Privacy Policy

3.2 Collection of De-Identified Information. We may create anonymous data. We do this by removing your name and other identifying details. We use reasonable measures to make sure the data cannot be linked back to anyone. The result is group-level data such as aggregate utilization statistics, plan cost benchmarks, and claims pattern analytics. We only do this with data you originally agreed to share with us.

3.3 Consumer-Directed Exchange via Patient Access APIs. When you connect a health plan, you are using your legal right to access your own health records. For insurers, this is your right of access under HIPAA, where it applies. For Medicare, it is the access right under its own federal rules. We act on your behalf, and at your direction, to retrieve that information. We support the following data sources:

• •Commercial health plan Patient Access APIs, including but not limited to Anthem/Elevance Health, UnitedHealthcare, Aetna, Cigna, Humana, and other participating payers (subject to registration approval). Uses HL7 FHIR R4 standards, SMART on FHIR protocols, and OAuth 2.0. This aligns with the CARIN Blue Button Implementation Guide (STU1 or later).
• •Medicare. This is the Centers for Medicare & Medicaid Services (CMS) Blue Button API. It gives Medicare beneficiaries access to their Part A, Part B, and Part D claims data. Uses OAuth 2.0 and HL7 FHIR R4 standards. Available to Medicare beneficiaries who authorize access through their MyMedicare.gov account.

MHICO requests only Coverage and ExplanationOfBenefit FHIR data. We do not request your name, address, or date of birth through FHIR connections. We receive only the data your insurer allows your account to access. An import covers only your own records. It should include only your own claims and coverage - not data about another person on your plan. Data may go back up to five years, depending on the source. AI personalization. Once imported, your coverage details and recent claims are shared with the MHICO AI assistant to personalize its answers. For example, the AI uses your actual deductible, copays, and claim history when you ask cost or coverage questions. This data is sent to AWS Bedrock (covered under MHICO’s HIPAA BAA with AWS) only for this purpose. Only display-level details are used - service descriptions, financial amounts, provider names, and dates. Diagnostic codes, procedure codes, and internal identifiers are never included. You can turn this off by removing your insurer on the Link Insurer page.

3.4 One-Time vs. Persistent Collection. We tell you whether data is collected once or on an ongoing basis. When you link a health plan, your insurer issues a short-lived access key (called an access token) that typically expires within an hour. When you log out, this key is cleared. Some insurers also issue a longer-lived refresh token, valid up to 90 days, so you do not need to re-authorize every time you sync. When all tokens expire, we will prompt you to reconnect. You can remove the connection at any time in Settings or through your insurer’s website.

3.5 Collection Limitations. We only collect data you have agreed to share. We never collect more than you authorize. All data is collected by lawful and fair means, with your knowledge and consent. We do not collect genetic data, biometric data (like fingerprints), or government ID numbers (like Social Security numbers). One exception: if you turn on the genetic information category in Settings, we may import claims related to genetic counseling or testing from your insurer. Even then, we only store the service description - never the actual genetic or diagnosis codes. See Section 3.6. You may only give us data that is your own, or data you have permission or the legal right to use. Do not upload another person's documents - such as bills, Explanations of Benefits, or insurance cards - unless you are allowed to act for them (for example, as their parent, legal guardian, or authorized representative).

3.6 Sensitive Health Data Categories and Per-Category Consent. Some claim types have extra legal protection under federal law. These include: substance use and addiction treatment, mental and behavioral health, HIV/AIDS, sexually transmitted infections, reproductive health, genetic information, and domestic violence.

By default, MHICO does not import or store claims in any of these categories. When we import your data, we briefly check whether a claim belongs to one of them. We look at security labels, code ranges, and drug name patterns. We never store those codes. If a claim is in a protected category and you have not turned that category on, we skip it and never save it. This automatic check runs only on claims we pull directly from your linked insurer - not on claims you add yourself (see below).

