Privacy Policy

Jupiter Health, Inc., a Delaware corporation doing business as Wellward ("Wellward," "we," "us," or "our") is a licensed insurance agency (NPN 21613725) that helps consumers compare and enroll in health coverage, and provides free tools for finding the price of care (collectively, the "Services"). This Privacy Policy describes how we collect, use, and disclose information about you when you visit our websites, including wellwardhealth.com and any subdomain or path operated by Wellward (collectively, the "Sites"), or use the Services.

Because Wellward provides services that involve protected health information, parts of this Privacy Policy must be read together with two additional documents:

• Our Notice of Privacy Practices, which describes how we use and disclose Protected Health Information under the Health Insurance Portability and Accountability Act ("HIPAA").
• Our Consumer Health Data Privacy Policy, which describes how we handle consumer health data subject to state laws such as Washington's My Health My Data Act.

Where there is a conflict between this Privacy Policy and the Notice of Privacy Practices with respect to PHI, the Notice of Privacy Practices controls.

1. Information We Collect

1.1 Information You Provide

We collect information you provide directly to us, including:

• Account and contact information: name, email address, password, phone number, postal address, and date of birth.
• Payment information: we use a third-party payment processor. The processor collects your payment-card and billing information directly; we do not store full card numbers on our systems.
• Intake information: after enrollment, we collect information needed to provide the Services, such as ZIP code and travel radius, household composition, demographic information, current and historical insurance status, recent or anticipated healthcare needs, current medications, preferred pharmacy, and chronic conditions you choose to share.
• Concierge communications: the content of messages you exchange with our care navigators and AI-assisted concierge, including any documents, photos, bills, prescriptions, or other materials you upload or submit.
• Service activity information: your selected providers and pharmacies, scheduled appointments, prescription comparisons, bill submissions, appeals submissions, and other actions you take through the Services.
• Authorizations and consents: records of authorizations you provide for Wellward to act on your behalf (for example, to contact a provider's billing department, to compare pharmacy pricing, or to release health information).

1.2 Information We Collect Automatically (on the Public Marketing Site Only)

When you visit our public marketing pages (including the homepage, /direct, /care, blog, and other non-authenticated pages), we automatically collect:

• Device and connection information, such as IP address, browser type, operating system, and approximate location derived from IP address.
• Browsing information, such as the pages you view, links you click, the date and time of your visit, and the referring or exit page.
• Information collected through cookies, web beacons, pixels, and similar technologies (see Section 4).

We do not use tracking technologies, advertising pixels, or third-party analytics on authenticated account surfaces. Pages you visit while logged in (including your account home, concierge, prescription, savings, and account pages, and any pages where you submit health information) do not load Google Analytics, Meta/Facebook Pixel, or other third-party tracking technologies.

1.3 Information We Obtain From Others

With your authorization, we may obtain information from third parties such as:

• Healthcare providers, pharmacies, laboratories, and imaging centers (for example, to confirm pricing, scheduling, or appointment outcomes you have authorized us to coordinate).
• Health plans, insurers, and pharmacy benefit managers (for example, to verify coverage or submit appeals).
• Publicly available sources, including public datasets such as the federal HRSA database of community health centers.

2. Insurance Quoting & Enrollment

When you use Wellward to compare or enroll in insurance plans, we collect the information needed to quote and enroll you: ZIP code and county, ages and dates of birth for each person seeking coverage, household size, tobacco use, and — if you choose to apply — names, sex, home and mailing address, contact details, income information (only if you apply for premium subsidies), and any other information the insurer's or Marketplace's application requires.

We share this information with: HealthSherpa (our enrollment technology partner, which processes quotes and applications), the Health Insurance Marketplace (HealthCare.gov/CMS) for on-exchange enrollments, and the insurance carrier you select. Each uses your information to price, process, and issue your coverage. When you use our anonymous comparison tools (ZIP code and ages only), no identifying information is collected until you choose to save your results or apply.

Wellward acts as your licensed insurance agent in these transactions. Federal rules require us to obtain and keep records of your consent and your review of your application; see "Consent records" under Retention.

