Privacy policy

withmalta.com is operated by Malta Health, Inc. and its subsidiary Malta Insurance Services, LLC (in California, Malta Health Insurance Services), a licensed insurance agency (together, "Malta", "we", "us"). We help people find and use health coverage: individual and family plans, and benefits through their employer. We are not an insurance company, a health plan, a health care provider or a government agency.

This policy explains how we handle personal information when you visit withmalta.com, fill out a form, talk, text or chat with us, or work with a Malta advisor. It also explains your choices and rights. Our Medicare site, withmalta.org, has its own privacy policy.

It does not cover information we handle for an employer's group health plan under a business associate agreement. That information is protected by HIPAA and by our contract with the plan, and the plan's own Notice of Privacy Practices applies. If your employer works with Malta, see section 9.

If you live in Washington, Nevada or Connecticut, our Consumer Health Data Privacy Policy (withmalta.com/consumer-health-data) also applies and explains how we handle health-related information about you.

What we collect depends on how you use Malta. You can browse the site without telling us who you are.

• Contact details you give us: name, email, phone number, and, for employers, your company and job title.
• Your answers when you ask for help: for example why you are looking for coverage, what coverage you have today, who needs coverage, when you need it to start, and your ZIP code. If you are helping someone else, their name.
• Anything you choose to tell us in a message, on a call, by text or in a chat.
• Your permissions: which contact and marketing options you chose, the exact wording shown, and when.
• Information you give an advisor to compare or apply for coverage, such as date of birth, doctors, prescriptions, current plan, income or household details. We ask only for what the comparison or application needs.
• Information you share so we can help you use your coverage, such as a bill, an explanation of benefits, a claim or the care you are looking for.
• Records of calls, chats and messages with us. Calls with Malta are recorded.
• How you use the site: pages viewed, the steps of a form you reached, links you clicked, the site you came from, campaign tags in the link, device and browser type, approximate location from your IP address, and similar technical data.
• Information from others: carriers and health plans (for example whether an application went through), your employer if it works with Malta (see section 9), partners who refer you to us, and business contact data providers for employer contacts.

We do not ask for your Social Security number on the website. If an application needs it, an advisor collects it directly, and access is limited to the people who need it for that application.

• To respond to your request: have a licensed advisor contact you, schedule a conversation, compare plans and help you apply.
• To contact you the ways you allowed. Calls and emails about your request are part of the help you asked for; texts and marketing need the separate permissions on our form.
• To support you after you enroll, for example with bills, claims, renewals, finding care and coverage changes.
• To keep required records, including enrollment records.
• To run, secure and improve the site and our service, including measuring which pages and form steps work.
• To measure and improve our advertising, as described in section 5.
• To comply with law, respond to lawful requests and protect Malta, our clients and others.

We use artificial intelligence (AI) tools to help our team and to answer questions in our member chat, for example to draft notes, summarize a conversation or find information about a plan. AI can make mistakes. A licensed person makes, and is accountable for, every recommendation about your coverage.

We do not use your conversations or your health information to train AI models. Our AI service providers process them only to provide their service to us, under contract.

We share personal information only as described here, and only what each recipient needs.

• Insurance carriers, health plans and health insurance marketplaces (HealthCare.gov or your state's) when you ask us to apply or make a change for you.
• A general agency or field marketing organization we contract through for a carrier, when the carrier requires it to process your application.
• Doctors, hospitals, pharmacies and other providers, when you ask us to help you find care, book a visit or sort out a bill.
• Service providers who work for us under contract and may use the information only to provide their service to us, such as hosting, databases, scheduling, phone and texting, email delivery, AI services and analytics.
• Advertising and analytics partners, limited as described in section 5.
• Your employer, only as described in section 9, if you get coverage through an employer that works with Malta.
• Our parent company, Malta Health, Inc., and its subsidiaries, under this policy.
• Someone you ask us to include, such as a family member or someone who helps you with coverage.
• Authorities or others when the law requires it, to protect rights and safety, or in connection with a merger, financing or sale of our business, subject to this policy.

We do not sell your personal information for money. We never sell, rent or share your mobile number or your text-message permission with anyone for their own marketing.

Our site uses cookies and similar tools to work properly, to understand how people use it, and to measure advertising.

