Privacy Policy

This Privacy Policy describes how Heppner Insurance Group, LLC ("Heppner Group," "We," "Us," or "Our") collects, uses, discloses, and protects Your information when You visit the Website, submit a contact form or lead-generation form, request a quote, communicate with Heppner Group by telephone, text message, email, or other channel, respond to Our advertisements, or otherwise interact with Heppner Group online or offline. This Privacy Policy applies to information collected through the Website, through lead-generation and marketing activities, and through communications initiated by You or by Us. Your use of the Website and Our services is also governed by Our Terms & Conditions, which contain additional consent language, regulatory terms, and legal disclosures. Please review the Terms & Conditions in addition to this Privacy Policy.

We use Personal Data to operate the Website, respond to inquiries, generate and follow up on leads, provide insurance brokerage services, communicate with You by telephone, text message, email, mail, and other channels, market and advertise Our services, comply with legal and regulatory obligations, and improve Our services and communications.

Interpretation and Definitions

Interpretation

Capitalized words shall have the defined meaning below regardless of whether they appear in singular or in plural.

Definitions

For the purposes of this Privacy Policy:

• Account means any online account or portal access we make available to you, if any.

• Affiliate means an entity that controls, is controlled by or is under common control with a party, where “control” means ownership of 50% or more of the shares, equity interest or other securities entitled to vote for election of directors or other managing authority.

• Cookies are small files that are placed on Your computer, mobile device or any other device by a website, containing the details of Your browsing history on that website among its many uses.

• Device means any device that can access the Service such as a computer, a cellphone or a digital tablet.

• Personal Data is any information that relates to an identified or identifiable individual , including but not limited to name, phone number, email address, mailing address, date of birth, Medicare eligibility information, health-related information provided for insurance purposes, IP address, device identifiers, and any other information defined as "personal information," "personal data," or "personally identifiable information" under applicable law.

• Service refers to the Website , and all related lead-generation forms, contact forms, landing pages, quoting tools, communications channels (including telephone, text message, email, and mail), online and offline marketing activities, and any other services or functionality We make available to You.

• Service Provider means any natural or legal person who processes the data on behalf of Heppner Group. It refers to third-party companies or individuals employed by Heppner Group to facilitate the Service, to provide the Service on behalf of Heppner Group, to perform services related to the Service or to assist Heppner Group in analyzing how the Service is used.

• Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself (for example, the duration of a page visit).

• Website refers to the Heppner Group websites accessible from https://www.heppnergroup.com/ and https://www.heppnerinsurance.com/.

• You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service, as applicable.

Collecting and Using Your Personal Data

Types of Data Collected

Personal Data

While using Our Service, submitting a contact or lead-generation form, requesting a quote, calling Us, communicating with Us, or otherwise interacting with Us, We may collect or You may provide Us with personally identifiable information that can be used to contact or identify You. This information may be collected directly from You, from Your Device, from third-party lead sources or referral partners, from advertising platforms, or from publicly available sources. Personally identifiable information may include, but is not limited to:

• Contact information, such as name, phone number (including mobile and landline), email address, and mailing address

• Insurance-related information, such as date of birth, Medicare eligibility status, Medicare Beneficiary Identifier or plan ID, plan preferences, current coverage, prescriptions, providers, household and dependent information, income or subsidy eligibility information, and other information needed to quote, compare, apply for, enroll in, or service insurance products

• Communications records, including inquiry details, form submissions, lead-source and referral information, consent records and timestamps, call recordings and call detail records where permitted or required by law, text message logs, email correspondence, and opt-in and opt-out re cords

• Demographic and inferred information, such as age range, geographic area, language preference, and insurance-related interests or needs, whether provided by You, inferred from Your interactions, or obtained from third-party data sources

• Lead-generation data, including information submitted through contact forms, landing pages, quote-request forms, click-to-call features, and similar tools, as well as information received from third-party lead providers, referral partners, and marketing vendors

• Usage Data

Usage Data

Usage Data is collected automatically when using the Service.