2.1 Dependent Information

Dependent ages and dates of birth are provided by the applying parent or guardian for coverage purposes. The Services are not directed to children.

2.2 Our Financial Privacy Notice

Jupiter Health, Inc. d/b/a Wellward is a licensed insurance agency. This notice describes how we handle the nonpublic personal information you provide when we quote or place insurance coverage for you.

What we collect. Information you give us on quotes and applications — such as name, date of birth, address, contact information, household details, tobacco use, and income where premium subsidies apply — and information about your transactions with us, such as the plans you consider and the coverage you enroll in.

What we share, and with whom. We share your information only as needed to serve you: with the insurance carrier you select, with the Health Insurance Marketplace for on-exchange enrollments, and with service providers that process quotes, applications, and communications on our behalf under contracts limiting their use of your information. We may also disclose information as required by law or to insurance regulators.

What we don't do. We do not sell your information, and we do not share it with unaffiliated third parties for their own marketing. Because we do not share for those purposes, there is nothing for you to opt out of.

How we protect it. We maintain physical, electronic, and procedural safeguards, including encryption in transit and at rest and role-based access controls.

Former customers. The same practices apply to information about former customers.

Questions: hello@wellwardhealth.com.

3. How We Use Information

We use the information we collect to:

• Provide, maintain, and improve the Services, including assembling and updating your Personal Provider Lineup, comparing prescription prices, reviewing and negotiating bills, and helping you navigate insurance and benefits.
• Authenticate your identity, process payments where applicable, and manage your account.
• Communicate with you about your account, service updates, and (with your consent) marketing communications about Wellward.
• Conduct internal analytics, research, and development on aggregated or de-identified data to improve our Services.
• Protect the rights, property, and safety of Wellward, the people who use our Services, and the public, and to enforce our Terms of Service and other agreements.
• Comply with legal obligations and respond to lawful requests.

To the extent the information we use is Protected Health Information under HIPAA, we use it only as described in our Notice of Privacy Practices.

3.1 Use of AI and Automated Tools

Wellward uses AI tools, including large language models, to help our care navigators draft, summarize, and prioritize concierge communications, to send certain messages with human oversight available, and to support internal workflows. We do not use your data, including any messages, intake information, or Protected Health Information, to train AI models, and the AI providers we use are contractually prohibited from using your data to train their own models. AI output is not a substitute for the judgment of a qualified medical, legal, financial, or insurance professional.

4. Cookies and Similar Technologies (Marketing Site Only)

On our public marketing pages, we use cookies and similar technologies for essential functionality, analytics, and (with your consent where required) advertising. We use the following categories:

• Strictly necessary cookies: required for the marketing site to function.
• Analytics cookies: to understand how visitors interact with our marketing site.
• Advertising cookies and pixels: used on our marketing pages to measure ad performance and reach prospective customers. We do not deploy these tools on any page where you are logged in to your account, nor on our care search pages — the price lookup and care search tools — because the queries you enter there reveal health-seeking behavior. Our quoting, application, and consent screens may carry standard advertising pixels and conversion tracking.

You can manage cookies through your browser settings or through the cookie banner presented on first visit. Disabling certain cookies may affect the functionality of the marketing site.

5. How We Disclose Information

We disclose information in the following ways:

5.1 Service Providers

We disclose information to service providers that perform services on our behalf, including hosting and infrastructure, database management, communications and notification delivery, identity verification, fraud prevention, customer support tooling, security and audit logging, and analytics on the marketing site. Service providers that receive health information are bound by contract to protect it and may use it only as permitted by those contracts and applicable law, including under a Business Associate Agreement where the provider requires one. Wellward is neither a covered entity nor a business associate under HIPAA, so these are protections we impose by contract rather than obligations HIPAA places on us directly.

5.2 Insurance Quoting, Enrollment, and Underwriting Partners

To quote, place, and service insurance coverage, we disclose information to:

• HealthSherpa — enrollment processing (quotes and applications).
• CMS and state marketplaces — on-exchange enrollment through the Health Insurance Marketplace.
• Insurance carriers — application, enrollment, and agent-of-record data for the plan you select.
• Everest — underwriting for the Bridge Plan, including the existing waitlist flow.

