Last modified: January 1, 2023

INTRODUCTION

Welcome to Empyrean Benefits Solutions, Inc. (“Empyrean”, “Company”, “We” or “Our”). Empyrean respects your privacy and is committed to protecting it through our compliance with this Platform privacy policy (“Platform Privacy Policy”).

This Platform Privacy Policy describes (i) the types of information we may collect from you or that you may provide when you use any Empyrean website(s), Empyrean’s mobile application(s) and other online products and services (collectively, our “Platform”) that link to or explicitly reference this Platform Privacy Policy, and (ii) Empyrean’s practices for collecting, using, maintaining, protecting, and disclosing that information. If a Platform links to a separate Empyrean privacy policy that separate Empyrean privacy policy will govern the information collected and used on such Platform. Further, in the event Empyrean offers a Platform that does not reference or link to any Empyrean privacy policy, this Platform Privacy Policy will apply to such Platform until such time as it links to a separate privacy policy or a separate Empyrean privacy policy explicitly states that it is applicable to such Platform.

Please read this Platform Privacy Policy carefully to understand our policies and practices regarding your information and how we will treat it. If you do not agree with our policies and practices, your choice is not to use our Platform. By accessing or using a Platform that is linked to this Platform Privacy Policy, you agree to this Platform Privacy Policy. This Platform Privacy Policy may change from time to time (see the section in this Platform Privacy Policy entitled Updates to Our Platform Privacy Policy). Your continued use of the Platform after we make changes or updates to this Platform Privacy Policy is deemed to be acceptance of those changes and/or updates, so please check this Platform Privacy Policy periodically for any updates or changes.

EMPYREAN’S INFORMATION COLLECTION PRACTICES

Collection and Use of Personal Information

We collect data and information from you that can be used to identify you (“Personal Information”). Personal Information that we collect may vary with each separate purpose for which you provide it. Personal Information includes, but is not limited to, name, address, age, date of birth, Social Security Number, driver’s license number, e-mail address, and telephone number.

We may use the Personal Information collected from and/or provided by you: (i) in accordance with the Platform respective terms of use; (ii) to provide customer support services; (iii) provide you with technical support services; (iv) perform updates to the Platform and/or related services; (v) provide you with related security alerts; (vi) perform analytics related to the Platform and/or related services; (vii) improve and update the Platform and/or related services; (viii) personalize your access to and use of the Platform and/or related services; (ix) prevent illegal or fraudulent activities including without limitation fraud detection, security enhancements, investigate security incidents or other unauthorized access attempts; (x) provide you with information about Empyrean and its offerings, products, services and events; (xi) respond to your questions; (xii) Platform registration and to enable us to present our Platform and its contents to you; (xiii) in any other way we may describe when you provide the Personal Information; and (xiv) for other legally permissible activities with your consent.

When you voluntarily submit your Personal Information on the Platform or through any Platform interactive features (e.g., web chat), or when you otherwise contact us (e.g., email), you are giving your consent to the collection, use and disclosure of your Personal Information in accordance with this Platform Privacy Policy. We may also use Personal Information about you for any legally permissible purposes in aggregated format that has been otherwise de-identified so that such Personal Information cannot be reasonably used to identify you.

Collection and Use of Non-Personal Information

When you visit our Platform, we collect “Non-Personal Information” that does not identify you personally (i.e., anonymous information) but does provide us with Platform access and usage data such as: (i) log information (e.g., browser agent, Internet Protocol (IP) address, Internet domain, and the dates and times that you access the Platform); (ii) location information (e.g., precise location of your device in accordance with device permissions); (iii) device information (e.g., information about the computer or mobile device being used to access the Platform, operating system information, unique device identifiers); and (iv) access and usage information obtained from cookies and other automated data collection technologies (see the section below in this Platform Privacy Policy entitled Information we Collect Through Automatic Data Technologies). This user data helps us analyze and improve the user’s experience on the Platform and the service(s) we provide.

