Health Data Practices

Effective date: June 22, 2026

Who we are

ShopHealthcare (shophealthcare.com) is operated by Core Value Insurance Associates, LLC, a licensed, independent, off-exchange health insurance brokerage. Our National Producer Number is 19482230, and our mailing address is 1 Century Lane, Miami Beach, FL 33139.

We want to be clear about what we are and what we are not, because it changes how the law treats your data:

• We are an insurance brokerage. We help you find and enroll in private health coverage. We are not an insurance carrier — we do not issue policies or pay claims.
• We are not the ACA Health Insurance Marketplace, HealthCare.gov, Medicare, Medicaid, or any government agency, and we are not affiliated with them. We do not sell ACA marketplace plans, Medicare, Medicaid, or government subsidies.
• We offer private, off-exchange coverage, including our flagship Health ProtectorGuard product (a fixed-indemnity / supplemental-style product) and supplemental add-ons such as accident coverage. If that flagship is not a fit, we may route you to a broader catalog of plans. We do not offer every plan on the market — we are limited to the plans of carriers we work with.

This data is not governed by HIPAA

You may assume that anything touching your insurance card or your health is covered by HIPAA. In our case, it is not, and we want you to understand why.

HIPAA's privacy rules apply to "covered entities" — health plans, health care providers, and health care clearinghouses — and their business associates. Core Value Insurance Associates, LLC is not a HIPAA covered entity, and as an independent insurance broker shopping coverage for you, we are not acting as a business associate of your carrier when we collect this information from you. That means the information described in this notice is not protected health information (PHI) under HIPAA, and HIPAA's specific rights and protections do not apply to it.

Instead, this information is governed by this Health Data Practices notice, by our general Privacy Policy, and — where you live in a state with a consumer health data law — by laws like the Washington My Health My Data Act and Nevada SB370, described below. We treat the information seriously and limit how we collect and use it, as set out here.

What "consumer health data" we collect

"Consumer health data" means information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status, or your attempt to obtain health care services or coverage. The pieces of consumer health data we may collect are:

Eligibility and basic health questions

To narrow down which plans you may qualify for and which make sense for your situation, we (and our AI enrollment assistant, Nora) ask a small set of questions, such as:

• Your date of birth and the state and ZIP code where you live;
• Your household and family composition (for example, who you want covered);
• Basic eligibility and health questions relevant to the coverage you are shopping for.

We ask these to assess eligibility and route you to appropriate coverage — not to build a clinical profile of you.

Your insurance card scan (optional)

If you choose to use it, you can scan or upload a photo of your existing health insurance card using your device camera or by uploading an image. We use optical character recognition (OCR) to read text from that image so you don't have to type it. From the card we may read information such as the carrier/insurer name, your member ID, group number, and plan details printed on the card. This is an optional convenience — you can always tell us this information yourself instead of scanning your card.

We do not ask for your Social Security number. A health insurance card does not normally contain an SSN, and we do not request one in this flow.

How the card scan works

When you scan or upload your card, the image is transmitted securely and processed by OCR to extract the printed text fields described above. Our intent is to capture only the coverage details we need to understand your current situation and route you to appropriate plans. We design this step to be minimal collection: we use the extracted text to help you, and we do not request information beyond what the card and our eligibility questions provide.

As to retention and deletion of the card image and the data extracted from it: our practice is to keep this information only as long as we need it to provide the service you asked for (finding and routing coverage) and to meet our legal, regulatory, and recordkeeping obligations as a licensed broker, and then to delete or de-identify it. We are finalizing and documenting the exact retention period and the precise deletion practice for the underlying card image (for example, whether the image itself is discarded after the text is extracted), and we will state that period here once confirmed. Until then, treat our published statements that we minimize collection and do not request your SSN as accurate, and understand that the precise retention/deletion schedule is being confirmed. You can ask us to delete this data at any time using the rights described below.

How we use your consumer health data

We use the consumer health data described above to:

• Assess your eligibility for coverage and determine which plans you may qualify for;
• Find, compare, and route you to health coverage options (including obtaining quotes and checking eligibility through our quoting partner);
• Have a licensed human agent at Core Value Insurance Associates, LLC review your options and, if you choose to proceed, complete your enrollment with the carrier you select;
• Communicate with you about your inquiry and your application;
• Keep records required of us as a licensed insurance producer and comply with applicable law.

A note about Nora, our AI enrollment assistant: Nora helps gather your information and explain options, but Nora is not a licensed agent and does not bind coverage. Every enrollment is reviewed and executed by a licensed human agent. We do not use your consumer health data to make a final, automated coverage decision without that human review.

Who we share it with — and who we don't

We never sell your data. We do not sell, rent, or trade your consumer health data, and we do not share it with third parties for their own advertising or marketing.

