Privacy Policy

Privacy Policy for PlanStan

Last Updated: August 27, 2026

PlanStan, LLC ("PlanStan," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website, https://theplanstan.com, and our related services (collectively, the "Services").

This Privacy Policy describes how we collect, use, and disclose information when you use our Services, and the choices and rights you have over that information.

1. Information We Collect

We collect information in several ways to provide and improve our Services. Important Note: We are not a HIPAA-covered entity, and HIPAA regulations do not apply to our Services. Your health information is protected by our security measures and contractual obligations.

A. Information You Provide Directly to Us

• Personal Information: When you register for an account, we collect personally identifiable information ("PII") such as your name and email address.
• User Content ("Plan Data"): To provide the core functionality of the Services, we collect the health insurance plan documents you upload and any financial or usage assumptions you input.

B. Information We Collect Automatically

• Usage and Log Data: Our servers automatically collect information when you access the Services, such as your IP address, browser type, operating system, access times, and the pages you have viewed.
• Referral and Navigation Data: Within the product, we collect information about how you move through the Services — the pages you visit and the order in which you visit them — to operate, secure, and improve them. On our marketing pages, analytics information (including the website or advertisement that referred you and campaign parameters contained in the link you followed) is collected only if you opt in to analytics cookies through the cookie banner or the Your Privacy Choices page. If you later create an account, we may associate activity from before you registered with your account — including consented marketing-page activity — so that we can understand how people discover and begin using the Services.
• Advertising Data (only if you opt in): If you turn on advertising cookies (Section 3 describes the controls), we and our advertising partners collect: cookie and device identifiers, IP address, browser and device information, the pages you viewed on our marketing pages and sign-up flow, and two generic events — completing sign-up, and starting a paid subscription. The tracking technologies themselves load only on our marketing pages and sign-up flow, never on the logged-in application; the subscription event is transmitted by our servers when a purchase completes, and carries only the advertising cookie identifier set when you consented and the purchase amount — never your name, email address, or phone number. No event ever includes any health information you provide in the Services.

C. Health Information

When you use our Services, you may provide health-related information including:

• Age (year and month of birth)
• Gender
• General medical conditions
• Expected healthcare utilization
• Pregnancy status and family health planning
• Other health profile information

If you provide information about dependents or other family members, you represent that you are authorized to do so and will inform them of this Privacy Policy. Information about dependents under 18 is provided by their parent or guardian.

This health information is particularly sensitive. We handle it with additional safeguards as described in Section 6. We do not send your health information to our analytics providers.

2. How We Use Your Information

We use the information we collect for various purposes, including:

A. To Provide and Maintain Our Service: To create and manage your account, process your uploaded Plan Data, perform cost-analysis calculations, and provide customer support.

B. To Improve Our Services: To understand how users interact with our platform, to improve our AI models and algorithms, and to develop new features. This includes the use of de-identified and aggregated Plan Data.

C. To Communicate With You:

• Transactional Communications: To send you critical service-related updates, security alerts, and administrative messages. You cannot opt out of these communications unless you delete your account.
• Marketing Communications: We will only send marketing communications if you are an existing customer or if you explicitly opt-in during registration. You may opt out of receiving these communications at any time. We will never share your email with third parties for their marketing purposes.

D. To Enforce Our Terms and Comply with Law: To protect the rights and safety of our users and third parties, as well as our own.

E. Data Minimization and Purpose Limitation: We only collect information necessary for the purposes stated in this policy. We do not use your health information, family information, or uploaded plan documents for advertising, and we do not sell or share them with data brokers or advertising partners.

F. Artificial Intelligence and Machine Learning: We use AI services to extract information from your insurance documents. We contractually prohibit our AI providers from using your content to train their models or for any purpose other than providing services to PlanStan. Providers may retain limited, access-controlled logs for abuse prevention and debugging for short periods consistent with their policies; we minimize the data we send and do not include more personal information than necessary. Your de-identified data may be used to improve our own AI models' accuracy, and we will not attempt to re-identify such data.

G. Advertising Measurement (opt-in only): With your separate opt-in consent, we use the advertising data described in Section 1 to measure the performance of our ads, and our advertising partners use it to optimize how our ads are delivered and to build audiences for our future advertising campaigns. You can withdraw this consent at any time (Section 8).

3. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to track the activity on our Service and hold certain information.

• Essential cookies: Required for login sessions and security, and to remember the cookie choices you make (declining optional cookies has to be remembered somewhere, so that choice itself is stored in an essential cookie that identifies nothing about you).
• Analytics cookies: To understand how visitors find and use the Services and to improve them. On our marketing and sign-up pages, analytics cookies are off by default and are set only if you opt in — through the cookie banner or on our Your Privacy Choices page — and you may withdraw that consent at any time (Section 8). Within the logged-in application, analytics is limited to what is reasonably necessary to provide the service you have requested. The analytics providers we use are listed at theplanstan.com/sub-processors.
• Advertising cookies and pixels (off by default): These load only after you opt in — through the cookie banner or the Your Privacy Choices page on our marketing pages, or in the Cookies section of your account settings — and only on our marketing pages and sign-up flow, never on any page that displays your health, family, or plan information. They are set by our advertising partners, who are listed at theplanstan.com/sub-processors, and collect the advertising data described in Section 1 so that we can measure our advertising and our partners can optimize ad delivery and build audiences for our future campaigns. You can withdraw at any time, as easily as you consented (Section 8), and withdrawal takes effect immediately for future collection, including the server-side subscription event described in Section 1.

