Consumer health data privacy policy

This policy explains how Malta Health, Inc. and its subsidiary Malta Insurance Services, LLC (in California, Malta Health Insurance Services), a licensed insurance agency (together, "Malta", "we", "us") collect, use and share consumer health data, and the rights you have over it, under the laws of Washington, Nevada and Connecticut. It adds to our Privacy Policy (withmalta.org/privacy). We apply it to everyone, wherever they live.

Consumer health data means personal information that is linked or reasonably linkable to you and that identifies your past, present or future physical or mental health, including information we could infer about your health.

Only when you give it to us, or when it is needed to help you with coverage:

• That you are looking for help with Medicare, and your answers about why (for example turning 65, leaving an employer's plan or moving).
• Your current coverage, including whether you have Medicare, Medicaid or both.
• Who needs coverage, including a family member you are helping.
• Information you choose to share with an advisor to compare plans, such as your doctors, prescriptions, health conditions or care you expect to need.
• What you say about your health on recorded calls, in texts, in chats or in messages to us.

We do not collect precise geolocation, biometric or genetic data. We do not use geofencing around health care facilities.

• You, through our forms, calls, texts and emails.
• Someone helping you, such as a family member or caregiver.
• Carriers, health plans and government programs, about applications you ask us to make.
• Our own analytics, which record which of our forms' questions you answered.

• To have a licensed advisor help you: understand your options, compare plans, and apply or change coverage.
• To support you after enrollment with bills, claims, finding care, renewals and changes.
• To keep the records insurance and Medicare rules require.
• To understand and improve how our intake works, using analytics that are bound by a HIPAA business associate agreement and never used for advertising.
• To meet legal obligations and protect against fraud.

We do not use consumer health data for advertising or to train AI models, and we do not sell it. We collect and share it only with your consent or as necessary to provide the service you asked for.

Categories of recipients:

• Insurance carriers, health plans and government programs, when you ask us to apply or make a change.
• A general agency or field marketing organization we contract through for a carrier, when the carrier requires it for your application.
• Doctors, hospitals, pharmacies and other providers, when you ask us to help you find care, book a visit or sort out a bill.
• Processors that work for us under contract and may use it only to provide their service to us, such as hosting, databases, scheduling, phone and texting, email delivery, AI services and analytics (under a HIPAA business associate agreement).
• People you ask us to include.
• Authorities when the law requires it.

Affiliates: our parent company, Malta Health, Inc., which operates our systems. You can ask us for the names of every third party and affiliate we have shared your consumer health data with (section 6). We do not share consumer health data with advertising partners or data brokers.

You have the right to:

• Confirm whether we collect, share or sell your consumer health data, and see it.
• Get a list of every third party and affiliate we have shared it with, and how to contact them.
• Withdraw your consent to our collecting or sharing it.
• Have it deleted, including from our processors' systems. Some records we must keep by law, such as Medicare call recordings; we will tell you if that applies.
• Not be discriminated against for using these rights.

Email privacy@withmalta.com or write to Malta, Attn: Privacy, 2261 Market Street STE 33206, San Francisco, CA 94114. We will verify your request using information we already have, respond within 45 days (extendable by 45 days when reasonably necessary, and we will tell you why), and respond at no charge up to twice a year.

If we deny your request, you can appeal by emailing privacy@withmalta.com with the subject "Health data appeal" within 45 days of our decision. We will respond within 45 days and explain our decision. If we deny your appeal, you may contact the Washington State Attorney General (atg.wa.gov/file-complaint), the Nevada Attorney General (ag.nv.gov) or the Connecticut Attorney General (portal.ct.gov/ag).

We will post changes here with a new date. Before we collect or share consumer health data in a new way that needs your consent, we will ask for it.