Privacy Policy

• You can browse plans without an account. An account needs only an email address.
• Plan documents you upload are read by our AI provider, Anthropic, to pull out the plan details. We don't store the file itself.
• We store chat conversations and delete chat messages after 90 days.
• We don't sell your personal information, we don't show ads, and we don't use advertising or cross-site trackers.
• We don't take commissions or payments from insurers, brokers or enrollment sites.
• You can delete saved plans and bookmarks yourself at any time, and ask us to delete your account by emailing hello@simplivera.com.

Simplivera is operated by [Company legal name](“Simplivera”, “we”, “us”), [Mailing address]. You can reach us about anything in this policy at hello@simplivera.com.

Simplivera is an educational tool for understanding and comparing health insurance plans. We are not an insurance company, agent or broker, and we don't enroll anyone in a plan. See our Terms of Use.

Your account

Accounts are free. To create one you give us an email address and either choose a password or sign in with a one-time code we email you. We don't ask for your name. Sign-in is handled by our database and authentication provider, Supabase, which stores your email address and (if you set one) a securely hashed version of your password.

Your profile

If you fill in your profile, we store what you enter, which can include:

• your ZIP code, state and county, and your household size;
• your estimated annual household income and its main source;
• tax details you choose to add, such as filing status, tax rates and health savings account (HSA) contributions;
• your Smart Match answers — for example, how you rate your health, whether you have an ongoing condition, how often you see specialists, how many prescriptions you take and whether you expect a surgery. If you answer Smart Match and then sign in or create an account, those answers are saved to your profile;
• medications you add to your profile, and any details you enter about them;
• doctors and other providers you add, and whether each one is a “must-keep”;
• plans you bookmark.

When you search for a medication in your profile, the search text goes from your browser directly to the U.S. Food and Drug Administration's public openFDA service to suggest drug names. It does not pass through our servers.

Plan documents you upload

You can upload a plan document — a Summary of Benefits and Coverage (SBC), an employer benefits guide, a plan comparison chart or a benefit summary — so we can pull out the details of the medical plans in it. Uploading needs a free account. Files must be PDFs of 4.4 MB or less, and each account can analyze up to 10 documents in a 24-hour period.

• The file.Your PDF is read in memory on our server, which picks out the pages that describe the medical plans and sends them to Anthropic, whose Claude AI models extract the plan details (deductibles, copays, out-of-pocket limits, premiums and so on). The pages go as text; scanned pages, and a few table pages so their columns are read correctly, also go as images; and pages about employer HSA contributions may also be sent in a separate, closer read. When those pages can't be picked out (for example, in a scanned document), the whole file is sent instead. Anthropic processes what it is sent under its commercial API terms. We don't save the file.
• The file name.We record the file name, the type of document, the time and how many pages were read, to count your uploads against the daily limits. Our server logs record the document type and how the reading went (as counts, page numbers and ratings, never the document's contents).
• The extracted plan details. On the plan document page, these are kept only if you choose to save the plan. When you add a plan document from inside a chat, it is saved to your plan library automatically, because that is how the chat gets to use it. Either way, you can delete a saved plan at any time from your plan library or dashboard.
• A fingerprint of the file. To avoid re-reading the same document, we keep the extracted plan details (not the file, and not who uploaded it) linked to a fingerprint of the file, for up to 180 days.

Please upload only documents you have the right to share, and don't upload documents that contain other people's personal information without their permission.

Chat

You can use the Companion chat with or without an account. We store your messages and the replies so you can return to a conversation, and we use the first 80 characters of your first message as the conversation's title. If you chat without an account, the conversation is tied to your browser by a cookie; if you sign in and keep chatting in that conversation on the same browser, it moves into your account.

To answer, your messages and recent conversation history are sent to Anthropic. If you are signed in, we also send the details from your profile that help answer plan questions: your ZIP code and state, household size, annual income, a summary of your Smart Match answers, the names of your medications and the names of your must-keep providers. If you add your own saved plans to a conversation, their details are sent too.

When you ask the chat what marketplace plans would cost you, it can look up a live estimate from the federal Health Insurance Marketplace API run by the Centers for Medicare & Medicaid Services (CMS). That lookup sends CMS your ZIP code, state, county, household income and the ages of the people to be covered.

