Privacy Policy

1. Information we collect

Information you provide directly. When you submit our interest form, you provide: first and last name, email address, city, state, ZIP code, year of birth, gender (including “prefer not to say”), current insurance status, plan interest, and any optional comments you choose to share.

Information collected automatically. When you visit the site we log limited technical data: IP address (stored only as a salted one-way hash used for rate limiting and abuse prevention), user-agent, referring URL, and UTM campaign parameters present in the URL. We do not currently use advertising cookies or cross-site tracking pixels.

Information from third parties. Our email provider reports delivery, open, click, bounce, unsubscribe, and spam-complaint events back to us so we can manage our communications.

2. How we use your information

We use personal information to:

• send program updates, webinar invitations, educational content, and announcements;
• tell you when CarePass opens in your state;
• respond to inquiries and provide customer support;
• understand aggregate interest (plan preference, geographic demand, insurance status) to inform product rollout;
• prevent fraud, abuse, and unauthorized access; and
• comply with legal obligations.

3. Email communications

When you check the consent box on our interest form, you agree to receive informational and promotional email from CashPrice Health at the address you provide. Consent is not a condition of any purchase.

Every email we send includes a one-click unsubscribe link in the footer. You can also email privacy@cashprice.health to be removed from our list. We do not currently send SMS or text messages.

4. Legal bases for processing

Where applicable, we rely on the following legal bases: your consent (email marketing and optional survey responses); performance of a contract or steps to enter a contract (responding to your membership inquiry); our legitimate interests (website security, fraud prevention, basic analytics); and compliance with legal obligations.

5. How long we keep your information

We keep interest-form submissions until you ask us to delete them or until we determine they are no longer needed, whichever comes first. Unsubscribe records and suppression lists are retained as long as necessary to honor your opt-out. Aggregated, de-identified data may be retained indefinitely for analytics.

6. Service providers we use

We share personal information with vendors that process it on our behalf under written contracts:

• Google Cloud / Firebase — website hosting and database (United States).
• Loops (loops.so) — email delivery and campaign management (United States).
• Cloudflare — bot protection on our web forms (global).

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising.

7. Security

We use industry-standard safeguards including encryption in transit (TLS), encryption at rest for stored records, least-privilege access controls, and rate-limiting on public endpoints. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

8. Your choices and rights

You can:

• unsubscribe from email at any time using the link in any message we send;
• request a copy, correction, or deletion of the personal information we hold about you;
• request that we stop using your information for specific purposes; and
• ask us to confirm whether we process your information.

To exercise any of these rights, email privacy@cashprice.health. We will verify your request and respond within the timeframe required by applicable law.

9. California residents

Under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), California residents have the right to know what personal information we collect, use, and disclose; to correct inaccurate personal information; to delete personal information; to opt out of “sale” or “sharing” of personal information; and to limit use of sensitive personal information.

We do not sell or share personal information as those terms are defined under California law, and we do not use sensitive personal information beyond the purposes permitted without an explicit right to limit. To exercise your rights, email the address above. You may designate an authorized agent; we will request written proof of authorization.

10. Other U.S. state privacy rights

Residents of states with comprehensive privacy laws (including, where applicable, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, New Jersey, New Hampshire, Minnesota, Tennessee, Indiana, Maryland, Kentucky, and Rhode Island) have similar rights of access, correction, deletion, portability, and objection. Use the contact email above to exercise these rights.

11. Children's privacy

This website is not directed to children under 16, and we do not knowingly collect personal information from children under 16. If you believe a child has provided information to us, contact us and we will promptly delete it.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the “Last updated” date above and, where required by law, notify you by email. Continued use of the website or our services after an update constitutes acceptance of the revised policy.

13. This policy does not cover Protected Health Information

Information collected through our website and marketing is not Protected Health Information (PHI) under HIPAA. If and when you enroll in a CarePass membership and establish a care relationship with an affiliated clinician, a separate Notice of Privacy Practices will govern the collection, use, and disclosure of your PHI. That notice will be provided at the time of enrollment.

14. Contact us

[LEGAL ENTITY NAME]
Attn: Privacy
[MAILING ADDRESS]
Email: privacy@cashprice.health