General Privacy Notice

Your privacy is important to us. This General Privacy Notice (“Notice”) describes the information BBP Admin and Risk Strategies Company ("BBP Admin", "we", "our", “us”) collects when interacting with you in connection with our products and services (such as COBRA, FSA, HRA, HSA and various employer sponsored plans and programs, each an “Account” and collectively, “Services”), or employment opportunities. This Notice also describes how our website and mobile application may collect information from you.

We encourage you to review our other applicable product, state, and regulatory notices provided below or located on bbpadmin.com. Please read those notices to understand how they apply to you and the Services. You can view the privacy practices applicable to specific types of information and to our different Services, and how we use personal information to conduct our business.

When we are administering a health benefit plan provided by your employer, the information we collect about you is subject to the requirements of the Health Insurance Portability and Accountability Act ("HIPAA"). In circumstances where HIPAA applies, your plan’s HIPAA Notice of Privacy Practices and not this General Privacy Notice will apply. If you have questions about which policy applies in a certain situation, please contact us using the Contact Information provided in this General Privacy Notice.

This website is intended for individuals who reside in the United States. We honor all individual privacy rights defined by law, as set forth herein, and in governing regulations.

We reserve the right to make changes to this Notice and our other privacy notices, and recommend you read them regularly. Your submission of personal information for job opportunities, or use of the BBP Admin website and/or our Services constitutes your acceptance of and agreement to this Notice. If you do not agree to this Notice, do not use the website, Services, or otherwise provide your personal information. If we provide Services to you, to stay current on our practices, please update your email address with us if it changes.

What information we collect

If you sign up for Services we may collect, from you or from your employer, among other information:

Your name;

E-mail and physical address;

Social security number ("SSN");

Date of birth;

Phone number;

Names of the dependents (and other identification or "ID") that are connected to or covered by your Account;

Names and ID of people authorized by you to use your Account;

Names and ID of people authorized by you to access your Account information;

Technical information associated with the device you use, such as the type and model, system language, browser type, geographical location, operating system, Internet protocol (IP) address, IDFA (identifier for advertisers), and other unique identifiers collected automatically when you interact with our website (as further detailed below in the “Cookies and Website” section); and

Transactions with us such as your Account balance, fees, payments, reimbursements, distributions, contributions, and the identity of persons to whom you make payments, including health care providers.

If you are receiving services from us, we may combine personal information that you provide us with information from other sources such as from your employer or benefits plan/program sponsor and our business partners and service providers.

If you apply for a job opportunity, we collect personal information from you in connection with your resume and the application you submit to us. We use your information to evaluate your skills and abilities for job opportunities, verify your information, carry out reference checks and/or background checks (where applicable), communicate with you about the recruitment process, recommend potential career opportunities, create and/or submit reports as required under applicable laws/regulations, and make improvements to our application or recruitment process.

The personal information we collect may include:

Identification Data – such as full name, preferred name, home address, email address, telephone number, and photo/image (if volunteered), citizenship status, or nationality.

Demographic Data – such as gender, ethnicity, disability status, gender identity, and sexual orientation. Our purposes for processing this data include the following:

To monitor and ensure diversity and equality of treatment and opportunity.

To provide work-related accommodations or adjustments; and

To comply with applicable legislation.

Note that where processing is not required or permitted by law, we will ask for your express consent.

Employment and Professional Data – such as job title/position, hire/term/rehire dates, employer information, employment contacts, CV/resume, academic/professional qualifications, skills, work-related licenses, education, references, military status, work permits, salary, desired salary.

Other Data – we may also collect personal information about you from third parties or public sources as needed to support the employment relationship or to engage with you concerning job opportunities at our company. For example, before and during your employment or assignment we may collect information from public professional sources, such as your LinkedIn profile for recruitment purposes. We also may conduct lawful background screenings to the extent permitted by law, through a third-party vendor for information about your past education, employment, credit and/or criminal history.

If you are offered and accept employment with us, the personal information collected during the job application and recruitment process may become part of your employment record. If you are not offered or accept employment, we will keep your CV/resume on file for future job openings. You may request removal of your CV/resume by submitting a request pursuant to the Data Subject Access Request process set forth herein.

