ScoreMyBenefits Privacy Policy

ScoreMyBenefits ("we," "our," "us") provides a decision-support platform for licensed employee-benefits professionals. This Privacy Policy explains what information we collect, how we use and share it, how long we keep it, and the choices you have. It applies to the ScoreMyBenefits platform and website (the "Service").

The Service is a business-to-business product: our users are benefits advisors and their firms. Advisors are instructed not to submit individually identifiable health information, and the Service applies the safeguards described below; this policy describes how we handle the information the Service is designed to receive.

1. Information We Collect

Account and organization information. Name, email address, and login credentials; your organization's name and related details; team membership and roles within your organization.

Documents and extracted data. Plan-level benefits documents you upload (such as Form 5500 filings, Summaries of Benefits and Coverage, renewal packages, aggregate claims summaries, and performance reports) and the plan-level values extracted from them. What is retained varies by feature — see Section 3.

Information you enter directly. Company and plan information entered into the calculator and other analysis tools.

Records of your agreements and confirmations. When you accept our Terms and this Policy, we record the acceptance with the document versions, a pseudonymous identifier derived from your email address, and technical metadata (IP address and browser user-agent). When you upload a document, we record which version of our supported-data confirmation you affirmed.

Operational and audit records. Sign-in and account activity, and operational event records — including records created when a document is declined by our screening or does not match the expected document type. These records contain event categories only, never the content of your documents.

Technical information. Browser and device information, standard technical logs generated by our hosting infrastructure (such as IP addresses and request records), and essential cookies used to keep you signed in and operate the Service. We do not use advertising cookies or third-party analytics trackers.

2. How We Use Information

We use the information we collect to:

• provide, operate, and improve the Service, including generating analyses, scores, benchmarks, and reports;
• process the documents you submit, including AI-assisted extraction as described in Section 4;
• administer accounts, organizations, and invitations, and send service-related communications;
• maintain the security and integrity of the Service, including screening, audit, and abuse prevention;
• keep records of legal acceptances and data-handling events; and
• comply with law.

Where you expressly consent, we may retain submitted documents and their extracted data for product development and validation (Section 3, "Research retention").

3. Documents: Processing, Storage, and Retention

Documents are parsed on our servers. What is retained depends on the feature:

• Transient analysis features. Some features (for example, the performance-review analysis) process your document in memory and retain neither the document nor its extracted values after your session.
• Extraction-and-review features. Some features extract values for your review and record validation events about the extraction (categories and confirmations — not document content).
• Retained analyses. Some features store the uploaded document and/or its extracted values as part of your organization's records — for example, Form 5500 analyses performed in the administrative workflow, and analyses you explicitly save.
• Calculator data in your browser. Data you enter in the calculator is stored locally in your browser and is transmitted to our servers when you run analyses or save results.
• Research retention (consent-based). Where express consent is given at the time of submission, a document and its extracted data may be retained separately for product development and validation. Without that consent, this retention does not occur.

Retention periods. We retain organization data while your account is active. We do not currently apply automatic expiration; see Section 7 for deletion.

4. AI-Assisted Processing

Certain features transmit the text of a submitted document to our AI service provider, Anthropic, to locate and extract printed plan-level values from varied document layouts. When this occurs:

• the transmission passes through a single control point that runs an automated screen for member-level identifiers (for example, Social Security number patterns, date-of-birth labels, member-identifier fields, and diagnosis-code markers) and is designed to block the transmission when such markers are detected. This screening is an automated safety measure and is one layer of protection alongside the Service's content restrictions; it is not a guarantee;
• the AI service is used to locate and read values printed in the document — the Service's scores and computations are produced by our own systems; and
• a record of any blocked transmission is kept (event categories only, never document content).

5. How We Share Information

We do not sell personal information. We share information only:

• With service providers that host and operate the Service on our behalf: Vercel (application hosting), Neon (database), Supabase (file storage), Anthropic (AI-assisted document reading, Section 4), and Resend (email delivery). These providers process information to provide their services to us.
• Within your organization. Members of your organization can see your organization's analyses and records according to their roles.
• For legal reasons, if we believe disclosure is required by law, legal process, or governmental request, or to protect the rights, safety, or property of ScoreMyBenefits or others.
• With your consent or at your direction.

6. Security

We take measures appropriate to the nature of the information we handle:

• encryption of data in transit, and storage with managed infrastructure providers that encrypt data at rest;
• role-based access controls, organization-level data separation, and invitation-only registration;
• private (non-public) file storage;
• automated screening of AI-bound transmissions for member-level identifiers (Section 4);
• audit records of security-relevant events (event categories, never document content); and
• recorded, versioned acceptance of legal terms and upload confirmations.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a breach affecting your information occurs, we will notify you as required by applicable law.

7. Your Rights and Choices

• Access and update. You can access and update account and organization information in the Service or by contacting us.
• Deletion. You (as an organization owner) may request deletion of your organization's data. Deletion removes your organization's database records and stored documents. One narrow exception: records evidencing your acceptance of legal terms are retained in anonymized form (identifiers removed; a pseudonymous email hash, the accepted versions, and the timestamp retained) so that consent remains provable after deletion. We may also retain information where required by law.
• Communications. Service and administrative messages are part of operating the Service. Any promotional communications will include an opt-out.
• Depending on where you live, you may have additional rights under applicable privacy laws; contact us to exercise them.

8. Cookies

We use essential cookies to keep you signed in and to operate the Service. We do not use advertising or cross-site tracking cookies.

9. Children's Privacy

The Service is a business tool and is not directed to children under 16. We do not knowingly collect personal information from children under 16; if we learn that we have, we will delete it promptly.

10. Changes to This Policy

We may update this Policy from time to time. The current version, with its version identifier and effective date, is always available on this page. Material changes will be reflected in a new version identifier.

11. Contact

Privacy questions or requests: rob@scoremybenefits.ai.