Questions you ask about your plans on the plan document page are sent to Anthropic together with the extracted plan details, to answer them. We don't store those conversations.

Please don't type information into the chat that you don't want stored and processed this way.

Subsidy estimates

If you enter your household details on the plans pages to estimate your premium after subsidies (ZIP code, county, ages, household size and income), they are kept in your browser tab's session storage, which is cleared when you close the tab. They are sent only to our server to calculate the estimate, and we don't store or log them there.

Waitlist and contact form

If you join the waitlist, we store your email address and which page you signed up from, and send you a confirmation email. If you use the contact form, we store your name, email address, topic, message and any plan ID you include, and email the message to our support inbox so we can reply. For both, we also record the page you came from, with personal details such as a ZIP code removed.

Payments

Simplivera doesn't sell anything. If you bought something before we stopped selling, the payment was handled by Stripe, which keeps its own records of past payments; we never received your card details.

Analytics

We use Vercel Web Analytics, which counts page views without cookies. It records the page visited, the referring site and general device, browser and location information. Before a page address is sent to it, we remove personal details such as ZIP code, county, income, household size and ages.

We also keep our own record of a few steps people take on the site — for example, that a sign-up prompt was shown or that a comparison was started — so we can tell whether those steps work. Each record holds the step's name, simple labels and counts, the page path (without its query string), a random ID stored in your browser, a rough device category (browser or bot), and your account ID if you are signed in. It never includes health details, Smart Match answers, ZIP codes, income, medications or providers.

We may use Google Analytics to understand how the site is used. If we do, Google sets cookies (such as _ga) and receives your IP address, device and browser details, and the pages you visit — with ZIP codes, counties, income, household size and ages removed from page addresses before they're sent. We don't use advertising or cross-site tracking features: Google signals and ad personalization are turned off.

If we use Google Analytics, we ask first. A banner asks whether you accept analytics cookies, and Google Analytics doesn't load at all — no script, no cookies, nothing sent to Google — unless you click Accept. You can change your choice at any time with “Cookie settings” in the site footer; declining stops Google Analytics and deletes its cookies from this site. You can also opt out with Google's browser add-on or by blocking cookies. While Google Analytics isn't in use, there is no banner and the site sets only the essential cookies listed below.

We don't use advertising networks or any advertising or cross-site trackers.

Server logs

Like most websites, our hosting provider, Vercel, keeps request logs that include your IP address, the address of the page you requested and your browser type. Searching plans by ZIP code puts the ZIP code in the page address, so it appears in your browser history and in these request logs. When you enter a ZIP code in Smart Match or your profile, the site also looks up its state and county by sending the ZIP code to our own server in the request address, so it appears in these logs too. ZIP codes are removed before anything is sent to analytics.

Our other providers keep their own logs: Supabase records sign-in activity (such as the IP address and browser used to sign in), and Resend records the emails it delivers for us (recipient address, subject and delivery status).

Essential cookies are always on, because the site needs them to work. Analytics cookies are set only if you accept them.

Essential

• Sign-in cookies set by Supabase keep you signed in.
• cc_session links an anonymous chat conversation to your browser. It lasts up to 30 days and is removed when the conversation moves into your account or you sign out.
• sv_csr_tier remembers which cost-sharing level (an income band worked out from the household income you entered) to show on the plans list. It is deleted when you close your browser.
• sv_analytics_consent remembers whether you accepted or declined analytics cookies, for 12 months. It is set only when we ask (that is, only if Google Analytics is in use).

Analytics (only if you accept)

• _ga and related cookies are set by Google Analytics, if we use it and you accept, to count visits (see Analytics above). They are not used for advertising.
• Vercel Web Analytics, our page-view counter, uses no cookies.

We don't use advertising cookies. The site also keeps a few things in your browser's own storage, such as the random analytics ID described above, which chat conversation you had open, and (only for the current tab) your Smart Match answers and household details while you are using them. You can clear these at any time in your browser settings.

We use the information described above to:

• run your account and show you your saved plans, bookmarks and profile;
• extract plan details from documents you upload, and answer your chat questions;
• estimate costs and subsidies and rank plans against the answers you give;
• enforce limits that keep the service affordable to run, and prevent abuse;
• reply to messages you send us and send waitlist confirmations;
• understand, in aggregate, which parts of the site work and fix what doesn't.

