CafeHealth, LLC. ("CafeHealth," "we," "us," or "our"), located at 3015 E Weldon, Phoenix, Arizona 85016, respects your privacy and is committed to protecting the personal information of visitors to our website (mycafehealth.com), our clients, plan participants, brokers, and any individual who communicates with us by phone, text message (SMS), email, or web form (collectively, "you"). This Privacy Policy explains what information we collect, how we use it, how we protect it, and the choices available to you.

1. Information We Collect

We may collect the following categories of information:

Contact information: name, email address, phone number, mailing address, and company/employer name.

Account and plan information: information related to COBRA, FSA, HSA, HRA, ICHRA, LSA, commuter benefits, or other benefit administration services you or your employer have enrolled in.

Communications data: records of calls, text messages, emails, and web chat conversations between you and CafeHealth.

Technical data: IP address, browser type, device information, and usage data collected automatically through our website and forms.

Protected Health Information (PHI): where applicable, and only to the extent necessary to administer benefit plans, handled in accordance with HIPAA and our Business Associate Agreements with plan sponsors.

2. How We Use Your Information

We use the information we collect to:

Administer and support COBRA, FSA, HSA, HRA, ICHRA, LSA, and commuter benefit programs.

Respond to inquiries, service requests, and support tickets.

Send account, billing, renewal, and compliance-related notifications.

Send marketing and promotional communications about our services, where you have consented to receive them.

Improve our website, services, and customer communications.

Comply with applicable federal, state, and local law, including ERISA, HIPAA, and IRS regulations.

3. Text Messaging (SMS) Privacy and Consent

If you provide your mobile phone number to CafeHealth through our website, web chat widget, forms, or verbally, you may receive text messages from CafeHealth related to your account, service requests, appointment or renewal reminders, or, where you have separately opted in, marketing and promotional offers.

Message frequency varies. Message and data rates may apply. You may reply STOP at any time to opt out of receiving text messages from CafeHealth, or reply HELP for assistance. Consent to receive text messages is never a condition of purchasing or receiving any service from CafeHealth.

No mobile information will be shared with third parties/affiliates for marketing/promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Text messaging originator opt-in data and SMS consent records are used solely by CafeHealth to facilitate the messaging services you have requested and are not sold, licensed, or shared with any third party or affiliate for their own marketing or promotional purposes.

4. How We Share Information

We do not sell your personal information. We may share information with:

Service providers and subcontractors who perform functions on our behalf (e.g., COBRA administration platforms, payment processors, IT hosting providers), under confidentiality obligations.

Plan sponsors/employers, to the extent necessary to administer the benefit plan in which you participate.

Regulators or government authorities, where required by law.

Successors, in connection with a merger, acquisition, or sale of company assets, subject to the same privacy commitments described here.

As stated above, SMS opt-in consent and originator data are never shared with third parties for their own marketing purposes.

5. Your Choices

SMS: Reply STOP to any text message to opt out, or contact us using the information below.

Email: Use the unsubscribe link included in marketing emails.

Website forms and chat: Provided consent checkboxes are optional and unchecked by default; declining marketing consent will not affect your ability to receive support or submit a service request.

6. Data Security

We maintain administrative, technical, and physical safeguards designed to protect personal information and Protected Health Information from unauthorized access, use, or disclosure, consistent with HIPAA Security Rule requirements and our Business Associate Agreements.

7. Data Retention

We retain personal information for as long as necessary to provide our services, comply with legal and regulatory recordkeeping requirements (including ERISA and IRS retention rules), and resolve disputes.

8. Children's Privacy

Our services are not directed to individuals under the age of 18, and we do not knowingly collect personal information from children.

9. Changes to This Policy

We may update this Privacy Policy from time to time. The "Effective Date" above reflects the date of the most recent revision. Material changes will be posted on this page.

10. Contact Us

CafeHealth, LLC. is operated by CafeHealth, LLC.

3015 E Weldon, Phoenix, Arizona 85016

Note: This document was drafted to satisfy A2P 10DLC / carrier SMS-compliance requirements (mandatory SMS non-sharing clause) and general benefits-administration privacy practices. Have your attorney review before publishing, particularly the HIPAA/BAA and state-law sections, and insert the actual publication date.

Cookies and Tracking Technologies

CafeHealth's website (mycafehealth.com) uses cookies and similar tracking technologies to operate the site, remember your preferences, and understand how visitors use our website. This may include:

Essential cookies that allow core site functionality (navigation, form submission, security).

Analytics cookies that help us understand site traffic and usage patterns, so we can improve our services.

You can control or disable cookies through your browser settings. Disabling cookies may affect the functionality of certain parts of our website. We do not use cookies to track SMS opt-in or consent data across third-party sites, and cookie data is never combined with SMS originator opt-in data for marketing purposes.