Unbrokered
Get started

Legal

Privacy Policy

Effective Date: October 19, 2026

1. Introduction

Unbrokered Health, LLC (“Unbrokered,” “we,” “us,” or “our”) is a North Carolina limited liability company that provides benchmarking, analytics, and fiduciary-documentation services for employers that sponsor health and welfare plans, and for the advisors, attorneys, and researchers who work with them. We are committed to transparency about how we collect, use, and protect information. This Privacy Policy describes our practices when you access or use our website at https://unbrokered.health (the “Site”), our web application (the “Application”), or otherwise interact with us (collectively, the “Services”).

Neutrality is a core principle of Unbrokered. No broker, carrier, pharmacy benefit manager, or vendor pays for placement or data on our platform. We do not sell your personal information, and we do not share it for cross-context behavioral advertising purposes.

By accessing or using our Services, you acknowledge that you have read and understand this Privacy Policy. If you do not agree with our practices, please do not use our Services.

2. Information We Collect

We collect personal information in the following ways:

2.1 Information You Provide to Us

When you create an account, use our Services, or communicate with us, you may provide:

  • Account Information: Your name, the email address you use to sign in, professional information such as your job title, and the role and firm name you provide at onboarding.
  • Payment Information: When you make a purchase, your payment is processed by our third-party payment processor, Stripe. We do not directly collect or store your credit card or bank account numbers. We retain only transaction metadata and a Stripe customer identifier.
  • Commercial Information: Records of products or services you have purchased, obtained, or considered through our platform.
  • User-Generated Content: Documents you upload (such as broker-compensation disclosures), plan or employer data you enter during onboarding, and messages you submit through our in-product research features. You should not upload documents containing protected health information (“PHI”), and any use of our Services for the uploading of PHI is contractually prohibited.
  • Communications: Information you provide when you contact us for customer service or support, respond to a survey, or otherwise communicate with us.

2.2 Information Collected Automatically

When you access our Services, we automatically collect certain information, including:

  • Device and Browser Information: Information about the device and browser you use to access our Services, including device type, operating system, and browser type.
  • Usage Information: Information about your interactions with our Site and Application, including pages visited within our platform, features used, and actions taken.
  • IP Address: Your Internet Protocol address, which may indicate your general geographic location.
  • Identifiers: Unique online identifiers associated with your account or device for analytics purposes.

We do not collect: Social Security numbers, driver’s license or passport numbers, phone numbers, consumer mailing addresses, bank or credit card numbers (Stripe processes payments directly), biometric information, precise geolocation data, demographic information, education information, or browsing history on third-party websites.

2.3 Information from Third-Party Sources

We collect information from the following third-party sources to support our Services:

Public Government Records

We collect information from publicly filed U.S. Department of Labor Form 5500 filings (including Schedules A and C), which contain broker-compensation data, plan-contact names, and employer plan information. We also collect publicly available drug-pricing data from the Centers for Medicare & Medicaid Services (“CMS”) National Average Drug Acquisition Cost (“NADAC”) database. While these filings and databases are publicly available, we recognize that information obtained from public government records may still constitute personal information under applicable privacy laws, and we treat it accordingly.

Third-Party Business Intelligence Providers

We use third-party business intelligence services, such as Apollo.io, to obtain or verify business contact information—including names, professional email addresses, and business titles or roles—for individuals associated with employers identified through public Form 5500 filings. This enriched contact information is used for personalized business-to-business outreach to employer finance and human resources contacts. Information obtained through third-party enrichment services is not derived from the public government filings themselves and is treated as personal information subject to this Privacy Policy.

3. How We Use Your Information

We use personal information for the following purposes:

  • Providing and Maintaining Services: To create and manage your account, process transactions, deliver our benchmarking and analytics services, and generate fiduciary-documentation artifacts.
  • Customer Support: To respond to your inquiries, requests, and provide technical support.
  • Communications: To send you service-related notices, product updates, promotional information, and newsletters. You may opt out of marketing communications at any time (see Section 9).
  • Analytics and Improvement: To understand how our Services are used, identify trends, and improve functionality and user experience.
  • Research and Development: To develop new products, features, and services.
  • Benchmark Treatment: Broker-compensation submissions may be used to calculate or verify your own current figure, but they do not enter broker peer benchmark cells; those cells use public Form 5500 Schedule A/C filings only. Employer-submitted Rx information may contribute to an Rx peer pool only as described when that information is collected and in de-identified, aggregated form.
  • Business-to-Business Outreach: To contact employer finance and human resources professionals identified from public Form 5500 filings and enriched through third-party business intelligence providers, for the purpose of offering our Services.
  • Security and Fraud Prevention: To protect our Services, detect and prevent fraud, and enforce our terms.
  • Legal Compliance: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests.

