Avero Health Privacy Policy
Version 1.0
Last Updated: 08/04/2026
This Avero Health Privacy Policy (this "Policy") explains how Avero Health Inc. ("Avero," “Avero Health,” "we,""us," or "our") collects, uses, discloses, retains, andprotects Personal Information through averohealth.com and other public websitesthat link to this Policy (the "Site"), the Avero software platformand portals (the "Avero Platform"), and our related products,services, support, communications, and business operations (collectively, the"Services").This Policy is intended to cover one Avero privacy frameworkfor Site visitors; Employer representatives; Employees, participants,dependents, beneficiaries, and COBRA qualified beneficiaries; Brokers, agents,agencies, FMOs, uplines, downlines, and Authorized Users; prospectivecustomers; support users; job applicants; and other business contacts. It doesnot apply to Avero workforce information that is governed by a separateinternal privacy notice.This Policy is a notice of Avero's data practices. It doesnot replace or amend any Avero Platform agreement, Business Associate Addendum,health plan document, insurance policy, carrier or marketplace notice, or HIPAANotice of Privacy Practices. If another document governs a particular use ordisclosure of information, that document and applicable law control for thatmatter.
1. Scope, Key Terms, and Avero's Roles
"Personal Information" means information thatidentifies, relates to, describes, is reasonably capable of being associatedwith, or could reasonably be linked to an individual or household. It does notinclude information that is lawfully public, de-identified, or aggregated sothat it cannot reasonably be linked to an individual, except where applicablelaw provides otherwise."Sensitive Personal Information" includesinformation such as Social Security numbers and other government identifiers;account credentials; financial account information; precise geolocation;health, insurance, and benefits information; information revealing certainprotected characteristics; and other information treated as sensitive underapplicable law.Avero may have different legal roles depending on theinformation and activity involved:• Avero acts for its own business purposes when it managesthe Site, accounts, security, customer relationships, marketing, productdevelopment, support, and corporate operations.• Avero may act as a service provider, processor, orbusiness associate when it processes Employer Group, Plan, Employee, orparticipant information on behalf of an Employer, health plan, Broker, Carrier,exchange, marketplace, or other organization. In those situations, thatorganization may determine the purposes and means of processing and may beresponsible for responding to privacy requests.• Avero may also process information to satisfy its ownlegal obligations, prevent fraud, protect the Avero Platform, maintain records,and establish or defend legal rights.
2. Notice at Collection and Summary
Where permitted, this Policy also serves as Avero's noticeat collection. The categories of Personal Information we collect are describedin Section 3, the sources are described in Section 4, the purposes aredescribed in Section 5, the recipients are described in Section 6, and ourretention practices are described in Section 11.Avero does not sell Personal Information for monetaryconsideration. Depending on the technologies enabled on the public Site, Averomay disclose limited device, cookie, and online activity information collectedon the public Site to analytics, advertising, and social media providers tosupport marketing and advertising, including targeted or interest-basedadvertising and measurement. Some state privacy laws may characterize thesedisclosures as a "sale," "sharing," or "targeted advertising,"and Avero provides the opt-out rights described in Sections 7 and 13. Averodoes not sell or share Protected Health Information, Social Security numbers,financial account information, consumer health data, or identifiableEmployer-sponsored benefits or enrollment information for targeted advertising,and does not use information processed through the Avero Platform for targetedor interest-based advertising.We collect Sensitive Personal Information only whenreasonably necessary for the Services, security, legal compliance, or anotherdisclosed purpose, and we seek consent where required by applicable law. We donot use Sensitive Personal Information to infer characteristics aboutindividuals for unrelated advertising purposes.
3. Personal Information We Collect
Identifiers, contact information, and account information
Examples include legal name, preferred name, email address,phone number, mailing address, username, account identifier, invitationinformation, authentication information, electronic acceptance records,communication preferences, and emergency or authorized contact information.
Government, tax, and other sensitive identifiers
Examples include Social Security number, taxpayeridentification number, Employer Identification Number, National ProducerNumber, driver's license or other identity documentation where needed, andinformation used to verify identity or authority.
Employer, organization, and business information
Examples include legal entity name, trade name, entity type,ownership or organizational structure, business address, payroll and bankingcontacts, Plan Sponsor or Plan Administrator information, authorizedrepresentatives, Employer Group settings, organizational hierarchy, andcontractual relationship information.
Employment, census, eligibility, and dependentinformation
Examples include employer, job status, hire and terminationdates, work location, compensation or salary where provided, hours, class,eligibility dates, contribution amounts, payroll information, household ordependent relationships, date of birth, age, sex or gender marker used forrating or enrollment, and other census information needed for benefitsadministration.