How we collect information

Your Personal Information

Direct Interactions: You provide your personal information when contacting us through applications, this website, mobile applications, signing up for or receiving Services, emailing us, or applying for job opportunities through candidate tracking systems.

Third Parties or Publicly Available Sources: We may obtain information about you from your employer, your health plan, benefit provider, publicly available online sources or government records, background check providers, criminal records check, or past or current professional references you supply to us. We will seek information from third parties only once a job offer or assignment has been made or through provisioning of Services, and will inform you that we are doing so.

It is your choice whether to provide us with personal information, however, our ability to provide or continue to provide Services or information to you may be impacted should you decline to provide us with requested information.

Cookies and Website Tracking

“Cookies” may be placed on your computer when you visit any of BBP Admin’s websites. Cookies allow us to collect technical information associated with the device you are using and collect information, including clickstream information, browser type, time and date you visited the website, and other information about your interactions with the website (as detailed above in “What Information We Collect”). Cookies can be for a single session or interaction with our website or can be persistent and stored on your computer or device until they are deleted or expire. Most internet browsers allow you to disable and delete cookies or can be set to notify you when you receive a cookie allowing you decide whether to accept it. If you choose to disable cookies some functionality on the website may be impacted or not work at all.

Additionally, like many websites, we use standard internet technology (such as web beacons, tracking pixels, and embedded scripts) to track your web-surfing activity when you are visiting our website. We also include standard internet technology in advertisements and promotional e-mail messages to determine whether advertising or messages have been acted upon. This information enables us to customize the services we offer our website visitors, to deliver targeted advertisements, and to measure the overall effectiveness of our online advertising, content, programming, or other activities. Some other examples of ways we use your activity information include developing anonymized reports regarding website usage, activity, and statistics for our internal use and assisting users experiencing website problems.

We use this information only as dictated by applicable law.

We may also allow third party service providers to use cookies and other web technologies to collect information and to track browsing activity over time and across third party websites such as web browsers used to read our websites, which websites are referring traffic or linking to our websites, which may deliver advertisements to you. We do not control these third-party technologies and their use is governed by the privacy policies of the third parties using such technologies. For more information about entities that use these technologies, see http://www.aboutads.info/consumers , and to opt-out of such ad networks’ and services’ advertising practices, go to www.aboutads.info/choices .

We use Google and Facebook technologies to advertise online. These technologies help us tailor ads that we think may be of interest to visitors to our website. As always, we respect your privacy and do not collect any personal information using these technologies. For example, we may tailor advertising based on the specific product pages you viewed on the website. These ads may appear across the internet, including websites on Google and Facebook. You may opt out of these cookies by visiting the ad settings on these entities’ webpages or through our cookie management console. Any data we collect through these technologies is used for internal purposes only, in accordance with applicable law and our privacy policies and notices.

We use Google Analytics as described at https://policies.google.com/technologies/partner-sites . You can prevent your data from being used by Google Analytics on our websites by installing the Google Analytics opt-out browser add-on or through our cookie management console. If you have accounts with third-party providers, you may be able to control your ad preferences through your account settings.

You could opt out of these cookies and web technologies at any time by using our cookie management console. You are prompted to make cookie management choices upon your first visit to our website. To update your choices, click on the Do Not Sell link at the bottom of our webpage.

How we use and share information

We may use or share the personal information listed above for the following business or commercial purposes:

Delivering our Services to you, or on behalf of another, including:

Verifying your identity, opening, and administering your Accounts and benefits, and providing other financial services under the USA PATRIOT Act.

Administering the Services that we offer you or your employer, including to determine eligibility or to review and pay claims.

Displaying claims information in your account portal with your authorization.

Communicating with you or others designated by you about your Account, benefits, and/or our Services.

Responding to inquiries.

Making payments to medical service providers.

Providing you with any health insurance information related to our Services, if applicable.

Helping to protect you and us from fraud and financial loss.

Linking accounts, you provide us to facilitate the movement of funds as directed by you.

Preparing Account statements.