4. How We Share Your Information

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising. We may disclose your personal information to the following categories of recipients, solely for the purposes described in this Privacy Policy:

4.1 Service Providers

We engage third-party companies and individuals to perform services on our behalf. These service providers are authorized to use your personal information only as necessary to provide services to us and are contractually obligated to protect your information. Our service providers fall into the following categories:

  • Payment Processing: Our payment processor, Stripe, handles all payment transactions through hosted checkout. Card data is entered directly with Stripe and is not stored by Unbrokered. We retain only Stripe customer identifiers and transaction metadata.
  • Cloud Infrastructure and Hosting: We use third-party providers for cloud database services, user authentication, and secure file storage.
  • Email Services: We use third-party providers for transactional email delivery (such as account notifications) and outbound email delivery for business communications.
  • Artificial Intelligence: Our AI provider, Anthropic, processes data in connection with AI-powered features of our Services (see Section 5 for details).
  • Business Operations: We use third-party providers for accounting, invoicing, banking, and business email and productivity tools.

4.2 Legal Requirements and Protection of Rights

We may disclose your personal information if required to do so by law, or in the good-faith belief that such action is necessary to: (a) comply with a legal obligation, subpoena, court order, or governmental request; (b) protect and defend our rights or property; (c) prevent fraud or other illegal activity; or (d) protect the personal safety of users or the public.

4.3 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal information may be transferred as part of that transaction. We will notify you via email or a prominent notice on our Site of any change in ownership or uses of your personal information.

5. Artificial Intelligence

We use artificial intelligence (“AI”) technology to enhance certain features of our Services. We believe in transparency about our use of AI and provide the following disclosures:

5.1 How We Use AI

  • Ask Unbrokered: This feature (available to customers whose purchase includes it) lets you query your filings and aggregated peer benchmarks using natural language. It is powered by a third-party large language model.
  • Internal Analysis: We may use AI tools to assist with internal data analysis and service improvement.

5.2 What Ask Unbrokered stores

Chat transcripts are not stored by default. A conversation lives in your browser session (and in server memory for that session only) and is gone when the session ends. A rolling summary used to keep long chats coherent is also session-only.

We store only what you explicitly create or confirm:

  • Plan facts, after the assistant asks “Save this to your plan facts?” and you confirm. You can view, edit, or delete each fact from the “What we know about your plan” panel for the life of the account.
  • Game plans, when you press “Build my game plan” or “Update game plan.” They remain in My Reports, like a report PDF, and you can delete them.
  • Drafts (letters, emails, memos), only when you click “Save draft.” They remain in My Reports until you delete them.
  • Support-note transcripts, only if you leave “Include this conversation” checked when sending a note to the Unbrokered team. Those transcripts are cleared 90 days after the request closes.
  • Guard-hit records, when an output-safety check fires. These contain the flagged response and the triggering user message only, and are deleted after 30 days.
  • Usage ledger, for every model call: token counts, cost, mode, and model. This ledger does not contain prompts, responses, or summaries.

Any future change to keep chat transcripts by default will go through legal review first.

5.3 Data Sent to AI Providers

When you use AI-powered features, the personal information sent to our AI provider is limited to your query, recent session messages, and associated account or employer context necessary to generate a response. We do not send your payment information, uploaded documents, or other unrelated personal information to our AI provider.

5.4 AI Provider Commitments

Our AI provider, Anthropic, is a contracted service provider that processes data solely on our behalf and in accordance with our instructions. Anthropic does not use data submitted through our Services to train its models.

5.5 No Automated Decision-Making

We do not use AI to make solely automated decisions that produce legal or similarly significant effects on individuals. AI-generated outputs are intended to support—not replace—human analysis and decision-making.

6. Cookies and Tracking Technologies

6.1 Cookies We Use

We use a limited number of first-party cookies to operate our Services:

  • Authentication Cookie: A session cookie that keeps you logged in while you use the Application.
  • Analytics Cookie: A first-party analytics identifier used to understand how visitors interact with our Site. Bot traffic is excluded from analytics collection.

6.2 What We Do Not Use

We do not use third-party advertising cookies, session replay tools, tracking pixels on our Site, or remarketing services. We do not engage in cross-site tracking or behavioral advertising. Our outbound email campaigns may include standard email open and click tracking to measure campaign performance, which is a common practice in business communications.

6.3 Managing Cookies

Most web browsers allow you to manage cookie preferences through browser settings. Please note that disabling cookies may affect the functionality of our Services, including your ability to remain logged in.

7. Data Retention

We retain personal information while your account is active and for as long as reasonably needed to provide the Services, secure the platform, maintain transaction and audit records, comply with legal obligations, resolve disputes, and enforce our agreements. Different categories may have different retention periods.

If you request deletion of your account, we will delete or de-identify personal information within a reasonable period, except where retention is reasonably necessary or permitted for legal, security, fraud-prevention, transaction-record, or dispute purposes. Deletion of account data does not remove public government records from their original sources or from public-record datasets.