5.3 Payment Processing

Payment information you enter at checkout flows directly to our third-party payment processor under that processor's own privacy policy. We receive limited information from the processor such as the last four digits of your card, card brand, expiration, and transaction status. We do not share Protected Health Information with our payment processor.

5.4 At Your Direction

With your authorization, we share information with healthcare providers, pharmacies, health plans, insurers, brokers, billers, and other third parties in order to provide the Services you have requested. You may revoke an authorization at any time, though revocation does not affect actions already taken.

5.5 Legal and Safety

We may disclose information when we believe in good faith that disclosure is necessary to: comply with applicable law, regulation, legal process, or a governmental request; enforce our Terms of Service or other agreements; protect the security or integrity of our Services; or protect the rights, property, or safety of Wellward, the people who use our Services, or others.

5.6 Corporate Transactions

In connection with any merger, acquisition, sale of assets, financing, due diligence, reorganization, bankruptcy, or similar transaction, we may disclose or transfer information, subject in the case of PHI to the requirements of HIPAA and our Notice of Privacy Practices.

5.7 Aggregated or De-Identified Information

We may share aggregated or de-identified information that cannot reasonably be used to identify you, for any purpose.

5.8 What We Do Not Do

We do not sell your personal information for money. We do not share your personal information for cross-context behavioral advertising. We do not sell or share consumer health data. We do not use Protected Health Information for marketing without your written authorization, except as permitted by HIPAA (for example, face-to-face communications and promotional gifts of nominal value).

6. Communications

6.1 Email

We send transactional emails about your account, your application or policy, service updates, and required disclosures. If you save a plan Short List without becoming a customer, we may email you about completing your enrollment; you opt in at the point of capture and we honor unsubscribe requests. With your consent, we may also send other marketing emails. You can opt out of marketing emails at any time by clicking the unsubscribe link in any marketing message or by contacting us at the address below. You cannot opt out of transactional communications about an active account, application, or policy.

6.2 SMS / Text Messaging

We contact you by text message or telephone about your quote or application only with your separate, optional consent, which is never a condition of receiving our services. Where you give that consent, we will send you SMS messages related to your account and the Services, such as appointment reminders, lineup updates, concierge replies, quote and application updates, and (with separate express written consent) marketing messages. Message frequency varies. Message and data rates may apply. Reply HELP for help. Reply STOP to opt out of further messages. We will honor opt-out requests promptly. Your consent to receive SMS is not a condition of purchase or service.

6.3 Voice Calls

Wellward staff or contracted care navigators may call you to provide the Services, and certain calls may be monitored or recorded for quality assurance and training. We do not use AI-generated outbound voice agents to call you.

7. Security and Account Sessions

We maintain administrative, technical, and physical safeguards designed to protect the information we hold. These include encryption in transit using TLS 1.2 or higher, encryption at rest using AES-256, role-based access controls, audit logging on access to records containing health information, regular security testing, and a vendor risk-management program with Business Associate Agreements where required.

Automatic session timeout. For your security, the Services will automatically log you out of your account after a period of inactivity. You are responsible for keeping your password confidential, for logging out when using a shared device, and for promptly notifying us of any unauthorized use of your account.

No method of transmission or storage is completely secure. While we strive to protect your information, we cannot guarantee its absolute security. If we learn of a security breach affecting your information, we will notify you as required by applicable law.

8. Data Retention

We retain information for as long as needed to provide the Services and to comply with our legal, regulatory, and operational obligations. Specifically:

• Account records: while your account is active, and for a period thereafter consistent with our document retention policy.
• Records containing Protected Health Information that are part of a designated record set: at least six years from the date of creation or the date when last in effect, whichever is later, consistent with HIPAA.
• HIPAA audit logs: at least six years.
• Payment records: as required for tax, accounting, and audit purposes, typically at least seven years.
• Marketing and analytics data: typically up to 24 months unless we are required to retain it longer.
• Insurance consent and application-review records: 10 years (CMS requirement, 45 CFR §155.220); these records are immutable and producible to regulators on request.

