Lirvion Privacy Policy

Who is Lirvion?

Lirvion is an ICHRA (Individual Coverage Health Reimbursement Arrangement) administration platform built to help employers, brokers, and benefits partners operate ICHRA programs with structure, visibility, and control. It also provides a structured and transparent environment for the key workflows that make up the employee-facing ICHRA experience. Through the platform, this may include: program setup, employee eligibility and class configuration, allowance management, enrollment support, document collection, compliance-related workflows, payments, reporting, renewals, and ongoing support for employers, employees, brokers, and referral partners.

Lirvion is not a health insurer, insurance carrier, medical group, healthcare provider, or telemedicine service, and does not provide medical advice, diagnosis, or treatment. Health plans, insurance carriers, marketplaces, and other parties involved in the benefits and enrollment process have their own legal, privacy, and compliance responsibilities. When you interact with those parties, they are responsible for providing you with any applicable privacy notices, including any required HIPAA Notice of Privacy Practices.

CMS's employer-facing guidance now also refers to ICHRAs as CHOICE Arrangements; Lirvion continues to use ICHRA as its primary term throughout this Privacy Policy for consistency with the existing regulatory framework and established industry terminology.

1. Who this Policy applies to

This Privacy Policy applies to everyone who uses the Lirvion platform or website, regardless of role, including:

• Employers and their authorized HR administrators or other representatives who access the employer portal;

• Agents — personnel authorized by Lirvion or its affiliates to assist Employers with onboarding and Employees with enrollment — who access the platform in that capacity;

• Employees who access the platform as part of an employer-sponsored ICHRA program, including individuals invited to onboard, actively enrolled, or in the process of selecting or managing coverage;

• Brokers and Referral Partners who access the broker/partner portal to support Employers and Employees, under their respective agreements with Lirvion; and

• Visitors to the Lirvion website, whether or not they create an account.

Where a specific section of this Policy applies only to certain roles, that is stated in the section.

2. Information we collect

2.1 Account and identity information

When you register for an account, we collect basic identifying information: your name (or your organization's legal name, for Employers), email address, phone number, and address. Depending on your role, we may also collect additional details necessary to verify your identity or authority to act in that role — such as an Employer's EIN, or a Broker's insurance license information.

2.2 Plan configuration information (Employer)

To administer an ICHRA plan, we collect information about plan design, including employee classes, contribution amounts, benefit periods, and eligibility rules.

2.3 Employment, household, and dependent information

Employers provide employee roster information for plan administration: names, dates of birth, addresses, hire dates, employment status, work location, and compensation information where relevant to eligibility. Employees may add household or dependent information — names, dates of birth, and relationships of a spouse, children, or other household members — to determine eligibility and enroll dependents.

Marketplace and carrier applications request additional information about an Employee and household members, which may include sex, tobacco use, pregnancy status, and employment status (including unemployed or self-employed status). Some applications also request race and ethnicity or gender identity on an optional basis. We collect these fields only to complete a marketplace or carrier application and transmit them only to the marketplace or carrier that requires them. They are not used by Lirvion for any other purpose.

2.4 Government identifiers

We collect an Employee's Social Security Number where required by law for marketplace enrollment eligibility verification, and, where applicable, alien registration or naturalization certificate numbers to verify citizenship or immigration status. These identifiers are not requested for any purpose other than enrollment.

2.5 Income information

Household income details may be collected where required for marketplace eligibility determination — typically when an Agent assists with a marketplace application and income verification is required.

2.6 Benefit and enrollment information

ICHRA allowance amount, health plan selected, carrier name, plan details, policy and subscriber numbers, enrollment confirmation numbers, premium amounts, and coverage effective dates.

2.7 Carrier-requested information

Some carriers require information beyond the above to complete enrollment in a specific plan — for example, carrier-specific eligibility questions or supporting documents. We transmit only what the relevant carrier requires, solely to complete that enrollment.