Purchased report PDFs and invoices are generally available while an account is maintained. If an account is terminated, we provide at least ninety (90) days of reasonable access to download those materials, consistent with our Terms of Use. Users should retain their own copies for long-term records. If you request account deletion, we may remove account-hosted copies after completing the request, subject to the exceptions above.

Information derived from public government records (such as Form 5500 filings) may be retained indefinitely as part of our benchmarking databases, as this information remains publicly available from its original government source.

8. Data Security

We implement reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, disclosure, alteration, and destruction. These measures include encryption of data in transit and at rest, access controls, and regular review of our security practices.

However, no method of transmission over the Internet or method of electronic storage is completely secure. While we strive to use commercially reasonable means to protect your personal information, we cannot guarantee its absolute security.

If you believe your account has been compromised, please contact us immediately at the address provided in Section 14.

9. Your Privacy Rights

9.1 General Rights

Depending on where you reside, you may have certain rights with respect to your personal information under applicable privacy laws. These rights may include:

  • Right to Know: The right to request information about the categories and specific pieces of personal information we have collected about you, the sources of that information, the purposes for collection, and the categories of third parties with whom we share it.
  • Right to Access: The right to request a copy of the personal information we hold about you.
  • Right to Delete: The right to request deletion of the personal information we have collected about you, subject to certain legal exceptions.
  • Right to Correct: The right to request correction of inaccurate personal information.
  • Right to Opt Out: The right to opt out of certain processing activities, such as targeted advertising or the sale of personal information. As noted above, we do not sell personal information or use it for targeted advertising.
  • Right to Non-Discrimination: The right not to receive discriminatory treatment for exercising your privacy rights.

9.2 California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”). We respect the privacy rights of California residents and will respond to verifiable requests in accordance with applicable law. To the extent CCPA applies to our processing of your personal information, you may exercise the rights described in Section 9.1 by contacting us as set forth in Section 14.

Notice Regarding Sale and Sharing: We do not sell personal information as defined under the CCPA. We do not share personal information for cross-context behavioral advertising.

9.3 Residents of Other States

Residents of Virginia, Colorado, Connecticut, and other states with comprehensive consumer privacy laws may have similar rights under their respective state statutes. We are committed to respecting the privacy rights afforded to you under the laws of your state of residence. If you wish to exercise any applicable rights, please contact us as set forth in Section 14, and we will respond in accordance with applicable law.

9.4 Exercising Your Rights

To submit a privacy rights request, please contact us at support@unbrokered.health. We will verify your identity before processing your request and will respond within the time period required by applicable law. You will not be required to create an account to submit a request.

9.5 Opting Out of Marketing Communications

You may opt out of receiving promotional or marketing emails from us by clicking the "unsubscribe" link included in each such email, or by contacting us at the address provided in Section 14. Please note that even if you opt out of marketing communications, we may continue to send you transactional or service-related messages (such as account notifications and security alerts).

10. Third-Party Links

Our Services may contain links to third-party websites, services, or resources that are not owned or controlled by Unbrokered. We are not responsible for the privacy practices or content of these third parties. We encourage you to review the privacy policies of any third-party sites you visit. This Privacy Policy applies solely to information collected through our Services.

11. Children’s Privacy

Our Services are not directed to individuals under the age of 18, and we do not knowingly collect personal information from children. If we learn that we have inadvertently collected personal information from a child under 18, we will take steps to delete that information promptly. If you believe we have collected information from a child, please contact us at the address provided in Section 14.

12. International Users

Our Services are designed for and directed to users in the United States. If you access our Services from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States, where our servers are located and our central database is operated. By using our Services, you consent to the transfer of your information to the United States.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will notify you by updating the "Effective Date" at the top of this Privacy Policy and, where required by applicable law, by providing additional notice (such as a prominent notice on our Site or an email notification).

We encourage you to review this Privacy Policy periodically. Your continued use of our Services after any changes become effective constitutes your acknowledgment of the revised Privacy Policy.

14. Contact Us

If you have any questions or concerns about this Privacy Policy, our data practices, or if you would like to exercise any of your privacy rights, please contact us at:

Unbrokered Health, LLC

Mail: 3064 Wake Forest Road, #1103, Raleigh, NC 27609

Email: support@unbrokered.health

Website: https://unbrokered.health

15. Social Media

We may maintain a presence on third-party social media platforms. When you interact with us on social media, the platform provider may collect information about you in accordance with its own privacy policy. We encourage you to review the privacy policies of any social media platforms you use.

Any information you post publicly on a social media platform is visible to others and is subject to the platform’s terms of use and privacy practices. We are not responsible for the privacy practices of any social media platform.

Our use of social media is for general informational and promotional purposes. This Privacy Policy governs only the information we collect through our own Services and does not apply to information collected by third-party platforms.