Privacy Policy
Effective Date: January 1, 2026
Accurate Enroll ("AE", "we", "us", or "our") values your privacy and is committed to protecting your information. This Privacy Policy explains how we collect, use, store, and safeguard your data when you use our enrollment platform and AI assistant ("AVA™").
1. Information We Collect
- Personal Identifiers: Name, email, phone number, job title, employer, login credentials.
- Employment & Benefits Data: Census uploads, dependent info, plan selections, campaign interactions.
- AI Interaction Data: Questions or responses submitted to AVA™, language preference, contextual inputs.
- Device & Usage Info: IP address, browser type, device metadata, session logs.
- Communication Logs: Twilio SMS logs, email history, decision-maker invite activity, call recordings (when enabled).
- Uploaded Plan Data: CSV or PDF plan files, benefit tier metadata, SBC summaries.
2. How We Use Your Information
- Authenticate users and manage account access.
- Deliver personalized benefit education through AVA™.
- Facilitate plan comparisons and enrollment workflows.
- Send campaign reminders and messages via SMS and email.
- Analyze usage patterns to improve product experience - See Section 2A below for details on analytics tracking.
- Comply with legal obligations and data processing standards.
2A. Analytics & Cross-Campaign Tracking
Session-Based Tracking:
- We track your browsing session using a session ID (a temporary identifier stored in a cookie).
- Cross-Campaign Tracking: If you view multiple employer campaigns during the same browsing session, your session ID links these activities together. This helps us understand how users navigate between campaigns and improve the platform.
- For Anonymous Users: Your session cannot be linked to your identity. We do not know your name, email, or personal information from the session ID alone.
- For Authenticated Users: If you are logged in (as a broker or employee), your user account is also tracked. Brokers may see aggregated analytics across all their campaigns in their dashboard.
What We Do NOT Use for Analytics:
- We do not use Protected Health Information (PHI) or personally identifiable information (PII) for analytics or AI training.
- Analytics data is anonymized and aggregated wherever possible.
- For anonymous users, analytics cannot identify you personally—only your browsing patterns during a session.
3. Call Recording & HIPAA Compliance
When Call Recording is Enabled:
Accurate Enroll may record phone calls between enrollers and employees for quality assurance, training, and compliance purposes. If call recording is enabled for your account, you will receive explicit notification at the beginning of each call.
Recording Notification & Consent
- Consent Required: All calls are preceded by an automated notification: "This call will be recorded for quality assurance and training purposes. By continuing, you consent to recording."
- Two-Party Consent States: In states requiring two-party consent (CA, CT, FL, IL, MD, MA, MT, NH, PA, WA), this notification is mandatory by law.
- Opt-Out: If you do not wish to be recorded, you may disconnect before the call is connected. Alternative contact methods (email, SMS) are available.
Recording Storage & Security
- Encryption: All call recordings are encrypted at rest and in transit using Twilio's HIPAA-compliant infrastructure.
- Secure Access: Recording access is restricted by role-based permissions. Only authorized personnel (staff, the enroller who handled the call, and the broker managing the campaign) can access recordings.
- Audit Logging: Every access to call recordings is logged with user identity, timestamp, and IP address for compliance auditing.
- Time-Limited URLs: Recording access uses temporary, expiring URLs that are generated on-demand and cannot be shared.
Data Retention & Deletion
- Automatic Deletion: Call recordings are automatically deleted after 90 days (configurable based on your organization's retention policy).
- Manual Deletion: You may request deletion of your call recordings at any time by contacting us (see Section 9 below).
- Deletion Audit Trail: All deletions (automatic or manual) are logged for compliance purposes.
Protected Health Information (PHI)
- HIPAA Compliance: Calls may discuss Protected Health Information (health conditions, medications, plan selection). We comply with HIPAA requirements through our Business Associate Agreement with Twilio.
- Limited Use: Recordings are used only for quality assurance, training, and resolving disputes. They are never sold, shared with third parties, or used for marketing purposes.
- Access Rights: You have the right to request access to recordings of your calls, request corrections, or request deletion (subject to legal retention requirements).
Current Recording Status: Call recording is currently DISABLED system-wide. When enabled in the future, this policy governs all recording practices.
4. Sharing Your Information
We do not sell or rent your personal information. We may share your data with:
- Your assigned broker or employer (as part of campaign participation).
- Vendors and service providers (e.g., Twilio, cloud infrastructure) under confidentiality agreements.
- Regulatory or legal authorities, if required by law.
5. Data Security
We use encryption, access controls, and secure storage to protect your data. While no system is 100% secure, we follow best practices and recommend strong passwords and cautious account management.
6. Your Rights
- Request access to your data.
- Update or correct inaccurate information.
- Request deletion of your information (where permissible).
- Opt out of non-essential communications.
- Request access to or deletion of call recordings (see Section 3 above).
7. Cookies & Tracking
We use cookies and similar technologies to improve your experience and understand usage trends. You can disable cookies in your browser settings.
8. Third-Party Links
Our platform may contain links to external websites. We are not responsible for their privacy practices or content.
9. Policy Updates
We may periodically update this Privacy Policy. When we do, we will revise the effective date. Your continued use of the platform signifies your acceptance of any changes.