Privacy Policy

1.The short version

2.Information you give us

Everything below is collected only when you choose to provide it:

• Account: your email address, password (stored only as a hash by our authentication provider), and the name you enter.
• Plan documents and details (Premium): benefits documents you upload or plan details you type in, and the fields our AI extracts from them.
• Health-profile questionnaire (Premium): your answers about coverage needs, expected care, and preferences, used to personalize estimates and the recommendation.
• Learning activity: which lessons you have watched and any notes you take, so your progress and notes are there when you come back.
• Messages you send us: support tickets and help-assistant conversations you hand off to support, newsletter signups, and enterprise enquiries.
• Billing: handled by Stripe. We store your Stripe customer id and subscription status; your card number never touches our servers.

3.Information collected automatically

Very little. We use no advertising trackers and no third-party analytics. Our hosting and database providers keep standard technical logs (such as IP address, browser type, and pages requested) to run and secure the service, and we keep an access log of actions on your own plan documents (uploads, views, questions, deletions) so you have an audit trail. Cookies are used only to keep you signed in and to run the site; there are no advertising cookies.

4.How we use your information

• to provide the service: lessons, progress, notes, and the Premium plan tools;
• to generate your summaries, cost estimates, comparisons, recommendation, and answers from the plans and answers you added;
• to process payments and manage your subscription;
• to respond when you contact us, and to send the emails the service requires;
• to secure the service, prevent abuse, and meet legal obligations.

5.How AI processing works

When you upload a plan document, ask about your plan, request a recommendation, or use the help assistant, the relevant text is sent to Anthropic (our AI provider) to generate the response, over an encrypted connection, under an agreement that prohibits using it to train models.

Your documents are never used to train AI models, by us or by our provider, and AI processing happens only for the features you actively use.

6.How your sensitive data is protected

• Application-layer encryption: parsed plan fields and questionnaire answers are encrypted (AES-256-GCM) with a key held outside the database before they are stored, so a database copy alone reveals nothing.
• Private storage: uploaded documents live in a private bucket, readable only by you, and are served through short-lived signed links, never public URLs.
• Row-level security: access rules are enforced in the database itself. A member can only ever read their own rows.
• Encryption in transit and at rest: all connections use TLS, and our providers encrypt stored data at rest.

7.Who processes data for us

We share your data only with the services below, which process it on our behalf to run HealthWise, and each only sees what its job requires:

Beyond these, we disclose data only if the law requires it, to protect the service or its members, or as part of a business transfer, in which case this policy continues to apply.

8.What we do not do

• We do not sell your personal information, and never have.
• We do not share it with advertisers or data brokers.
• We do not use your documents or answers to train AI models.
• We do not show your data to other members, employers, or insurers.
• We do not run third-party advertising or analytics trackers.

9.A note about HIPAA

HIPAA, the U.S. health-privacy law, applies to health plans, healthcare providers, and their business associates. HealthWise is a consumer education tool you use directly, so HIPAA generally does not apply to the data you give us. That is not a loophole we use: this policy, the encryption above, and our contracts are what protect your data, and we hold ourselves to the commitments on this page regardless of which law applies.

10.How long we keep data

We keep your data while your account exists so the service can work, with one deliberate exception: uploaded plan documents and their extracted details are kept for 18 months from upload, then deleted automatically. That window covers the plan year you chose them for plus the next Open Enrollment, so last year's plan is still there to compare against, without us holding sensitive documents indefinitely. You can delete an upload sooner at any time, and it is removed along with its parsed fields. Delete your account and your profile, plans, questionnaire answers, progress, and notes are permanently deleted. Billing records are kept as long as tax and accounting law requires, and support messages are kept as correspondence. Backups age out on our providers' standard schedules.

11.Your choices and rights

• See and update: your account page shows your details and lets you change your name, email, and password.
• Delete an upload: remove any plan document, and its parsed data, from your dashboard.
• Delete your account: from your account page, permanently. This cancels any subscription and removes your data as described above.
• Unsubscribe: every marketing email has an unsubscribe link. Emails the service requires, such as a password reset you asked for, are sent regardless.

Depending on where you live, you may have additional legal rights, such as access, correction, deletion, and portability. Email sales@healthwise.us.com and we will honor them. We do not discriminate against you for exercising them.

12.Children

HealthWise is not directed to children and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us personal information, email sales@healthwise.us.com and we will delete it.

13.Changes to this policy

When we change this policy we will update the effective date above, and for material changes we will give notice, such as by email or a notice on the site, before they take effect. The current version always lives at https://healthwise.us.com/privacy.

14.Contact us

HealthWise is operated by HealthWise LLC. Questions and legal notices go to sales@healthwise.us.com. Our Terms of Service cover the rest of the relationship.