Usage Data may include information such as Your Device’s Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that You visit, the time and date of Your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

When You access the Service by or through a mobile device, We may collect certain information automatically, including, but not limited to, the type of mobile device You use, Your mobile device unique ID, the IP address of Your mobile device, Your mobile operating system, the type of mobile Internet browser You use, unique device identifiers and other diagnostic data.

We may also collect information that Your browser sends whenever You visit our Service or when You access the Service by or through a mobile device.

Information from Third-Party Sources

We may receive Personal Data about You from third-party sources, including lead-generation providers, referral partners, insurance carriers, general agencies, data brokers, advertising platforms, public records, and other sources. This information may include contact information, demographic information, insurance-related information, and lead-source and attribution data. We combine information received from third-party sources with information We collect directly from You and through the Website, and We use the combined information for the purposes described in this Privacy Policy.

Tracking Technologies and Cookies

We use Cookies and similar tracking technologies to track the activity on Our Service and store certain information. Tracking technologies used are beacons, tags, and scripts to collect and track information and to improve and analyze Our Service. The technologies We use may include:

• Cookies or Browser Cookies. A cookie is a small file placed on Your Device. You can instruct Your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if You do not accept Cookies, You may not be able to use some parts of our Service. Unless you have adjusted Your browser setting so that it will refuse Cookies, our Service may use Cookies.

• Web Beacons. Certain sections of our Service and our emails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit Heppner Group, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of a certain section and verifying system and server integrity).

Cookies can be “Persistent” or “Session” Cookies. Persistent Cookies remain on Your personal computer or mobile device when You go offline, while Session Cookies are deleted as soon as You close Your web browser. Learn more about cookies on the Privacy Policies website article.

We use both Session and Persistent Cookies for the purposes set out below:

• Necessary / Essential Cookies Type: Session Cookies Administered by: Us Purpose: These Cookies are essential to provide You with services available through the Website and to enable You to use some of its features. They help to authenticate users and prevent fraudulent use of user accounts. Without these Cookies, the services that You have asked for cannot be provided, and We only use these Cookies to provide You with those services.

• Cookies Policy / Notice Acceptance Cookies Type: Persistent Cookies Administered by: Us Purpose: These Cookies identify if users have accepted the use of cookies on the Website.

• Functionality Cookies Type: Persistent Cookies Administered by: Us Purpose: These Cookies allow us to remember choices You make when You use the Website, such as remembering your login details or language preference. The purpose of these Cookies is to provide You with a more personal experience and to avoid You having to re-enter your preferences every time You use the Website.

We currently use Google Analytics and may use, enable, replace, supplement, or integrate additional analytics, advertising, tracking, call-tracking, session-replay, attribution, remarketing, retargeting, conversion-measurement, audience-matching, chat, form-analytics, cookie, pixel, tag, beacon, script, software-development-kit, or similar technologies from Google or other service providers. These technologies may collect or receive information from the Website, emails, online forms, advertisements, Devices, browsers, and interactions with our digital properties, and may use cookies, device identifiers, IP addresses, event data, page-view data, referrer data, approximate location data, campaign parameters, hashed or matched contact information, and similar data to measure usage, improve services, evaluate marketing, personalize or measure advertising, prevent fraud, and understand how users interact with the Website. We may use this information, to the fullest extent permitted by applicable law, to remarket or retarget advertisements to Website visitors, form submitters, prospective customers, existing customers, and similar or lookalike audiences across Google properties, search engines, social media platforms, advertising networks, and other digital properties. For more information about how Google collects and processes data, visit Google’s privacy policy and the page entitled “How Google Uses Information from Sites or Apps that Use Our Services.” You may opt out of Google Analytics by installing the Google Analytics Opt-Out Browser Add-on, and You may manage Google ad personalization settings through Google’s Ads Settings page. We do not knowingly use health-related data or other sensitive personal information for remarketing or targeted advertising in a manner prohibited by applicable law, CMS rules, carrier requirements, or advertising-platform policies.

