Privacy policy

withmalta.org is operated by Malta Health, Inc. and its subsidiary Malta Insurance Services, LLC (in California, Malta Health Insurance Services), a licensed insurance agency (together, "Malta", "we", "us"). On withmalta.org we help people with Medicare: comparing and enrolling in Medicare Advantage, Medicare Supplement (Medigap) and Part D prescription drug plans, and using their coverage afterwards. We are not an insurance company, a health plan, a health care provider or a government agency.

This policy explains how we handle personal information when you visit withmalta.org, fill out a form, talk, text or chat with us, or work with a Malta Medicare advisor. It also explains your choices and rights. Malta's site for individual, family and employer coverage, withmalta.com, has its own privacy policy.

If you live in Washington, Nevada or Connecticut, our Consumer Health Data Privacy Policy (withmalta.org/consumer-health-data) also applies and explains how we handle health-related information about you.

What we collect depends on how you use Malta. You can browse the site without telling us who you are.

• Contact details you give us: name, email and phone number.
• Your answers when you ask for help: for example whether you are turning 65 or already on Medicare, what coverage you have today, when you need coverage to start, and your ZIP code. If you are helping someone else, their name.
• Anything you choose to tell us in a message, on a call, by text or in a chat.
• Your permissions: which contact and marketing options you chose, the exact wording shown, and when.
• Information you give an advisor to compare or enroll in a plan, such as your Medicare number, date of birth, Medicare Part A and B start dates, doctors, prescriptions, pharmacies and current plan. We ask only for what the comparison or enrollment needs.
• Information you share so we can help you use your coverage, such as a bill, an explanation of benefits, a claim or the care you are looking for.
• Records of calls, chats and messages with us. Calls with Malta are recorded.
• How you use the site: pages viewed, the steps of a form you reached, links you clicked, the site you came from, campaign tags in the link, device and browser type, approximate location from your IP address, and similar technical data.
• Information from others: Medicare plans and carriers (for example whether an enrollment went through), and partners who refer you to us, such as financial advisors or senior living communities.

We do not ask for your Social Security number or Medicare number on the website. If an enrollment needs them, an advisor collects them directly, and access is limited to the people who need them for that enrollment.

• To respond to your request: have a licensed advisor contact you, schedule a conversation, compare plans and help you apply.
• To contact you the ways you allowed. Calls and emails about your request are part of the help you asked for; texts and marketing need the separate permissions on our form.
• To support you after you enroll, for example with bills, claims, renewals, finding care and coverage changes.
• To keep the records Medicare rules require, including call recordings, Scope of Appointment records and enrollment records.
• To run, secure and improve the site and our service, including measuring which pages and form steps work.
• To measure and improve our advertising, as described in section 5.
• To comply with law, respond to lawful requests and protect Malta, our clients and others.

We use artificial intelligence (AI) tools to help our team and to answer questions in our member chat, for example to draft notes, summarize a conversation or find information about a plan. AI can make mistakes. A licensed person makes, and is accountable for, every recommendation about your coverage.

We do not use your conversations or your health information to train AI models. Our AI service providers process them only to provide their service to us, under contract.

We share personal information only as described here, and only what each recipient needs.

• Medicare Advantage, Part D and Medicare Supplement carriers, and the Centers for Medicare & Medicaid Services (CMS), when you ask us to enroll you or make a change for you.
• A general agency or field marketing organization we contract through for a carrier, when the carrier requires it to process your application.
• Doctors, hospitals, pharmacies and other providers, when you ask us to help you find care, book a visit or sort out a bill.
• Service providers who work for us under contract and may use the information only to provide their service to us, such as hosting, databases, scheduling, phone and texting, email delivery, AI services and analytics.
• Advertising and analytics partners, limited as described in section 5.
• Our parent company, Malta Health, Inc., and its subsidiaries, under this policy.
• Someone you ask us to include, such as a family member or someone who helps you with coverage.
• Authorities or others when the law requires it, to protect rights and safety, or in connection with a merger, financing or sale of our business, subject to this policy.

We do not sell your personal information for money. We never sell, rent or share your mobile number or your text-message permission with anyone for their own marketing.

