Clinician & Agent Privacy Policy

1. Introduction and Purpose

Ardor Service LLC d/b/a Informed + Choice (“Informed + Choice,” “we,” “our,” or “us”) provides software services for licensed insurance agents, agencies, health-care organizations, clinicians, and other authorized professional users.

The Services may include Agent Workspace, HealthLink Secure, SOA Vault, Agent Vault, Medicare and ACA consent workflows, annual-review and plan-assessment tools, recorded communications, professional webpages, Event Pages, Event structured data, RSVP forms, Event communications, and related services.

This Professional Privacy Policy explains how we collect, use, disclose, retain, and protect:

Personal information concerning professional users and their organizations.
Professional account, licensing, billing, support, and usage information.
Customer-supplied content.
Event Organizer, professional webpage, and Event Page information.
RSVP information processed through the Services for professional users.
Annual Review Data.
Protected Health Information (PHI), but only when and to the extent the applicable service and relationship are governed by HIPAA and a Business Associate Agreement.

2. Scope and Other Privacy Notices

This Policy applies to professional users and organizations that create or administer accounts, professional webpages, Event Pages, and other Services.

Individual visitors who view an Event Page or submit an Event RSVP are covered by the separate privacy notice displayed on or linked from that Event Page. This Professional Privacy Policy is not the attendee privacy notice.

Medicare beneficiaries and other individuals who authorize access to Medicare or health-plan information through a separate beneficiary workflow are covered by the privacy notice applicable to that workflow.

A professional user is independently responsible for information the user exports, copies, stores, or uses outside the Services and may be required to provide a separate privacy notice governing those activities.

3. Information We Collect

3.1 Professional, Account, and Organization Information

We may collect professional identity, National Producer Number (NPN), license, appointment, certification, registration, jurisdiction, service area, organization, business contact, account, authentication, billing, transaction, support, and Service-usage information. This information may be supplied by you, your organization, a service provider, or another authorized source.

Unless we expressly state otherwise, we do not independently verify or certify that professional information.

3.2 Professional Webpage, Event Organizer, and Event Page Information

When a professional user creates or administers a professional webpage or Event Page, we may collect:

Organizer, agent, speaker, agency, or organization name.
Business contact information.
NPN, license number, jurisdiction, service area, or other professional information.
Event title, description, category, date, time, location, venue, room, parking, capacity, accessibility, language, and virtual-access information, when supported.
Photographs, logos, biographies, and other Customer-supplied content.
Event-type selections and variable disclaimer information.
Page, flyer, template, publication, editing, cancellation, rescheduling, and status information.
Structured-data, search-engine, social-sharing, source, and page-performance fields.
Event Page URL and publication-version information.
Support communications concerning the webpage or Event Page.

Information submitted or selected for public display on a professional webpage, Event Page, flyer, structured-data record, or social-sharing preview is public information. Professional users should not submit information for public display that they do not have authority to publish.

3.3 RSVP and Event Communication Information

When an attendee uses an Event Page, we may process:

Name.
Email address.
Telephone number.
Number attending.
ZIP code, when enabled.
Event selected and RSVP or attendance status.
An optional accessibility or language request.
Confirmation or email-reminder selections.
Event confirmations, reminders, cancellation notices, rescheduling notices, and related delivery records.
Applicable Event version, field configuration, disclosure, and selection records.
Submission date and time.
Source information, such as whether the request came from a QR code, shared link, or direct visit.
Security and anti-abuse signals derived from Internet Protocol address and browser user-agent information.
Privacy, support, misuse-report, or complaint information.

Depending on the jurisdiction and context, RSVP or Event information that identifies a person as seeking Medicare, ACA, or other health-coverage information may constitute or be treated as consumer health data under certain state privacy laws.

3.4 Annual Review Data

If you use annual review features, we may create, receive, maintain, and process Annual Review Data. Annual Review Data may include beneficiary-submitted information, Medicare Data authorized by the beneficiary, medications, pharmacies, providers, current plan information, review concerns, Annual Review Profiles, Plan Review Assessments, estimated costs, plan comparison outputs, ranking or triage outputs, agent notes, review status, and final disposition records.

3.5 HIPAA Status

We act as a Business Associate only when and to the extent we create, receive, maintain, or transmit PHI on behalf of a HIPAA Covered Entity or another Business Associate under an applicable Business Associate Agreement.

Not every professional user is a HIPAA Covered Entity, not every Service involves PHI, and ordinary Event Page and RSVP information is not automatically PHI.

