Privacy Policy

1. Information We Collect

Depending on how you interact with our website and brokerage services, we collect several categories of information necessary to evaluate, process, administer, and service health insurance products:

• Identifiers and Contact Details: Full name, mailing address, email address, telephone number, date of birth, account or policy details, insurance or benefits history, household details, and employment or business information.
• Government-Issued Identifiers: Social Security Number (SSN), Driver’s License number, Tax Identification Number (TIN), or state identification number, collected strictly as necessary to process insurance applications, verify eligibility, or fulfill tax/regulatory reporting requirements.
• Financial and Billing Information: Bank account numbers, routing details, credit/debit card numbers, and payment authorization records required to facilitate insurance premium processing or service fee billing.
• Health-Related Information & PHI: Health status, medical history, claims information, coverage eligibility records, benefit utilization, and other protected health details necessary to evaluate, apply for, or service health insurance policies.
• Automatically Collected Usage Information: IP address, browser type and version, device identifier, operating system, referring website, pages visited, date/time stamps, and general website interaction data collected through essential website functionality cookies.

2. How We Use Your Information

We process personal, financial, and health information for legitimate business and regulatory purposes permitted by law, including to:

• Provide and administer health insurance brokerage, advisory, and benefit services.
• Evaluate eligibility, generate insurance quotes, process enrollment applications, and confirm coverage.
• Administer claims, policy updates, and ongoing coverage servicing.
• Respond to customer inquiries, requests for information, and account correspondence.
• Communicate administrative updates, policy changes, transactional notices, and legally required disclosures.
• Operate, maintain, audit, and secure our website, systems, and network infrastructure.
• Detect, prevent, and investigate fraudulent transactions, security incidents, and unauthorized activity.
• Comply with statutory obligations under New York law, federal insurance statutes, HIPAA regulations, and legal process.

3. How We Share Information & Mobile Privacy Standards

We do not sell personal information or health data in the ordinary course of operating our health insurance brokerage services. We disclose information to third parties only as necessary to provide our services, meet legal obligations, or operate our business as permitted by law:

• Insurance Carriers and Underwriters: To submit applications, obtain binding quotes, establish coverage, and service policies.
• Healthcare Providers and Administrators: To verify coverage eligibility, coordinate benefits, or resolve claims inquiries.
• Service Providers & Business Associates: Third-party technology vendors, payment processors, legal/financial advisors, and administrative software providers operating under strict confidentiality agreements and HIPAA Business Associate Agreements (BAAs).
• Regulatory & Law Enforcement Authorities: Government agencies, state insurance departments, or law enforcement bodies when legally required by subpoena, court order, or applicable statutory mandates.

4. Cookies, Tracking Technologies & HHS OCR Compliance

Our website uses essential and functional cookies to ensure site security, remember user settings, and understand site usage.

5. Health Information & HIPAA Compliance

Mally Financial Services operates as a licensed independent insurance agency and acts as a Business Associate under HIPAA when handling Protected Health Information (PHI) on behalf of covered health plans, insurance carriers, and plan sponsors:

• PHI is collected, maintained, used, and disclosed strictly in accordance with the HIPAA Privacy, Security, and Breach Notification Rules.
• Our separate Notice of Privacy Practices provides detailed explanations regarding your rights to access your health records, request restrictions on disclosures, receive an accounting of disclosures, and submit privacy complaints.

6. Telemarketing & TCPA Communications Consent

If you provide us with your telephone number or email address, we may communicate with you regarding your insurance inquiry, policy administration, or requested service:

• TCPA Prior Express Consent: We will not send marketing text messages or make telemarketing calls using automated telephone dialing systems or prerecorded voices without your explicit, prior written consent obtained via an un-checked, affirmative opt-in checkbox on our website forms.
• Non-Condition of Sale: Consenting to marketing communications is never a condition of purchasing any insurance product or receiving brokerage services.
• Immediate Opt-Out: You may opt out of marketing communications at any time by clicking the unsubscribe link in emails or replying STOP to any text message. Transactional and servicing notices will continue as needed.

7. Data Safeguards & Security Standards

We maintain technical, administrative, and physical safeguards designed to protect personal and health information against unauthorized access, destruction, loss, alteration, or disclosure, in compliance with the New York SHIELD Act and HIPAA Security Rule.

Security protocols include end-to-end encryption in transit (TLS 1.3) and at rest (AES-256), multi-factor authentication, role-based access restrictions, continuous threat monitoring, employee compliance training, and regular audits.

8. Data Retention

We retain personal and health information for as long as reasonably necessary to fulfill the operational purposes described in this Privacy Policy, satisfy contractual commitments, resolve disputes, enforce agreements, and comply with state and federal statutory retention mandates (including New York Department of Financial Services insurance record retention rules).

9. State Privacy Rights & CCPA/CPRA Disclosures

Depending on your state of residence, you may possess specific statutory rights regarding your personal information under state privacy statutes (including California, Virginia, Colorado, Connecticut, and Utah):

10. Children's Privacy

Our website and services are intended for adult consumers and are not designed to knowingly collect personal information directly from children under the age of 13 without verifiable parental or guardian authorization. Information regarding minor dependents submitted during family insurance enrollment is handled strictly in accordance with applicable healthcare and insurance laws.

11. Data Breach & Incident Response

We maintain formal incident response procedures to detect, contain, and remediate cybersecurity threats. If a security incident results in unauthorized access to unencrypted personal or health information, Mally Financial Services will issue notifications to affected individuals, state regulators (including the New York Department of Financial Services and NY Attorney General), and federal authorities (HHS OCR) as required by the NY SHIELD Act and HIPAA Breach Notification Rule.

12. External Website Links

Our website may contain links to third-party portals, insurance carrier sites, or government health exchanges. Mally Financial Services is not responsible for the content, security practices, or privacy policies of third-party websites. We encourage you to review the privacy notices of every site you visit.

13. Policy Updates

We reserve the right to update this Privacy Policy periodically to reflect changes in our services, technology, legal requirements, or privacy practices. Updated versions will be posted on this page with a revised "Last Updated" date. Material updates will be communicated through prominent website notices or direct email where required by law.

14. Contact Us & Privacy Officer

If you have questions about this Privacy Policy, your privacy choices, or our handling of personal and health information, please contact our Privacy Officer:

15. Important Regulatory Notice

This Privacy Policy describes our general website and data handling practices. It does not override or replace specific terms contained in individual insurance policies, plan documents, or our formal Notice of Privacy Practices. Where specific federal or state privacy laws impose stricter standards than outlined herein, those legal requirements shall govern.