this information to operate, secure, and improve the Portal as described in this Policy.

Where Enrollment Information includes health information protected by the Health Insurance Portability and Accountability Act (HIPAA) or similar laws, Everon handles it in accordance with those laws and with the agreements in place between Everon, your Employer, and the Vendor Programs. Nothing in this Policy reduces any rights you have under those laws.

3. Information We Collect

3.1 Information You or Your Employer Provide

• Account data: name, email address, phone number, and login credentials;
• Identity and contact data: date of birth, gender, home address, Social Security number, and employment details such as hire date, job classification, and compensation where required for eligibility;
• Dependent data: the same categories of identity information about your spouse, domestic partner, children, or other dependents you enroll;
• Health information: responses to medical or eligibility questionnaires, including conditions, medications, treatment history, height and weight, tobacco use, and similar information a Vendor Program requires for underwriting or eligibility;
• Election data: the benefits you select or decline, coverage tiers, beneficiaries, and effective dates;
• Qualifying event data: information you submit to request an election change, such as a marriage, birth, or loss of other coverage;
• Billing data: invoices, statements, payment history, and the payment methods you add. Card and bank details are collected and stored by our payment processors; Everon retains only a token and the last four digits;
• Signature data: your typed or drawn electronic signature, and the date, time, and IP address of signing;
• Documents: enrollment forms, confirmations, plan documents, and other files made available to you; and
• Communications: messages you send to support, and your notification preferences, including any SMS opt-in.

3.2 Information Collected Automatically

• Device and connection data: IP address, browser type, operating system, and device identifiers;
• Usage data: pages viewed, actions taken, timestamps, and referring pages; and
• Security and audit logs: sign-in events, password and setting changes, and record access.

3.3 Information From Other Sources

• Your Employer: census and eligibility information used to invite you and pre-fill your enrollment;
• Vendor Programs and their carriers or administrators: coverage status, eligibility determinations, and billing amounts; and
• Payment processors: payment confirmations and failure notices.

4. How We Use Information

• Create and secure your account and authenticate you;
• Present the benefits your Employer has made available and record your enrollment and elections;
• Transmit Enrollment Information, including health information, to the applicable Vendor Program and its carriers, administrators, or underwriters so they can determine eligibility, underwrite, and issue coverage;
• Process election changes and qualifying events;
• Generate invoices and statements, process payments, and manage payment methods where applicable;
• Produce, store, and deliver enrollment forms, confirmations, and other documents;
• Send transactional notices about your enrollment, coverage, billing, and account by email and, if you opt in, by text message;
• Provide customer support and respond to your requests;
• Detect, investigate, and prevent fraud, abuse, and security incidents, and maintain audit trails;
• Comply with legal obligations and enforce the Terms of Service; and
• Operate, maintain, and improve the Portal, including troubleshooting and analytics performed on de-identified or aggregated data.

We do not use your Enrollment Information, including health information, for marketing, and we do not use it to train artificial-intelligence models.

5. Legal Basis for Processing (where applicable)

• Performance of a contract: operating the Portal under the Terms of Service;
• Service to your Employer and the Vendor Programs: processing Enrollment Information on their behalf under the agreements between those parties;
• Legal obligations: recordkeeping, tax, benefits, and security requirements;
• Legitimate interests: securing and improving the Portal and preventing fraud; and
• Consent: where required, for example for optional text-message notifications.

6. Information Sharing and Disclosure

We share personal information only as described below. We do not sell personal information.

• Your Employer and its authorized representatives: enrollment status, elections, and the information needed to administer the Employer's benefits. Your health questionnaire responses are not shown to your Employer through the Portal.
• Vendor Programs, carriers, third-party administrators, and underwriters: the Enrollment Information they require to determine eligibility, underwrite, issue, bill, and administer coverage.
• Agents and affiliates assisting your Employer: enrollment progress and non-health information needed to support the Employer's group, subject to the access controls of the Portal.
• Service providers: cloud hosting, database, email and SMS delivery, payment processing, e-signature, error monitoring, and customer-support tooling, each bound by contract to use the information only to provide services to us.
• Legal and safety: when required by law, subpoena, or court order, or when we believe disclosure is necessary to protect the rights, property, or safety of Everon, our users, or others.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.