Preparing annual tax reporting information, if applicable.

Protecting your health, safety, or welfare.

Delivering user surveys; and

Delivering customized content and analytics on our websites or app.

Operating our websites and maintaining or servicing your Account.

Engaging third party service providers to assist us in administering and providing our products and services pursuant to a written agreement.

Performing analytics and improving our Services and website.

Conducting internal research to develop and demonstrate technology.

Marketing our Services, only as permitted by law.

Keeping a record of our transactions and communications.

Conducting audits and reporting related to transactions and interactions, including online interactions, you may have with us or others on our behalf.

Detecting, analyzing, and preventing security incidents, and other fraudulent or illegal activity.

Identifying, debugging, and repairing errors in our systems, websites, or app that impair existing functionality.

Protecting our rights, the rights of affiliates and related third parties, or taking appropriate legal action, such as to enforce our Terms of Use.

Complying with applicable laws, regulations, administrative or legal requests, subpoenas, or otherwise as required by law.

In connection with a merger, acquisition, or other sale or transfer of all or part of our assets or business.

In accordance with your consent, authorization, or instructions.

Short-term, transient use of personal information that is not disclosed to another third party and is not used to build a profile about you or otherwise alter your experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction; and

We do not sell our customer lists or individual customer information. We will only share your personal information with third parties as outlined in our privacy notices. From time-to-time, we provide your information to nonaffiliated third-party service providers (i.e., subcontractors) to perform services for or functions on our behalf, to effect, administer, or enforce transactions necessary for the proper administration of an Account or as otherwise authorized by you.

We may also exchange information with reference sources or reporting agencies for risk management and verification, to maximize the accuracy and security of your personal information. We only use and share information needed to service your account or protect against fraud unless we are required to do so by law.

If you have an Account and are receiving Services from us, you may authorize other individuals to access your information or make changes to your Account (such as a spouse, dependent, or legal representative). You are responsible for your authorized user’s transactions. Your authorized users will have access to the Account balance if they are authenticated by our system. It is your responsibility to keep your authorizations up to date and accurate. You will be able to see all activities conducted by an authorized user.

Rights and Choices

You may have rights such as the right to know, access, and/or delete your information. These rights may differ depending on your State of residency or the source of the information, or the type of Services or Account you have. You can submit a request regarding your personal information by email to support@bbpadmin.com. If you are a BBP Admin employee, please contact your HR Department.

There may be situations where we cannot grant your request, for example, if you ask us to delete your data that is governed by a federal privacy regulation that is exempted from your state privacy law, or where BBP Admin is legally obligated to keep a record of our interactions with you to comply with law. We may also decline your request to maintain our legitimate use of data for anti-fraud and security purposes, such as when you request deletion of an account that is being investigated for security concerns. Other reasons your privacy request may be denied are if it jeopardizes the privacy of others, is frivolous or vexatious, or would require disproportionate effort.

International Data Transfer

Your personal data may be transferred, used, and stored by us and our third-party service providers outside the country in which you reside, including but not limited to the United States, where data protection and privacy regulations may not offer the same level of protection as in other parts of the world. By using our Sites, you agree to this storing, processing, or transfer.

If you use our Sites, you consent to the capture, storage, transfer, use and processing of your information under the laws of the United States. This does not affect your rights and freedoms under the General Data Protection Regulation 2016/679 (GDPR) and any successor legislation. You agree that all transactions relating to BBP Admin shall be deemed to have occurred in the United States, where we currently have our personnel and operations.

Electronic and Online Communications

We use e-mail to send newsletters, account notifications, marketing materials, and other communications, on a periodic basis to various individuals and organizations. You can opt-out of these communications at any time. For example, you can opt-out using links in a specific email communication or contact us (see Contact Information below). Opt-outs may not apply to communications related to your Account status, administrative messages, website updates, or other communications that are necessary to provide our Services.

We also, if you opt in to such communications, may use SMS text to communicate with you. We do not share your subscriber data with any other parties.