2.8 Payment and financial information

When an Employer sets up funding for its ICHRA program, we collect the information needed to complete an ACH Authorization Form, including the Employer's bank account and routing number and the name and contact details of the Employer's designated benefit officer who authorizes the account. When a payment is made through the platform — including premium payments from an Employee's ICHRA virtual card, or platform fees paid by an Employer — our authorized financial partners collect and process the relevant information. Bank account and routing information provided for ACH authorization is retained by our payment partner as necessary to process contributions. Our current financial and payment partners include Lynx FinHealth, Inc. and Stripe.

2.9 Platform usage, technical, and website data

We automatically collect information about how the platform and website are used, including IP address, device type, browser, operating system, pages visited, session duration, login timestamps, actions taken, and error logs. On the website, this includes information collected via analytics and cookie-consent tools described in Section 9.

2.10 Communications

We retain records of communications with Lirvion support, including emails, in-platform messages, chat transcripts, support tickets, and documents uploaded (for example, proof of a qualifying life event for a Special Enrollment Period request).

3. How we collect your information

Directly from you — when you register, complete onboarding, sign an applicable agreement, configure a plan, add household members, select a health plan, upload documents, submit the website contact form, or contact support. For an Employer, Broker, or Referral Partner, this includes the information provided about your own organization when you sign up — for example, an Employer's legal name and EIN, or a Broker's agency name, contact details, and insurance license information.

From your Employer — if you are an Employee, your Employer provides your name, contact details, employment status, and allowance amount to set up your ICHRA benefit before you receive an invitation.

From your authorized representatives — HR administrators, benefits managers, or others an Employer authorizes to manage the platform on the Employer's behalf provide and maintain the Employer's account information, plan configuration, and Employee roster. The Employer is responsible for ensuring those individuals are authorized to share information with us.

From your Agent, Broker, or Referral Partner — if a Broker or Referral Partner refers your organization to Lirvion, or an Agent or Broker assists with onboarding, plan configuration, or enrollment, they may provide or update the related information about your organization or your account, within the scope of their role.

From the marketplace and carriers — after an Employee enrolls in a health plan, we receive enrollment confirmation data and eligibility information from HealthSherpa to verify and reconcile your coverage. Where Lirvion facilitates a Broker's carrier appointments, we may also receive appointment confirmation information directly from carriers.

From payment partners — Lynx FinHealth, Inc. and Stripe share transaction identifiers, payment confirmation details, and account status information necessary to process Employer contributions, Employee premium payments, and Employer platform fees.

From third-party verification services — where required to verify an Employer's identity or EIN, an Employee's citizenship/immigration status, or a Broker's insurance license and appointments, we may receive confirmation data from authorized verification services.

Automatically — through cookies and similar technologies described in Section 9, for anyone who uses the platform or website, regardless of role.

4. How we use your information

• We use the information we collect to:

• Create and manage accounts for Employers, Employees, Agents, Brokers, and Referral Partners;

• Administer an ICHRA plan in compliance with IRS, DOL, and HHS regulations;

• Determine Employee eligibility for an Employer's ICHRA plan and set up and fund the Employee's ICHRA virtual card;

• Help Employees understand benefit options and facilitate enrollment through the marketplace or directly with a carrier;

• Process employer contributions and premium payments, and facilitate platform fee billing;

• Generate required plan documents and legal notices through the platform, including the ICHRA Notice, COBRA Notice (where applicable), ERISA Notice, and Summary Plan Description (SPD);

• Notify users of important deadlines — open enrollment, Special Enrollment Periods, payment due dates, and plan changes;

• Process Special Enrollment Period requests following a qualifying life event;

• Verify Employer eligibility and EIN, Employee identity/eligibility, and a Broker's insurance license and carrier appointments, through authorized verification services;

• Administer Broker and Referral Partner relationships, including carrier appointment tracking, licensing status, and applicable commission or referral-fee payments;

• Provide customer support and respond to inquiries;

• Detect and prevent fraud, unauthorized access, and security incidents, and maintain audit logs;

• Meet legal and regulatory obligations, including ERISA, HIPAA, and IRS reporting requirements; and

• Improve and develop the platform and website, including through anonymized or aggregated analytics.

