Privacy Policy

About this policy

Effective date: 2026-10-08.

This Privacy Policy explains how Objectiv LLC ("Objectiv", "we", "us") collects, uses, shares, and protects personal information through the Objectiv website and platform. It covers website visitors, employer administrators, employees, and the dependents whose information an employer provides. It is also our notice of insurance information practices.

We collect information from employers, from employees, from insurance carriers when we serve your coverage, from website visitors, and from public sources such as a company's own website. Most information about employees and dependents comes from their employer, not from them directly.

We do not use pretext interviews, and we do not obtain investigative consumer reports about you.

If you are an employee, your employer decides what information about you to give us, and the employer's own policies also apply to it.

Information we collect

We collect personal information, including information related to health benefits, leave, and plan enrollment. We remove identifiers from it before any automated analysis, as described below.

Account information: your sign-in email address and password (stored by our database provider in hashed form). For a company: its name, address, and employer identification number, and the name, title, email address, and phone number of its authorized signer.

Employee information, provided by employers: first and last name, email address, date of birth, gender, home ZIP code, work location ZIP code, hire and termination dates, job title, department, employment type, hours, pay rate and frequency, and annual and year-to-date wages. Depending on the features an employer uses: the type of and reason for a separation, Medicare and COBRA status, quarterly wages and paid family and medical leave withholding, the last four digits of a Social Security number if the employer enters them, benefit elections and coverage tier, and leave records, including the type of leave, its dates, paid leave application and claim numbers, absence hours, and any return-to-work restrictions or accommodations.

Information about dependents, provided by employers: first and last name, date of birth, gender, home ZIP code, relationship to the employee, and whether the dependent is a student or has a disability.

Employer health questionnaire: an employer's yes-or-no answers and short notes about its covered group as a whole, such as whether anyone is in active cancer treatment. The questionnaire asks for no names, and employers should not enter any.

Messages and documents: chat messages employees send to the employee concierge, messages administrators send to the compliance assistant, questions escalated to our team, plan documents, quotes, and proposals you upload (such as summaries of benefits, invoices, and policies), and the notices and letters the platform prepares. Business contact details for plan vendors and carriers.

Website visitors: the email address you give us on the waitlist or the rate tool, the ages and coverage choices you enter in the rate tool, the procedures and ZIP codes you search for in the price tools, a one-way coded form of your IP address when you request information, and your IP address when we limit the rate of requests.

Acceptance records: the version of these documents you accepted, a fingerprint of their text, the time, and your email address at that time.

What we do not collect: we do not ask for or store full Social Security numbers, driver's license numbers, or bank account numbers. Payment card numbers go directly to Stripe and never to us; we store only the identifiers Stripe gives us for your company's customer record and subscription.

How we use information

We use personal information to provide the platform and our insurance services: to show requirements that may apply to an employer, compute estimates, analyze plans and renewals, prepare documents, answer questions, and send notices and reminders. We also use it to bill for subscriptions, keep the platform secure, limit abuse, meet our legal and insurance-licensing duties, and respond to your requests.

We send service emails about your account and your company's requirements. We may send marketing emails, and every marketing email has an unsubscribe link that works without signing in.

We do not sell personal information, and we do not share it for targeted advertising.

Automated drafting and analysis

Some features send text to Anthropic, which provides automated drafting and analysis, and return its response to you. No protected health information is sent to Anthropic or to any other provider of automated analysis.

Before any request that carries information about employees or plan members, the platform removes names, member and claim identification numbers, the employer's name, and every element of a date about a person except the year. It does not send stop-loss laser information or detail about any individual with high claims. Claims information is analyzed only as group totals, never as an individual's claim record, even with identifiers removed. Employee rosters from small groups go only as totals, and figures that could point to a person in a small group are withheld.

Before a chat message is sent, the platform checks it for the names and other direct identifiers of you and your dependents and removes them; if any remain, or the check cannot run, the message is not sent.

Census analysis sends ranges, such as age and wage bands, never names or dates of birth. Plan document text is sent after sections that hold personal health information are removed. Plan, renewal, and quote features send plan design, rates, premiums, and group-level figures. Research about a prospective client sends text from that company's public website.

Who we share information with

Your employer: an employer's administrators can see the information the platform holds for their company, including employee and dependent records, except an employee's concierge conversations, which only that employee can see in the platform. Employees see their own record.

Our staff, including our Massachusetts-licensed insurance producer, to serve you and to answer escalated questions.

Service providers that run the platform for us, each receiving only what its job needs: Supabase (database, sign-in, and file storage; it holds the information stored in the platform and sends account emails); Netlify (website hosting; it receives your requests to the website, including your IP address and browser information); DigitalOcean (hosting for our own servers that extract text from uploaded documents, prepare letters and compliance calendars, and look up prices); Anthropic (automated drafting and analysis, as described above); Resend (email delivery; it receives the recipient email address and the message); Stripe (payments; it receives the company name, the billing contact email address, and the card details you enter on its checkout page); Google Fonts (it receives your IP address and browser information when a page loads its fonts); and Zippopotam.us (it receives a ZIP code you enter in the price tools, to find its location).

