Consumer Health Data Privacy Policy

1. Scope and responsible entity

CoverageFlow, LLC provides this separate notice for consumer health data processed in connection with this website. It supplements the Privacy Policy and applies to the extent Washington’s My Health My Data Act or another applicable consumer-health privacy law covers the data and activity. Insurance-related information is not automatically exempt; a particular exemption must apply to the specific information and processing.

CoverageFlow is not a medical provider, and visiting the website does not create a provider-patient relationship. Do not assume that all information entered in an insurance-marketing website is protected by HIPAA. Use sample information in the current preview and do not upload medical records.

2. Categories, sources, and purposes

Health-related information can include the fact that you are exploring health, Medicare, life, or final-expense coverage; current health coverage; Medicare enrollment or eligibility statements; benefits of interest; self-reported health; and associated age, birthdate, sex, contact details, or general location when they identify or relate to a person’s health needs. A page request or prefilled URL may reveal a health-related interest even if you never submit a form.

Sources are you, the browser or device making a request, a party that included information in a link, and hosting/security records generated from that request. The purpose of the current preview is to display the journey you requested, tailor questions locally, keep the site available and secure, measure page usage and performance, and handle your direct communications or privacy requests. We do not derive a diagnosis, medical treatment history, or advertising audience from these answers.

Current service: CoverageFlow is a guided website preview. Completing a funnel does not submit a lead, request a quote, purchase a policy, enroll you in coverage, or authorize marketing. Answers typed into the preview are processed in your browser and are cleared when the page is reloaded or closed. Values supplied in a link are different: the URL is sent when the page is requested and may appear in browser history, hosting or security logs, and the records of whoever supplied the link.

3. Disclosures, recipients, and affiliates

Current typed preview answers are not sent to an insurer, agent, marketing affiliate, or lead buyer. Technical requests, including their URLs, are processed by Cloudflare for hosting and security. Cloudflare Web Analytics receives page and performance information; a health-related page path may reveal the category of coverage explored. Analytics is not used here to infer a diagnosis or create advertising audiences. Communication providers and authorized personnel process health-related information only if you choose to include it in a message needed to address your request. Relevant information may be disclosed when legally required or necessary for an applicable security or rights-protection purpose.

We do not disclose preview consumer health data to an affiliate for independent marketing. There are no insurance lead recipients receiving preview answers. A future live service must identify its actual recipient categories and any specific affiliates in an updated notice before the relevant processing begins.

4. Collection, sharing, and sale permissions

Where applicable law requires consent, we must request it before the covered collection or sharing, explain the categories and specific purposes, and provide a way to withdraw. Consent to sharing must be separate from consent to collection when the law requires that separation. Acceptance of general terms does not supply consumer-health consent. Processing necessary to provide a product or service you actually requested is assessed separately under applicable law.

We do not sell consumer health data through the current preview. If a future activity constitutes a covered sale, a separate, valid authorization must identify the data, seller and buyer, purpose, expiration, revocation method, and other required disclosures and be signed and dated. It cannot be bundled into general terms or made a condition of goods or services where prohibited. Required copies and records must be provided and retained. No such authorization is collected by this preview.

5. Your consumer-health rights

Where the applicable law provides these rights, you may confirm processing, access your consumer health data, obtain information about recipients, withdraw consent for future collection or sharing, and request deletion. You may also appeal a denial. Withdrawal does not turn prior lawful processing into a violation, but it restricts future consent-based processing. We do not require an account solely to exercise these rights or unlawfully discriminate against you for doing so.

Use Privacy requests & contact and identify that your request concerns consumer health data. We may reasonably verify identity or authority before revealing or deleting records. Do not send a medical record or government identifier unless a secure and necessary verification method has been specifically explained to you.

6. Responses, deletion, and appeals

For a verified Washington consumer-health request, we respond without undue delay and within 45 days, subject to an allowed extension of up to 45 additional days with an explanation. If we deny a request, we explain the reason and how to appeal. A Washington appeal receives a written response within 45 days, including how to contact the Attorney General if denied.

Deletion includes appropriate instructions to processors, affiliates, or other recipients where the law requires them, and lawful handling of backups and retained records. We explain an applicable limitation rather than claiming all copies disappear instantly. For the current preview, restarting or closing the page clears typed browser answers, but separate URL or correspondence records require a request.

Washington resources: My Health My Data information and Attorney General complaint options.

7. Retention, safeguards, and changes

The retention criteria in Privacy Policy, section 7 apply. We limit the preview’s use of health information to the requested experience. We do not use geofencing around healthcare facilities or precise device location to identify or advertise to people seeking care.

A material expansion of categories, purposes, sharing, or sale requires updated disclosures and any legally required affirmative permission before the new activity. The effective date above identifies this version. Contact us for an accessible copy or a question about this notice.