You may be able to control cookies and similar technologies through browser settings, device settings, platform controls, industry opt-out tools, universal opt-out preference signals where required by law, and any cookie or privacy controls we make available on the Website. Where applicable state privacy law gives you the right to opt out of the sale or sharing of personal information, targeted advertising, profiling, or certain uses of sensitive personal information, we will honor legally required opt-out requests and legally required universal opt-out preference signals, including Global Privacy Control signals where required by applicable law. If you disable or reject certain technologies, parts of the Website or related services may not function as intended, and we may be less able to remember your preferences, measure performance, or provide relevant communications.

Use of Your Personal Data

Heppner Group may use Personal Data for the following purposes:

• To provide and maintain our Service, including to monitor the usage of our Service.

• To manage Your Account, if applicable: to manage registration, authentication, account access, and user preferences if we provide account-based functionality.

• To provide insurance brokerage services: to respond to inquiries, compare insurance options, prepare quotes, assist with applications or enrollments, service policies, and communicate with carriers, administrators, and service providers as needed.

• To contact You: to communicate with You by telephone (including autodialed and prerecorded calls where permitted), text message (SMS), email, mail, and other methods regarding inquiries, quotes, services, appointments, applications, enrollments, policy servicing, compliance matters, and other insurance-related communications, subject to any consent You have provided and applicable law, including the Telephone Consumer Protection Act (TCPA) and applicable CMS Medicare communications and marketing guidelines. Additional consent disclosures and mechanisms may be provided at the point of contact or in Our Terms & Conditions.

• To provide marketing and lead-generation communications: to market, advertise, and promote insurance products, services, and educational content that may be of interest to You by telephone, text message, email, mail, remarketing advertisements, social media, and other channels, subject to applicable consent requirements, opt-out rights, TCPA requirements, CMS Medicare marketing guidelines, and other applicable law. We may use information You provide through the Website, contact forms, or lead-generation forms to initiate follow-up communications with You.

• To manage Your requests: To attend and manage Your requests to Us.

• For regulatory compliance and recordkeeping: to maintain records of consent, opt-in, opt-out, communications, and transactions as required or permitted by applicable law, including CMS Medicare marketing and communications requirements, TCPA requirements, state insurance regulations, and state consumer privacy laws; to respond to regulatory inquiries; and to demonstrate compliance with applicable legal obligations.

• For lead management and follow-up: to track, manage, assign, and follow up on leads generated through the Website, contact forms, landing pages, advertising, referrals, third-party lead providers, and other sources; to verify contact information; to schedule and confirm appointments; and to manage our sales pipeline and customer-relationship-management systems.

• For business transfers: We may use Your information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Data held by Us about our Service users is among the assets transferred.

• For analytics, advertising, remarketing, and digital measurement: We may use Personal Data, Usage Data, cookies, pixels, tags, web beacons, device identifiers, analytics events, form-submission data, lead-source data, hashed contact information, and similar information to analyze Website traffic, measure conversions, attribute leads, evaluate and improve advertising campaigns, build, suppress, refine, retarget, remarket to, or exclude audiences, create or use similar or lookalike audiences where permitted, personalize or measure marketing, troubleshoot forms and user experience, prevent fraud, and improve our Website, products, services, marketing, and communications, subject to applicable consent, opt-out, sensitive-data, Medicare-marketing, and platform-policy requirements.

• For legally permitted data sharing and remarketing: We may disclose, upload, match, hash, pseudonymize, or otherwise make available personal information, identifiers, lead-source information, form-submission data, and similar information to advertising platforms, analytics providers, measurement vendors, customer-relationship-management providers, communications vendors, and other Service Providers or business partners for remarketing, retargeting, audience creation, suppression, attribution, conversion measurement, lead follow-up, and related marketing purposes, where permitted by applicable law and subject to applicable opt-out rights and contractual restrictions.

• For any other purpose disclosed to You at the time of collection or with Your consent, or as otherwise permitted or required by applicable law.

