Updated September 19, 2026

Privacy and secure data handling.

This notice explains what The ICHRA Shop collects, why we use it and how sensitive census, claims and prescription information should be shared.

Information we collect

We may collect contact and organization details, employer and broker quote-request information, requested services, meeting information and ordinary technical information generated when you use the website.

Do not email sensitive information. Names combined with dates of birth, Social Security numbers, claims files, prescription records, banking information and payment-card information should be submitted only through the protected process provided for that purpose.

How we use information

Respond to quote, feasibility, risk-intelligence and enrollment requests.
Coordinate licensed insurance support, plan administration and employee communications.
Operate, secure and improve the website and related services.
Meet applicable recordkeeping, fraud-prevention and legal obligations.

Sensitive census and health information

Public website fields are not intended for claims files or detailed medical information. When sensitive information is needed, The ICHRA Shop will direct the authorized employer, broker or individual to the designated intake or file-transfer process. Access should be limited to personnel and service providers who need the information for the authorized work. A link should be treated as approved for sensitive data only when The ICHRA Shop specifically identifies it for that purpose.

Service providers and external destinations

Some actions open services operated by other companies, including payment processors, Microsoft, Quotit, Saga Health, Choice Benefits and other selected administrators or carriers. Those providers process information under their own terms and privacy notices. We share information only as reasonably necessary to complete the requested service or as authorized by the customer.

Sale, retention and security

We do not sell personal information for money. We retain information only as long as reasonably necessary for the requested service, business records and legal obligations. We use administrative, technical and organizational safeguards designed to protect information, but no online system can guarantee absolute security.

Your choices

You may ask to review or correct contact information, opt out of nonessential communications or ask questions about a request. Some records may need to be retained for insurance, contractual or legal purposes.

Contact

Email Janet@ichra.shop, or call 303-903-2054. Do not include claims, prescriptions, dates of birth or other sensitive data in an ordinary email.

Enrollment information and broker permission

For coverage assistance, see our Enrollment privacy & HIPAA notice and Broker permission and revocation page. Individual enrollment permission and application review are separate from employer intake. Required Marketplace records are retained for at least 10 years, including after consent expires or is revoked. Other records remain subject to applicable retention requirements.

Quote authorization, privacy & AI

Quote requests authorize only the requested benefits services. Census matching, medical or pharmacy data research, predictive scoring and AI processing require a separate project scope identifying the data, population, vendors, recipients, purpose and retention period. Do not submit medical records, diagnoses, prescriptions, Social Security numbers or banking information in this form.

Employer permission is not an individual HIPAA authorization and does not grant access to third-party health records. Before sensitive processing, the applicable legal basis, vendor data and matching rights, security controls and signed BAAs where required must be verified. No identifiable health information may be sent to public AI tools or used to train general-purpose models. Approved AI processing must be restricted to the documented purpose, access and retention terms, with human review.

Employer-facing predictive reports require at least 30 covered lives and aggregate results only. Small cells, rare conditions and combinations that could identify a person must be suppressed, including complementary cells where needed. Thirty lives and removing names alone do not establish HIPAA de-identification. Predictions are estimates, not diagnoses or guarantees, and must not be used for employment decisions or individual eligibility discrimination.

Cross-client benchmarking, public case studies and external research are not included automatically. They require separate written project approval, contractual rights and documented HIPAA de-identification where applicable. Identifiable research requires its own lawful pathway. No sale of identifiable health data or unrelated marketing use is authorized.

Privacy, security and data handling · Questions or prospective withdrawal of optional permission: brad@ichra.shop / 303-903-2054. Withdrawal does not undo prior lawful processing or required retention. A quote checkbox does not execute a BAA or certify HIPAA compliance.