How and When We Collect Information

We collect information directly at the time when you provide it to us (e.g., account registration, sign-up forms, emails, search queries on the Platform). We also collect information automatically as you navigate through the Platform (see the sections in this Platform Privacy Policy entitled Collection of Personal Information; Collection of Non-Personal Information; and Information We Collect Through Automatic Data Collection Technologies.)

Information We Collect Through Automatic Data Collection Technologies

As you navigate through and interact with our Platform, we reserve the right to monitor your use of the Platform through the use of automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:

Details of your visits to our Platform, including traffic data, location data, logs, and other communication data and the resources that you access and use on the Platform.
Information about your computer and internet connection, including your IP address, operating system, and browser type.

The information we collect automatically is only Non-Personal Information (i.e., statistical data and does not include Personal Information), but we may maintain it or associate it with Personal Information we collect in other ways. It helps us to improve our Platform and to deliver a better and more personalized service, including by enabling us to:

Estimate our audience size and usage patterns.
Store information about your preferences, allowing us to customize our Platform according to your individual interests.
Speed up your searches.
Recognize you when you return to our Platform.

Cookies and other Automatic Data Collection Technologies:

The technologies we use for automatic data collection may include:

Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting you may be unable to access certain parts of our Platform. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our Platform.
Flash Cookies. Certain features of our Platform may use local stored objects (or Flash cookies) to collect and store information about your preferences and navigation to, from, and on our Platform. Flash cookies are not managed by the same browser settings as are used for browser cookies. For information about managing your privacy and security settings for Flash cookies, see the section of this Platform Privacy Policy entitled Choices About How We Use and Disclose Your Information.
Web Beacons. Pages of our Platform and our e-mails may contain small el ectronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit Empyrean, for example, to count users who have visited those pages or opened an email and for other related website statistics that help us compile aggregated statistics regarding the effectiveness of our promotional campaigns or other operations of our website.

Third-Party Use of Cookies

Some content or applications, including advertisements, if any, on the Platform are served by third-parties, including advertisers, ad networks and servers, content providers, and application providers. These third parties may use cookies (alone or in conjunction with web beacons or other tracking technologies) to collect information about you when you use our Platform. The information they collect may be associated with your Personal Information or they may collect information, including Personal Information, about your online activities over time and across different websites and other online services. They may use this information to provide you with interest-based (behavioral) advertising or other targeted content. We may participate in Google’s AdSense program, which uses DART cookies to enable serving their behavioral ads. To opt out of the DART cookies you may visit the Google ad and content network privacy policy at the following url: http://www.google.com/privacy_ads.html. Tracking of users through the DART cookie mechanisms are subject to Google’s own privacy policies.

We do not control these third parties’ tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly. For information about how you can opt out of receiving targeted advertising from many providers, see the section in this Platform Privacy Policy entitled Choices About How We Use and Disclose Your Information.

We may use the information we have collected from you to enable us to display advertisements to our advertisers’ target audiences. Even though we do not disclose your Personal Information for these purposes without your consent, if you click on or otherwise interact with an advertisement, the advertiser may assume that you meet its target criteria.

We reserve the right to use third party web analytics services that use third party cookies (cookies passed by them, not by us) to collect Non-Personal Information about your use of this Platform. These web analytics services may also transfer this information to third parties where required to do so by law, or where such third parties process the information on the third party web analytics service’s behalf.

Sharing or Disclosure of Information

We will not sell any of your Personal Information to any outside organization. We only disclose your Personal Information to third parties as reasonably necessary to carry out the permitted uses described in this Platform Privacy Policy. For example, we may share Personal Information that we collect or you provide as described in this Platform Privacy Policy to or in connection with the following:

Affiliated Entities – To our subsidiaries and affiliates.
Service Providers – To contractors and other third parties we use to support our business and who are bound by contractual obligations to keep Personal Information confidential and use it only for the purposes for which we disclose it to them.
Successors – To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Empyrean assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information held by Empyrean about our Platform users is among the assets transferred.
Purpose Fulfillment – To fulfill the purpose for which you provide it.
Disclosed Purposes – For any other purpose disclosed by us when you provide the Personal Information.
Third-Party Advertising Partners – See the section in this Platform Privacy Policy entitled Third-Party Use of Cookies.
With your Consent or Opt-In – For example, see the section in this Platform Privacy Policy entitled Use of Personal Information for Marketing Activities.