These category controls cover only your own health data. An import covers only your own records, so the categories you turn on or off are always your own. You never handle another person's sensitive data. If your insurer ever sends a protected-category claim that belongs to someone else (for example, a dependent on your plan), we reject it during import and never store it - no matter how your categories are set.

To allow claims in a category, go to Settings → Sensitive health data and turn on the ones you want. Once turned on, we will import and store those claims. The stored description may include procedure names, drug names, or test names. We never store diagnosis codes.

If you later turn off a category, all stored claims in that category are permanently and immediately deleted. This cannot be undone. Each category is controlled separately.

Claims you add yourself are handled differently. This covers claims you enter by hand and claims you import from a file you download from your insurer, such as a CSV, Excel, or PDF claims summary you save from your insurer's portal. We do not screen these for protected categories, and they are not affected when you turn categories on or off. Because you choose the file, it may include protected-category items, like a prescription name. We store what the file contains as-is, so only import files you are comfortable saving. To read a file you import, we send its contents to our AI model (AWS Bedrock, covered by our HIPAA BAA with AWS), which pulls the claims out of it. The model is used only to parse the file you uploaded. If you merge one of these with a sensitive imported claim, the merged record is treated as one you added yourself - turning off that category later will not delete it. To remove a record, delete that individual claim or close your account.

4.1 Initial Consent. Before we collect any data, we show you exactly what we will collect, how we will use it, and who we may share it with. You must say yes before we proceed.

4.2 Consent for Health Plan Data Access. When you connect your health plan, your insurer shows you exactly what data MHICO will access. You approve it through your insurer’s own login screen.

4.3 Separate Marketing Consent. Before using your data for marketing, MHICO will explain what we plan to do and ask for your permission. You must actively say yes. Marketing consent is never assumed. Agreeing to use the platform does not count as agreeing to marketing. Saying no does not affect any core features. Marketing consent covers only your own data, not your family members' data. We will not use your data to market to your family without their own separate permission.

4.4 Consent for Third-Party Disclosure. Before sharing your data with anyone outside our contracted service providers or legal requirements, we will explain the purpose and ask for your permission. We always ask before sharing, not after. You can always choose which recipients your data goes to.

4.5 Policy Change Notification and Re-Affirmation of Consent. When we make a material change, we email all users with existing accounts and post a notice at least 30 days before it takes effect. We explain what changed and how it affects your data. The next time you log in after the change takes effect, you will see a summary screen. You cannot access platform features until you respond. You must accept the updated terms to keep using MHICO, or you can decline. If you decline, your account data is immediately anonymized and you are logged out - the same process as closing your account.

4.6 What Happens When Consent Is Re-Affirmed. If you accept a material change, we will continue to collect and use your data under the updated policy. All past and future data will follow the new terms. We record your acceptance with a timestamp.

4.7 What Happens When Consent Is Withdrawn. If you withdraw consent, we will: (a) stop collecting your data right away; (b) stop using your data for AI analysis, plan comparisons, and claims; (c) stop sharing your data with others, except as required by law; (d) delete your data on request (see Section 8.2); (e) ask our service providers to delete your data where we can - AWS covers this under our HIPAA agreement, and our other providers, including but not limited to Google, Brave Search, Reddit, and Twilio (SendGrid and Verify), handle only limited, non-health data under their own policies; (f) keep any anonymous data already created before you withdrew - that data can no longer be linked back to you - but we will not create new anonymous data from your information; and (g) if you withdraw an optional consent (such as marketing or data sharing), you keep full access to core features and lose only the optional feature that consent supported; if you withdraw a consent that our core services depend on, you can no longer use the platform, and we close and anonymize your account - the same process described in Section 4.5 and Section 8.2.

4.8 Age Requirement. This platform is only for adults. You must be at least 18 to create an account. We do not knowingly collect personal data from anyone under 18. If we discover an account was created by someone under 18, we will close and anonymize it immediately.

4.9 Easily Changing Consent Options. You can change your consent settings at any time. Go to Settings → Privacy & Consent to adjust each option. You can also email julia@mhico.ai. Changes take effect right away. Withdrawing consent does not make past processing unlawful. There are no fees or penalties for changing your preferences. Some features may stop working if you withdraw the consent they depend on.