Health, insurance, benefits, and Protected HealthInformation
Examples include insurance applications, plan selections,coverage elections, effective dates, enrollment and termination status,premiums, subsidies, ICHRA or HRA allowances, reimbursement and substantiationinformation, claims-support information, provider and facility searches,prescription and formulary searches, coverage documents, attestations, andhealth-related information you or an authorized party submits through the AveroPlatform. Some of this information may be Protected Health Information("PHI") under HIPAA.
Financial, banking, payment, and transaction information
Examples include bank account and routing information,payment authorizations, ACH information, payment status, premium andbinder-payment information, reimbursements, refunds, reversals, chargebacks,consulting fees, administrative fees, transaction identifiers, reconciliationrecords, and limited payment-card information handled through paymentproviders.
Broker, producer, licensing, appointment, andcompensation information
Examples include licenses, state authorities, appointments,certifications, National Producer Number, Marketplace or exchange registration,carrier relationships, broker-of-record or agent-of-record elections,Designated Producer information, hierarchy relationships, commissions,consulting fees, overrides, and co-branding information.
Communications, documents, and support information
Examples include emails, messages, support tickets, chatcontent, call notes or recordings where notice is provided, uploaded documents,forms, signatures, acknowledgments, complaints, appeals, feedback, and othercommunications with Avero or through the Services.
Device, usage, cookie, and online activity information
Examples include IP address, browser and device type,operating system, cookie and similar technology identifiers, pages or featuresviewed, clicks, referring and exit pages, session activity, login history,approximate location derived from IP address, and diagnostic or performanceinformation.
Security, fraud-prevention, and verification information
Examples include identity-verification results, access logs,authentication events, device and network signals, suspected fraud or misuseindicators, incident information, and records used to investigate complaints,disputes, unauthorized access, or legal and regulatory matters.
Derived information, calculations, and inferences
Examples include quote estimates, contribution models,affordability calculations, workflow status, task priority, plan comparisons,broker revenue estimates, eligibility indicators, fraud or security risksignals, and other outputs generated from information processed through theServices. These outputs may be estimates and do not replace official records ordecisions of Employers, Plans, Carriers, exchanges, marketplaces, governmentalagencies, or other authoritative sources.
Prospect, marketing, recruiting, and business-contactinformation
Examples include demo requests, event registrations,newsletter preferences, referral information, professional history, resume andapplication information, interview notes, and communications with prospectiveclients, partners, vendors, or applicants.
4. Sources of Personal Information
We may collect Personal Information from:• you directly, including through the Site, the AveroPlatform, forms, uploads, communications, and support interactions;• Employers, Plan Sponsors, Plan Administrators, authorizedEmployer representatives, payroll teams, and benefits personnel;• Brokers, agents, agencies, FMOs, uplines, downlines,Designated Producers, and their Authorized Users;• Employees, participants, dependents, beneficiaries,personal representatives, and authorized family members;• Carriers, health plans, exchanges, marketplaces, EDEpartners, governmental agencies, licensing authorities, NIPR, COBRAadministrators, payroll providers, banks, payment processors,identity-verification vendors, data vendors, and other Third-Party Sources;• service providers and integrations used to provide theServices;• publicly available sources and records, where permitted bylaw; and• devices, browsers, cookies, pixels, logs, and similartechnologies when you use the Site or Avero Platform.
5. How We Use Personal Information
Avero may use Personal Information to:• create, authenticate, administer, and secure accounts andinvitations;• provide, configure, operate, maintain, support, andimprove the Site, Avero Platform, and Services;• support Employer setup, plan design, eligibility, employeeclasses, contribution schedules, affordability tools, census management, anddocument workflows;• support quoting, plan shopping, comparisons, enrollment,renewal, termination, coverage changes, broker-of-record or agent-of-recordprocesses, and Designated Producer arrangements;• support premium payments, binder payments, autopay,reimbursements, claims-related administrative support, consulting fees,administrative fees, banking, payment processing, refunds, reversals,reconciliation, and reporting;• support provider, facility, pharmacy, prescription,formulary, network, premium, enrollment-status, payment-status, and licensingor appointment lookups;• generate, populate, store, deliver, and manage Plandocuments, notices, disclosures, reports, confirmations, and electronicacceptance records;• provide customer service, training, communications,reminders, technical support, and dispute resolution;• verify identity, authority, licensing, appointments,eligibility, and compliance;• detect, prevent, investigate, and respond to fraud,misuse, security incidents, unauthorized access, technical issues, legalviolations, and other harmful activity;• comply with legal, regulatory, tax, insurance, employment,benefits, audit, recordkeeping, reporting, and contractual requirements;• establish, exercise, or defend legal claims and enforceour agreements;• communicate about Avero products, services, events,surveys, and business opportunities, subject to applicable marketing choices;• conduct analytics, quality assurance, research, productdevelopment, and service improvement;• create and use aggregated or de-identified information forlawful analytics, research, security, benchmarking, product development, andmachine-learning purposes, provided we do not attempt to re-identify it exceptas permitted by law;• evaluate business transactions, financing, investment,reorganization, acquisition, or sale; and• recruit and evaluate applicants and manage businessrelationships.
