Privacy Policy
Effective Date: July 31, 2026 Last Updated: July 31, 2026
At Anjoy Collective, Inc., doing business as Aloe Health ("Aloe," "we," "us," or "our"), your privacy matters. This Privacy Policy describes the information we collect, how we collect it, why we collect it, how we share and use it, and the choices you have, including how to access, correct, or delete information.
By using our Platform, you agree to this Privacy Policy. This Privacy Policy is incorporated into our Terms of Service, which also apply when you use the Platform.
Contents
- Important: This Policy Does Not Cover Protected Health Information
- Key Terms
- When This Policy Applies and When It Does Not
- Information We Collect
- Where We Get It
- Cookies, Analytics, and Advertising
- How We Use It
- How We Share It
- What We Do Not Do
- De-Identified and Aggregated Data
- Artificial Intelligence
- Your Choices
- Your Rights
- Data Retention
- Data Security
- Children
- Who May Use the Services
- Do Not Track and Global Privacy Control
- Third-Party Sites
- Changes to This Policy
- Contact Us
1. Important: This Policy Does Not Cover Protected Health Information
Aloe is a third party administrator. When we administer an ICHRA, qualified medical expense reimbursement, or other benefit on behalf of an employer's health plan, we act as a business associate under the Health Insurance Portability and Accountability Act ("HIPAA").
Protected health information ("PHI") we handle in that role is not governed by this Privacy Policy. It is governed by:
- HIPAA and its implementing regulations
- the business associate agreement between Aloe and the health plan
- the plan's Notice of Privacy Practices, which the plan sponsor furnishes to covered individuals
If you are a covered employee or dependent and want to know how your health information is used, disclosed, and protected, or how to exercise your HIPAA rights, refer to your plan's Notice of Privacy Practices or contact your employer's benefits administrator. You may also contact us at hello@aloehealth.co and we will route your request appropriately.
Clinical information held by a health care provider is governed by that provider's own notice of privacy practices, not by this Policy.
Where information we hold is both PHI and Personal Information, HIPAA and the applicable business associate agreement control.
2. Key Terms
| Term | Definition |
|---|---|
| "Personal Information" | Any information relating to an identified or identifiable individual, including the categories listed in Section 4 |
| "PHI" | Protected health information as defined at 45 C.F.R. § 160.103 |
| "Platform" | Our websites, portals, and applications, including aloehealth.co |
| "Services" | Services provided through the Platform |
| "Privacy Policy" | This document |
| "Terms of Service" | Our terms of service, located at aloehealth.co/legal/terms |
| "Aloe," "we," "us," "our" | Anjoy Collective, Inc. d/b/a Aloe Health |
Capitalized terms used but not defined here have the meaning given in the Terms of Service.
3. When This Policy Applies and When It Does Not
This Policy applies when:
- you visit or use the Platform
- your employer or its authorized representative engages Aloe to administer a benefit and provides information about you
- you communicate with us electronically, including by email, chat, or text message
- you communicate with us by phone or in person
- you contact us as a broker, agency, vendor, or job applicant
This Policy does not apply to:
- PHI we handle as a business associate, as described in Section 1
- clinical information held by a provider or medical practice
- any website or application operated by a third party, including one linked from the Platform
- information you provide directly to a carrier, broker, provider, or financial partner, which is governed by their own policies
4. Information We Collect
| Category | Examples |
|---|---|
| Identifiers | Name, postal address, email address, telephone number, account name, IP address, unique device or user identifiers |
| Employment and professional information | Employer name, job title, employee class, hire and termination dates, compensation details where needed for affordability testing, broker or agency affiliation, insurance license numbers |
| Government identifiers | Social Security number and date of birth, where required for enrollment, eligibility, or tax reporting |
| Financial information | Bank account and routing details for funding and reimbursement, transaction identifiers, billing records. Full payment card numbers are handled by our payment providers and are not stored on our systems |
| Benefits and coverage information | Plan selections, premium amounts, allowance amounts, dependent counts and relationships, eligibility status, reimbursement submissions |
| Protected classifications | Age, marital status, and information about medical conditions where provided in connection with a benefit. Where this is PHI, Section 1 applies |
| Commercial information | Demo and quote requests, services purchased or considered, support inquiries |
| Internet and device activity | Pages viewed, referring URL, session duration, browser and device type, operating system |
| Approximate location | Region-level location derived from IP address. We do not collect precise geolocation |
| Inferences | Preferences and segment assignments used for product and marketing purposes |
Sensitive information. Some of the above is sensitive under state law, including Social Security numbers, financial account details, and health-related information. Where health-related information is PHI, Section 1 applies. We collect sensitive information only as needed to verify identity, administer a benefit, or meet a legal obligation, and we do not use or disclose it for other purposes.