5.3 Permitted Uses of De-Identified Information. We may use anonymous data only to: (a) improve the platform and AI; (b) create aggregate analytics and benchmarks (e.g., average plan costs by region, common denial patterns by procedure type); and (c) research health insurance trends. We do not use anonymous data for anything else. If we ever want to, we will ask the person the data came from, if we can reach them. We do not use anonymous data for advertising, marketing, underwriting, or discrimination.

6.4 Contractual Obligations for All Third-Party Service Providers. All service providers and contractors who receive your data are bound by contracts - either a data processing agreement or their own published privacy terms. These contracts include: (a) limits on how they can use your data to the purposes in this policy; (b) a ban on uses or sharing that conflict with our commitments; (c) security at least as strong as ours; (d) a ban on re-identifying anonymous data; (e) a duty to notify us and you of data breaches; and (f) a duty to delete your data when you ask or when our relationship ends.

6.5 No Sale of Personal Data or De-Identified Information. We do not sell your data, trade it for anything of value, or share it with data brokers. Ever.

6.7 Disclosure of De-Identified Information. We may share anonymous data with third parties for research, analytics, or industry benchmarking. All recipients must: (a) keep the data anonymous; (b) not try to re-identify individuals; and (c) take steps to ensure no one can be identified from the data. We never share anonymous data for advertising, marketing, underwriting, or discrimination.

7.1 Right to Access. You can request a copy of all the data we have about you, subject to what is technically possible and what the law allows. Go to Settings → My Data or email julia@mhico.ai. We will send it in a standard format within 30 days.

7.2 Right to Correction. If your data is wrong, let us know. If the error came from your insurer or another outside source, we will help you understand how to ask them to fix it. If the error is ours, we will fix it.

7.3 Right to Portability. You can ask for your personal data in a standard, machine-readable format.

7.4 Right to Annotation. If data we hold is inaccurate or incomplete, you may add a note to it. We will pass that note along to anyone you have authorized to see your data.

7.5 Right to Revoke Data Access. You may revoke MHICO’s access to health plan data at any time through Platform settings or your health plan’s member portal.

7.6 Right to Delete. You can ask us to delete all your personal data and health information at any time. Go to Settings → Close Account, or email julia@mhico.ai. Section 8.2 explains what gets deleted right away, what may take up to 30 days (backups), and the rare situations where we cannot delete immediately.

7.7 Complaint Process. Email julia@mhico.ai with any complaints. We will respond within 5 business days and give you a full answer within 30 days.

8.1 Retention Periods. Here is how long we keep each type of data:

• •Account data: kept while your account is active. Deleted right away when you close it (Section 8.2). For inactive accounts, see Section 8.4. Backup copies may remain up to 30 days (Section 8.3(c)).
• •Health data from your insurer: kept while your account is active; deleted when you close it. Claims are the one exception - see the claims and appeals entry below.
• •Insurance plan data: same as health data above.
• •Claims and appeals: while your account is open, resolved claims are kept up to 3 years from the date of service, then automatically deleted; claims that are not yet resolved are kept until they are resolved. When you close your account, all claims and appeals are deleted right away, no matter their age or status (Section 8.2).
• •Insurer connection records: removed after 90 days with no sync activity. Your insurer’s access tokens expire within minutes to an hour and are also cleared when you log out. Clearing a token does not delete your connection record or any already-imported data. Refresh tokens (when issued) are valid for up to 90 days. When all tokens expire, we ask you to reconnect.
• •Anonymous data: may be kept indefinitely for research and improvement.
• •Legal records: as long as the law requires.
• •AI chat messages: tied to your login session. You are automatically logged out 14 days after you log in, and your chat history is cleared on logout. You can also delete individual sessions from the chat sidebar at any time.
• •AI chat session metadata (a record that a session occurred, which tools were used, and whether attachments were present - not message content): 90 days.
• •Login records: 90 days.
• •Account activity logs (data syncs, consent changes, payer connections, MFA changes, and other account-level events): 365 days.
• •Ad click identifiers (a Google or Reddit click ID, captured only if you arrive via one of those ads and create an account in that session): kept while your account is active; deleted when you close it.
• •Email deliverability records (your email address, recorded only after a bounce or spam complaint so we can stop sending to it): kept for the life of your account; deleted when you close it.
• •Survey responses: the satisfaction rating is anonymous and never linked to your account, so it may be kept indefinitely; the separate record that you completed the survey is deleted when you close your account.
• •Security logs (used only for security, compliance, and incident response): web server logs - 10 days on server, 90 days in CloudWatch; application logs - 90 days; network traffic logs - 90 days; API audit trails (AWS CloudTrail) - 365 days; firewall (WAF) logs - 14 days, stored in the US.