Plan documents generated through the platform, including the SPD, are produced from the Employer's plan configuration and are provided as a starting point, not a final, attorney-reviewed instrument. Each Employer is responsible for having its own legal counsel review its plan documents, including the SPD, for compliance with applicable law before adopting or distributing them.

We do not sell personal information, and we do not use personal information for advertising purposes.

5. HIPAA and Protected Health Information

Lirvion acts as a HIPAA Business Associate for an Employer's ICHRA plan where an executed Business Associate Agreement (BAA) is in place between Lirvion and the Employer or the Employer's plan. Where a BAA is in effect, PHI we handle may include enrollment status, coverage details, and premium payment records. We use and disclose PHI only as permitted by the applicable Business Associate Agreement and the HIPAA Privacy Rule, and never for marketing or any purpose unrelated to administering the applicable ICHRA plan.

An Employer can see an Employee's enrollment status, allowance utilization, and payment status for plan administration purposes. An Employer cannot see an Employee's individual health plan details, the specific carrier or plan chosen, claims, medical records, or other PHI. An assigned Agent or Broker can see the plan details necessary to complete and support that Employee's enrollment, as described in Section 7, and is bound by confidentiality and applicable insurance licensing obligations.

6. AI features

Lirvion may incorporate artificial intelligence ("AI") features into certain areas of the platform to support and improve how services are delivered within the ICHRA administration workflow. Where AI is used, it functions as a supporting tool, not as a decision-maker.

Any determination that could affect eligibility, allowance amount, enrollment status, or health coverage outcome is reviewed by a person before it takes effect. AI features do not replace human judgment or override the terms of an Employer's ICHRA plan.

Lirvion collects only the minimum information necessary to deliver its services. Where information collected through the platform is used to evaluate or improve AI features, that use is limited to internal purposes and carried out in accordance with applicable law, including HIPAA where PHI is involved.

7. How we share your information

We do not sell personal information and do not share it for advertising. We share information only in the following circumstances:

With your Agent or Broker — an assigned Agent or Broker can view household information, plan selections, and enrollment confirmation details to the extent needed to complete enrollment and support the account. Agents and Brokers are bound by applicable insurance licensing laws and confidentiality obligations. Where an Agent or Broker completes enrollment on an Employee's behalf, the Employee will be asked to review the information submitted and provide consent before the Agent or Broker proceeds.

With marketplaces and carriers, via HealthSherpa — to complete enrollment, we transmit information required by the marketplace or carrier, which may include household details, income information, employer ICHRA details, citizenship/immigration status, and demographic information required by the marketplace or carrier.

With Lynx FinHealth, Inc. — information necessary to manage the ICHRA virtual card, allowance funding, and premium payments, including the Employer's bank account and routing number and benefit officer contact information submitted via the ACH Authorization Form.

With Stripe — information necessary to process Employer platform fees.

With DocuSign — signer name, email, and document metadata necessary to execute agreements and plan documents electronically.

With other service providers — vendors who help operate the platform and website, including cloud hosting (AWS), address verification (Smarty), and analytics providers (see Section 9), under contracts requiring confidentiality and restricting use to the purpose for which data was shared.

In a business transfer — if Lirvion is acquired, merges, or transfers all or substantially all of its assets, information may be transferred as part of that transaction. Affected users will be notified.

As de-identified or aggregated data — data that cannot reasonably identify an individual may be used for internal analytics, product improvement, and reporting.

To comply with law — including responding to court orders, legal process, or government/regulatory requests.

The platform and website may link to or integrate with third-party services, including HealthSherpa, Lynx FinHealth, Inc., Stripe, DocuSign, a state marketplace, or a carrier's website. Those services operate under their own privacy policies, not this one.

8. Third-party services

The table below lists the third-party services currently used across the Lirvion platform and website, and the general purpose of each.