Information Security

BBP Admin places a high priority on protecting your personal information. We maintain administrative, technical, and physical safeguards designed to protect the information that you provide on this website and in connection with the Services from unauthorized access to or acquisition of such information. Please be advised, however, that regardless of our best efforts to protect information, the confidentiality and security of any communication or material transmitted to or from the website or via email cannot be guaranteed to be 100% secure at any time. We also cannot guarantee that the information you transmit over the Internet will not be unlawfully intercepted or accessed by third parties. Any transmission of your information is at your own risk. Therefore, we strongly encourage all users to be careful and responsible about what you choose to provide online. Further, when you create an Account with BBP Admin, you will create a unique password. It is your responsibility to personalize your password and protect and secure such password. BBP Admin is not responsible for any information compromised due to your failure to secure your Account or login credentials.

If you have any reason to believe that your interaction with us through this website or other means is no longer secure, please immediately notify us (see Contact Information below).

BBP Admin will, for example:

Never ask for your login or password through email or phone call.

Use your secret question and answer to authenticate you on a phone call.

Never utilize an automated voice response system when contacting you.

Information provided via our web portal is submitted within a secure session. These sessions utilize Transport Layer Security (TLS, formerly known as SSL) technology to ensure that the information is encrypted while in transit. Your browser must be able to support this technology to use our web services.

Require a User ID and password to access an Account or receive Services. This may either be provided to you, or you will be allowed to choose your own. The User ID and password are designed to protect you by confirming your identity to our computer network systems. Our employees do not have access to your password.

Automatically log you out of your Account if you are inactive after logging in for a certain amount of time.

Require you to regularly change your password from time to time.

Monitor your Account for any signs of suspicious or potentially fraudulent activity.

Maintain up to date policies, standards, and processes designed to protect your personal information and comply with applicable state and federal data security laws, regulations, and guidance.

Train our workforce on our policies, standards, and processes.

Limit access to your personal information to only those who need it to perform their duties.

Require our subcontractors to maintain the same privacy and security standards for protecting your information as we do.

California Privacy Practices

If you are a California resident, please see more information about our privacy practices and your rights in our California Privacy Notice below.

Children's Privacy

BBP Admin’s Services are intended for individuals who are at least 13 years of age. The Services may include information about dependents or beneficiaries who are under the age of 13, however, there are no Services offered directly to children under the age of 13. We do not collect personal information from children under the age of 13. If you think we have collected personal information from a child under the age of 13, without parental consent, please alert us at support@bbpadmin.com.

Contact Information

If you have any questions or comments about this Notice or our other privacy notices, the ways in which we collect and use information, or choices and rights regarding personal information, please contact us at:

Phone: 1-630-773-2337

Email: support@bbpadmin.com

Mail: BBP Admin

Attn: Privacy Officer

125 W. Orchard St.

Itasca, IL 60143

Effective Date

Last updated August 2023.

State Privacy Laws

Vermont Privacy Notice

For Vermont residents, the information sharing practices described in our General Privacy Notice are in accordance with federal law. Vermont law places additional restrictions on sharing information about their residents, and our policies comply with such restrictions.

Nevada Privacy Notice

Nevada law requires that we also provide Nevada residents with the following contact information: Bureau of Consumer Protection, Office of the Nevada Attorney General, 555 E Washington St., Suite 3900, Las Vegas, NV 89101; phone: 702.486.3132; e-mail: BCPINFO@ag.state.nv.us.

California Privacy Notice

For California residents, our information sharing practices are in accordance with federal law. California law places additional restrictions on sharing information about their residents, and our policies comply with such restrictions.

Direct Marketing Requests

California Civil Code Section 1798.83 permits you, if you are a California resident, to request certain information regarding disclosure of Personal Information (defined below) to third parties for their direct marketing purposes. To make such a request, please send an e-mail to support@bbpadmin.com or write us at Privacy Officer, BBP Admin, 125 W Orchard St. Itasca, IL 60143.

Do Not Track Settings

Cal. Bus. And Prof. Code Section 22575 also requires us to notify you how we deal with the “Do Not Track” settings in your browser. As of the effective date listed below, there is no commonly accepted response for Do Not Track signals initiated by browsers. Therefore, BBP Admin’s system does not respond to the Do Not Track settings. Do Not Track is a privacy preference you can set in your web browser to indicate that you do not want certain information about your web page visits tracked and collected across websites. For more details, including how to turn on Do Not Track, visit www.donottrack.us.