5. Where We Get It
From you. When you visit the Platform, request a demo or quote, create an account, contact support, or apply for a job. When you contact us, we receive the contents of your message and any attachments.
From employers and plan sponsors. When an employer engages us, it and its authorized representatives provide information about employees and dependents so we can determine eligibility, administer allowances, and facilitate enrollment. This may include names, dates of birth, addresses, contact information, dependent information, employment and compensation details, and Social Security numbers where required.
From brokers and agencies. Where a broker or agency is engaged by you or designated by the plan sponsor.
From payroll and HRIS systems. Through integrations the employer authorizes, to keep rosters and compensation data current.
From carriers, providers, and vendors. Enrollment confirmations, premium amounts, network participation, pricing data, and reimbursement records.
From financial partners. When you make a payment or connect a bank account, our payment and funds custody partners collect and process the relevant details. These include Moov Financial and Stripe. We do not retain full payment card numbers or full account numbers, but may receive transaction identifiers and confirmation details.
From enrollment partners. We use HealthSherpa for plan data and enrollment. If you shop for or enroll in a plan through the Platform, you may be directed to HealthSherpa, and information you provide there is handled under its own privacy policy.
Automatically. Through cookies and similar technologies, as described in Section 6.
6. Cookies, Analytics, and Advertising
We and our service providers use cookies, web beacons, pixels, and similar technologies to collect information as you navigate the Platform.
A cookie is a small file stored on your device. Session cookies are deleted when you close your browser and are used to optimize performance within a single session. Persistent cookies remain until you or your browser deletes them and are used for authentication, preferences, and analytics.
We do not use advertising pixels, social media tracking tags, behavioral analytics, or session recording on the Platform. We do not sell Personal Information and we do not share Personal Information for cross-context behavioral advertising or targeted advertising.
Technologies we do use:
| Technology | Purpose |
|---|---|
| Session and authentication cookies | Keep you signed in and protect your session. Required to use the Platform |
| Preference cookies | Remember settings you choose |
| Error monitoring | Detects and diagnoses application errors. Configured to exclude protected health information |
| Google Places | Address autocomplete on forms. Google sets its own cookies, including NID, on the google.com domain when this feature loads |
| HubSpot | Embedded scheduling widget on our demo request pages |
Managing cookies. Most browsers let you refuse or delete cookies. Blocking session cookies will prevent you from signing in. Instructions are available from your browser vendor:
- Google Chrome: support.google.com/chrome
- Mozilla Firefox: support.mozilla.org
- Safari: support.apple.com
- Microsoft Edge: support.microsoft.com
7. How We Use It
- provide, operate, secure, and improve the Platform and Services
- respond to demo, quote, and support requests
- set up and administer employer, broker, and member accounts
- determine eligibility, calculate allowances, and process reimbursements
- process payments, funding transfers, and fees, and detect transactional fraud
- send transactional and administrative communications, including deadline reminders
- send marketing communications where permitted, with opt-out available
- notify you about changes to the Platform, Services, or this Policy
- detect, prevent, and investigate fraud, abuse, and security incidents
- conduct internal testing, research, analysis, and product development
- meet legal, regulatory, licensing, tax, and audit obligations, including obligations to state departments of insurance
- respond to law enforcement requests, court orders, and subpoenas
- enforce our agreements, including for billing and collection
- analyze usage and measure marketing effectiveness
- create de-identified and aggregated data as described in Section 10
- any other purpose for which you provide the information, or with your consent
We do not use Personal Information for automated decision-making that produces legal or similarly significant effects without human review.