We do share your information with a limited set of service providers and partners who help us deliver the service, and only for that purpose:

• Quotit — to generate quotes and check plan eligibility;
• Insurance carriers — when you choose a plan and move forward, so a licensed agent can submit your enrollment to the carrier you select;
• Klaviyo — to send you email about your inquiry and your application.

We also use advertising and analytics technologies — Google Analytics 4 and Google Tag Manager, and the Meta Pixel and Conversions API — on our website. These tools are described in our Cookie and Tracking notice and Privacy Policy. We do not use your insurance card scan, your member ID, or your answers to eligibility/health questions for advertising, and we do not share that consumer health data with Google or Meta for advertising purposes. Today our site does not yet offer a cookie-consent or preferences control; we describe the trackers we use and how to limit them in the Cookie and Tracking notice.

We may also disclose information when required by law, to comply with a legal or regulatory obligation, to enforce our Terms, or to protect the rights, safety, or property of you, us, or others.

Your consent to process your insurance card scan

Because the card scan involves consumer health data, we want your clear, informed permission before we process it.

By scanning or uploading your insurance card, you authorize Core Value Insurance Associates, LLC to collect the image and to use OCR to extract the printed information from it — including your carrier name, member ID, group number, and plan details — and to use and share that information as described in this notice: to assess your eligibility, to find and route appropriate coverage through our quoting partner, and to have a licensed human agent complete an enrollment you choose with the carrier you select. Providing your card is optional; you can give us the same details yourself instead. Your authorization is voluntary, and you may withdraw it at any time as described in the next section. Withdrawing your consent does not undo processing that already happened, but it will stop further processing and, on request, we will delete the data.

Your rights

Depending on where you live, you have specific rights over your consumer health data. We extend the core of these rights to all of our users.

Washington My Health My Data Act

If you are a Washington consumer (or your data was collected in Washington), the My Health My Data Act gives you the right to:

• Access the consumer health data we have collected about you, and get a list of the third parties with whom we have shared it;
• Delete your consumer health data;
• Withdraw consent to our collection and processing (and to any sharing) of your consumer health data.

We also will not sell your consumer health data, and we will not collect or share it beyond what is necessary to provide the service you asked for or what you have consented to.

Nevada SB370

If you are a Nevada consumer, SB370 gives you the right to:

• Confirm whether we are collecting or sharing your consumer health data and access that data;
• Delete your consumer health data;
• Limit our collection and sharing to what is necessary, and, where applicable, withdraw consent.

We do not sell consumer health data in Nevada or anywhere else.

If we deny a request — your right to appeal

If we decline to act on a rights request, we will tell you why. You may appeal that decision by replying to our response or by emailing us at privacy@shophealthcare.com with the word "Appeal" in the subject line. We will review the appeal and respond with our decision and the reasons for it. If we deny your appeal, you may contact your state Attorney General to raise a concern — Washington residents may contact the Office of the Washington Attorney General, and Nevada residents may contact the Office of the Nevada Attorney General.

How to exercise your rights

To access, delete, or stop the processing of your consumer health data, or to withdraw a consent you gave us, contact us:

• Email: privacy@shophealthcare.com
• Mail: Core Value Insurance Associates, LLC, Attn: Privacy, 1 Century Lane, Miami Beach, FL 33139

We will verify your identity before acting on a request, in a way proportionate to the sensitivity of the data, and we will not ask for more information than necessary to do so. We aim to respond within the timelines required by applicable law (generally within 45 days, with the possibility of an extension where the law allows, and we will tell you if we need it). You may use an authorized agent to submit a request on your behalf where the law permits, and we will not discriminate against you for exercising your rights.

A note on our licensing

We hold insurance licenses in a defined set of states. Our backend licensing source of record currently reflects coverage in 37 states. Some of our marketing has described us more broadly; the operative, verifiable footprint is the state list we maintain and substantiate, and our Licensing page is the authoritative reference for where Core Value Insurance Associates, LLC is licensed. We mention this here because we will only collect and process your consumer health data to route you to coverage we are actually able to offer in your state.

Children

Our services are intended for adults shopping for coverage (which may include coverage for their family members). We do not knowingly collect consumer health data directly from children for their own use. Where you provide information about family members, including minors, to enroll them in coverage, we handle that information under this notice.

Changes to this notice

We may update this Health Data Practices notice as our practices or the law change. When we do, we will revise the "Effective date" above and, for material changes, take additional steps as required by law. The current version always governs.

Related notices

This notice works together with our other policies: the Privacy Policy (our general data practices), the Cookie and Tracking notice (Google Analytics/Tag Manager and the Meta Pixel/Conversions API), the Communications notice (email, calls, and future text messages), the Terms of Service, the Licensing page, and our E-Sign Consent and Accessibility statements.

Contact us

Questions about this notice or our handling of your consumer health data? Email privacy@shophealthcare.com or write to Core Value Insurance Associates, LLC, Attn: Privacy, 1 Century Lane, Miami Beach, FL 33139.