How we ask for advertising consent. We ask for this consent separately from your acceptance of our Terms of Service — agreeing to the Terms is not consent to advertising. Before you decide, we describe what would be collected and with whom it would be shared, and we ask for two separate consents — one to the collection of this information, and one to its sharing with our advertising partners. You can grant or refuse each individually on our Your Privacy Choices page; choosing “Accept all” in the cookie banner grants both of them, together with the separate analytics-cookies consent described above, and each consent is recorded separately. We keep a record of the consents you give and withdraw — when, and what you were shown — so that we can honor them. Declining or withdrawing never affects your ability to use PlanStan.

You can control cookies through your browser settings, though disabling them may limit the functionality of the Services. Global Privacy Control: we treat a GPC signal from your browser as a refusal of analytics and advertising cookies, or as a withdrawal of previously given consents. On a browser sending GPC we do not load analytics or advertising technologies on our marketing pages, and a withdrawal — however you make it — also stops the server-side event disclosure described in Section 1.

4. Disclosure of Your Information

We do not sell your personal information for money. We do not sell or share your personal information for advertising purposes except as follows: if you opt in to advertising cookies, the advertising data described in Section 3 is disclosed to our advertising partners (listed at theplanstan.com/sub-processors), and some state laws treat that disclosure as "sharing" or "selling." We never disclose your health information for advertising. You can stop this disclosure at any time by turning off advertising cookies (Section 8), and we honor Global Privacy Control signals (Section 3). If you do not opt in, none of your information is disclosed for advertising. We do not share your health information with insurers, employers, or benefits administrators. We may share information we have collected about you in certain situations described below.

A. With Third-Party Service Providers: We may share your information with third parties that perform services for us or on our behalf. These providers fall into the following categories: application hosting and content delivery; database and document storage; account authentication; subscription and payment processing; AI processing of uploaded documents; product and website analytics; advertising measurement (only if you opt in, per Section 3); error monitoring; and rate limiting and caching.

A current list of the specific providers we use, what each one is for, and what information each receives, is available at theplanstan.com/sub-processors.

These service providers process your data according to their own privacy policies and terms of service. We select service providers that maintain reasonable data protection practices. We may change our service providers from time to time; when we do, we update the sub-processors page. We primarily process and store data in the United States. Some service providers may process data outside your state of residence; where they do, they maintain their own data protection safeguards.

B. By Law or to Protect Rights: We may disclose your information if required by law, subpoena, or government request, or if we believe in good faith that disclosure is necessary to protect our rights, prevent fraud, respond to an emergency, or protect the personal safety of our users or the public.

C. Business Transfers: In connection with a merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company, your information may be transferred as a business asset. Any acquirer will be required to honor the promises we have made in this Privacy Policy with respect to your information, or we will obtain your consent before materially changing how your information is used. We will notify you via email and/or a prominent notice on our website of any change in ownership.

D. With Your Consent: We may disclose your personal information for any other purpose with your consent.

5. Your License Grant for Data

When you provide User Content to us, you grant PlanStan certain licenses as described in Section 7C of our Terms of Service.

In summary: You grant us a perpetual license to (i) Summary of Benefits and Coverage (SBC) documents and plan structure data you upload (these standardized documents do not contain personal health information), and (ii) de-identified and aggregated data that cannot be linked back to you. For any other content you provide, we receive only a limited license to provide the Services, which ends when you delete the content. We do NOT receive a perpetual license to your identifiable personal health information, family member data, or health condition information—these are deleted according to the retention periods in Section 7 of this Privacy Policy.

We will not attempt to re-identify any de-identified or aggregated data.

For complete details about the scope and terms of the data license, please see Section 7C of our Terms of Service.

6. Data Security

We use administrative, technical, and physical security measures to help protect your personal information. For health information specifically, we:

• Encrypt all health data at rest using AES-256.
• Encrypt data in transit using TLS 1.2+.
• Limit access to employees who need it for service provision.
• Conduct regular security assessments.

A. Health Breach Notification: In the event of a breach of your health information, we will notify you without unreasonable delay and in no case later than 60 calendar days after discovery. If a breach involves 500 or more individuals, we will also notify the Federal Trade Commission without unreasonable delay and, where required, prominent media outlets. These obligations are required by the FTC Health Breach Notification Rule (16 CFR Part 318).