We may also disclose your Personal Information in connection with the following:

Legal Process – To comply with any court order, subpoena, law, or legal process, including to respond to any government or regulatory request.
Enforcement – To investigate, respond to, or enforce or apply our terms of use for the applicable Platform and other agreements, including for billing and collection purposes.
Security – If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Empyrean, our customers, or others, or to detect, prevent, and address fraud or other illegal activity.

We also reserve the right to disclose or share Non-Personal Information and/or de-identified information without restriction.

Use of Personal Information for Marketing Activities

We may share Personal Information that we collect or you provide in connection with the following Empyrean and/or third party marketing activities (subject to your consent as described below):

When Third Parties Act as a Marketing Affiliate, Partner or Reseller for Empyrean. We reserve the right to disclose your Personal Information to any of our (i) marketing affiliates or marketing partners that referred you to our Platform for purposes of sales by us, and (ii) resellers that may re-sell our products or services to you. Understand that you originated with these marketing affiliates, marketing partners and resellers, and that the information you may provide to them is subject to their privacy policies also.
When We Act as a Marketing Affiliate, Partner or Reseller for Others. We may act as a marketing affiliate, marketing partner, or reseller to a third party marketing partner for purposes of Empyrean selling their products or services to you, and we reserve the right to disclose your Personal Information to such third party marketing partners for purposes of compensation, transaction processing, fulfillment, and support. These third party marketing partners may also email you regarding complimentary products or services, however, you have two ways to opt out of receiving these emails: (i) contact us (through the Contact Us process described below) with a request to opt-out, or (ii) utilize the email unsubscribe option in the third party marketing partner’s email to you.
Third Party Direct Marketing. We may provide you with the opportunity to receive promotional offers from specifically identified third-parties through their direct marketing efforts, but only if you explicitly consent (opt-in) to receive each offer. If you explicitly consent (opt-in), your Personal Information will be shared only with the specifically identified third-party to enable them to provide you with the offer you have requested, and then only in connection with that specific promotion and not on a continual basis. Any information that you provide in the process of registration or purchase will be transferred to these sites. We have no responsibility or liability for the policies and practices of these third party websites. You should review any privacy policies posted on any of these third party websites before providing information to them.

Choices About How We Use and Disclose Your Information

We strive to provide you with choices regarding the personal information you provide to us. We have created mechanisms to provide you with the following control over your information:

Browser Configuration. You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, please note that some parts or aspects of the Platform may then be inaccessible or not function properly.
NAI Targeted Ads Opt-Out. We do not control third parties’ collection or use of your information to serve interest-based advertising. However these third parties may provide you with ways to choose not to have your information collected or used in this way. You can opt out of receiving targeted ads from members of the Network Advertising Initiative (“NAI“) on the NAI’s website.
State Resident Rights and Choices. Certain states provide their residents with additional rights and choices.
- California Residents – California residents may have additional personal information rights and choices. Please see Your California Privacy Rights for more information.
- Nevada Residents – Nevada residents who wish to exercise their sale opt-out rights under Nevada Revised Statutes Chapter 603A may submit a request to this designated address: Compliance_Privacy@goempyrean.com.

RESIDENTS OF THE EUROPEAN ECONOMIC AREA (EEA)

Your EEA Privacy Rights

If you reside in the European Economic Area (EEA) you may have the following additional rights under the GDPR:

The right to access (i.e., the right to be provided with a copy of your Personal Information);
The right to rectification (i.e., the right to require us to correct any mistakes in your Personal Information);
The right to be forgotten (i.e., the right to require us to delete your Personal Information – in certain situations);
The right to restriction of processing (i.e., the right to require us to restrict processing of your Personal Information – in certain circumstances, e.g., if you contest the accuracy of the data);
The right to data portability (i.e., the right to receive the Personal Information you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party – in certain situations);
The right to object (e.g., the right to object to your Personal Information being used for direct marketing, and in certain other situations, to object to our continued processing of your Personal Information, e.g., processing carried out for the purpose of our legitimate interests);
The right to withdraw consent (i.e., where processing is based on your consent, you have the right to withdraw that consent – without affecting the lawfulness of processing based on consent before its withdrawal);
The right to information regarding consent (i.e., to obtain information about the possibility or providing or denying your consent and the consequences of such consent or denial of consent); and
The right not to be subject to automated individual decision-making (i.e., the right not to be subjected to a decision based solely on automated processing – including profiling – that produces legal effects concerning you or similarly significantly affects you).