6. How We Disclose Personal Information
We may disclose Personal Information only as reasonablynecessary for the purposes described in this Policy, as directed or authorizedby an appropriate party, or as permitted or required by law. Recipients mayinclude:• Employers, Plan Sponsors, Plan Administrators, authorizedEmployer representatives, and payroll or benefits personnel;• Employees, participants, dependents, beneficiaries,personal representatives, and authorized family members, as appropriate;• Brokers, agents, agencies, FMOs, uplines, downlines,Designated Producers, and Authorized Users with a recorded and authorized role;• Carriers, health plans, exchanges, marketplaces, EDEpartners, governmental agencies, licensing authorities, NIPR, providers,pharmacies, and other official sources;• banks, depository institutions, ACH operators, paymentprocessors, payroll providers, COBRA administrators, identity-verificationproviders, document vendors, communications vendors, data providers, cloudhosting providers, security vendors, analytics providers, and other serviceproviders;• professional advisors, auditors, insurers, consultants,and legal counsel;• law enforcement, regulators, courts, governmentalauthorities, or other parties when required or permitted by law or reasonablynecessary to protect rights, safety, security, or the integrity of theServices;• parties to a merger, acquisition, financing, investment,reorganization, bankruptcy, sale of assets, or similar business transaction,subject to appropriate protections; and• other parties at your direction, with your consent, or asdisclosed when the information is collected.Access within the Avero Platform is intended to berole-based. Avero may rely on Employer, Broker Organization, hierarchy,account, and authorization information when determining access. Organizationsusing the Avero Platform are responsible for managing their Authorized Usersand promptly removing access that is no longer appropriate.
7. Cookies, Analytics, Advertising, and Online Choices
The Site and Avero Platform may use cookies, pixels,software development kits, local storage, logs, and similar technologies. Thesetechnologies may support:• essential functions, authentication, security, fraudprevention, and session management;• preferences, accessibility, and remembering settings;• performance, diagnostics, analytics, and productimprovement; and• marketing, attribution, advertising, or social mediafeatures on the public Site, where enabled.You may control certain cookies through browser settings,through any cookie banner or preference center Avero makes available on theSite, and through the opt-out described in Section 13. Blocking essentialtechnologies may prevent parts of the Site or Avero Platform from working.Where required by applicable law, Avero honors legally recognized browser-basedprivacy signals and treats a valid signal as a request to opt out of the saleor sharing of Personal Information and targeted advertising for the associatedbrowser or device.You may unsubscribe from marketing emails by using theunsubscribe link in the message. Even if you opt out of marketing, Avero maycontinue sending transactional, security, legal, benefits-related, account, orservice communications.
8. HIPAA, Health Plans, and Protected Health Information
Avero may create, receive, maintain, or transmit PHI onbehalf of an Employer-sponsored health plan or another HIPAA covered entity.When Avero acts as a business associate, its use and disclosure of PHI aregoverned by HIPAA, the applicable Business Associate Addendum, the applicablePlan documents, and the covered entity's instructions and HIPAA Notice ofPrivacy Practices.This Policy is not a HIPAA Notice of Privacy Practices.Avero is not required to issue a separate HIPAA Notice of Privacy Practicessolely because it acts as a business associate. The applicableEmployer-sponsored Plan, Carrier, provider, or other covered entity isresponsible for its own notice and for many individual HIPAA rights.If you submit a request involving PHI or information Averoprocesses solely on behalf of an Employer, Plan, Carrier, or otherorganization, Avero may direct the request to that organization or assist it inresponding. Avero will not use this Policy to authorize a use or disclosure ofPHI that is not otherwise permitted by applicable law and the applicableBusiness Associate Addendum.