We may share Your personal information in the following situations:

• With Service Providers, advertising platforms, and marketing vendors: We may share personal information, Usage Data, identifiers, form-submission data, hashed or pseudonymized contact information, call or message data, lead-source data, and related information with Service Providers, advertising platforms, analytics providers, customer-relationship-management providers, communications vendors, call centers, lead-management platforms, data-matching providers, and other vendors that help us operate the Website, provide insurance brokerage services, analyze usage, measure and improve advertising, create, suppress, match, retarget, or remarket audiences, place or receive calls and texts, provide email or SMS services, perform call tracking or recording, detect fraud, or otherwise support our business, subject to applicable law and contractual restrictions.

• For business transfers: We may share or transfer Your personal information in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of Our business to another company.

• With Affiliates: We may share Your information with Our affiliates, in which case we will require those affiliates to honor this Privacy Policy. Affiliates include Our parent company and any other subsidiaries, joint venture partners or other companies that We control or that are under common control with Us.

• With business partners: We may share Your information with Our business partners , including insurance carriers, general agencies, managing general agents, field marketing organizations, lead providers, and referral partners, to offer You insurance products, services , quotes, or related information, and to facilitate enrollments, applications, and policy servicing.

• With insurance carriers, CMS, and regulators: We may share Your information with insurance carriers, Medicare Advantage organizations, Part D plan sponsors, the Centers for Medicare & Medicaid Services (CMS), state departments of insurance, and other regulatory authorities as required or permitted in connection with insurance applications, enrollments, plan administration, compliance, audits, and regulatory inquiries.

• With Your consent: We may disclose Your personal information for any other purpose with Your consent.

Consumer Health Data

We may collect health-related information, including prescriptions, providers, health conditions, Medicare eligibility, plan preferences, and related insurance information, when You provide it or when it is needed to quote, compare, apply for, enroll in, or service insurance products. For Washington and Nevada residents and others covered by applicable consumer health data laws, this information may be treated as consumer health data. Where required, We will provide any separate Consumer Health Data Privacy Policy, homepage or footer link, consent mechanism, deletion process, and sale authorization required by those laws. We will not sell consumer health data without a valid authorization where required, and We will not use geofencing around health care facilities to identify, track, collect consumer health data from, or target consumers based on health care services.

GLBA and State Insurance Privacy Notices

Because We provide insurance brokerage services, some information We collect or receive may be subject to the Gramm-Leach-Bliley Act, state insurance privacy laws, and insurance-specific privacy notices. This Website Privacy Policy does not replace any initial, annual, or other insurance privacy notice, nonaffiliated third-party opt-out notice, carrier notice, or disclosure required by GLBA, state insurance privacy regulations, or applicable carrier requirements. To the extent information is governed by GLBA or insurance privacy laws, that information may be exempt from certain state consumer privacy laws, and We will handle it in accordance with the applicable financial-services or insurance privacy framework.

CMS TPMO and Medicare Beneficiary Data Restrictions

When We act as, or work with, a Third-Party Marketing Organization in connection with Medicare Advantage or Part D marketing, sales, or enrollment activities, personal beneficiary data collected for marketing or enrollment purposes will be used only for the express purpose for which it was collected and as permitted by CMS rules. We will not share such personal beneficiary data with another Third-Party Marketing Organization unless the beneficiary has provided prior express written consent through a clear and conspicuous disclosure that identifies each recipient and allows the beneficiary to consent or reject sharing with each recipient, as required by applicable CMS regulations.

Call Recording Notice

Telephone calls with Us or Our Service Providers may be monitored, recorded, transcribed, or otherwise documented for quality assurance, training, compliance, consent verification, dispute resolution, and recordkeeping purposes. Where required by law, We will provide notice of recording and obtain any required consent before recording a call. If You do not wish to be recorded, You may notify the representative, discontinue the call, or contact Us through another available method.