9. Cookies and tracking

On the platform

We use cookies to maintain login sessions, remember preferences, and keep the platform secure. We do not use advertising or behavioral tracking cookies on the employer, employee, or broker portals.

On the website

The Lirvion website uses Google Tag Manager, Google Analytics, and Microsoft Clarity to understand how visitors use the site, and a cookie-consent widget (Cookiesaur) to manage cookie preferences. Website visitors can manage cookie settings through the consent widget or their browser; disabling certain cookies may affect site functionality.

Tracking scripts used on the website — including Google Tag Manager, Google Analytics, and Microsoft Clarity — are configured to load only after a visitor provides consent through Cookiesaur, in jurisdictions where prior opt-in consent is required (for example, California and other states with comprehensive privacy laws). Visitors who decline consent will not have these scripts loaded.

10. Your privacy rights

Subject to applicable law and our legal retention obligations, you have the right to:

• Request a copy of the personal information we hold about you;

• Ask us to correct inaccurate or incomplete information;

• Ask us to delete your information, subject to legal retention obligations;

• Receive your data in a common, machine-readable format;

• Ask us to limit how we process your information in certain situations;

• Receive notice of material changes to this Policy; and

• Opt out of certain sharing of your personal information, where applicable.

To exercise any of these rights, contact us at compliance@lirvion.com.

State-specific rights

If you are located in California, Colorado, Virginia, or another state with comprehensive privacy legislation, additional rights may apply. Contact us to learn more about rights applicable to your situation.

Sensitive personal information

Some of the information we collect — including Social Security numbers, citizenship/immigration status, and, on an optional basis through marketplace or carrier applications, race, ethnicity, and gender identity — is treated as sensitive personal information under certain state privacy laws. Where applicable law gives you the right to limit our use or disclosure of sensitive personal information, you may exercise that right by contacting us at compliance@lirvion.com. In most cases, we already collect this information only to complete a required marketplace or carrier application and do not use it for any secondary purpose, so exercising this right will generally not change how your enrollment is processed.

11. Data security

Our safeguards include:

• Encryption of data in transit and at rest;

• Role-based access controls — each user sees only the data relevant to their role; an Employer cannot access Employee PHI;

• Multi-factor authentication for platform logins;

• Continuous security monitoring and intrusion detection;

• Regular security audits and penetration testing;

• Audit logs of data access and administrative actions, retained for a minimum of seven years as required by IRS HRA recordkeeping rules; and

• Business Associate Agreements and security requirements for third-party vendors who handle your data.

No system is completely risk-free. Keep your account password confidential. If you believe your account has been compromised, contact us immediately at compliance@lirvion.com.

If a data breach affects your information or PHI, we will notify you within 60 days of discovery as required by HIPAA, and within any shorter timeframe required by applicable state law.

12. How long we keep your information

We retain account and plan information for the duration of the relevant relationship with Lirvion and for a minimum of seven years afterward, as required by IRS rules for HRA records. Financial transaction records are retained in accordance with applicable tax and financial recordkeeping laws. Upon account closure, an export of records may be requested before deletion.

13. Children's privacy

The Lirvion platform is intended for adults 18 and older. We do not knowingly collect personal information directly from children under 18. Information about minor dependents is submitted by the account holder and used only for enrollment and plan administration. If we learn we have collected information directly from a child under 18, we will delete it promptly.

14. Changes to this Policy

We may update this Privacy Policy when our practices change or applicable law requires it. If we make material changes, we will notify affected users by email and display a notice on the platform at least 30 days before the changes take effect. Continued use of the platform or website after the effective date constitutes acceptance of the updated Policy.

15. Contact us

Questions, concerns, complaints, or requests related to this Privacy Policy or your personal information: compliance@lirvion.com

General or other questions: support@lirvion.com

Complaints to the federal government: U.S. Department of Health and Human Services, Office for Civil Rights, 200 Independence Avenue S.W., Washington D.C. 20201 — hhs.gov/hipaa/filing-a-complaint