Privacy Policy

1. Introduction

Everon Technologies LLC ("we", "us", or "our") is committed to protecting the personal information handled through the Employer Portal, which Employers use to complete group benefits applications and administer employee enrollment in the XGB and EHP Vendor Programs. This Privacy Policy explains how we collect, use, disclose, and safeguard personal information in connection with the Portal.

By using the Portal, you acknowledge the data practices described in this Privacy Policy. This Policy should be read in conjunction with the Employer Portal Terms of Service.

2. Roles: Whose Data, and On Whose Behalf

The Portal involves two categories of personal information, and Everon's role differs for each:

• Employer account data — information about Authorized Users (e.g., HR contacts, business owners) collected when they register and use the Portal. Everon processes this data to operate the Portal as described in this Policy.
• Employee Data — information about an Employer's employees and dependents (including Census Data) submitted by the Employer or generated through enrollment. Everon processes Employee Data on behalf of the Employer and the applicable Vendor Program in order to provide eligibility, enrollment, and administration services. The Employer is responsible for having the authority and any required consents to submit Employee Data, and for its own privacy and notice obligations to its employees.

Where Employee Data includes information subject to specific legal protections (such as protected health information under HIPAA, where applicable), it is handled in accordance with applicable law and any applicable agreements between the relevant parties.

3. Information We Collect

3.1 Information Provided Through the Portal

• Authorized User data: name, business email address, phone number, job title, and login credentials;
• Employer business data: legal entity name, address, tax identification number, industry, employee counts, payroll vendor, and related application information;
• Application data: group health benefits application responses, plan selections, contribution settings, and supporting documents;
• Census Data: employee and dependent information submitted for eligibility and enrollment, which may include names, dates of birth, Social Security numbers, addresses, contact information, employment and compensation information, and coverage tier selections;
• Adds/terms data: ongoing additions, terminations, and changes to employee information;
• Financial data: bank account or other payment information required for invoicing and premium payment; and
• Communications: messages, support requests, and other correspondence sent through the Portal.

3.2 Information Collected Automatically

• Technical data: IP address, browser type and version, operating system, device identifiers;
• Usage data: pages visited, actions taken, time spent, and navigation paths;
• Cookies and similar technologies used for session management, authentication, and security; and
• Log data: access logs, error logs, audit trails, and other system-generated records.

3.3 Information from Other Sources

• The applicable Vendor, carrier, or third-party administrator: application status, underwriting outcomes, enrollment confirmations, and billing information;
• The agent or affiliate that initiated the Employer's registration: plan and rate selections and Employer contact information used to generate the registration invitation; and
• Payment processors and verification services: transaction confirmations, payment status, and results of any verification checks.

4. How We Use Information

We use the information we collect to:

• Create, maintain, and administer Employer accounts and Authorized User access;
• Process group benefits applications, plan selections, contributions, Census Data, and adds/terms, and transmit them to the applicable Vendor, carrier, or administrator;
• Facilitate invoicing and payment processing;
• Communicate with Authorized Users about applications, enrollment status, billing, policy changes, and support requests;
• Verify identity, prevent fraud, and comply with legal obligations;
• Analyze Portal usage, improve functionality, and develop new features;
• Detect, investigate, and prevent security threats, unauthorized access, and other malicious activity; and
• Enforce the Terms of Service, resolve disputes, and respond to legal processes.

5. Legal Basis for Processing (where applicable)

Where required by applicable data protection law, we rely on the following legal bases:

• Contractual Necessity: processing required to perform our obligations under the Terms of Service;
• Legitimate Interests: processing for fraud prevention, security, and improvement of the Portal;
• Legal Obligation: processing required to comply with applicable laws and regulations; and
• Consent: where explicit consent has been given, such as for optional communications.

6. Information Sharing and Disclosure

We do not sell personal information. We may share information with:

6.1 Vendors, Carriers, and Administrators

We share application data, Census Data, adds/terms, and related information with the applicable Vendor (XGB or EHP) and its designated insurance carriers and third-party administrators for the purpose of underwriting, enrollment, billing, and benefits administration. XGB and EHP are separate data controllers with respect to the personal information they receive, and their handling of that information — and any communications they send — is governed by their own privacy policies, not this Policy. Everon is not responsible for the privacy practices, communications, or content of XGB, EHP, or any other entity, regardless of any corporate affiliation between such entity and Everon.

