Last updated: July 19, 2024
Introduction
Benefitfocus.com, Inc., and its affiliated companies (collectively, “Benefitfocus,” “we,” “our,” or “us”) maintains and operates www.benefitfocus.com (the “Site”) , which includes the products and online benefit services provided by Benefitfocus, the mobile application, and any other websites that link to this Privacy Notice (collectively, the “Services”).
“You” or “your” refers to the person accessing and using the Services. You may be a “Platform User” if your employer provides you with access to the Services and/or a “Site User” when you browse the Site generally.
This Privacy Notice details the personal information you may provide us or we otherwise collect, use, maintain, and disseminate in connection with your use of the Services. This Privacy Notice is part of the Terms of Use between you and us. Do not use the Services if you do not agree with the terms of this Privacy Notice.
We encourage you to review the privacy notices of benefits providers available through the Services so that you can understand how those companies collect, use, and share your information. Benefitfocus is not responsible for the privacy notices or other content on websites outside of the Services.
This Privacy Notice may be updated from time to time. Updates will be posted on this page and become effective upon posting. Your continued use of the Services after Benefitfocus posts or otherwise notifies you of any changes indicates your agreement to the changes, so please review this page periodically for updates.
Collection of Information
"Personal information” is information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an individual. Personal information does not include:
- Publicly available information from government records.
- Deidentified or aggregated consumer information.
We may interact with you in a variety of ways and collect personal information during those interactions. While some of the personal information collected by us is required to provide you the services you are requesting, you may voluntarily provide other personal information.
We collect your personal information from these sources:
- Directly from you or from your employer when you register for the Services.
- Using cookies and other similar tracking technology that automatically collects device information and internet/network activity.
- From social media platforms and networks if you interact with us on social media or use features, such as plug-ins or other tools made available by social media platforms or networks associated with the Site.
- From other sources such as benefits providers, marketing or advertising service providers, vendors that provide services on our behalf, and other publicly available sources.
We may collect the following personal information from Platform Users and Site Users:
- Personal Identifiers such as your first and last name, online identifier, internet protocol (IP) address, email address, phone numbers, or similar identifiers.
- Device Information such as device model, IP address, cookies, beacons, pixel tags, mobile ad identifier, or similar unique identifiers.
- Internet/Network Activity such as your interaction with the website, application, or platform.
- Commercial Information such as products you have purchased and services you have enrolled in.
- Demographic Information such as age, gender, race, ethnicity, estimated income, and household information, some of which may include characteristics of protected classifications under state or federal law.
- Job Application Information such as work history, tax identification or other government identification number, education history, eligibility or right to work, citizenship, information relating to your fitness for the position, information relating to conflict-of-interest issues, and other information necessary to consider your candidacy, perform background checks, and initiate on-boarding, as applicable.
- Sensitive Personal Information as defined in the applicable U.S. state privacy laws and which may be collected solely to provide you the services you have requested. Benefitfocus does not use sensitive personal information for inferring characteristics about you.
We may also collect the following additional information from Platform Users:
- Registration Information such as your social security number, date of birth, email address, mailing address, phone number, your benefit elections, account log in and password, and other similar personal information.
You may also provide us additional information at your sole discretion when you contact us via the webform or talk to a customer service representative.
Use of Information
We use your personal information to:
- Provide the Services;
- Contact you about your products and services or additional products and services;
- Communicate with you and to respond to questions you send us;
- Inform you of enrollment eligibility;
- Process your benefits selection;
- Improve our offerings and understand how you interact with the Site;
- Assess your job application;
- Prevent and detect fraud and otherwise comply with law;
- Protect and enforce our legal rights;
- Engage with you through advertising and marketing campaigns;
- Help maintain the safety, security, and integrity of the Services, databases, and other technology assets, and business; and
- Test, research, and develop products, including to develop and improve the Services.
For Platform Users, your account is controlled by your employer or the party that has arranged your access to the Services. We will process information you provide for the purposes of employee benefits administration via our software, in accordance with our contract with the party that has arranged for your access to the Services, and as set forth in this Privacy Notice.
Unless you opt-out of communications, we may also use your email and mailing addresses provided at registration to advise you in the future of items that may be of interest to you. The information you provide at registration may be used to facilitate and monitor your activities on the Site and to allow us to send you administrative and other information related to the Services.
Our use of personal information is limited to the purposes set forth in this Privacy Notice unless we obtain consent for such other processing.
Disclosure of Information
We disclose your personal information to:
- Affiliates for business purposes such as providing the Services;
- Service providers that perform services on behalf of Benefitfocus and for ordinary business purposes including, but not limited to, cloud-hosting platform providers analyzing customer data; providing marketing assistance, and processing payments;
- Benefits providers as directed by you via your benefits election choices;
- Your employer as required by our contract in order to provide you the Services;
- Third parties to protect the security and integrity of the Services and to correct any technical problems and malfunctions; and
- With your consent.