We will not discriminate against you if you choose to exercise any of these rights. The GDPR gives individuals in the EEA the right to lodge a complaint with a supervisory authority, in the European Union (or European Economic Area) state where you work, normally live, or where any alleged infringement of data protection laws occurred.

You can exercise your rights under the GDPR by contacting Empyrean through the Contact Us process described below. If you contact us through the email contact information please use “GDPR” in the subject line.

RESIDENTS OF CALIFORNIA

Your California Privacy Rights

California consumers have the right to request any of the following information from Empyrean regarding Personal Information collected about you during the preceding 12 months:

The categories of Personal Information collected about you.
The categories of sources from which the Personal Information is collected.
The business or commercial purpose for collecting or selling Personal Information.
The categories of third parties with whom we share Personal Information, if any.
The specific Personal Information collected about you.
For Personal Information sold or disclosed to a third party for a business purpose, you have a right to know the categories of Personal Information about you that we sold and the categories of third parties to whom the Personal Information was sold; and the categories of Personal Information that we disclosed about you for a business purpose.

We will provide this information free of charge up to two (2) times in any twelve (12) month period within 45 days of receiving your verifiable request (including verification of your identity and your California residency), subject to delays and exclusions permitted by law. Specific Personal Information about you or your account that is categorized as sensitive or confidential may be redacted.

As a California resident, you have the right to request that we delete any Personal Information that we have collected about you. We will honor this request subject to the range of exclusions permitted by law. For example, we are not required to delete Personal Information if it is necessary to complete a transaction or reasonably used for an ongoing business relationship or if it is used internally in a lawful manner that is compatible with the context in which the consumer provided the information.

As a California resident, you also have the right to opt-out of the sale of your Personal Information to third parties. We do not sell your Personal Information. However, we are permitted to share your Personal Information with a contracted service provider.

You can exercise your California privacy rights through the Contact Us process described below. We will not discriminate against you if you choose to exercise any of these rights.

GENERAL PRIVACY TOPICS

Children Under the Age of 13

Our Platform is not intended for children under 13 years of age. No one under age 13 may provide any Personal Information through the Platform. In accordance with the U.S. Children’s Online Privacy Policy (“COPPA”), we do not knowingly collect Personal Information from children under 13 through our Platform. If you are under 13, do not use or provide any information on this Platform or provide any information about yourself to us, including but not limited to your name, address, telephone number, email address, or any screen name or user name you may use. If we learn we have collected or received Personal Information from a child under 13 through our Platform without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 13 that was not obtained voluntarily from the child’s parent or legal guardian or the employer of the child’s parent or legal guardian in connection with the administration of benefit programs provided by Empyrean, please contact us at Compliance_Privacy@goempyrean.com.

Data Security

We have implemented reasonable measures designed to secure your Personal Information from accidental loss and from unauthorized access, use, alteration, and disclosure. All Personal Information you provide to us is stored encrypted on our secure servers behind our firewalls.

The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Platform, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. We urge you to be careful about giving out information in public areas of the Platform. The information you share in public areas may be viewed by any user of the Platform.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your Personal Information, we cannot guarantee the security of your Personal Information transmitted to our Platform.

Data Storing and Transferring

Any Personal Information which we may collect or use on this Platform will be stored and processed in our servers located only in the United States. Any Personal Information that we may transfer to any subcontractor is processed and stored here in the United States where Empyrean is based and not transferred outside of the United States. Empyrean and its service providers may transfer your information to, or store or access it in, jurisdictions that may not provide equivalent levels of data protection as your home jurisdiction. We will take steps to ensure that your Personal Information receives an adequate level of protection in the jurisdictions in which we process it. For example, all stored data while at rest remains encrypted. If you reside outside the United States, by using this Platform you consent to the transfer of Personal Information outside your country of residence to the United States.

