Terms of Use

3.1 Transparency. We keep a plain-language Privacy Policy covering how we collect, use, share, and delete your data. It follows the ONC (Office of the National Coordinator for Health Information Technology) Model Privacy Notice.

3.2 Consent. We ask for your permission before collecting or sharing your data. We do not share by default. Marketing requires its own separate opt-in. The Platform is only for users 18 and older. When our Privacy Policy changes materially, we email all existing users and show a summary screen on their next login. You must accept the update to continue, or you may decline, which closes your account immediately.

3.3 Use and Disclosure Limitations. All our service providers are bound by contracts that mirror the commitments we make to you. We only use your data as described in our Privacy Policy or with your consent. We do not use your data for targeted advertising.

3.4 Individual Access. You can access your data, change your consent settings, and close your account at any time. Our Privacy Policy explains the rare cases where deletion may not be possible right away.

3.5 Security. MHICO protects your data with AES-256 encryption at rest and TLS 1.2+ in transit. We use role-based access controls and audit logs. All service providers must meet the same standards. We run continuous security monitoring including network traffic logs, API audit trails, and automated threat detection. These logs are kept for defined periods (see our Privacy Policy) and used only for security and incident response.

3.6 Authentication. MHICO uses industry-standard protocols for health plan logins. Before your account becomes active, we verify your email address. We offer two types of two-factor authentication (2FA): an authenticator app (a time-based one-time code, or TOTP) or an SMS text code. Authenticator apps are the stronger option and meet recognized standards for two-factor authentication. SMS codes are also available, but the federal digital identity guidelines (NIST 800-63B) treat SMS as a weaker, ‘restricted’ method because of risks like SIM-swapping (someone taking over your phone number). These guidelines recommend authenticator apps instead. If you currently use SMS 2FA, we encourage you to switch to an authenticator app in your account settings.

3.7 Breach Notification. MHICO and all our service providers follow all applicable breach notification laws, including the FTC Health Breach Notification Rule (16 CFR Part 318).

3.8 Re-Identification Prohibition. MHICO and all our service providers are prohibited from trying to re-identify anonymous data.

3.9 Data Provenance. We track where every claim came from. Claims imported from an insurer carry the source plan name, a unique FHIR record ID, and a reference to the sync that retrieved them. Claims you entered manually are marked as manual. Claims from uploaded documents are marked as document-sourced. All of this is included in your data export.

3.10 Accountability. MHICO complies with all applicable federal and state laws. A named executive is responsible for our data practices. We have a complaint process and train all staff on data privacy.

3.11 Education. We provide resources inside the platform to help you understand our data practices and protect your privacy.

3.12 Change of Ownership. Our Privacy Policy explains what happens to your data if MHICO is sold or shuts down, including advance notice, what the new owner must do, and your right to download or delete your data.

4.1 Consumer-Directed Data Retrieval. We use standard FHIR and SMART on FHIR protocols to connect to health data. We support two source types: (1) commercial health plan APIs from insurers like Anthem, UnitedHealthcare, Aetna, Cigna, and Humana; and (2) CMS Blue Button API - the Medicare API for Part A, Part B, and Part D data, accessed through MyMedicare.gov. As we add integrations, you can authorize each source through its own login. Supported sources are listed in your account settings.

4.2 Scope of Data Accessed. Through Patient Access APIs, MHICO requests only Coverage and ExplanationOfBenefit data. We do not request your name, address, or date of birth through FHIR. We receive only the data your insurer allows your account to access. An import covers only your own records - it should include only your own claims and coverage, not data about another person on your plan. Imported data includes service descriptions, dates of service, billed and paid amounts, provider names, and your share of costs. During import, we briefly check ICD-10 codes, procedure codes, and FHIR security labels to detect federally protected health categories. These codes are never stored. Certain categories - such as substance use disorder - are blocked by default and only imported after you explicitly consent. See Privacy Policy Section 3.6. Data may go back up to five years.

4.3 Token-Based Access. Access is controlled by OAuth tokens. You can revoke access at any time by removing the data source in the Platform or through your health plan’s member portal.

4.4 CARIN Blue Button Alignment. MHICO’s Patient Access API integrations are designed and being built to align with the CARIN Blue Button Implementation Guide (STU1 or later).

4.5 Payer Links. When you link a health plan, we immediately import a snapshot of your claims and coverage data. This is a one-time sync, not a live connection. We store the link record and your insurer’s encrypted credentials until you remove it or it is purged due to inactivity (see our Privacy Policy). Access tokens from your insurer expire within minutes to an hour and clear when you log out. Clearing a token does not delete your connection record or any already-imported data. If your insurer issues a refresh token, it is valid for up to 90 days and lets you sync again without logging in. When all tokens expire, we ask you to reconnect. Your imported data stays safe. You can see all active links in your account settings. Removing a connection revokes access and deletes the stored tokens.