Our site uses cookies and similar tools to work properly, to understand how people use it, and to measure advertising.

• Our hosting provider counts page views and measures page speed without cookies.
• Our product analytics provider, bound by a HIPAA business associate agreement, records how people use the site. It knows you by a random ID and, after you send a request, by the request's reference number, never by your name, email or phone number. It makes no session recordings of our Medicare pages, our Medicare request form or our articles. If your browser sends a Global Privacy Control signal, it does not run at all.
• Google Tag Manager and Google Analytics never run on our Medicare pages, our Medicare request form or our articles, and never receive anything about a Medicare request. They may run on this site's legal pages, where they receive only the page you view. We turn off Google's personalized advertising features.

Under some state laws, sharing information about your use of our site with advertising partners counts as "selling" or "sharing" personal information, or as targeted advertising. You can opt out at any time by emailing privacy@withmalta.com. We also honor Global Privacy Control signals from your browser as an opt-out for that browser.

We never use information about your health, your coverage situation or your answers on our forms for targeted advertising.

Calls with Malta are recorded for quality, training and compliance. Medicare rules require us to record and keep our Medicare sales and enrollment calls.

We text you only if you checked the box to allow it, and marketing texts or calls need a separate, optional permission. Reply STOP to any text to stop texts, or HELP for help. Our SMS Terms (withmalta.org/sms) explain the program.

Email and text are not always encrypted. Please do not send sensitive details such as your Social Security number by email or text; your advisor can give you a secure way to share them.

You can stop marketing emails with the unsubscribe link in any of them. To stop calls or other contact, tell your advisor or email us, and we will stop contacting you through every channel you ask us to stop.

We keep personal information as long as we need it for the purpose we collected it, and as long as law or our contracts require. For example:

• Medicare sales and enrollment call recordings: at least 6 years, as Medicare rules require. Enrollment and Scope of Appointment records: 10 years.
• Records of your permissions and opt-outs: as long as we might contact you, and for the period needed to show we followed your choices.
• Requests that never became a client relationship: as long as we need to respond and follow up, then deleted or de-identified.
• Chat history that is not part of an enrollment or other required record: deleted when you ask, within 30 days.
• Detailed website analytics: Google Analytics keeps it for 2 months.

We use administrative, technical and physical safeguards appropriate to the information, including encryption in transit, access limited to people who need it, and vendors bound by contract to protect it. No system is perfectly secure. If a breach affects your information, we will notify you as the law requires.

Depending on where you live, you may have the right to:

• Know what personal information we have about you and get a copy.
• Correct information that is wrong.
• Delete your information, subject to records the law requires us to keep.
• Opt out of the sale or sharing of personal information, targeted advertising and certain profiling.
• Limit the use of sensitive personal information, although we use it only for the purposes the law permits.
• Appeal our decision on your request.
• Not be treated differently for using these rights.

To make a request, email privacy@withmalta.com or write to us at the address in section 12. We will confirm we received it within 10 business days and respond within 45 days, or tell you if we need more time as the law allows. We verify requests by matching information you give us to what we have; we ask for as little as possible to do that. You may use an authorized agent, who will need your written permission.

If we deny your request, you can appeal by replying to our decision or emailing privacy@withmalta.com with the subject "Appeal". If you are unhappy with the result of an appeal, you may contact your state attorney general.

California residents: the categories of personal information we collected in the last 12 months are those in section 2, from the sources in section 2, for the purposes in section 3, disclosed to the recipients in section 4. Advertising partners in section 5 receive internet activity and identifiers, which California treats as "sharing". We do not knowingly sell or share the personal information of anyone under 16. California's Shine the Light law: we do not share personal information with third parties for their own direct marketing.

Our site is for adults. We do not knowingly collect personal information from children under 13 through the site. A parent or guardian may give us information about a child when getting coverage for them, and we use it only for that.

We will post any changes here and update the date above. If a change is material, we will tell you on the site or by email before it takes effect.

Email privacy@withmalta.com or write to Malta, Attn: Privacy, 2261 Market Street STE 33206, San Francisco, CA 94114.