Updating Your Personal Information

If you are a registered user of the Platform, you can review, change and/or correct your Personal Information you provide directly to us at any time by using the features within the Platform or submitting a written request through the Contact Us process described below. Please note that if you with to update or change any Personal Information that has come to us from your employer in connection with a separate services engagement, you will need to contact your employer directly to support your request.

Deactivating Your Account

At any time you may request that we deactivate your account by contacting us through the Contact Us process described below. We will require you to provide information to confirm that the account you are requesting to deactivate is yours or that you have legal authority to make such request. Please also note, however, that we may retain certain cached or archived copies of your Personal Information as required by law or for legitimate business purposes for a certain period of time in accordance with applicable law.

Mobile Push Notifications; Alerts

If you are a registered user of the Platform, we may, with your consent, send promotional and non-promotional push notifications or alerts to your mobile device. You can deactivate these messages at any time by changing the notification settings on your mobile device.

Email Messages; Promotional Communications; Opt-Outs

If you provide Empyrean with your e-mail address you may receive periodic messages from us with information specific to the Platform and required for the normal functioning of the Platform or for promotional communication purposes. You may elect to opt-out of receiving promotional communications from Empyrean by following the instructions in those communications or by emailing us at the Contact Us information provided below of your election to opt-out. If you opt-out, we may still send non-promotional emails, such as those about your account or our ongoing business relations, as applicable.

Sale of Your Personal Information

Neither Empyrean nor our subcontractors will sell any of your Personal Information to any outside organization.

Links to Third Party Websites

The Platform may contain links to or from other websites. Please be aware that we are not responsible and do not have any liability for the privacy practices of third-party websites. This Platform Privacy Policy applies only to the Personal Information that Empyrean collects via its Platform as described in this Policy. If you submit or otherwise provide Personal Information to any of these third-party websites, your information is governed by their privacy policies. We encourage you to carefully read the privacy policies and terms of use of any website you visit or link to or from the Platform.

Your E-Mails to Empyrean

We welcome e-mails from you, and, within the Platform, there may be e-mail boxes for your questions and comments. You may also send us email directly outside of the Platform. We may share the information you send to us via email with our Empyrean service center representatives, other employees capable of addressing your questions and concerns, or certain third parties, as necessary to assist you.

Please note that non-encrypted internet e-mail sent by you may be accessed and viewed by unintended third parties without your knowledge and permission while in transit to us. If you elect to use e-mail to communicate information to us that you consider confidential you do so at your own risk, acknowledgment and agreement that Empyrean is not responsible for unauthorized access, losses, security incidents, or data breaches to the extent arising out of or otherwise related to such e-mail communications.

Updates to Our Platform Privacy Policy

Empyrean reserves the right to update or modify this Platform Privacy Policy at any time and from time to time without prior notice. It is our policy to post any updates or modifications we make to our Platform Privacy Policy with a notice on the Platform that the Platform Privacy Policy has been updated. If we make material changes to how we treat our users’ Personal Information, we will also notify you by email to the primary email address specified in your Empyrean account and/or through a notice on the Platform home page. The date the Platform Privacy Policy was last revised is identified at the top of the page. You are responsible for ensuring we have an up-to-date active and deliverable email address for you, and for periodically visiting our Platform and this Platform Privacy Policy to check for any changes. Your continued use of this Platform indicates your acceptance of the updated Platform Privacy Policy.

Contact Us

If you have any questions about this Platform Privacy Policy or how we collect, use, share or protect the security of your Personal Information, please see the Contact Us page on our Platform or you may also submit your questions or requests in writing to Empyrean at:

Empyrean Benefit Solutions, Inc.

3010 Briarpark Drive, Suite 8000

Houston, TX 77042

Attn: Compliance and Privacy Official

E-mail: Compliance_Privacy@goempyrean.com