9. Consumer Health Data Privacy Notice
This Section is intended to serve as Avero's consumer healthdata privacy notice where applicable, including for personal health informationthat is not governed by or exempt under HIPAA, insurance laws, or anotherapplicable exemption. Avero will prominently link to this Section or thisPolicy where required.
Consumer health data we may collect
Depending on the Services used, consumer health data mayinclude insurance and benefits eligibility; enrollment and coverage status;plan selections; premium and reimbursement information; claims-support orsubstantiation information; provider, facility, pharmacy, prescription,formulary, and network searches; health information voluntarily submittedthrough support or required workflows; dependent and household coverageinformation; and location or demographic information used to identify availablecoverage, providers, or services.
Sources and purposes
We may receive consumer health data from the individual, anEmployer or Plan, a Broker or Designated Producer, a Carrier, exchange,marketplace, EDE partner, COBRA administrator, payment or payroll provider,provider or pharmacy directory, or another authorized source. We use it toprovide requested Services, support eligibility and enrollment, administerpayment and reimbursement workflows, provide lookups and support, maintainsecurity, comply with law, and perform other purposes disclosed in this Policy.
Sharing of consumer health data
We may share consumer health data with the applicableEmployer or Plan; authorized Broker, agency, FMO, or Designated Producer;Carrier, exchange, marketplace, EDE partner, COBRA administrator, provider orpharmacy data source; bank, payment processor, payroll provider,identity-verification provider, hosting or security provider; professionaladvisor; governmental authority; or another party authorized by the individualor required by law. Avero does not currently share consumer health data with acorporate affiliate for the affiliate's independent advertising or unrelatedcommercial purposes.
Sale, advertising, and geofencing
Avero does not sell consumer health data. Avero does not useconsumer health data obtained through Employer-sponsored benefitsadministration for targeted advertising. Avero does not use geofences aroundhealth care facilities to identify or track individuals seeking health careservices or to send advertisements based on such activity.
Consumer health data rights
Where applicable, you may request confirmation of whetherAvero collects, shares, or sells consumer health data; access to that data;withdrawal of consent; deletion; and a list of third parties or affiliates withwhom the data was shared. Some requests may need to be directed to theEmployer, Plan, Carrier, or other organization for which Avero processes thedata. Requests may be submitted as described in Section 13.
10. Automated Tools, Calculations, and Profiling
Avero may use automated tools to calculate estimates,organize workflows, identify possible errors, prioritize tasks, support fraudand security detection, and display plan, contribution, affordability,licensing, appointment, enrollment, payment, or other information. These toolssupport administrative processes and do not replace the official decisions orrecords of Employers, Plans, Carriers, exchanges, marketplaces, governmentalagencies, providers, pharmacies, or other authoritative sources.Avero does not currently use Personal Information for solelyautomated profiling that produces legal or similarly significant effectsconcerning an individual without an opportunity for appropriate human orofficial-source review. Where Avero processes covered Personal Information fortargeted advertising, sale, or legally significant profiling, Avero willprovide the disclosures and choices required by applicable law.
11. Data Retention
Avero retains Personal Information according to a retentionschedule based on the category of information, the Services provided, therelationship involved, and applicable legal, contractual, audit, insurance,security, and dispute-resolution needs. In general:• account, agreement, electronic acceptance, organization,and relationship records may be retained for the duration of the relationshipand for a reasonable period afterward to document rights and obligations;• Plan, enrollment, coverage, payment, reimbursement,claims-support, payroll, tax, compensation, and compliance records may beretained for several years or longer when required by benefits, insurance,HIPAA, tax, employment, contract, audit, or other laws;• support communications, workflow records, and disputerecords are retained for the period reasonably necessary to provide support,resolve issues, improve the Services, and establish or defend legal claims;• security, access, and system logs are generally retainedfor shorter operational periods unless needed for an incident, investigation,fraud prevention, legal hold, or security purpose;• marketing and prospect information is retained until it isno longer reasonably needed or you opt out, subject to suppression records usedto honor the opt-out; and• aggregated or de-identified information may be retainedfor longer periods, including indefinitely, where it cannot reasonably belinked to an individual and is maintained in de-identified form.We delete or de-identify Personal Information when it is nolonger relevant and reasonably necessary for the disclosed purposes, unlessretention is required or permitted by law, contract, legal hold, security need,or another legitimate purpose. Backup copies may remain for a limited periodbefore being overwritten or deleted in the ordinary course.