Where information is required to establish or administer a benefit, providing it is necessary. If you decline, we may be unable to enroll you or process a reimbursement.
8. How We Share It
- Service providers and vendors who perform functions on our behalf, including hosting and data storage, payment processing and funds custody, identity verification, payroll and HRIS integration, plan data and enrollment, electronic signature, transactional messaging, error monitoring, and customer support. They are bound by contract to use the information only to provide services to us, and by business associate agreements where they handle protected health information. A current list of our subprocessors is available on request at hello@aloehealth.co.
- Employers and plan sponsors, in connection with the benefits they sponsor and consistent with HIPAA and the applicable business associate agreement.
- Brokers and agencies of record, where you have engaged them or the plan sponsor has designated them, so they can identify and place coverage, manage changes, and provide services to you. Their handling of your information is governed by their own privacy policies.
- Carriers, providers, and pharmacy vendors, as needed to enroll individuals, coordinate care, and process reimbursements.
- Regulators and authorities, including state departments of insurance, when required by law, subpoena, audit, or legal process.
- Professional advisors, including auditors, accountants, and counsel.
- Successors, in connection with a merger, divestiture, restructuring, reorganization, dissolution, financing, or sale of assets, including in bankruptcy or a similar proceeding.
- To enforce our rights, including to enforce our Terms of Service and protect the safety and security of the Platform and its users.
- With your consent, where you request or direct us to share.
9. What We Do Not Do
We do not sell Personal Information.
We do not use PHI to train general-purpose artificial intelligence models.
We do not disclose text messaging opt-in data or consent to third parties for their own marketing. This applies to all third parties other than the aggregators and providers that deliver the messaging service.
10. De-Identified and Aggregated Data
We may create de-identified and aggregated data from information we hold and use it to operate, analyze, benchmark, and improve the Services and to produce industry reporting, which we may publish. De-identification of PHI follows the standards in 45 C.F.R. § 164.514. Aggregated data does not identify any employer, participant, or dependent. We do not attempt to reidentify de-identified data and we require recipients not to.
11. Artificial Intelligence
Parts of the Platform use artificial intelligence to assist with support, document handling, and similar tasks. AI outputs assist human judgment and do not replace it. Any determination affecting eligibility, a benefit amount, a reimbursement, or access to care is reviewed by a person.
Information processed through AI features is handled under this Policy, applicable business associate agreements, and HIPAA. Information submitted through AI features is not used for advertising and is not disclosed to advertising technology vendors.
12. Your Choices
Marketing email. Click the unsubscribe link in any marketing message or contact hello@aloehealth.co. This does not stop transactional communications required to administer your benefits.
Text messages. Reply STOP to any message.
Cookies. Use your browser settings as described in Section 6.
Targeted advertising by third parties. We do not control information collected by third parties for their own purposes. You can opt out of participating ad networks through the Network Advertising Initiative at optout.networkadvertising.org and the Digital Advertising Alliance at optout.aboutads.info.
Access and correction. You can review and update much of your information in your account. You may also contact us at hello@aloehealth.co to correct errors, request deletion, or close your account. We may be unable to accommodate a request if doing so would violate a legal requirement or render information inaccurate.
13. Your Rights
Depending on where you live, you may have the right to:
- confirm whether we process your Personal Information and access a copy
- correct inaccurate Personal Information
- delete Personal Information, subject to legal and contractual retention requirements
- obtain a portable copy of your Personal Information
- opt out of the sale or sharing of Personal Information and of targeted advertising
- opt out of profiling that produces legal or similarly significant effects
- limit the use of sensitive Personal Information
- appeal a denial of a request
- be free from discrimination or degraded service for exercising these rights
As of the date of this Policy, comprehensive consumer privacy laws are in effect in California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. Michigan and Ohio do not currently have one. We extend the rights above to all individuals in the United States regardless of residence.