7. Cookies and Tracking Technologies

The Portal uses cookies and similar technologies that are strictly necessary to operate it: keeping you signed in, remembering your display preferences, protecting against cross-site request forgery, and supporting bot protection on sign-in pages. We do not use advertising cookies or third-party tracking pixels on the Portal. You can control cookies through your browser settings; disabling necessary cookies will prevent the Portal from working.

8. Data Retention

We retain personal information for as long as your account is active and for the period required by your Employer, the applicable Vendor Program, and applicable law. Enrollment, election, signature, and billing records are typically retained for the life of the coverage plus the period required by benefits, tax, and insurance recordkeeping rules. Security and audit logs are retained for a limited period appropriate to their purpose. When information is no longer needed, we delete it or de-identify it in accordance with our retention practices and the instructions of your Employer and the Vendor Programs.

9. Data Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit, encryption of sensitive identifiers at rest, role-based access controls, audit logging, and secure cloud infrastructure. No system is completely secure, and we cannot guarantee the absolute security of your information. If we learn of a security incident that affects your personal information, we will notify you and the appropriate parties as required by law.

10. Your Choices

• You can review and update your contact information and preferences in the Portal settings.
• Text-message notifications are optional; you can opt out at any time by replying STOP or through the Portal settings. Transactional emails about your enrollment and billing are part of the service and cannot be switched off while your account is active.
• Corrections to identity, dependent, or election data that has already been transmitted to a Vendor Program may need to be made through your Employer or the Vendor Program; we will direct you to the right contact.

11. Your Privacy Rights

Depending on where you live, you may have rights under state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act, to:

• Know what personal information we collect, use, and disclose about you, and access a copy of it;
• Correct inaccurate personal information;
• Delete personal information, subject to exceptions such as legal recordkeeping obligations;
• Receive your information in a portable format;
• Limit the use of sensitive personal information to the purposes described in this Policy; and
• Not be discriminated against for exercising these rights.

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We honor browser-based opt-out preference signals, such as Global Privacy Control, to the extent required by applicable law.

To exercise a right, email legal@everon.tech from the address on your account or use the contact details in Section 16. We will verify your identity, which may require you to sign in or confirm details we already hold, and we will respond within the time required by law (generally 45 days). You may designate an authorized agent to submit a request on your behalf; we may ask for proof of that authorization. Because much of your Enrollment Information is held on behalf of your Employer and the Vendor Programs, we may refer your request to them or coordinate our response with them, and certain records may be retained where the law requires. Health information protected by HIPAA is subject to the access and amendment rights provided under that law, which you may exercise through the applicable health plan.

12. International Data Transfers

The Portal is operated from the United States and intended for individuals located in the United States. If you access the Portal from another jurisdiction, your information will be transferred to and processed in the United States, where privacy laws may differ from those of your jurisdiction.

13. Children's Privacy

The Portal is not directed to children, and we do not knowingly allow anyone under the age of 18 to create an account. Information about minor dependents is collected only from the adult Member enrolling them and is used solely to administer their coverage.

14. Non-Everon Communications and Links

The Portal may display documents, notices, or links provided by your Employer, the Vendor Programs, carriers, or other parties, and you may receive communications from them outside the Portal. Their handling of your information is governed by their own privacy notices, and Everon is not responsible for their practices.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will provide notice of material changes by posting the revised Policy on the Portal and updating the effective date, and, where required, by notifying you directly. Continued use of the Portal after any changes constitutes acceptance of the revised Policy.

16. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact the Everon team at legal@everon.tech. Questions about your coverage or claims should be directed to your Employer or the contact identified in your plan documents.