California Consumer Privacy Act/California Privacy Rights Act Supplemental Notice

This California Privacy Notice is intended to supplement our other privacy notices.

To understand our privacy practices, you should refer to our other privacy notices and this supplemental California notice (“Notice”).

Applicability

The California Consumer Privacy Act (“CCPA”), the California Privacy Rights Act (“CPRA”), and this Notice apply to visitors, users, and others who are California residents (“consumers” or “you”).

This Notice applies to California residents’ Personal Information, as defined below, we collect to provide them with certain products and services (collectively, “Services”). The CCPA and CPRA do not apply to Personal Information for some of our Services that are excepted from the CCPA and CPRA, such as those subject to the Health Insurance Portability and Accountability Act of 1996 (HIPAA) or Gramm-Leach-Bliley (GLBA). The requirements of CCPA and CPRA further do not apply to deidentified or aggregate consumer information.

In addition, updated CCPA/CPRA requirements went into effect on January 1, 2023, for applicable Services related to employee and business-to-business Personal Information. As a result, this Notice also applies to employees, applicants for employment, and independent contractors, who are California residents.

Personal Information

The CCPA and CPRA define “Personal information” as information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a consumer or household. Under the CPRA, “Personal Information” further includes “Sensitive Personal Information” such as social security number, driver license number, state identification card, passport number, financial data, genetic data, biometric data, precise geolocation, and racial and ethnic origin, content of consumer communications (email, mail, or text), unless the business is the intended recipient, genetic data, and information collected concerning a consumer’s health, sex life, or sexual orientation.

Below are the categories of Personal Information that we may have collected or shared for a business purpose in the last twelve (12) months, as permitted by law and depending on the product you receive:

Category	Examples	Possibly collected or shared for a business purpose in the last 12 months
A. Identifiers	Real name, alias, postal address, email address.	Yes
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	Identifiers listed in the preceding category A and subsequent category I, and signature, social security number, telephone number, passport number, driver’s license or state identification card number, insurance policy number, bank account number, or any other financial information, medical information, health insurance information.	Yes
C. Protected classification characteristics under California or federal law.	Age, marital status, medical condition, gender, veteran, or military status.	Yes
D. Commercial Information	Products or services purchased, consumer history	Yes
E. Biometric information	N/A	Yes
F. Internet or other similar network activity.	Browsing and search history, usage of, and information regarding your use of our applications or website. This information may be used to create anonymous data to help us better understand customer preferences and needs.	Yes
G. Geolocation data.	City and state location of your device, which may include GPS-based, WiFi based, or cell-based location information. You can disable collection of location information by our app at any time in your mobile device settings.	Yes
H. Sensory data.	Audio recordings of calls when you call our customer service, and Internet and electronic network activity, as described above. You are notified at the beginning of a call whether the call is being recorded.	Yes
I. Professional or employment-related information.	Resume and employment application information.	Yes
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g, 34 C.F.R. Part 99)).	Where applicable, student information related to eligibility for benefits.	Yes
K. Inferences drawn from other personal information.	Inferences drawn from (1) the information we collect when you visit our website, use our app, or interact with our tools, widgets, or plug-ins, (2) information we collect from reimbursement claims, and (3) information about user preferences and behavior that we collect on our website and mobile app to create a profile about a user reflecting the user’s preferences, characteristics, predispositions, behavior, and abilities.	Yes
L. Sensitive personal information.	Identifiers listed in the preceding category B and precise geolocation, racial and ethnic origin (when hired for a position), the contents of communications where BBP Admin is not an intended recipient.	Yes

Retention

We retain Personal Information about you necessary to fulfill the purpose for which that information was collected and in accordance with your employer’s contract with us, consistent with applicable laws. We generally retain information regarding [for example, an individual’s Commuter Account with us] for at least seven years from [the date of our last interaction/account closure/etc.], in compliance with our obligations under applicable laws, or for longer if required to do so according to our regulatory obligations or where we believe necessary to establish, defend, or protect our legal rights or those of others.