4. How We Use Information

We may use information covered by this Policy to:

Create, administer, secure, and support professional accounts and Services.
Verify account access and prevent unauthorized use.
Process subscriptions, billing, transactions, support, and account requests.
Create and publish professional webpages and Event Pages.
Display Organizer, professional, and Event information.
Generate structured data and search-engine or social-sharing metadata.
Make Event information available to search engines and Event-discovery, map, calendar, or social-sharing services.
Process and route RSVPs to the identified Event Organizer.
Provide confirmations, email reminders, access information, cancellations, rescheduling notices, and other Event communications.
Maintain records of notices, selections, versions, and submissions.
Provide annual-review features, including intake, data matching, plan assessment, review triage, documentation, vault storage, audit logs, and exports.
Secure, monitor, troubleshoot, maintain, and improve the Services.
Prevent fraud, impersonation, abuse, or unauthorized access.
Respond to privacy, support, misuse-report, and complaint requests.
Enforce our agreements and protect legal rights.
Comply with applicable law and legal process.

We do not sell RSVP information or Annual Review Data or use it for targeted advertising or unrelated marketing.

We may share information as follows:

Public webpage and Event information. Information selected for public display may be displayed to persons viewing a professional webpage or Event Page and made available to search engines, Event-discovery services, map or calendar services, social-sharing services, and other public recipients.
Event Organizers. RSVP information is made available to the Event Organizer identified on the Event Page so the Organizer can administer the Event and respond to the attendee’s request.
Your organization. Professional account, content, Event, RSVP, and other Service information may be available to authorized users and administrators of your organization.
Service providers. We may disclose information to providers that supply hosting, infrastructure, database, security, email, text messaging when separately enabled, monitoring, support, billing, backup, and related services. Providers may process information only for the services they perform for us and subject to applicable contractual restrictions.
Business and legal purposes. We may preserve or disclose information when required by applicable law, legal process, or a valid governmental request, or when reasonably necessary to protect the Services, prevent fraud or material harm, protect a person’s safety, complete a corporate transaction subject to appropriate safeguards, or establish, exercise, or defend legal claims.
At your direction. We may share information when you or your organization instructs or authorizes us to do so.

Professional users are independently responsible for their access to, export, use, disclosure, retention, and deletion of RSVP information after receiving or copying it.

6. Privacy Responsibilities for Event Services

Depending on the applicable law and activity:

The professional user determines the Event’s purpose, content, classification, and the user’s subsequent use of RSVP information.
We provide the Event Page and process RSVP information according to the professional user’s instructions, the attendee’s request, the applicable Event Page notice, and our own legal obligations.
We independently determine processing reasonably necessary for Service security, fraud prevention, support, billing, legal compliance, dispute resolution, and enforcement of our agreements.
The professional user remains independently responsible for information exported, copied, or maintained outside the Services.

We do not undertake to supervise, audit, approve, or verify a professional user’s Event conduct, licensing, insurance services, or regulatory compliance.

An RSVP or retained contact detail does not by itself establish permission for sales or marketing contact. The professional user is responsible for determining and documenting authority to use RSVP information for another purpose.

7. Retention and Deletion

7.1 Event and RSVP Information

Subject to applicable law, contractual obligations, legal holds, security requirements, optional organization settings, and our account and backup lifecycle, a professional user’s organization controls how long its RSVP records are retained and when they are deleted.

Event Page content, publication versions, notices, communication selections, and related audit records may be retained as reasonably necessary to provide the Services, preserve the record of what was published or selected, respond to disputes or complaints, enforce our agreements, protect security, or comply with law. Backup copies expire under our documented backup lifecycle.

A professional user may maintain separate copies in external email accounts, customer relationship management systems, devices, exported files, or other systems outside our control. Deleting information from the Services does not delete those separate copies.

7.2 Other Professional Information

We retain other professional information for as long as reasonably necessary for the purposes described in this Policy, the professional user’s account or agreement, applicable retention requirements, security, dispute resolution, enforcement, or legal claims. Where a Business Associate Agreement applies to PHI, its retention, return, destruction, and legal-hold terms control to the extent of a conflict.

8. Cookies and Similar Technologies

Event Pages use essential technologies and server logs needed to deliver and secure the page, maintain form state, process RSVPs, prevent abuse, measure limited aggregate page and RSVP activity, and diagnose errors.

Educational Event Pages do not use Google Analytics, advertising pixels, retargeting tags, or session-replay technology. Other Informed + Choice websites and authenticated Services may use different cookies or analytics as described in the Cookie Policy applicable to those services.

9. Security and Access

We use administrative, technical, and organizational safeguards designed to protect information appropriate to its nature and the Services involved.

Your organization controls access to its private RSVP and Event records. Our personnel do not routinely review private RSVP content. Access is limited to authorized personnel when reasonably necessary for support, security, abuse prevention, legal compliance, or another permitted operational purpose and is subject to applicable access controls and audit practices.

No method of transmission or storage is completely secure. Professional users are responsible for protecting account credentials, configuring authorized users, and securing information after export.

10. Contact

For privacy questions or requests concerning a professional account, contact privacy@informedpluschoice.com.

Contact: privacy@informedpluschoice.com