Insurance carriers, when you ask us to place or change coverage or sign a broker-of-record letter for us to send. Census files in a carrier's format are prepared for you to download and send yourself.

Others, only when the law requires it, to protect rights and safety, or as part of a merger, acquisition, or sale of assets, in which case the information stays subject to this policy.

Objectiv has no affiliates. We disclose personal information outside Objectiv only as this section describes and as the law permits, and these practices continue after you stop being a client.

Cookies and browser storage

The platform does not use advertising or analytics cookies, and it does not track you across other websites. Your browser's local storage keeps your sign-in session and a few display preferences, such as whether a panel is collapsed.

Because we do not track you across websites, the platform does not respond differently to a browser's Do Not Track signal.

How long we keep information

Each document uploaded to your plan document library carries a retention date set when it is uploaded: 6 years for every document, including census files. If you start onboarding and do not finish within 30 days, the unfinished onboarding session is cleared automatically. Documents you uploaded during it are kept as plan documents, with the retention dates above.

Quotes and proposals uploaded during a renewal, and carrier census files the platform prepares, have no retention date set in the platform; they follow the schedule below.

Our retention schedule: information about employees and dependents, chat messages, and uploaded documents is kept while your company's account is open and deleted within 90 days after it closes, or sooner if you ask us. Broker-of-record letters and coverage placement records are kept for 6 years after the transaction, and company account and acceptance records for 6 years after the account closes, because contract claims can be brought for 6 years. Commission and billing records are kept for 7 years, for tax purposes. Unsubscribe requests are kept indefinitely, so that we keep honoring them. Website leads are kept for 2 years after the last contact, and the IP addresses in our rate-limit log for 90 days. Copies in our providers' backups expire on their own schedules.

We do not yet delete these records automatically when their retention date passes. Until we do, we delete them by hand, and until then they stay stored and protected as this policy describes. You can ask us to delete information sooner, unless the law requires us to keep it. When we delete information, we erase it so it cannot practicably be read or reconstructed.

A company closes its account by asking us at the contact address below; the 90-day period starts when we confirm the closure.

How we protect information

The database limits each company's users to that company's records, and limits employees to their own. Uploaded files are kept in private storage. Information between your browser and the platform travels over encrypted connections. Access to our servers requires key-based sign-in. Before text goes to automated analysis, the platform removes the identifiers described above.

No method of storing or sending information is completely secure. If a breach of security affects your personal information, we will notify you, your employer where it applies, and regulators, as the law requires.

Your choices and rights

You can ask to see the personal information we hold about you, to correct it, or to delete it. Send your request to the contact address below. We will confirm your identity first and respond within 30 business days. If we cannot meet a request, for example because the law requires us to keep the information, we will tell you why.

If your employer provided your information, you can also ask your employer to correct it. You can unsubscribe from marketing emails at any time through the link in each one.

Insurance information rights: when you ask to see your information, we also tell you, to the extent we have recorded it, who we disclosed it to in the past two years and where it came from. If we decline to correct information you dispute, you may send us a short statement of disagreement, which we keep with the information and send to anyone we later disclose it to. If we decline to correct information you dispute, we will tell you why, and you may ask the Massachusetts Commissioner of Insurance to review our decision. When we correct information, we tell those we disclosed it to in the past two years, if you ask us to. Information in a report prepared by an insurance-support organization may be kept by that organization and disclosed to other persons.

You may see and copy your recorded information in person or get a copy by mail. If an adverse underwriting decision is made about you, you may ask us in writing for the specific reasons.

Some states give their residents more privacy rights. Where one of those laws applies to us, we will honor the rights it gives you. Nevada residents may send a request to opt out of the sale of their information to the contact address below; we do not sell personal information.

Health information

Medical bill review is not offered. A bill submitted on the Medical Bills page is refused without being read or stored. Before we offer the feature, we will update this policy and ask you to accept the new version.

The explanation of benefits check is not offered. Before we offer it, we will update this policy and ask you to accept the new version.

Where we sign a business associate agreement with an employer or its group health plan, that agreement also governs how we handle the plan's health information.

Children

The platform is not directed at children, and we do not knowingly collect personal information directly from children under 13. Employers and employees may give us information about dependents who are children, which we handle as this policy describes.

Where information is processed

We store information in the United States. Our website host may deliver web pages from servers outside the United States.

Changes to this policy

When we change this policy, we publish a new version with a new version number. The next time you sign in, you are asked to review and accept it before you continue.

Contact us

Privacy questions and requests: hello@objectivbenefits.com, or Objectiv LLC, P.O. Box 131, Sherborn, MA 01770.