When we destroy your Personal Information, we do so in a way that prevents that information from being restored or reconstructed.

Categories of Sources of Personal Information

Below are the sources from which we may receive your Personal Information:

directly from you when you inquire about our Services via our website or by telephone

from you when you or a benefit program sponsor creates an account with us

from you when you submit a claim for reimbursement

from your device when you access our website, mobile app and other online services

from your employer (where applicable) when related to Services that are covered by CPRA and CCPA

from third parties that assist us in providing relevant Services

We may combine Personal Information that you provide us through our website with other information we have received from you or your employer plan or program sponsor, whether online or offline, or from other sources such as from our service providers. For more information, please see the “What Information We Collect” section of our General Privacy Notice. Our website uses cookies to improve functionality and performance. Please see the “Cookies” section of our General Privacy Notice for more information.

How We Use and Share Personal Information for Business or Commercial Purposes

We may use or share the Personal Information listed above for the following business or commercial purposes:

Delivering relevant Services to you, or on behalf of another, including:

Verifying your identity in connection with the Services.

Administering the Services subject to CCPA and CPRA at the direction of your employer, including to determine eligibility for reimbursement under your employer’s benefits program.

Communicating with you or others designated by you about your participation in an employer sponsored benefit program, in connection to which we provide Services.

Responding to covered inquiries.

Helping to protect you and us from fraud or financial loss.

Linking accounts, you provide us to facilitate the movement of funds.

Preparing account statements.

Preparing annual tax reporting information, if applicable.

Protecting your health, safety, or welfare.

Delivering user surveys; and

Delivering customized content and analytics on our websites or app.

Operating our websites in connection to covered Services.

Engaging third party service providers to assist us in administering and providing covered Services pursuant to a written agreement.

Performing analytics and improving our Services and websites.

Conducting internal research to develop and demonstrate technology.

Marketing our Services, only as permitted by law.

Keeping a record of our transactions and communications.

Conducting audits and reporting related to particular transactions and interactions, including online interactions, you may have with us or others on our behalf.

Detecting, analyzing, and preventing security incidents, and other fraudulent or illegal activity.

Identifying, debugging, and repairing errors in our systems, websites, or app that impair existing functionality.

Protecting our rights, the rights of affiliates and related third parties, or taking appropriate legal action, such as to enforce our Terms of Use.

Complying with applicable laws, regulations, administrative or legal requests, subpoenas, or otherwise as required by law.

In connection with a merger, acquisition, or other sale or transfer of all or part of our assets or business.

In accordance with your consent or the direction of your employer.

Short-term, transient use of Personal Information that is not disclosed to another third party and is not used to build a profile about you or otherwise alter your experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction; and

As otherwise necessary or useful for us to lawfully conduct our business or provide covered Services.

Within the last 12 months, we have disclosed Personal Information identified in the “Personal Information” section, categories (A)-(L) above only (i) at your express request or at the direction of your employer benefit program sponsor; (ii) as part of an exempt transaction; or (iii) to our service providers for the business purpose(s) described above. To learn more about the categories of third parties with whom we share such information, please see the “How We Use and Share Information” section of our General Privacy Notice.

No Sale of Personal Information

We do not sell Personal Information within the meaning of the CCPA or CPRA. If that changes, we will let you know in advance and provide you with information so that you may understand and exercise your right to opt-out of the future sale or disclosure of your Personal Information.

Consumer Rights

If you are a California resident, you may exercise certain privacy rights related to your Personal Information. You may exercise these rights free of charge except as otherwise permitted under applicable law. Please note, there may be situations where we cannot grant your request, for example, if you ask us to delete your Personal Information that is governed by a federal privacy regulation that is exempted from CCPA/CPRA, or where BBP Admin is legally obligated to keep a record of our interactions with you to comply with law. We may also decline your request in order to maintain our legitimate use of data for anti-fraud and security purposes, such as when you request deletion of an account that is being investigated for security concerns. Other reasons your privacy request may be denied are if it jeopardizes the privacy of others, is frivolous, or would require disproportionate effort.

