This Privacy Policy and Terms of Use (“Policy”) governs the collection, use, disclosure, and protection of personal data by Atlas National Group LLC (“Atlas National,” “we,” “us,” or “our”) in connection with its platforms, benefit administration services, client portals, mobile applications, communication systems (including SMS), and related services (collectively, the “Services”).

By accessing, interacting with, or using any component of the Services, you acknowledge that you have read, understood, and agree to be legally bound by the terms and conditions set forth herein. If you do not accept these terms, you must immediately discontinue use of the Services.

3. Categories of Information Collected

We collect and maintain the following categories of information:

A. Identifiable Personal Data
This includes but is not limited to:

• Full name, date of birth, Social Security number
• Residential address, email address, mobile phone number
• Employment-related information including payroll and eligibility data
• Dependent and beneficiary details

B. Plan and Claims Information

Information relating to eligibility,elections, reimbursements, claim submissions, and supporting documentation
asrequired under applicable plans.

C. Health Information (PHI)

Collected and maintained in compliancewith the Health Insurance Portability and Accountability Act (HIPAA) andassociated regulations.

D. Technical and Usage Data

Includes IP address, browser type,device identifiers, session metadata, app interaction data, and access logs.

E. Communication Records

Retention of chat transcripts, calllogs, support tickets, consent preferences, opt-ins/opt-outs, and feedbackcollected through any channel.

4. Purpose of Data Processing

Your data is processed for the following legitimate business and regulatory purposes:

• Administration of health and welfare benefit plans, FSAs, HRAs, HSAs, and Commuter Benefits
• Identity verification and participant authentication
• Delivery of regulatory-compliant notices and disclosures
• Payment processing and claims adjudication
• Support ticket resolution and participant service delivery
• Risk management, fraud prevention, audit preparation, and litigation response
• Legal compliance and fulfillment of contractual obligations with your employer, plan sponsor, or broker

We do not use your data for profiling, targeted advertising, or unrelated marketing purposes without your express consent.

5. Data Retention and Storage

All personal and sensitive information is retained in accordance with applicable laws, industry standards, and contractual obligations. Retention periods are based on statutory requirements, audit trails, dispute resolution, and operational needs.
‍
Data is stored on secure, access-controlled, and encrypted servers. When retention is no longer legally or operationally required, data is securely destroyed or anonymized.

6. Data Protection and Security Measures

Atlas National maintains a robust information security framework, incorporating physical, technical, and administrative safeguards that meet or exceed industry standards, including:

• Role-based access control (RBAC) with least-privilege enforcement
• End-to-end encryption of data at rest and in transit
• Multi-factor authentication for system administrators and privileged accounts
• Real-time security event monitoring and audit logging
• Secure development lifecycle (SDLC) practices for all software platforms
• Ongoing penetration testing and vulnerability management
• Third-party vendor risk assessments aligned with SOC 2 and HIPAA standards

7. Data Sharing and Third Parties

We do not sell or rent any personal data under any circumstances.
‍
Disclosures of data are limited and made only as required to fulfill our contractual or legal obligations, including:

• Trusted vendors (e.g., benefits card issuers, custodians, cloud infrastructure providers, SMS platforms), strictly bound by confidentiality and use limitations
• Plan sponsors, brokers, and compliance auditors subject to fiduciary standards
• Government agencies and legal authorities pursuant to subpoenas, court orders, or regulatory inquiries