We may also disclose your Personal Information:
- To comply with any court order, law, or legal process, including to respond to any government or regulatory request;
- To enforce or apply our terms of use, terms of sale, and other agreements;
- If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Benefitfocus, our customers, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction;
- At your direction; and
- In connection with a sale, merger, consolidation, change in control, transfer of assets, reorganization, or liquidation of part or all of our assets or business.
Cookies
The Site uses cookies, and other similar technologies such as pixels and beacons, from third parties and service providers to help personalize your online experience, remember your preferences, analyze the use of the website, to advertise our services to you, and to maintain security of the Site. Cookies help us to collect information about how users interact with our Site, including date and time of visits, pages viewed, amount of time spent using our digital offerings, or general information about the device used to access our Site. Through the use of cookies and other similar technologies, information about video materials or services you engage with on the Site may be disclosed incidentally in the ordinary course of business.
To the extent that cookies and other similar tracking technologies are deemed to be a “sale” / “sharing” which include targeted advertising, as defined under applicable U.S. state laws, you can opt-out of these online tracking technologies by submitting a request via privacy@benefitfocus.com. Please note, some features of our websites may not be available or function as intended as a result. For more information on your right to opt out, please visit the US State Data Privacy Laws section below.
Security
We work to protect your personal information from loss, misuse, or unauthorized alteration by using commercially reasonable security safeguards, coupled with security procedures and practices. Although Benefitfocus employs measures to maintain security, we cannot guarantee that your information will not be intercepted by third parties’ illegal efforts. It is your responsibility to maintain the privacy of your username and password. Unauthorized use of your registered account with us will enable access to your personal information. Please keep your username and password in a safe and secure place.
Children Under the Age of 16
The Services are not intended for children under 16 years of age. No one under the age of 16 may provide any personal information to the Services and we do not knowingly collect personal information directly from children under 16. If you believe we might have collected personal information from a child under 16 inadvertently, please email us at the email address provided in the Contact Us section below.
Do-Not-Track Signals; Third-Party Tracking
Unless your browser settings are configured to make your online activities and information about your online activities invisible to usage analytics tools, we do not presently have the capability to omit you from usage analytics to the extent your browser only sends us a “do not track” message and does not otherwise screen you from tracking without any action on our part. To learn more about browser tracking signals and “Do Not Track,” please visit http://allaboutdnt.org. Third parties, other than our vendors (such as our website analytics provider), do not have authorization from us to track which websites you visited prior to and after visiting the Services. Please note, however, that we cannot control third-party tracking and there may be some third-party tracking that occurs without our knowledge or consent.
Third-Party Sites
The Services may also contain links to other websites which are not controlled by us. These links are made available to you as a convenience, and you agree to use these links at your own risk. Benefitfocus disclaims any responsibility for the privacy practices or the content of such other websites. If you navigate to a third-party website from the Services, we strongly encourage you to review and become familiar with that third-party website’s own privacy policy and statements.
Notice to Individuals Outside the United States
The Services are only intended for individuals located in the United States. If you are located outside of the United States, any information you provide to us will be transferred to and stored in the United States and by submitting information to us, you explicitly authorize its transfer and storage within the United States. We will protect the privacy and security of personal information according to this Privacy Notice regardless of where it is processed or stored.
U.S. State Data Privacy Laws
Benefitfocus processes your personal information in accordance with applicable U.S. state data privacy laws, including California, Colorado, Connecticut, Utah, and Virginia. Consistent with applicable law, residents of these states may exercise the rights described in this section. Please note that consumer rights vary from state-to-state.
Additionally, if you are a Platform User, then your employer or referring organization may ask us to disclose your personal information to them in order to fulfill a request from you. If you make a request through your employer, we will directly provide you with your information, however you may directly contact Benefitfocus to make a consumer request.
Personal Information Collection and Uses.
U.S. state data privacy laws require Benefitfocus to disclose the categories of personal information collected, from whom personal information is collected, and how such personal information is used. Please see the sections above for more information: “Collection of Information” which details the sources and categories of personal information Benefitfocus collects and “Use of Information” which details how your personal information is used.
Categories of Personal Information Disclosed and Categories of Recipients
We disclosure the following categories of personal information used for a business purpose:
- We disclose Personal Identifiers, Device Information, Internet/Network Activity with businesses, service providers, and third parties, such as advertising networks, analytics and social media networks.
- We disclose Payment Information with businesses and service providers who process payments.
- We disclose Personal Identifiers, Commercial Information, and Demographic Information with service providers, such as insurance providers, benefits providers, and your employer in order to provide the services you have requested.
We disclosure the following categories of personal information for a commercial purpose:
- We disclose Personal Identifiers, Device Information, Internet/Network Activity with businesses, service providers, and third parties, such as advertising networks, analytics and social media networks.
Right to Opt Out of Sale/Sharing
Our Site uses cookies and other online tracking technologies that may be considered a “sale” / “sharing” under applicable law. You may exercise your right to opt out of the “sale” / “sharing” of your personal information by following the Privacy Choices link at the bottom of your screen.