8.2 Right to Close Account and Delete Data. You can close your account and delete all your data at any time. Go to Settings → Close Account, or email julia@mhico.ai. Once we confirm your request, we will immediately: (a) cut off your account access and all insurer connections; (b) permanently delete all your personal data and health information, including your name, email, plan data, claims history, payer connections, login history, AI chat records, 2FA credentials, any stored phone number, ad click identifiers, and any email suppression record associated with your address; (c) replace your identifying information with an anonymous token for audit and legal purposes only, with no personal information attached; and (d) ask our service providers to delete your data where we have the right to do so. For AWS, this is covered under our signed HIPAA BAA. For our other service providers, including but not limited to Google, Brave Search, Reddit, and Twilio (SendGrid and Verify), the data shared is limited, non-health data governed by their own privacy policies and deletion practices. We delete any encrypted backup copies of your data within 30 days (see Section 8.3(c)).

8.4 Dormant Accounts. If your account has not been used for 12 months, we will email you. You will have 30 days to log in and keep it active. If you do not log in, your account will be deactivated. During that time, your data stays on our servers but is frozen - you cannot log in, your insurers will not sync, and the AI will not use your data. We do not share your data with anyone new, and our staff can only access it for security and legal reasons. Accounts that remain inactive for a total of 2 years from the last login will be deleted as described in Section 8.2.

9.1 Collection. Anonymous data comes from personal data and health data we collected with your consent (Section 3.2). We remove identifying details using reasonable steps to make sure the data cannot be linked back to anyone.

9.2 Use. De-identified information may be used only for Platform improvement, aggregate analytics and benchmarking, and research (Section 5.3). It is not used for targeted advertising, marketing, underwriting, or discrimination.

9.3 Disclosure. De-identified information may be disclosed to third parties for research, analytics, or benchmarking. All recipients are contractually prohibited from re-identification (Section 6.7).

9.4 Prohibition on Re-Identification. We have internal rules and require all third parties to sign contracts that ban re-identifying anonymous data.

10.1 Authentication. MHICO uses provider portal credentials that follow SMART on FHIR standards. When you connect a health plan, you log in directly on your insurer’s website. Your insurer may require its own identity checks and multi-factor authentication. Email verification is required before your account is activated. We support two types of two-factor authentication (2FA): an authenticator app (TOTP, a time-based one-time password) and an SMS code sent to your phone via Twilio Verify. Authenticator apps are the stronger option; the federal digital identity guidelines (NIST 800-63B) treat SMS as a weaker, ‘restricted’ method, so we recommend an authenticator app where possible. 2FA is required to use the AI chat assistant. You can create an account without 2FA, but you will be prompted to set it up before using AI features. Phone numbers for SMS 2FA are encrypted with AES-256-GCM using a separate key. Your insurer’s access tokens typically expire within minutes to an hour and are cleared when you log out. If your insurer issues a refresh token, it is valid for up to 90 days. When all tokens expire, we will prompt you to reconnect. Your already-imported data is not affected. You can remove your insurer connection at any time from the Link Insurer page or through your insurer’s member portal.