Important exemptions. These rights generally do not apply to PHI, which is governed by HIPAA and your plan's Notice of Privacy Practices. Most state privacy laws also exempt information governed by HIPAA, and some exempt information subject to the Gramm-Leach-Bliley Act. Where an exemption applies, we will tell you and direct you to the right process.
How to make a request. Email hello@aloehealth.co or call 616.730.8918. We will verify your identity before responding and will not use verification information for any other purpose. You may use an authorized agent where state law permits. We respond within the time required by applicable law, generally 45 days, with one extension where permitted.
Appeals. If we deny your request, you may appeal by replying to our response or writing to hello@aloehealth.co with "Privacy Appeal" in the subject line. We will respond within the time required by applicable law, generally 45 or 60 days depending on your state. If we deny the appeal, we will tell you how to contact your state attorney general.
California residents may also request, once per calendar year, information about disclosures of Personal Information to third parties for their own direct marketing purposes under California Civil Code Section 1798.83.
14. Data Retention
We retain information for as long as needed to provide the Services and to meet legal, tax, accounting, and insurance recordkeeping obligations. Retention periods for records related to administered benefits are set by applicable law, plan documents, and our agreements with plan sponsors, and generally extend for several years after the relationship ends. State third party administrator regulations impose their own minimum retention periods on books and records. After an account is closed, we may retain limited information for compliance and tax reporting. When information is no longer needed, we delete or de-identify it.
15. Data Security
We maintain administrative, technical, and physical safeguards designed to protect against accidental, unlawful, or unauthorized access, alteration, destruction, disclosure, or use. These include access controls, encryption in transit and at rest, logging and monitoring, vendor due diligence, incident response procedures, and workforce training. Our security program is designed to meet the HIPAA Security Rule and the insurance data security laws of the states where we are licensed, including Michigan's Insurance Data Security Act.
Transmission over the internet is not completely secure. We cannot guarantee the security of information transmitted to, on, or through the Platform, and any transmission is at your own risk. Where you have chosen a password, it is your responsibility to keep it confidential. We are not responsible for the circumvention of privacy settings or security measures in your own device or operating system.
16. Children
The Platform is not directed to children and we do not knowingly collect Personal Information directly from anyone under 18 through the Platform. Information about covered dependents, including minors, is provided to us by the employee or plan sponsor and is handled under Section 1. If we learn we have collected information directly from a minor through the Platform, we will delete it. If you are a parent or guardian who believes a minor has provided information through the Platform, contact hello@aloehealth.co.
17. Who May Use the Services
Aloe operates subject to state and federal regulation, and the Platform and Services may not be available in your state. Access is limited to users located in states within the United States where the Services are available. The Services are not available to users located outside the United States. Accessing the Platform from a jurisdiction where it is not offered is prohibited.
Protected health information is stored in the United States and accessed only in a manner compliant with applicable law. If you access the Platform from outside the United States, you consent to transfer and processing in the United States.
18. Do Not Track and Global Privacy Control
Some browsers offer a "Do Not Track" signal. There is no accepted standard for how a site should respond, and we do not currently take action in response to that signal.
We do honor Global Privacy Control and similar universal opt-out preference signals as an opt-out of sale, sharing, and targeted advertising, where required by applicable law.
19. Third-Party Sites
The Platform links to third-party websites and tools, including carriers, providers, and financial partners. We do not control them and are not responsible for their privacy practices or content. Review their policies before providing information.
20. Changes to This Policy
We may update this Policy to reflect changes in our practices, in the law, or in best practices. We will post the revised version with a new Effective Date. If changes are material, we will notify you by email to the address associated with your account or through a notice on the Platform. You are responsible for keeping a current, deliverable email address on file and for reviewing this page periodically.
21. Contact Us
If you have questions, concerns, complaints, or suggestions about this Privacy Policy, contact us:
Anjoy Collective, Inc. d/b/a Aloe Health 2 Fulton St. W Grand Rapids, Michigan 49503 hello@aloehealth.co 616.730.8918
For questions about protected health information, contact your plan's privacy officer or your employer's benefits administrator.