12. Data Security
Avero uses reasonable administrative, technical, andphysical safeguards designed to protect Personal Information based on itssensitivity, volume, and the nature of the Services. These safeguards mayinclude access controls, authentication, encryption, logging and monitoring,secure development practices, incident-response procedures, employee training,vendor oversight, and policies for retention and disposal.No system, transmission, or storage method is completelysecure. Avero cannot guarantee absolute security. You are responsible forprotecting account credentials, using secure devices and networks, limitingaccess to authorized users, and promptly notifying Avero of suspectedunauthorized access or misuse. Avero maintains an incident-response process andwill provide notice of security incidents to affected individuals, Employers,Plans, regulators, or other parties as and when required by applicable law,contract, or an applicable Business Associate Addendum.
13. Your Privacy Rights and How to Exercise Them
Depending on your residence, the context in which Averoprocesses information, and whether an exemption applies, you may have rightsto:• confirm whether Avero processes Personal Information aboutyou and access that information;• correct inaccurate Personal Information;• delete Personal Information, subject to legal andoperational exceptions;• obtain a portable copy of certain information youprovided;• obtain information about categories or specific thirdparties to whom Personal Information was disclosed;• opt out of the sale or sharing of Personal Information,targeted advertising, or certain profiling;• limit certain uses and disclosures of Sensitive PersonalInformation;• withdraw consent where processing is based on consent;• appeal a denial of a privacy request; and• exercise privacy rights without unlawful discrimination orretaliation.To submit a privacy request, email support@averohealth.comwith the subject line “Privacy Request.” Please identify your relationship toAvero and the right you wish to exercise. To appeal a decision, reply to thedecision or email support@averohealth.com with the subject line “PrivacyAppeal.”Avero may verify your identity and authority usinginformation associated with your account, invitation, Employer, BrokerOrganization, or prior interactions. We will use verification information onlyfor the request and related security purposes. An authorized agent may submit arequest where permitted by law, but Avero may require proof of authorizationand may verify the request directly with the individual.If Avero processes the information solely as a serviceprovider, processor, or business associate for an Employer, Plan, Carrier,Broker Organization, or other entity, Avero may refer the request to thatentity or explain where the request should be submitted. We may deny or limit arequest where an exemption applies, verification is not possible, the requestis excessive or manifestly unfounded, disclosure would create a security orlegal risk, or retention is required or permitted by law.Avero will respond within the time required by applicablelaw. We may extend the response period where permitted and will provide noticeof the extension. If you need this Policy or a privacy response in anaccessible alternative format, contact us using the information below.Some U.S. state privacy laws grant residents specific rightsand require specific procedures. Where such a law applies to Avero's processingof your Personal Information, Avero will honor the rights and follow theprocedures that law requires, even if they differ from the general descriptionabove. Nothing in this Policy limits a right you have under applicable law.
14. Children and Dependents
The public Site is not directed to children under 13, andAvero does not knowingly collect Personal Information directly from childrenunder 13 through the public Site without legally required parental consent. TheAvero Platform may process information about minor dependents when provided bya parent, guardian, Employer, Plan, Broker, or other authorized person forbenefits administration, enrollment, coverage, payment, or reimbursementpurposes.A person who provides information about a minor or anotherindividual represents that the person has the authority required to provide theinformation and act on that individual's behalf. Parents, legal guardians, andother authorized representatives may exercise applicable rights as permitted bylaw.
15. Third-Party Services, External Links, and ProcessingLocations
The Site and Avero Platform may link to or integrate withCarriers, exchanges, marketplaces, governmental agencies, banks, paymentproviders, payroll providers, COBRA administrators, provider and pharmacydirectories, and other third-party services. Those third parties may collectand process information under their own privacy notices and terms. Avero is notresponsible for a third party's independent privacy practices. Avero is basedin the United States, and Personal Information may be processed in the UnitedStates and other locations where Avero or its service providers operate,subject to safeguards required by applicable law.
16. Changes to This Policy
Avero may update this Policy to reflect changes in law,technology, the Services, vendors, or business practices. We will post theupdated Policy with a revised "Last Updated" date. When a change ismaterial, Avero will provide additional notice through the Site, AveroPlatform, email, or another reasonable method as required by law. Materialchanges apply prospectively unless applicable law or a valid authorizationpermits otherwise. Where required, Avero will provide an opportunity towithdraw consent before materially different processing of previously collectedPersonal Information begins.
17. Contact Avero
Questions, privacy requests, appeals, or concerns about thisPolicy may be directed to:Avero Health | support@averohealth.com| averohealth.com
For Plan, coverage, enrollment, claims, reimbursement, COBRA, or Carrier-recordmatters, you may also need to contact the applicable Employer, PlanAdministrator, Carrier, exchange, marketplace, COBRA administrator, or otherofficial source.