6.2 Agents and Affiliates

The agent or affiliate that initiated an Employer's registration may have visibility into the status of that Employer's application and enrollment through the affiliated sales platform, as necessary to support the Employer's onboarding. Agents and affiliates are independent of Everon and are responsible for their own conduct and communications.

6.3 Service Providers

We engage third-party service providers (e.g., cloud hosting, payment processing, identity verification, analytics) who process data on our behalf under contractual obligations to protect it and use it only to perform services for us.

6.4 Legal and Regulatory Authorities

We may disclose information if required by law, court order, or governmental authority, or where we believe disclosure is necessary to: (a) protect our legal rights; (b) enforce the Terms of Service; or (c) prevent fraud or imminent harm.

6.5 Business Transfers

In the event of a merger, acquisition, asset sale, or restructuring, personal information may be transferred to the successor entity, subject to the same privacy protections.

7. Cookies and Tracking Technologies

The Portal uses cookies and similar technologies to maintain sessions and authentication, secure the Portal, and analyze usage. Browser settings can control cookies; however, disabling certain cookies may affect Portal functionality. Continued use of the Portal constitutes consent to our use of cookies as described in this Policy.

8. Data Retention

We retain personal information for as long as the Employer's account is active or as necessary to fulfill the purposes for which it was collected. Following account termination, we may retain certain information to comply with legal obligations (including insurance, tax, and accounting recordkeeping requirements), resolve disputes, prevent fraud, and enforce our agreements. Enrollment and financial records may be retained for longer periods as required by applicable law.

9. Data Security

We implement administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, loss, destruction, or alteration, including:

• Encryption of data in transit (TLS/SSL) and at rest;
• Role-based access controls and authentication mechanisms;
• Audit logging and monitoring; and
• Staff training on data protection obligations.

Given the sensitivity of Census Data (including Social Security numbers and dependent information), Employers should likewise limit Authorized User access to personnel with a need to know, safeguard exported data, and maintain the confidentiality of Portal credentials. No method of transmission over the internet is completely secure.

10. International Data Transfers

Personal information may be transferred to and processed in countries other than the country of residence of the data subject. Where such transfers occur, we take appropriate safeguards to protect the information in accordance with applicable data protection laws, including the use of standard contractual clauses or other approved transfer mechanisms.

11. Non-Everon Communications and Links

The Portal may contain, transmit, or display communications, content, plan information, offers, or links originating from XGB, EHP, carriers, administrators, brokers, agents, affiliates, or other entities or persons other than Everon. This Privacy Policy applies only to information collected by Everon through the Portal. Everon does not control, and is not responsible for, the content, accuracy, data practices, or privacy policies of any other entity — including entities that share corporate affiliation, common ownership, or branding with Everon — or any communications such entities send on, through, or in connection with the Portal. We encourage review of the privacy policies of any entity with which you interact.

12. Employee Rights Requests

Employees and dependents whose information is submitted to the Portal by their Employer should direct requests to access, correct, or delete their information to their Employer or the applicable Vendor Program in the first instance, as Everon processes Employee Data on their behalf. Where Everon receives such a request directly, we may redirect the request to the Employer or applicable Vendor, or assist them in responding, as appropriate under applicable law.

13. Your Rights

Depending on jurisdiction, Authorized Users and other individuals may have rights with respect to their personal information, including:

• Access: the right to request a copy of the personal information we hold;
• Rectification: the right to request correction of inaccurate or incomplete information;
• Erasure: the right to request deletion, subject to certain exceptions (including insurance recordkeeping requirements);
• Restriction: the right to request that we restrict processing;
• Portability: the right to receive personal information in a structured, machine-readable format;
• Objection: the right to object to processing based on legitimate interests; and
• Withdrawal of Consent: where processing is based on consent, the right to withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us using the details in Section 16. We will respond within the timeframe required by applicable law and may require identity verification before processing a request.

14. Children's Privacy

The Portal is designed for use by adult Authorized Users. Dependent information (which may relate to minors) is collected only as submitted by Employers for benefits enrollment purposes and is used solely for those purposes. We do not knowingly collect personal information directly from individuals under the age of 18.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. We will provide notice of material changes by posting the revised Policy on the Portal and updating the effective date. Continued use of the Portal after any changes constitutes acceptance of the revised Policy.

16. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact the Everon team (legal@everon.tech).