Residents of certain states may opt out by broadcasting an Opt-Out Preference Signal, such as the Global Privacy Control (GPC) (on the browsers and/or browser extensions that support such a signal). If you choose to use the GPC signal, you will need to turn it on for each supported browser or browser extension you use.
Categories of personal information disclosed that may be considered “sale” / “sharing” include, Basic Identifying Information, Device Information, and Internet/Network Activity.
Categories of third parties to whom personal information was disclosed that may be considered “sale”/ “sharing” include certain advertisers and marketing partners, data analytics providers, and social media networks.
Right to Access, Know, and Correct
Residents of states with data privacy laws have the right to know what personal information was collected and the right to know the business and commercial purpose with which Benefitfocus processed the personal information over the past 12 months. Residents also have the right to correct any personal information maintained by Benefitfocus that may be incorrect. Once we receive your request and confirm your identity, we will disclose to you:
- The categories of personal information collected about you.
- The categories of sources for the personal information we collected about you.
- Our business or commercial purpose for collecting or selling that personal information.
- The categories of third parties with whom we share that personal information.
- If we sold or disclosed your personal information for a business purpose, two separate lists disclosing:
- sales, identifying the personal information categories that each category of recipient purchased; and
- business purpose, identifying the personal information categories that each category of recipient obtained.
- The specific pieces of personal information we collected about you.
Right to Delete
Residents of states with data privacy laws have the right to request that Benefitfocus delete any of the personal information collected and retained, subject to certain exceptions. Once we receive your request and confirm your identity, we will review your request to see if an exception allowing us to retain the information applies. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) and as permitted by applicable law. We will delete or deidentify personal information not subject to an exception from our records and will direct our service providers to take similar action.
Exercising Your Rights
To exercise your rights described above, please submit a request by either:
- Calling us at 1-855-221-6400
- Sending an email to privacy@benefitfocus.com
Only you, or a natural person or an authorized agent may make a verifiable consumer request related to your personal information. You may make a verifiable consumer request on behalf of your minor child.
You may only submit a request to know twice within a 12-month period. Your request must:
- Provide sufficient information that allows us to reasonably verify you.
- Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.
You do not need to create an account with us to submit a request. We will only use personal information provided in the request to verify the requestor’s identity or authority to make it.
Authorized Agents
If you use an authorized agent, you may provide a power of attorney executed pursuant to applicable law. If a power of attorney is not submitted, you will be required to provide the authorized agent signed permission to submit a request, verify your identity directly with us, and directly confirm with us that you provided the authorized agent permission to submit the request. If you’re an authorized agent making a request, you need to submit the following to the email address below in our contact information:
- a copy of a power of attorney provided to you by the consumer pursuant to applicable law; or
- proof of signed permission along with a copy of your ID
You will also need to have the consumer directly confirm with us that they provided you permission to submit the request by sending an email to the address below in our contact information.
Response Timing and Format
We will acknowledge a verifiable consumer request within ten (10) days of receipt, where applicable law requires, and we will respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing.
Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.
We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
Residents of certain states may have the right to appeal our decision with respect to a request. To appeal a decision, please contact us through the ways listed above or any method outlined in the decision.
Non-Discrimination and No Retaliation
We will not discriminate against you for exercising any of your rights. Unless permitted by applicable law, we will not:
- Deny you goods or services.
- Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
- Provide you a different level or quality of goods or services.
- Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
California Shine the Light
Under California’s “Shine the Light” law, California residents who provide personal information in obtaining products or services for personal, family, or household use are entitled to request and obtain from us once a calendar year information which includes a list of all third parties to which Benefitfocus has disclosed personal information, as defined in California Civil Code Section 1798.83(e) during the preceding year, if any, with other businesses for their own direct marketing uses. If applicable, this information would include the categories of customer information and the names and addresses of those businesses with which we shared customer information for the immediately prior calendar year. California residents may request this information in writing by contacting us via email to privacy@benefitfocus.com with “California Privacy Request” in the subject line. In your request, please attest to the fact that you are a California resident and provide a current California address for your response.
HIPAA Data Request
The Health Insurance Portability and Accountability Act (HIPAA) provides that individuals have certain rights regarding their Protected Health Information (PHI). In the event Voya maintains PHI as part of the services or products it provides to you, and you wish to exercise these rights with regard to PHI, please submit a HIPAA data request.
Changes to This Notice
We reserve the right to amend this Notice at our discretion and at any time. When we make changes to this Notice, we will post the updated notice on the website and update the notice’s effective date. Your continued use of our Services following the posting of changes constitutes your acceptance of such changes.
Contact Us
If you have any questions about this Privacy Notice, or any other questions or suggestions, please contact our Privacy Officer as follows:
Benefitfocus Privacy Officer
Email: privacy@benefitfocus.com
Phone: 1-855-221-6400
Address: 100 Benefitfocus Way, Charleston, South Carolina 29492