Consumer Health Data Privacy Policy

Last Updated: August 27, 2026

This policy explains how PlanStan, LLC ("PlanStan," "we," "us," or "our") handles consumer health data, and the rights you have over it under the laws of certain states, including Washington's My Health My Data Act, Nevada's consumer health data law (SB 370), and Connecticut's consumer health data provisions. It supplements our Privacy Policy; where the two overlap, this policy governs for consumer health data.

1. What consumer health data we collect, and why

To provide the cost-modeling service you request, we collect health-related information that you enter directly:

Age (year and month of birth) and gender, for each person you model
General medical conditions
Expected healthcare utilization (for example, expected doctor visits or prescriptions)
Pregnancy status and family health planning information
Other health profile information you choose to provide

We collect this data for one purpose: to estimate healthcare utilization and model your out-of-pocket costs across the insurance plans you upload. We do not use it for advertising, and we do not sell it.

Section 4 describes advertising-related information that may be treated as consumer health data under some state laws.

2. Sources of consumer health data

All of the health information above comes from you (or, for family members, from the account holder entering it on their behalf). We do not obtain your health information from third parties, data brokers, insurers, employers, or public sources.

3. How consumer health data is shared

We share consumer health data only with service providers (processors) acting on our behalf to operate the Services, under contracts that limit their use of it to providing services to PlanStan. These include the provider that stores your health profile and uploaded plan documents, and the provider that performs AI processing of the insurance plan documents you upload. A current list of our service providers, and the information each receives, is available at theplanstan.com/sub-processors. We have no corporate affiliates; we share consumer health data only with the service providers listed there.

We do not share the health information you enter in the product (Section 1) with advertising platforms, insurers, employers, benefits administrators, or data brokers, and we do not sell it. We may disclose information if required by law, as described in Section 4 of our Privacy Policy.

Analytics information. We use analytics service providers to understand how the Services are used and to operate, secure, and improve them. These providers process on our behalf, under contract: an account identifier, usage and navigation information (such as pages viewed and features used), device and browser information, IP address, and approximate location derived from IP address. On our marketing pages, this collection occurs only if you opt in to analytics cookies (through the cookie banner or the Your Privacy Choices page), and you may withdraw that consent at any time on our Your Privacy Choices page. We honor Global Privacy Control signals as a refusal or withdrawal of this consent as well. Within the logged-in product, this collection is limited to what is reasonably necessary to provide the service you have requested. Analytics providers do not receive the health information you enter, and they are not permitted to use this information for their own purposes. To the extent applicable law treats information about an identified person's use of the Services as consumer health data, we treat this information as consumer health data, and the rights described in Section 5 apply to it. A current list of our analytics providers, and the information each receives, is available at theplanstan.com/sub-processors.

We do not sell your health information. Section 4 describes the only disclosure that some state laws could treat as a "sale" or "share" of consumer health data — it never includes the health information you enter, and it happens only with your separate opt-in consent.

4. Advertising Data

If you opt in to advertising cookies (through the cookie banner or the Your Privacy Choices page on our marketing pages, or in the Cookies section of your account settings), we and our advertising partners (listed under “Advertising partners” at theplanstan.com/sub-processors) collect: cookie and device identifiers, IP address, browser and device information, pages viewed on our marketing pages and sign-up flow, and two events — completing sign-up, and starting a paid subscription. The tracking technologies themselves load only on our marketing pages and sign-up flow. The subscription event is transmitted by our servers when a purchase completes (a "server-side" disclosure), not by any tracking technology in the logged-in application, and carries only the advertising cookie identifier set when you consented and the purchase amount — never your name, email address, or phone number. Our partners use this data to measure our advertising, to optimize how our ads are delivered, and to build audiences for our future advertising campaigns.

This data contains none of the health information described in Section 1, and these technologies never load on the logged-in application where health information appears. To the extent applicable law treats this information as consumer health data, we collect and share it only with your prior opt-in consent, and you may withdraw that consent at any time, as easily as you gave it — in the Cookies section of your account settings if you have an account, or on our Your Privacy Choices page (linked from the footer of our marketing pages) if you do not. We honor Global Privacy Control signals as a refusal or withdrawal of that consent, and a withdrawal also stops the server-side event disclosure described above.

5. Your rights

If you are a resident of a state with a consumer health data law, you have the right to:

Access your consumer health data, including a list of the third parties and affiliates with whom we have shared it;
Withdraw consent to our collection or sharing of your consumer health data;
Delete your consumer health data. We will also direct our processors, and any third parties with whom the data was shared, to delete it.

You may also ask us to correct inaccurate information at any time, as described in Section 8 of our Privacy Policy — that right applies equally to consumer health data.

To exercise any of these rights, email stan@theplanstan.com from your account email address with the right you wish to exercise. We will verify your request using your account email and respond within 45 days, extendable once by a further 45 days where reasonably necessary. If you do not have an account — for example, you consented to advertising cookies on our marketing pages and never signed up — you may still make a request, and we will honor it to the extent we can reasonably verify it or associate it with data we hold.

How long we keep consumer health data. The health information you enter is retained while your account is active and for 90 days after deletion, as described in Section 7 of our Privacy Policy. We keep records of the consents you give and withdraw for as long as we need to be able to demonstrate them. Advertising data is held by our advertising partners under their own retention policies once disclosed; withdrawal stops new disclosure but does not retroactively delete what a partner already holds — though your deletion right above extends to directing them to delete it.

Appeals. If we refuse to act on your request, we will tell you why, and you may appeal by replying to our decision or emailing stan@theplanstan.com with "Appeal" in the subject line. We will respond to appeals within 45 days. If your appeal is unsuccessful, you may contact your state Attorney General:

Washington: www.atg.wa.gov/file-complaint
Nevada: ag.nv.gov
Connecticut: portal.ct.gov/ag

We will never deny you access to PlanStan, charge you a different price, or degrade the service because you exercise any of these rights.

A deletion request under this section is different from deleting your account: you may make it whether or not you have an account or keep one, and it is not limited by the ordinary retention periods described in our Privacy Policy — upon a verified request we delete the consumer health data from our active systems, direct our processors and any third parties with whom it was shared to do the same, and remove it from archives and backups as they are cycled.

6. Contact us

PlanStan, LLC 228 Park Ave S, Suite 258824 New York, NY 10003 Email: stan@theplanstan.com