HIPAA

Some health information may be subject to HIPAA or carrier-specific privacy and security obligations when We receive, use, or disclose it on behalf of a covered entity or business associate. This Privacy Policy is not intended to replace any HIPAA Notice of Privacy Practices provided by a carrier, health plan, provider, or other covered entity. Where HIPAA applies to a particular data set or relationship, We will handle that information in accordance with applicable HIPAA obligations, carrier agreements, and other governing requirements.

State Consumer Privacy Rights. Residents of certain states may have rights under applicable state consumer privacy laws, including the right to request access to, correction of, deletion of, or portability of certain personal information; to opt out of the sale or sharing of personal information, targeted advertising, profiling in furtherance of decisions that produce legal or similarly significant effects, or certain processing of sensitive personal information; and, where applicable, to limit the use and disclosure of sensitive personal information. Sensitive personal information may include health-related information provided for insurance quoting or enrollment. You may exercise Your rights by contacting Us using the information in the "Contact Us" section below or through any opt-out mechanism We make available on the Website, including any "Do Not Sell or Share My Personal Information" or "Limit the Use of My Sensitive Personal Information" mechanism that applicable law requires Us to provide. We will verify requests as required by law, may request information reasonably necessary to confirm Your identity or authority, and will respond within the time required by applicable law, generally within 45 days where that timeframe applies. You may designate an authorized agent where permitted by law, subject to verification of the agent’s authority and Your identity. If We deny a request, You may appeal the decision by contacting Us using the same method used to submit the request and stating that You are appealing Our decision. We will not discriminate against You for exercising Your privacy rights.

We do not knowingly sell or share sensitive personal information, including health-related information provided for insurance quoting or enrollment, for targeted advertising or cross-context behavioral advertising. If Our use of advertising, analytics, audience-matching, or remarketing technologies constitutes a sale, sharing, or targeted advertising under applicable law, We will provide legally required opt-out methods and honor applicable opt-out requests.

Telephone, Text Message, and Email Communications

We maintain records of consent, opt-in, opt-out, and communications as required by applicable law, including the TCPA, CMS Medicare marketing and communications requirements, and applicable state laws. You may opt out of marketing communications at any time using the methods described in this Privacy Policy or in Our Terms & Conditions. Opting out of marketing communications does not affect transactional or service-related communications that are not primarily marketing in nature.

We maintain an internal do-not-call list. If You wish to be placed on Our internal do-not-call list, You may contact Us using the information in the "Contact Us" section below, reply STOP to any text message, or use any other opt-out mechanism We make available. We will honor Your request within the timeframes required by the TCPA and applicable state do-not-call laws.

By providing Your email address, You acknowledge that We may use it to send You transactional communications (such as quote confirmations, application updates, and appointment reminders), marketing and promotional communications about insurance products and services, and other communications related to Our business, subject to applicable law. You may opt out of marketing emails at any time by using the unsubscribe link in any email or by contacting Us.

By providing Your telephone number (including any mobile or wireless number) through the Website, a contact form, a lead-generation form, a quote request, or any other means, You acknowledge that Heppner Group and its Service Providers may use that number to contact You by telephone call (including calls made using an automatic telephone dialing system or prerecorded or artificial voice where permitted by law), or voicemail regarding insurance products, services, quotes, appointments, applications, enrollments, policy servicing, and related matters. Consent for such communications may be obtained through Our Terms & Conditions, at the point of contact, or through other consent mechanisms We make available. Providing Your telephone number and consenting to be contacted is not a condition of purchasing any goods or services from Us.

Notwithstanding anything else in this Privacy Policy, mobile phone numbers collected for the SMS program, SMS opt-in data, SMS consent records, and text-messaging consent information will not be sold, rented, or shared with third parties or affiliates for their marketing or promotional purposes. This information may be disclosed only to service providers that help Heppner Group operate and deliver the SMS program, such as messaging platform providers and wireless carriers, and only for purposes related to providing the SMS program.