You may submit your request in through our Privacy portal, which you can by emailing support@bbpadmin.com. If you are a BBP Admin employee please contact our HR Department.

The Right to Know, Access, Rectify, and/or Delete Personal Information

Where the CCPA/CPRA applies to the Services we provide, you may have the right to know, access, correct, and/or delete Personal Information about you which we have collected.

The Right to Know/Access: You have the right to know the information contained in this Notice and our General Privacy Notice, and to request access to a copy of the Personal Information that BBP Admin has collected about you directly or indirectly, including Personal Information collected by a service provider or contractor on our behalf. You may access your account through the websites and mobile app and view your Personal Information.

The Right to Correct: You may access your account through the websites and mobile app and update your Personal Information. Users may make changes to some Personal Information through their online accounts. For Personal Information that cannot be changed via your account, you may contact us as set forth above to request the change or contact your employer if the change relates to covered Services. We will use commercially reasonable efforts to honor your requests within the limits defined by your employer program sponsor.

The Right to Delete: You have the right to request that BBP Admin delete your Personal Information, subject to certain limited exceptions. For example, we may retain an archived copy of your records consistent with applicable law, to continue to provide covered Services, or for other legitimate business purposes.

The Right to Opt-out of the Sale or Sharing of Personal Information or De-identified Personal Information

We do not sell your Personal Information for monetary or other valuable consideration.

We do not sell any de-identified Personal Information. We may de-identify your Personal Information for internal use only.

We do not share your Personal Information for the purposes of “cross-context behavioral advertising.” Cross-context behavioral advertising is “the targeting of advertising to a consumer based on the consumer’s personal information obtained from the consumer’s activity across businesses, distinctly-branded websites, applications, or services, other than the business, distinctly-branded website, application, or service with which the consumer intentionally interacts.”

The Right to Limit the Use of Sensitive Personal Information

We limit our use of Sensitive Personal Information to only the purposes necessary to perform covered Services, and for certain business and commercial purposes described above.

The Right to Non-Discrimination

We will not discriminate or retaliate against you for exercising your consumer rights under the CCPA/CPRA, including by (a) denying you goods or services; (b) charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; or (c) providing you a different level or quality of goods or services (or suggesting that we will do so). We may, however, charge different prices or rates, or provide a different level or quality of goods or services, if that difference is reasonably related to the value provided to us by your Personal Information. This section currently applies to consumers. In 2023, this section may also apply to employees, applicants for employment, and independent contractors.

Verification

As required or permitted under applicable law, we may take steps to verify your request before providing Personal Information to you, deleting Personal Information, or otherwise processing your request. To verify your request, you must provide your name, employer (if any), product or service, email address, phone number, and state of residence. You may also be asked to verify your ability to control the email address or phone number you have provided to us. If we believe we need further information to verify your request as required by law, we may ask you to provide additional information to us. We will review each request carefully and respond accordingly within the timeframe established by the CCPA/CPRA.

Agent Authorization

You may designate an authorized agent to request any of the above rights on your behalf. You may make such a designation by providing the agent with written permission, signed by you, to act on your behalf. Your agent may contact us as set forth in this Notice. Even if you choose to use an agent, as permitted by law, we may require you to confirm you have authorized the agent to act on your behalf or require you to verify your own identity.

Notice of Financial Incentive

We do not offer financial incentives to consumers for providing Personal Information.

Changes to Our Privacy Notice

We reserve the right to amend this Notice at our discretion and at any time. We will do so by updating this Notice. Amended terms take effect upon being incorporated into this Notice, and your continued use of the website or participation in your employer’s covered benefit program following the posting of any changes constitutes acceptance of any new terms. If the changes will materially affect the way we use your Personal Information in connection with covered Services that we have already collected, we will notify you by sending you a message in your online account.

Requesting Notice in Alternative Format/Language

You may be able to request this Notice in another language where we provide such notices in the ordinary course of business or in an alternative format if you have a disability. Please contact the Privacy Office below to request an alternative format.