Privacy Policy

Last Updated: September 23, 2026

Administering healthcare benefits requires the use of personal and financial information. That is a reality that deserves clarity.

At Stack Healthcare Inc. (“Stack,” “we,” “us,” or “our”), we provide services related to health, benefits, and financial support. To do that responsibly, we collect information that is necessary to administer benefits, operate our platform, and perform other business functions described below. We structure our systems to limit access, require defined safeguards, and align our practices with applicable federal and state privacy laws, including HIPAA where it applies.

This Privacy Policy explains what information Stack collects, why it is collected, how it is used, how it may be shared, and the choices available to you.

When you see the term “personal information” in this Privacy Policy, we mean information that can be linked to an identifiable individual or household.

1. Our Role and Relationship With You

Stack operates a platform that helps individuals access and manage health benefits, including employer-sponsored ICHRAs, insurance enrollment support, care navigation services, the Stack Premium Payments program, and related administrative services (collectively, the “Services”). Stack is not a medical group, healthcare provider, or telemedicine service. Stack does not deliver medical diagnosis or treatment. Instead, Stack works with health plans, insurance carriers, brokers, employers, and other HIPAA-regulated entities to facilitate coverage enrollment.

When you use Stack through your employer, your employer sponsors the benefit plan (the “Plan Sponsor”). Stack provides administrative and technology services to support that plan.

In those cases, Stack acts as a “service provider” or “Business Associate” to employer-sponsored health plans, and your personal information, which is considered protected health information (“PHI”), is subject to HIPAA and applicable Business Associate Agreements with your employer-sponsored health plan. Stack receives and processes PHI as necessary to provide the Services and in accordance with our agreements with those plans, as described in this Privacy Policy.

When you interact with Stack directly outside of a plan-sponsored context, Stack acts as a direct provider to you and Stack is considered the “controller” of your personal information.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal information collected through Stack’s marketing website, www.stackhealthcare.com (our “Site”), as well as the mobile applications and platform used to deliver our Services (the “Platform”). Individuals can access the Platform through our Site, but the Site and Platform are described separately in this Privacy Policy.

This Privacy Policy does not apply to:

• Insurance carriers or health plans, which maintain their own privacy policies and notices of privacy practices;

• Employers’ internal HR systems; or

• Third-party websites or services linked from our Site or Platform.

This Privacy Policy is incorporated into our Terms of Use, available at https://stackhealthcare.com/terms-of-use. You should review our Terms of Use carefully before using our Site, Platform, and Services.

3. HIPAA and Protected Health Information; Stack as a Business Associate

In certain circumstances, as described above, Stack acts as a Business Associate to employer-sponsored health plans and processes PHI subject to HIPAA and applicable Business Associate Agreements. We will only use and disclose PHI as permitted by HIPAA, other applicable law, and the applicable HIPAA Notice of Privacy Practices. We implement safeguards designed to protect PHI. Your employer or health plan provides the applicable HIPAA Notice of Privacy Practices. We may combine PHI we receive with other personal information that we have obtained from you or received from third parties such as your employer, health insurer, employee benefits program administrator, broker, or other healthcare-related entities where permitted by law.

Our Site is not intended to collect or retain any PHI. Sections of this Privacy Policy that discuss personal information collected on the Site do not apply to PHI, and we do not request, obtain, use or disclose any PHI through our Site.

4. Personal Information We Collect

We collect different personal information depending on the context in which you interact with us.

Information We Collect Through Our Platform and Services

When you use our Services, we collect certain personal information from you directly or, where applicable, from the Plan Sponsor, including:

A. Identifiers

• Name, email address, mailing and residential address, phone number

• Account credentials and authentication information

• Social Security number or other government identifiers

• IP address and online identifiers
  
  

B. Insurance and Benefit Information

• Insurance enrollment forms

• Policy numbers and coverage selections

• ID card details

• Reimbursement submissions and supporting documentation

• Explanation of Benefits (EOBs) or similar records
  
  

C. Financial Information

When financial features are made available through the Platform, we may collect or process certain financial information in connection with benefit administration, reimbursement payments, or related services. This may include:

• Bank account details for reimbursement payments

• Payment card information processed through service providers

• Transaction history related to benefit administration
  
  

D. Employment and Eligibility Information

• Employer name and employment status

• Eligibility verification data

• Plan participation information

Information We Collect Automatically

When you use our Site or Platform to access Services, we collect certain device and usage information automatically, such as:

• Browser type, operating system, device identifiers

• Log data and usage activity

We use a limited set of analytics technologies on our Site and Platform to collect device and usage information for purposes of operating, securing, and improving our Services. These technologies are operated by service providers acting on our behalf under contractual data processing restrictions and, where applicable, Business Associate Agreements. We do not use tracking technologies for advertising purposes.

5. Cookies and Related Technologies

We use analytics technologies, including cookies and similar tools, to collect information about how users interact with our Site and Platform. This information is used to monitor performance, identify issues, and improve the user experience. These tools are operated by service providers that process data solely on our behalf and are prohibited from using it for their own purposes. We do not use advertising cookies or share tracking data with advertising networks. You may disable cookies through your browser settings, though some features may not function as intended. We will honor Global Privacy Control signals where required by applicable law.