Retention of Your Personal Data

Heppner Group will retain Your Personal Data for as long as is necessary for the purposes set out in this Privacy Policy , including to provide services, maintain customer and lead records, fulfill legal and regulatory obligations, and support our business operations. We will retain and use Your Personal Data to the extent necessary to comply with our legal obligations (including CMS recordkeeping requirements, TCPA consent-record requirements, state insurance regulations, and state consumer privacy laws), resolve disputes, enforce our legal agreements and policies , and for other legitimate business purposes. Consent records, opt-in and opt-out records, communications logs, and call recordings may be retained for the period required by applicable law or our internal retention policies, whichever is longer.

Heppner Group will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period of time, except when this data is used to strengthen the security or to improve the functionality of Our Service, or We are legally obligated to retain this data for longer time periods.

Transfer of Your Personal Data

Your information, including Personal Data, is processed at Heppner Group’s operating offices and in any other places where the parties involved in the processing are located. It means that this information may be transferred to — and maintained on — computers located outside of Your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from Your jurisdiction.

Your consent to this Privacy Policy followed by Your submission of such information represents Your agreement to that transfer.

Heppner Group will take all steps reasonably necessary to ensure that Your data is treated securely and in accordance with this Privacy Policy and no transfer of Your Personal Data will take place to an organization or a country unless there are adequate controls in place including the security of Your data and other personal information.

Delete Your Personal Data

Where required by applicable law, You may have the right to request deletion of the Personal Data that We have collected about You, subject to certain exceptions. We may deny a deletion request in whole or in part where retention is required or permitted by applicable law, regulation, or contractual obligation, including but not limited to CMS recordkeeping requirements, TCPA consent-record requirements, state insurance regulations, carrier requirements, fraud prevention, legal-claim defense, and completion of pending transactions.

If we provide account-based functionality, the Service may allow you to update or delete certain information from within the Service.

You may contact Us to request access to, correction of, or deletion of personal information that You have provided to Us, subject to applicable legal, regulatory, recordkeeping, and carrier requirements.

Please note, however, that We may need to retain certain information when we have a legal obligation or lawful basis to do so.

Other Disclosure of Your Personal Data

Business Transactions

If Heppner Group is involved in a merger, acquisition or asset sale, Your Personal Data may be transferred. We will provide notice before Your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law Enforcement

Under certain circumstances, Heppner Group may be required to disclose Your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency).

Other Legal Requirements

Heppner Group may disclose Your Personal Data on the good faith belief that such action is necessary to:

• Comply with a legal obligation

• Protect and defend the rights or property of Heppner Group

• Prevent or investigate possible wrongdoing in connection with the Service

• Protect the personal safety of Users of the Service or the public

• Protect against legal liability

Security of Your Personal Data

The security of Your Personal Data is important to Us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. While We strive to use commercially acceptable means to protect Your Personal Data, We cannot guarantee its absolute security.

Children’s Privacy

Our Service is intended for adults and is designed to assist individuals who are eligible for or interested in Medicare and related insurance products. We do not knowingly collect personally identifiable information from anyone under the age of 18. If You believe a minor has provided Us with Personal Data, please contact Us, and We will take steps to remove that information.

Links to Other Websites

Our Service may contain links to other websites that are not operated by Us. If You click on a third party link, You will be directed to that third party’s site. We strongly advise You to review the Privacy Policy of every site You visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in Our practices, technologies, legal requirements, or business operations. We will notify You of any changes by posting the updated Privacy Policy on this page and updating the "Last Updated" date at the top. Where required by applicable law, We may provide additional notice of material changes (such as by email or a prominent notice on the Website).

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

Contact Us

If You have any questions about this Privacy Policy, wish to exercise any privacy rights, or need to submit an opt-out or deletion request, You can contact Us at:

• By phone: (888) 700-0126

• Email: info@heppnergroup.com

• Mailing address: 2600 Eagan Woods Drive, Suite 135, Eagan, MN 55121

This Privacy Policy should be read together with Our Terms & Conditions, which contain additional consent disclosures, regulatory terms, dispute-resolution provisions, and other legal terms that apply to Your use of the Website and Our services.