Consumer Health Data Privacy Policy

1. Scope of This Policy

This Consumer Health Data Privacy Policy ("Health Data Policy") describes how Astoria Company Marketing LLC, doing business as Astoria Company ("Astoria," "we," "us," or "our"), collects, uses, shares, and sells consumer health data, and the rights available to you with respect to that data. This Health Data Policy supplements the Astoria Company Master Privacy Policy and applies to consumer health data subject to Washington's My Health My Data Act, Nevada's consumer health data law, and any other law that regulates consumer health data in a similar manner. If this Health Data Policy conflicts with the Master Privacy Policy with respect to consumer health data, this Health Data Policy controls.

This Health Data Policy applies to the Astoria-operated websites and services through which consumer health data may be collected, including NewMedicare.com, NewHealthInsurance.com, and any other Astoria website, landing page, form, or phone line through which you submit a health-related, Medicare-related, or health-insurance-related inquiry. It is linked prominently on the homepage of each such website.

"Consumer health data" means personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. On our websites, this can include information that reveals your health status indirectly, such as a request to be matched with a Medicare plan or health insurance provider, answers to health-related eligibility questions, or your interest in a health-related product or service. Consumer health data that is regulated by certain other laws, such as the Gramm-Leach-Bliley Act or HIPAA, is exempt from the consumer health data laws and is governed by the applicable law and the Master Privacy Policy instead.

2. Categories of Consumer Health Data We Collect

Depending on the inquiry you submit, we may collect the following categories of consumer health data:

• Health-related inquiry information, such as your request to be matched with Medicare plans, Medicare Advantage or supplement providers, or health insurance providers, and the type of coverage you are seeking.
• Individual health conditions, treatments, or concerns, but only if you voluntarily provide them in a form field, chat, call, or message.
• Information about your use of medications, health services, or health-related products, if you voluntarily provide it.
• Demographic and eligibility information submitted with a health-related inquiry, such as age or date of birth, household size, income range, ZIP code, and current coverage status, when combined with your health-related inquiry.
• Approximate location information derived from your IP address when you submit a health-related inquiry. We do not collect precise geolocation with health-related inquiries, and we do not use geofencing as described in Section 8.
• Data that identifies you as seeking health care services or coverage, such as consent records, form submissions, call recordings where permitted, and lead records associated with a health-related inquiry.
• Inferences we derive from the information above in order to route your inquiry to appropriate Partners, such as the coverage category applicable to your request.

3. Sources of Consumer Health Data

Directly from you, when you submit a form, call a posted phone number, chat with us, or otherwise communicate with us on a covered website.

Automatically from your device and browser when you use a covered website, such as IP address, device and browser information, and form interaction data, to the extent that information is linked to a health-related inquiry.

From consent documentation and call tracking technologies operating on our forms and phone numbers, such as ActiveProspect TrustedForm or Jornaya LeadiD, to the extent their records are linked to a health-related inquiry.

From publishers and marketing partners that operate forms or campaigns that ask to be matched through Astoria, where you submitted a health-related inquiry to them.

4. Why We Collect and Use Consumer Health Data

We collect and use consumer health data for the following purposes:

• To provide the product or service you requested, which is to match your inquiry with, and transmit it to, Medicare, health insurance, or other health-related Partners who can respond to you.
• To document, verify, and defend your consent to be contacted and your consent to our collection and sharing of consumer health data.
• To operate, secure, and improve our websites and matching services, and to prevent fraud, invalid traffic, and abuse.
• To honor your privacy choices, maintain suppression records, and comply with applicable law.
• We do not use consumer health data for advertising unrelated to your request, and we do not process consumer health data for any purpose not disclosed in this Health Data Policy without first obtaining any consent required by law.