Our Site currently uses Google Analytics and HubSpot to collect usage information, and our Platform uses PostHog. You can learn more about how Google uses information from sites that use its services at https://policies.google.com/technologies/partner-sites, and you can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on, available at https://tools.google.com/dlpage/gaoptout.

6. Service Providers and Platform Integrations

We use service providers to support communications, analytics, customer support, and employment-related data integrations. Depending on the features made available, these providers may process information on our behalf to help us operate, improve, and secure the Platform.

Service providers may include:

• HubSpot (CRM, communications, and Site analytics) – https://legal.hubspot.com/privacy-policy

• Google Analytics (Site usage analytics) – https://policies.google.com/privacy

• PostHog (Platform usage analytics) – https://posthog.com/privacy

• Kustomer (customer support) – https://www.kustomer.com/privacy-policy/

• Twilio (communications) – https://www.twilio.com/en-us/legal/privacy

• Finch (employment data integrations) – https://www.tryfinch.com/legal/privacy

We also use third-party service providers to support payment processing and financial verification, including:

• Stripe (payment processing, money transmission, financial account services, and card issuing through its bank partners Celtic Bank and Fifth Third Bank) – Privacy Policy

• Finch (payroll integration) – Privacy Policy

• Enigma (financial verification) – Privacy Policy

These providers operate under their own privacy policies and terms of service. We may add, remove, or replace service providers as our services evolve.

7. How We Use Personal Information

We may use your personal information for the following purposes:

• To deliver our Site, Platform, and Services, including for account management and eligibility verification, reimbursement processing and payment facilitation, and care navigation and support services

• To interact with you, including responding to your requests, providing customer support, providing information about additional products, services, and promotions that may be of interest to you, and informing you about important changes to this Privacy Policy, our Terms of Use, or other policies

• To tailor the content we display to you on our Site or Platform

• To operate, maintain, supervise, administer, and enhance our Site, Platform, and Services, including monitoring and analyzing the effectiveness of content, aggregating site usage data, and improving overall performance, and related purposes which may include the use of artificial intelligence or machine learning

• To conduct internal testing, research, analysis, and product development, including to improve, upgrade, or enhance our Site, Platform, and Services

• To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection

• To fulfill any other purpose for which you provide personal information, or any other purpose with your consent

• To comply with legal and regulatory obligations, including employee benefit plan requirements, respond to any subpoena or government investigation, and to enforce our Terms of Use and other legal rights

• For fraud detection, security monitoring, and system integrity

• Communicating about our Products and Services, to the extent permitted by law

  
  

8. How We Share Information

We may disclose any personal information we collect to the following recipients for the purposes outlined above:

• Employers and plan sponsors, as necessary to administer benefits

• Insurance carriers and brokers involved in enrollment or claims support

• Service providers and vendors performing services on our behalf

• Payment processors

• Analytics services providers operating under data processing agreements and/or Business Associate Agreements on our behalf, as described elsewhere in this Privacy Policy

• Government authorities where necessary to comply with applicable law or to respond to requests from law enforcement agencies or other government authorities

• To communicate about our Products and Services, as permitted by law

• If you request or direct us to do so

We may share your personal information when it is necessary to protect our customers, employees, or property; in emergency situations; or to enforce our rights under our Terms of Use and other policies. We reserve the right to transfer to another entity or its affiliates or service providers some or all information about you in connection with, or during negotiations of, any merger, acquisition, sale of assets or any line of business, change in ownership control, or financing transaction. We cannot promise that an acquiring party or the merged entity will have the same privacy practices or treat your information the same as described in this Privacy Policy.

We do not “sell” personal information or “share” personal information for cross-contextual behavioral advertising. Analytics data collected through the Site or Platform is processed by service providers acting solely on Stack’s behalf and is not used for advertising or shared with advertising networks.

9. Artificial Intelligence and Automated Processing

Certain artificial intelligence (“AI”) features may be used to improve your experience or the overall experience of the Site, Platform and Services. When we collect personal information from an individual who uses the Site or Platform, we may use the personal information in conjunction with our AI features to provide the Services, and other internal purposes permitted by applicable laws. AI-generated insights assist but do not replace human decision making; in particular, any decision that influences health coverage will be reviewed by a human.

We may use information we collect to internally refine, improve, and train the models and algorithms that support our AI features, in accordance with applicable law. This helps us enhance AI-driven insights, improve recommendations, and contribute to better outcomes.

10. Your Privacy Choices

You may have certain choices when it comes to how we collect and use your personal information. For additional information about rights you may have under applicable privacy laws, see below.

• Account Information. Please visit your account page to update your personal information and payment method.

• Email Marketing. If at any time you no longer wish to receive marketing communications from us, you can click the unsubscribe link at the bottom of any email or email us at privacy@stackhealthcare.com.

• Analytics and Usage Tracking. We use analytics tools to understand how users interact with our Site or Platform. You may disable cookies through your browser settings, though some features may not function as intended. For more information, see Section 5 (Cookies and Related Technologies).