We don't sell your personal information, share it for advertising, or use your documents, profile or chats to train AI models.

We share information only with the service providers that run parts of Simplivera for us, and only what each needs:

• Supabase — our database and sign-in provider. It stores your account, profile, saved plans, bookmarks, chats and the other records described in this policy.
• Vercel — hosts the website, keeps request logs and provides our page-view analytics.
• Anthropic — provides the Claude AI models that read uploaded documents and answer chat questions.
• Resend — delivers waitlist confirmation emails and forwards contact-form messages to us.
• CMS Health Insurance Marketplace API — a federal government service that returns live premium estimates when the chat looks one up for you.
• openFDA — a public U.S. Food and Drug Administration service that suggests medication names as you search.
• Google Analytics (if we use it, and only if you accept) — measures how the site is used, as described under Analytics above.
• Stripe — processed payments in the past; it no longer receives anything new from us.

Within Simplivera, the people who run the site can see the stored records described in this policy when needed to operate it — for example, to read and answer contact messages, help with an account, investigate a problem or carry out a deletion request. They don't browse your information for any other reason.

We may also disclose information if the law requires it, to protect the safety or rights of people or of Simplivera, or as part of a merger, sale or transfer of the business, in which case this policy would continue to apply to it.

Some of what you can give us — Smart Match answers, medications, providers, plan documents and chat messages — is about your health. We treat it carefully: it is never used for analytics or advertising, and it is shared only with the providers above to deliver what you asked for.

Simplivera is not a health plan, a health care provider or a health care clearinghouse, and we don't receive your information from them. That means the federal HIPAA privacy rules that apply to those organizations generally don't apply to the information you give us. This policy describes how we handle it.

• Account and profile: until you ask us to delete your account.
• Saved plans and bookmarks: until you delete them, or your account is deleted.
• Chat messages:we delete each message 90 days after it was sent. A conversation's title (the first 80 characters of its first message) is kept after that. For a conversation in your account, the title is kept until you ask us to delete it or your account. A conversation you had without an account isn't linked to any email address, so we can't find it on request; its messages are still deleted after 90 days, and its title is kept with no link to an account.
• Uploaded files: not stored. The record of each upload (file name, document type and time) is kept with your account.
• Waitlist sign-ups and contact messages: until you ask us to delete them.
• Our own site-usage records: kept to measure the site over time. When an account is deleted, the link between those records and the account is removed.
• Server logs and analytics: kept by Vercel for its standard retention periods.

• Delete saved plans and bookmarks yourself at any time, from your dashboard, your plan library or the plan itself. You can also change or remove your profile details, medications and providers in your profile.
• Delete your account or your chats by emailing hello@simplivera.comfrom the address on your account. This is a manual process for now. Deleting your account deletes your sign-in, profile, medications, providers, bookmarks, saved plans, upload records and the chat conversations in your account. We will reply within 30 days. Chats you had without an account aren't linked to you, so we can't identify them to delete them; their messages are deleted automatically after 90 days.
• Access, correction and deletion. Depending on where you live, you may have rights to know what personal information we hold about you, get a copy of it, correct it or have it deleted. We offer these to everyone, wherever you live: email us and we will respond within 30 days. We may need to confirm that the request comes from you, usually by replying from the email address on your account. We won't treat you differently for making a request.
• Opting out of sale or targeted advertising.We don't sell personal information or use it for targeted advertising, so there is nothing to opt out of.
• Browser controls.Clearing your browser's cookies and site data removes everything the site stores on your device.

The site is served only over encrypted connections (HTTPS). Account data is protected by database rules that let a signed-in person read only their own records, and the keys that bypass those rules are used only on our servers. No system is perfectly secure, so please use a strong, unique password, and tell us at hello@simplivera.com if you think something is wrong.

Simplivera is meant for adults choosing health coverage. It is not directed to children under 13, and we don't knowingly collect personal information from them. If you believe a child has given us personal information, email us and we will delete it.

We will update this policy when what we collect or how we use it changes, and change the effective date at the top. If a change is significant, we will say so on the site before it takes effect.

Email hello@simplivera.com, use our contact form, or write to [Company legal name], [Mailing address].