4.6 AI Personalization Using Linked Health Data. Once you link an insurer, your coverage details and recent claims are shared with the AI to personalize its answers. For example, the AI will use your actual deductible, copays, and claim history instead of giving generic guidance. Only display-level details are shared - service descriptions, amounts, provider names, and dates. Diagnostic codes, procedure codes, and internal identifiers are never sent to the AI. This is processed via AWS Bedrock under our HIPAA BAA with AWS. You can turn off AI personalization at any time by removing your insurer on the Link Insurer page.

This section limits what MHICO is legally responsible for if something goes wrong. These limitations are required by law to be written in the exact legal language below. Plain-English explanations follow each one.

THE PLATFORM IS PROVIDED “AS IS” AND “AS AVAILABLE” WITHOUT WARRANTIES OF ANY KIND, EITHER EXPRESS OR IMPLIED.

In plain terms: we do our best, but we cannot guarantee the platform will always work perfectly or be error-free.

TO THE MAXIMUM EXTENT PERMITTED BY LAW, MHICO SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES ARISING OUT OF YOUR USE OF THE PLATFORM.

In plain terms: if you experience a loss that is not directly caused by our actions - for example, lost time, lost income, or stress - we are generally not responsible for those damages.

There is also a limit on the total amount MHICO may have to pay you. Our total liability will never be more than the greater of these two amounts:

• (a)what you paid MHICO in the 12 months before the claim; or
• (b)$100.

The Platform is free today, so for most users (a) is $0. That makes the real cap $100. This limit applies as far as the law allows.

This cap does not apply to: (i) claims from gross negligence (serious carelessness) or willful misconduct; or (ii) claims under state privacy laws that set their own fixed damages a contract cannot reduce, such as California’s Consumer Privacy Rights Act (CPRA) or the Washington My Health My Data Act.

13.1 Informal Resolution. Email julia@mhico.ai to try to resolve the issue informally within 30 days.

13.2 Binding Arbitration. If we cannot resolve it informally, the dispute goes to binding arbitration in New Jersey under the AAA Consumer Arbitration Rules. If the total amount in dispute is $10,000 or less, MHICO pays all AAA filing and administration fees. For larger claims, the AAA Consumer Arbitration Rules decide who pays those fees. Either way, each side pays its own attorney fees, unless the arbitrator orders otherwise under the law. Small claims exception. Instead of arbitration, either you or MHICO may bring an individual claim in small claims court, as long as the matter stays in small claims court and is brought only on an individual basis.

13.3 Class Action Waiver. YOU WAIVE (GIVE UP) ANY RIGHT TO PARTICIPATE IN A CLASS ACTION LAWSUIT OR CLASS-WIDE ARBITRATION.

13.4 New Jersey Enforceability. This arbitration section is governed by the Federal Arbitration Act. If you live in New Jersey, state law also requires us to clearly explain what rights you are giving up by agreeing to arbitration. By accepting these Terms, you give up your right to sue MHICO in court and your right to have a jury decide your case. You also give up the right to join a class action lawsuit. This paragraph exists to make sure those waivers are valid and enforceable in New Jersey.

13.5 Your Right to Opt Out of Arbitration. You can opt out of this arbitration agreement (Sections 13.2 and 13.3, including the class action waiver) within 30 days of first accepting these Terms. Email julia@mhico.ai with your name and a statement that you want to opt out of arbitration. If you opt out, neither you nor MHICO can require the other to arbitrate, and any dispute is resolved in court instead. Opting out does not affect any other part of these Terms, and it has no effect on your access to the Platform.

UNLESS YOU OPT OUT AS DESCRIBED IN SECTION 13.5, BY AGREEING TO THESE TERMS, YOU WAIVE YOUR RIGHT TO A TRIAL BY JURY AND YOUR RIGHT TO PARTICIPATE IN A CLASS ACTION.

15.1 Termination by MHICO. We may end or suspend your access at any time. In most cases, we will email your account address at least 7 days before we do this. If we have to act right away - for example, to stop an active security threat - we will email you as soon as we can after the action. When your access ends: (a) your right to use the Platform ends; (b) you can request a copy or deletion of your data under our Privacy Policy; and (c) your data is handled as described in our Privacy Policy and CARIN commitments.

15.2 Account Closure by You. You can close your account at any time in your account settings or by emailing julia@mhico.ai. When you close it, we delete all your personal data and health information right away. We delete any encrypted backup copies within 30 days. We keep only an anonymous record with no personal details, for audit and legal purposes. See Privacy Policy Section 8.2 for details, including the rare cases when immediate deletion may not be possible.

MHICO Inc.

Website: https://mhico.ai

Email: julia@mhico.ai