• SMS Marketing. Consent to receive automated marketing text messages is not a condition of any purchase. You can opt out of receiving commercial text messages by responding to any of our text messages with STOP or UNSUBSCRIBE. If you opt out, we may still send you messages regarding the status of your orders and other service-related communications. We do not share mobile contact information with third parties or affiliates for marketing or promotional purposes. We do not sell your SMS consent and only share such SMS consent information with third parties as necessary to facilitate text message delivery (i.e., with our technology partners).

11. Data Retention

We retain personal information as long as necessary to provide Services and comply with legal obligations.

Retention periods vary depending on the type of information and the purpose for which it was collected, applicable legal and regulatory requirements, and our legitimate business needs. These may differ for health and benefit records, financial and reimbursement records, and general account or usage data. Where we process information as a Business Associate, retention is also governed by applicable HIPAA requirements and Business Associate Agreements.

12. Security

We use administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, or misuse.

• Encryption in transit and at rest

• Role-based access controls

• Monitoring and logging

• Vendor oversight and contractual safeguards

While we use these precautions to safeguard your information, we cannot guarantee the security of the networks, systems, servers, devices, and databases we operate or that are operated on our behalf.

13. Children and Minors

Our Services are not directed to individuals under 18 years of age. We do not knowingly collect personal information directly from minors through the Platform. If we learn that a minor has provided personal information without required parental or guardian consent, we will take reasonable steps to delete such information.

We may collect and process personal information relating to children when that information is provided by a parent, guardian, employer, or plan sponsor for legitimate benefit administration or services.

14. Your Privacy Rights

Right to Know and Request Access to, Correction of, and Deletion of Personal Information

You have the right to request access to personal information collected about you in a portable format and to receive information regarding the source of that personal information, the purposes for which we collect it, and the third parties and service providers with whom we share it. You also have the right to request we correct inaccurate personal information and to request, in certain circumstances, that we delete any that we have collected directly from you.

You may submit a request to exercise your rights to know/access, correct, or delete your personal information by emailing privacy@stackhealthcare.com or by calling us at 844-MYSTACK (844-697-8225). You may authorize another individual or a business, called an authorized agent, to make requests on your behalf through these means.

In order to process your request, we must verify your identity. We do this by asking you to provide personal information we can match against information we may have collected from you previously and confirm your request using the email account stated in the request.

We may have a reason under the law why we do not have to comply with your request, or why we may comply with it in a more limited way than you anticipated. If we do, we will explain that to you in our response.

Right to Opt Out of Personalized Advertising and Sale to Third Parties

You have the right to opt out of the use and disclosure of your personal information for the purposes of selecting or delivering advertising based on your activity over time and across different online platforms. U.S. residents also have the right to opt out of certain disclosures that are considered “sales” under applicable state laws. We do not currently “sell” or “share” personal information in this manner, and so you are already opted out. We also do not use your personal information for purposes of “targeted advertising.”

Right to Limit Use of Sensitive Personal Information

We collect certain categories of sensitive personal information, including government identifiers such as Social Security numbers, health and insurance information, and financial account details, as necessary to provide our Services. We do not use sensitive personal information for purposes beyond those necessary to provide the Services, comply with legal obligations, or as otherwise permitted by applicable law. Please note that limiting our use of this information may prevent us from completing or maintaining your enrollment, administering your benefits, or otherwise performing our Services.

If you access our Services through an employer-sponsored benefit plan

Stack processes your personal information as a Business Associate to your employer’s health plan. In that context, your rights with respect to PHI are governed by HIPAA and your employer’s Notice of Privacy Practices, not this Privacy Policy. To exercise rights relating to PHI, please contact your employer’s human resources department. Stack will refer or redirect any such requests to the appropriate health plan Covered Entity.
Right to Opt Out of Automated Decisionmaking

Residents of certain states have the right to opt out of automated profiling in certain instances where such processing would produce legal or other similarly significant effects. At this time, we do not use personal information to make automated decisions about you in any situations where you may have a legal right to opt out.

Right to Opt Out of Automated Decisionmaking

Residents of certain states have the right to opt out of automated profiling in certain instances where such processing would produce legal or other similarly significant effects. At this time, we do not use personal information to make automated decisions about you in any situations where you may have a legal right to opt out.

Right to Appeal

If we deny your request, you may have the right to appeal our decision by contacting us as described in the “Contact Us” section below.

15. Updates to This Privacy Policy

We may make changes to this Privacy Policy from time to time. The “Last Updated” date at the top of this page indicates when this Privacy Policy was last revised. We may also notify you in other ways from time to time about the collection, use, and disclosure of your personal information described in this Privacy Policy.

16. Contact Us

If you have questions or concerns about this Privacy Policy, please contact:

Stack Healthcare Inc

8 East Broad Street

Columbus, OH 43215

privacy@stackhealthcare.com

844-MYSTACK (844-697-8225)

If you are using our Services through your employer and have questions about your privacy rights, please contact your employer’s human resources department.