7. Data Retention Periods

We retain your information for specific periods:

• Account data: Duration of your active account + 90 days.
• Health information: Duration of your active account + 90 days.
• SBC documents and plan structure data: Retained indefinitely under our perpetual license (as described in Section 5 and Terms Section 7C). These standardized documents do not contain your personal health information.
• Other uploaded documents: Duration of your active account + 90 days.
• De-identified/aggregated data: Indefinitely. We retain de-identified data indefinitely for: (i) product improvement, (ii) compliance with legal obligations, (iii) establishment or defense of legal claims, and (iv) legitimate business interests in developing industry insights.
• Marketing data: Until you opt-out + 30 days for processing.
• Advertising data: Transmitted to our advertising partners at collection and retained by them under their own policies; identifiers captured for the server-side subscription event are deleted from our records promptly after the event is sent, and in any case within 90 days.
• Consent records: Records of the consents you give and withdraw (including acceptance of these policies) are retained for as long as we need to be able to demonstrate them.
• Security logs: 12 months.
• Analytics data: Retained for the periods configured with our analytics providers, and no longer than reasonably necessary for the purposes described in Section 2.
• Backups: Deleted data may persist in encrypted backups for up to 90 days before being permanently deleted as part of our routine backup rotation.
• Transaction records: We retain billing and transaction records as required by tax, accounting, and legal obligations (generally up to 7 years).

8. Your Privacy Rights

You have certain rights regarding your personal information:

• Access: You may request a copy of the personal information we hold about you.
• Correction: You may request that we correct any inaccurate personal information.
• Deletion: You may request deletion of your personal information, subject to our legal retention obligations and the data retention periods specified in Section 7.
• Portability: You may request your data in a portable format where technically feasible.
• Opt-Out: You may opt out of marketing communications at any time by following the unsubscribe instructions in those emails or by contacting us directly.
• Withdraw Consent: Where we rely on your consent, you may withdraw it at any time, as easily as you gave it. Advertising consents can be withdrawn in the Cookies section of your account settings or on our Your Privacy Choices page; the analytics-cookies consent can be withdrawn on our Your Privacy Choices page (linked from the footer of our marketing pages) — no account is needed for either. Withdrawal takes effect prospectively and does not affect processing that happened while your consent was in place.

We will never deny you access to PlanStan, charge you a different price, or degrade the service because you decline or withdraw consent to analytics or advertising cookies.

State-specific rights. Depending on where you live, you may have additional rights:

• California: the rights to know, delete, and correct your personal information; to limit the use of sensitive personal information; to opt out of the sale or sharing of personal information (see Section 4 and Global Privacy Control in Section 3); and to not be discriminated against for exercising any of these rights. We have no actual knowledge that we sell or share the personal information of consumers under 16 years of age. You may designate an authorized agent to submit a request on your behalf; we will ask the agent for proof of your written authorization and may also ask you to verify your identity directly.

Categories of personal information (California). In the preceding 12 months we have collected the following categories of personal information, from you directly and from your automatic use of the Services, for the business purposes described in Section 2:

The sources, purposes, and retention period for each category are described in Sections 1, 2, and 7; the current list of recipients is at theplanstan.com/sub-processors.

• Washington, Nevada, and Connecticut (consumer health data): the rights to access your consumer health data, including a list of the third parties with whom it has been shared; to withdraw consent to its collection or sharing; and to have it deleted, with your deletion request propagated to our processors and to any third parties with whom the data was shared. If we refuse to act on a request, you may appeal, and if the appeal fails, you may contact your state Attorney General. Our Consumer Health Data Privacy Policy describes these rights, and our handling of consumer health data, in full.

We will respond to verifiable privacy requests within 45 days, extendable once by a further 45 days where reasonably necessary (we will tell you if we need the extension). We verify requests using your account email address and, where needed, additional information sufficient to confirm you are the account holder.

How to Exercise Your Rights: To exercise any privacy rights, contact us at stan@theplanstan.com with:

• Your account email address.
• The specific right you wish to exercise (e.g., access, deletion).
• Any information needed to verify your identity.

If you do not have an account, you may still make a request, and we will honor it to the extent we can reasonably verify it or associate it with data we hold.

9. Children's Privacy

Our Services are not intended for use by individuals under the age of 18, and we do not knowingly collect personal information directly from anyone under 18. Information about dependents under 18 is provided by their parent or guardian, as described in Section 1C. We comply with the Children's Online Privacy Protection Act (COPPA) with respect to children under 13.

If you are under 18, you may not use the Services. If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us immediately at stan@theplanstan.com, and we will delete such information as quickly as possible.

10. Changes to This Privacy Policy

We may modify this Privacy Policy from time to time. If we make any changes, we will change the Last Updated date above. We also may provide additional notice, as applicable, depending on the type of change. If you object to any changes, you may stop using the Services. Your continued use of the Services after we publish or otherwise provide notice about our changes to the Privacy Policy means that you have read and understood the updated Privacy Policy. If we ever want to collect or share your information for a materially new advertising or consumer-health-data purpose, we will first ask for your consent.

11. Third-Party Websites

Our Services may contain links to third-party websites. We are not responsible for the privacy practices of these external sites. We encourage you to review their privacy policies.

12. Contact Us

If you have any questions about this Privacy Policy, please contact us at:

PlanStan, LLC
228 Park Ave S, Suite 258824
New York, NY 10003
Email: stan@theplanstan.com