10.2 Breach Notification. MHICO follows all breach notification laws that apply to us, including the FTC Health Breach Notification Rule (16 CFR Part 318) and state breach laws. Our service providers must do the same, and AWS must tell us about any breach under our HIPAA Business Associate Agreement. A breach means your unsecured health data or other personal data is exposed. If one ever happens, we will: (a) tell you quickly - without unreasonable delay (no needless waiting), and no later than 60 calendar days after we find the breach; (b) tell the FTC. If the breach affects 500 or more people, we tell the FTC at the same time we notify affected individuals (and in no case later than 60 calendar days after we discover the breach). If it affects fewer than 500 people, we keep a written log and report those breaches to the FTC once a year, within 60 calendar days after the end of the calendar year. If a breach affects 500 or more residents of one state, we also tell major news outlets in that state, in the time the Rule requires; (c) explain, in plain language, when the breach happened (or our best guess), when we found it, what happened, what data was involved, what we are doing about it, and how you can protect yourself; and (d) give you a contact (julia@mhico.ai) for questions. We send this notice by email, plus any other way the law requires. If you think your account or data has been broken into, email julia@mhico.ai right away so we can look into it.

10.3 Prohibition on Re-Identification. MHICO does not allow anyone - including our service providers - to try to re-identify anonymous data. Any attempt violates our contracts. We will end the relationship and may take legal action.

12.1 California (CCPA/CPRA). California residents have the right to know what data we collect about you and why. You can ask us to delete your data or correct it if it is wrong. You can opt out of the sale or sharing of your data - MHICO does not sell or share your data. You can ask us to limit how we use sensitive personal information. You have the right to be treated the same whether or not you exercise these rights.

12.2 Virginia (VCDPA). Virginia residents can access a copy of their data, correct errors, and ask for deletion. You can request a portable copy of your data in a format you can reuse. You can opt out of targeted advertising, the sale of your data, and decisions made about you through automated profiling.

12.3 Colorado (CPA). Colorado residents can access a copy of their data, correct errors, and ask for deletion. You can request a portable copy of your data. You can opt out of targeted advertising, the sale of your data, and automated profiling that has legal or similarly significant effects.

12.4 Connecticut (CTDPA). Connecticut residents can access a copy of their data, correct errors, and ask for deletion. You can request a portable copy of your data. You can opt out of the sale of your data and targeted advertising.

12.5 New Jersey (NJ Privacy Act, effective January 15, 2025). New Jersey residents have the right to: know what personal data we collect and why; get a copy of it; fix errors in it; delete it; export it in a standard format; opt out of the sale of personal data, targeted advertising, and automated profiling that affects important decisions (like insurance, employment, or housing); and not be treated differently for exercising any of these rights. We do not sell personal data, use it for targeted advertising, or run automated profiling. Email julia@mhico.ai to make any request. We will respond within the time the law requires.

12.6 Nevada. Nevada law (NRS 603A) lets you opt out of the sale of your covered information. We do not sell it. Nevada also has a consumer health data law (SB 370). It gives you the right to know what health data we collect and share, to see and delete that data, and to take back your consent. We will not sell or share your health data without your permission.

12.7 Washington (My Health My Data Act). If you are a Washington resident, you have the right to know what consumer health data we collect, use, and share, and to learn the categories of third parties and affiliates we share it with. You can ask for a copy of that data, withdraw your consent at any time, and ask us to delete it. We do not sell or share your consumer health data, and we will never do so without your written authorization. This Privacy Policy also serves as our Consumer Health Data Privacy Policy under the Act, and is linked in the footer of every page, including our homepage. Email julia@mhico.ai to make any request.

12.8 Other U.S. States. Many other states now have their own privacy laws. These include Texas, Oregon, Montana, Utah, Iowa, Delaware, Indiana, Tennessee, Minnesota, Maryland, Nebraska, New Hampshire, Kentucky, and Rhode Island, among others. If you live in a state with a privacy law we did not list above, you still have the rights that law gives you. In most states, this means you can see your personal data, fix it, delete it, and get a copy to take with you. You can also opt out of the sale of your data, targeted ads, and profiling. We do not sell your data or use it for targeted ads or automated profiling. To use any of these rights, email julia@mhico.ai.