• Our hosting provider counts page views and measures page speed without cookies.
• Our product analytics provider, bound by a HIPAA business associate agreement, records how people use the site. It knows you by a random ID and, after you send a request, by the request's reference number, never by your name, email or phone number. On our employer and general pages it also makes session recordings, with everything you type masked and the part of the form where you enter your contact details blocked from recordings. It makes no recordings on our individual coverage pages (including their scheduling pages and the page where you choose a lane) or on our articles. If your browser sends a Global Privacy Control signal, it does not run at all.
• Google Tag Manager, Google Analytics and Google Ads measure which pages and campaigns bring people to Malta. They never run on our individual coverage pages (including their scheduling pages and the page where you choose a lane) or our articles, and never receive anything about an individual coverage request. On other pages they receive the pages you view, how far you get through our forms and whether you submitted a request. They never receive your answers, your name, email or phone number. We turn off Google's personalized advertising features.

Under some state laws, sharing information about your use of our site with advertising partners counts as "selling" or "sharing" personal information, or as targeted advertising. You can opt out at any time by emailing privacy@withmalta.com. We also honor Global Privacy Control signals from your browser as an opt-out for that browser.

We never use information about your health, your coverage situation or your answers on our forms for targeted advertising.

Calls with Malta are recorded for quality, training and compliance.

We text you only if you checked the box to allow it, and marketing texts or calls need a separate, optional permission. Reply STOP to any text to stop texts, or HELP for help. Our SMS Terms (withmalta.com/sms) explain the program.

Email and text are not always encrypted. Please do not send sensitive details such as your Social Security number by email or text; your advisor can give you a secure way to share them.

You can stop marketing emails with the unsubscribe link in any of them. To stop calls or other contact, tell your advisor or email us, and we will stop contacting you through every channel you ask us to stop.

We keep personal information as long as we need it for the purpose we collected it, and as long as law or our contracts require. For example:

• Enrollment records and call recordings: the period insurance laws require.
• Records of your permissions and opt-outs: as long as we might contact you, and for the period needed to show we followed your choices.
• Requests that never became a client relationship: as long as we need to respond and follow up, then deleted or de-identified.
• Chat history that is not part of an enrollment or other required record: deleted when you ask, within 30 days.
• Detailed website analytics: Google Analytics keeps it for 2 months.

We use administrative, technical and physical safeguards appropriate to the information, including encryption in transit, access limited to people who need it, and vendors bound by contract to protect it. No system is perfectly secure. If a breach affects your information, we will notify you as the law requires.

Some employers hire Malta to advise on their benefits and to help their employees use them. In that case your employer's group health plan is covered by HIPAA, and we handle plan information as the plan's business associate under a written agreement.

Your conversations with a Malta advisor are confidential. Your employer does not see what you ask us, what you tell us about your health or your family, or which doctors or prescriptions you mention. Your employer may receive information it needs to run the plan, such as whether you enrolled and in which plan, or summaries that do not identify anyone. Your employer may not use information from Malta to make decisions about your job.

If your employer offers an individual coverage HRA (ICHRA), your employer may learn whether you enrolled in qualifying coverage and the amounts reimbursed, because the law requires it to verify coverage. It will not learn your health conditions or claims from Malta.

Depending on where you live, you may have the right to:

• Know what personal information we have about you and get a copy.
• Correct information that is wrong.
• Delete your information, subject to records the law requires us to keep.
• Opt out of the sale or sharing of personal information, targeted advertising and certain profiling.
• Limit the use of sensitive personal information, although we use it only for the purposes the law permits.
• Appeal our decision on your request.
• Not be treated differently for using these rights.

To make a request, email privacy@withmalta.com or write to us at the address in section 13. We will confirm we received it within 10 business days and respond within 45 days, or tell you if we need more time as the law allows. We verify requests by matching information you give us to what we have; we ask for as little as possible to do that. You may use an authorized agent, who will need your written permission.

If we deny your request, you can appeal by replying to our decision or emailing privacy@withmalta.com with the subject "Appeal". If you are unhappy with the result of an appeal, you may contact your state attorney general.

California residents: the categories of personal information we collected in the last 12 months are those in section 2, from the sources in section 2, for the purposes in section 3, disclosed to the recipients in section 4. Advertising partners in section 5 receive internet activity and identifiers, which California treats as "sharing". We do not knowingly sell or share the personal information of anyone under 16. California's Shine the Light law: we do not share personal information with third parties for their own direct marketing.

Our site is for adults. We do not knowingly collect personal information from children under 13 through the site. A parent or guardian may give us information about a child when getting coverage for them, and we use it only for that.

We will post any changes here and update the date above. If a change is material, we will tell you on the site or by email before it takes effect.

Email privacy@withmalta.com or write to Malta, Attn: Privacy, 2261 Market Street STE 33206, San Francisco, CA 94114.