5. Consent to Collection and Sharing

Except where collection or sharing is necessary to provide a product or service you have requested, we will not collect or share your consumer health data without first obtaining your affirmative, opt-in consent. That consent request is presented separately from other terms, clearly describes the categories of consumer health data collected or shared, the purpose, the categories of entities with whom it is shared, and how you can withdraw consent. We will not obtain your consent through deceptive design, and declining to consent will not prevent you from using the parts of our websites that do not involve consumer health data.

6. Sharing and Sale of Consumer Health Data

We may share consumer health data with the following categories of third parties:

• Medicare, health insurance, and other health-related Partners, agents, agencies, and carriers that respond to the inquiry you asked us to match.
• Service providers and processors that act on our behalf under contracts restricting their use of the data, such as hosting, call tracking, consent documentation, fraud prevention, analytics, and communications vendors.
• Professional advisors, government authorities, regulators, courts, or law enforcement where required or permitted by law.
• Astoria does not share consumer health data with affiliates.
• A transfer of consumer health data for monetary or other valuable consideration may be a "sale" under applicable consumer health data laws. Astoria does not sell consumer health data. Washington and Nevada residents are suppressed from health data sale transactions.

7. Your Consumer Health Data Rights

If you are a Washington or Nevada resident (or a resident of another state with a similar law), you have the right to:

• Confirm whether we collect, share, or sell consumer health data about you, and access that data.
• Receive, as part of an access request, a list of all third parties and affiliates with whom we have shared, or to whom we have sold, your consumer health data, and an active email address or other online mechanism you can use to contact each of them.
• Withdraw consent you previously gave to our collection or sharing of your consumer health data.
• Have your consumer health data deleted, including data held by our affiliates, processors, contractors, and other third parties to whom we have disclosed it, to whom we will convey your deletion request as required by law.
• Appeal our refusal to take action on a request, using the process described below.
• Exercise these rights without being discriminated against or being unlawfully denied goods or services.

How to exercise your rights

You may exercise these rights by emailing our dedicated privacy address, calling our privacy number, or submitting the Consumer Health Data Request Form (also available from Health Data Rights). We may need to verify your identity using information we already hold before acting on a request. Authorized agents may act for you where the law permits, subject to proof of authorization.

Timing and appeals

We will respond to a verified request within forty-five (45) days of receipt, and we may extend that period once by up to forty-five (45) additional days where reasonably necessary, with notice to you within the initial period. If we decline to act on your request, we will explain why and how to appeal. You may appeal by submitting the appeal form or replying to our response; we will respond to your appeal in writing within the statutory period, with an explanation. If your appeal is denied, you may contact the office of your state attorney general to raise a concern: the Washington Attorney General at www.atg.wa.gov/file-complaint, or the Nevada Attorney General at ag.nv.gov.

8. No Geofencing

We do not use geofencing to create a virtual boundary around any facility that provides in-person health care services, including any mental health facility or reproductive or sexual health facility, for the purpose of identifying or tracking consumers seeking health care services, collecting consumer health data, or sending notifications, messages, or advertisements to consumers related to their consumer health data or health care services.

9. Retention and Security

We retain consumer health data only as long as reasonably necessary to provide the service you requested, to document and defend consent, and to comply with legal obligations, after which it is deleted or de-identified. We maintain reasonable administrative, technical, and physical safeguards for consumer health data and restrict internal access to personnel and processors that need the data to provide the services described in this Health Data Policy.

10. Contact Us

Privacy Officer
Astoria Company Marketing LLC d/b/a Astoria Company
6387 Camp Bowie Blvd, STE B #171, Fort Worth, TX 76116
Dedicated Privacy Email: privacy@astoriacompany.com
Privacy Phone Number: 1-510-663-7016

• Consumer Health Data Rights and Authorization Page: Health Data Rights
• Consumer Health Data Request Form: Request Form
• Appeal Form: Privacy Appeal

11. Changes to This Health Data Policy

We may update this Health Data Policy from time to time. When we do, we will revise the date above and post the updated version on each covered website. If a change materially expands our collection, sharing, or sale of consumer health data, we will obtain any new consent required by law before applying the change to previously collected data.