Contact julia@mhico.ai. We respond within time periods required by applicable state law.

13.1 Designated Officer. Julia Mahieu is our designated executive officer responsible for the data protection commitments in this policy and the CARIN Code of Conduct. These commitments are public and can be enforced by the FTC, state attorneys general, or other authorities.

13.2 Workforce Training. Everyone at MHICO with access to personal data is trained on our data practices. Training happens when they start, at least once a year, and whenever we make a significant change to how we handle data.

13.3 FTC Compliance. MHICO is subject to Section 5(a) of the Federal Trade Commission Act, which prohibits unfair or deceptive acts or practices in commerce.

13.4 Applicable Law. MHICO and all our service providers comply with all applicable federal and state laws on data protection and privacy.

13.5 Certification and Accreditation Notifications. If we receive any independent certification (such as CARIN Code of Conduct accreditation or SOC 2), we will announce it on the platform and update this policy. We will include the name of the certifying organization, what was certified, and the certification period.

17.1 Which AI we use. Our AI features use Anthropic’s Claude. This includes Ask Mhico (the chat assistant), insurance card and document reading, and claims analysis. Claude is a large language model (LLM) - a type of AI trained to understand and write text. We reach Claude through Amazon Bedrock, an AWS service covered by our signed HIPAA Business Associate Agreement (BAA) with AWS. We do not run our own AI models. We do not send your data to any AI provider other than Anthropic’s Claude through AWS.

17.2 Vendor documentation. Claude is built and owned by Anthropic. It is proprietary (privately owned), so Anthropic does not share the model’s source code or the data it was trained on. Here is the documentation that Anthropic and AWS make public:

• •Claude models overview: anthropic.com/claude
• •Anthropic documentation: docs.anthropic.com
• •Anthropic Usage Policy: anthropic.com/legal/aup
• •AWS Bedrock data protection and privacy: docs.aws.amazon.com/bedrock

17.3 What data is shared with the AI, and how it is used. We send data to the AI only to answer your question or do a task you started. Depending on the feature, this may include: (a) the messages you type in the chat; (b) files you upload in chat or in the Open Enrollment plan finder (PDFs, images, or text, such as a benefits summary or plan-comparison page), which we process in memory only and never store (see Section 3.1) - before answering, a quick automated check confirms an uploaded file relates to health or insurance, and we turn away a file that clearly does not; (c) billing details we pull from claim documents you upload on the Claims page; (d) your coverage and recent claims from a linked insurer, used to personalize answers (see Section 3.3); and (e) the medication names you enter for an AI drug-cost analysis in the Open Enrollment plan finder - for a Medicare Part D, employer, or COBRA plan - used only to generate that guidance and not stored afterward. For insurer data, we send only the details you would see on screen: service descriptions, dollar amounts, provider names, and dates. We never send diagnosis codes, procedure codes, or internal ID numbers to the AI. If you have enabled a sensitive health data category (see Section 3.6), service descriptions for claims in that category may include procedure names, drug names, or test names - but diagnosis codes are never sent regardless of your category settings. The AI uses this data only to answer you in that moment. We do not use it for advertising. We do not share it with anyone beyond what is needed to give you an answer.

17.4 Your data is not used to train AI models. Anthropic and AWS do not use your messages, your uploads, or the AI’s answers to train or improve their AI models. They do not share your data with the model maker for that purpose. The AWS Bedrock service terms and our HIPAA BAA with AWS require this. MHICO also does not use your personal data or health data to train any AI model. To improve our own features, we may use only de-identified, grouped data (see Section 5.3) - never data that can identify you. Because no data that identifies you is ever used to train AI, there is nothing you need to opt out of. You can still control what we send to the AI. To turn off personalization, remove your insurer on the Link Insurer page. To send nothing at all, do not use the chat or document features.

MHICO Inc.

Website: https://mhico.ai

Email: julia@mhico.ai