We use a soft-delete pattern on records containing health information. When you close your account, your records are marked inactive and access is restricted, but the records are not immediately purged. You may exercise rights with respect to your information as described in Section 10 and in our Notice of Privacy Practices.

9. International Data Transfers

The Services are intended for use by individuals in the United States. We store and process information in the United States. If you access the Services from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, which may not provide the same level of data protection as your home jurisdiction.

10. Your Rights and Choices

Depending on where you live, you may have rights under applicable privacy laws. To exercise any of these rights, contact us using the information in Section 15. We will verify your identity before responding, and we will respond within the time period required by applicable law. You may also designate an authorized agent to make a request on your behalf.

10.1 California Residents (CCPA/CPRA)

If you are a California resident, you may have the right to:

• Know what categories and specific pieces of personal information we have collected about you, the sources, the purposes for which we collected it, and the categories of third parties with whom we have shared it.
• Request deletion of personal information we have collected, subject to certain exceptions.
• Correct inaccurate personal information we maintain about you.
• Opt out of the sale or sharing of your personal information. As stated above, we do not sell or share personal information.
• Limit the use and disclosure of sensitive personal information, subject to certain exceptions.
• Be free from retaliation for exercising your rights.

Personal information regulated by HIPAA is not subject to the CCPA. The exercise of your rights with respect to Protected Health Information is governed by our Notice of Privacy Practices.

10.2 Nevada Residents

Nevada residents have the right to direct us not to sell certain covered personal information. As stated above, we do not engage in such sales.

10.3 Washington Residents and Other Consumer Health Data Rights

If you are a Washington resident, or if you live in another state with a consumer health data law (currently Nevada and Connecticut), please review our separate Consumer Health Data Privacy Policy, which describes the categories of consumer health data we collect, the purposes for which we collect it, and the rights you have with respect to it under Washington's My Health My Data Act and similar laws.

10.4 Other U.S. States

Residents of other states with comprehensive privacy laws (including, as applicable, Colorado, Virginia, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, New Jersey, New Hampshire, Tennessee, Indiana, Minnesota, and others) may have similar rights to access, delete, correct, and opt out of certain processing. To exercise these rights, contact us as described in Section 15.

10.5 PHI-Specific Rights

Rights with respect to your Protected Health Information are described in our Notice of Privacy Practices, including the right to inspect and copy, request amendment, request an accounting of disclosures, request restrictions, request confidential communications, and receive notice of breach.

11. Third-Party Sites and Social Media

The marketing site may contain links to third-party websites and social media plug-ins (including Facebook, Instagram, and LinkedIn). We are not responsible for the privacy practices of those third parties. Their privacy policies govern your interactions with them. Social media plug-ins, where present, appear only on our marketing site and not on any authenticated account surface.

12. Public Posting Areas

If we make any public posting area available through the Services, information you post will be visible to others. Do not include in any public post information you do not want made public. We are not responsible for the use by others of information you disclose in a public posting area. The Services do not currently include public posting areas open to the general public.

13. Children's Privacy

The Services are not directed to individuals under the age of 18, and we do not knowingly collect personal information from individuals under 18. If we learn that we have collected personal information from a person under 18, we will delete it. Adults may share information about minor dependents in the course of using the Services for the dependent's benefit, in which case the information is treated as the adult's information for purposes of this Privacy Policy and as Protected Health Information for purposes of HIPAA.

14. Changes to this Privacy Policy

We may amend this Privacy Policy from time to time. When we do, we will update the "Last Updated" date above. If the changes are material, we will provide additional notice, such as by email to the address you have on file or a prominent notice on the Services. Your continued use of the Services after the effective date of the updated Privacy Policy will indicate your acceptance of the updates, except where additional consent is required by law.

15. Contact Us

If you have any questions, comments, or concerns about this Privacy Policy, or to exercise your rights, contact us at:

Jupiter Health, Inc. d/b/a Wellward
Attn: Privacy
860 Broadway, 6th Floor, New York, NY 10003
Email: hello@wellwardhealth.com