Privacy Policy

healthEfair.com
Effective September 16, 2026

This policy explains what information healthEfair collects, why, who can see it, and what choices you have. It is written to be read rather than skimmed past, so it is in plain language. Where a word carries a specific legal meaning, it is explained the first time it appears.

Who we are

healthEfair is operated by Danone Simpson Insurance Services, doing business as Montage Insurance Solutions ("Montage", "we", "us"), a California insurance brokerage. The website is built and maintained on our behalf by Market Action Research, which works under our direction and under contract terms that bind it to this policy.

healthEfair is a benefits education portal. Employers who work with Montage give their employees access so those employees can learn about the benefits available to them. This policy covers this website only. Montage's other services are governed by the agreements that apply to them.

What we collect

Information you give us

• Account details. Your name, email address, the employer you are associated with, a username and a password. Passwords are stored only in a one-way scrambled form; we cannot read them back.
• Things you send us. Messages you send through the site, and files that an authorised administrator at your employer uploads on your employer's behalf, such as an employee roster used to set up accounts.

Information collected automatically

• Sign-in records. When you sign in, from what network address, and whether the attempt succeeded. These protect your account.
• Usage information. Which pages are visited, roughly how long, and the device, browser and network address used. Some of this is in ordinary web server logs; some is collected by the analytics service described below.
• Cookies. Small files a website stores in your browser. Details are in the next section.

Health information

Because healthEfair is about benefits, some of what passes through it can be health information. Where information identifies a person and relates to their health, care or coverage, it is protected health information ("PHI") under the federal Health Insurance Portability and Accountability Act ("HIPAA"). How we handle PHI is described in its own section below, because the rules are stricter and the protections are different.

Cookies and analytics

healthEfair uses two kinds of cookies.

• Essential. A session cookie that keeps you signed in as you move between pages, and a security cookie that stops forged requests. The site does not work without these. They hold no personal details and are cleared when you sign out or close your browser.
• Analytics. healthEfair uses Google Analytics, provided by Google LLC, to understand which parts of the site are used. It collects the pages visited, the approximate location a connection comes from, the device and browser type, and a random identifier that recognises a returning browser. It does not receive your name, your email address, your health information, or anything you type into the site.

Your choices. You can block or delete cookies in your browser settings; blocking the essential ones will stop you signing in. To opt out of Google Analytics everywhere, Google offers a free browser add-on at tools.google.com/dlpage/gaoptout. We do not currently respond to browser "Do Not Track" signals, because there is no agreed standard for what they should mean.

How we use information

• to run the site and let you sign in to it;
• to show you the benefits information that applies to your employer;
• to keep the site and your account secure, including detecting misuse;
• to respond when you contact us;
• to understand how the site is used so we can improve it;
• to meet our legal obligations.

We do not sell your information. We do not use it for advertising, we do not share it with advertisers, and we never use health information for marketing.

Who else sees it

We share information only with companies that help us run the site, and only as much as each needs to do its part. Each is bound by contract to protect it. At the time of writing they are:

• Amazon Web Services, which hosts the site, stores its files, and delivers the emails it sends. Data is held in the United States.
• Cloudflare, which sits between the internet and our servers to filter attacks and speed up delivery. It sees the network address of every connection.
• Google, for the analytics described above, and for reCAPTCHA, a service used on our sign-up form to tell a person apart from an automated program. reCAPTCHA runs only on that public form.
• Content delivery networks that serve shared code and fonts the site depends on (jsDelivr, cdnjs, the jQuery CDN, and Font Awesome). Loading those files sends them your network address and browser type, as any web request does.
• Video services. Some pages embed videos hosted on YouTube or Vimeo. Pressing play loads the player from that service, which may set its own cookies under its own policy.

Beyond that, we disclose information only when the law requires it, to protect the rights or safety of a person, or with your consent.

Protected health information

Montage handles PHI on behalf of employer health plans, which makes us a business associate under HIPAA. That means we are legally bound to protect it, and so is every company we allow to touch it. Specifically:

• We use and disclose PHI only as the health plan allows and as HIPAA permits, and never for marketing.
• We apply the minimum necessary rule: people see only the PHI their role requires.
• Every company that stores or transmits PHI for us is required to sign a business associate agreement, the contract HIPAA requires, before handling any. Services that cannot enter such an agreement, such as analytics, are kept away from PHI entirely.
• Information is encrypted while it travels over the internet, and files are held on infrastructure that encrypts them in storage.
• Access to administrative functions is limited to named, authorised staff, and sign-ins are recorded.
• If PHI is ever exposed in a way HIPAA treats as a breach, we notify the health plan and any affected people as the law requires.

Your rights over your own health records, including the right to see them and ask for corrections, run through your health plan. We will help direct a request to the right place.

How long we keep it

Account information is kept while your employer is a Montage client and you have access to the site, and is removed after that. Sign-in and security records are kept long enough to investigate problems and then discarded. Health information is kept only as long as the health plan's own retention rules require.

Your choices and rights

You can see and correct your account details by signing in. You can ask us to delete your account by contacting us; we will do so unless a legal obligation requires us to keep something, in which case we will tell you what and why.

California residents. California law gives residents the right to know what personal information a business collects, to ask for it to be deleted, to correct it, and to be free from discrimination for exercising those rights. We do not sell personal information and do not share it for cross-context behavioural advertising, so there is nothing to opt out of on that front. To exercise any of these rights, contact us using the details below. We will confirm your identity before acting, so that we are not handing your information to someone else.

Children

healthEfair is for employees and their families as part of an employer's benefits programme. It is not directed at children, and we do not knowingly collect information from anyone under 13. If you believe a child has provided information to us, contact us and we will remove it.

Changes to this policy

When we change this policy we will update the date above and, for anything material, tell signed-in users the next time they visit. The current version is always the one on this page.

Contact

Questions about this policy or your information should go to the address above, marked for the attention of the Privacy Officer.