Legal

Blosum Privacy Policy

Sovra Care, Inc.  ·  Effective September 7, 2026

This Privacy Policy explains how Sovra Care, Inc. (“Sovra Care,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you use Blosum, our websites, applications, software, AI-enabled features, and related services (collectively, the “Services”).

Blosum is a product operated by Sovra Care, Inc. This policy applies whether you use Blosum directly or receive access through an employer, broker, association, or other sponsoring organization.

Section 01

Information We Collect

Account and contact information

  • Name, email address, phone number, authentication information, and account preferences
  • Subscription, customer-support, survey, and communication records

Coverage and healthcare information

  • Insurance status, insurer and plan information, deductibles, copays, coinsurance, out-of-pocket limits, and uploaded plan documents such as a Summary of Benefits and Coverage
  • Information you choose to provide about medications, conditions, care needs, providers, Direct Primary Care relationships, upcoming care, and healthcare searches
  • Documents, receipts, and other information you choose to upload

Healthcare spending and planning information

  • Healthcare expenses, dates, categories, amounts, payment methods, planned care, estimates, contributions, and reserve goals
  • Limited billing and transaction records associated with a Blosum subscription; payment-card details are generally processed by our payment processor or an app store rather than stored directly by us

Content you provide

  • Questions, prompts, responses, feedback, and other content exchanged with Genie or other AI-enabled features
  • Messages and information you send to support or otherwise provide through the Services

Device, usage, and cookie information

  • IP address, browser and device type, operating system, identifiers, approximate location derived from IP address, log data, pages viewed, feature interactions, and diagnostic information
  • Cookie and similar technology data used for authentication, security, preferences, analytics, and service performance
Section 02

Where Information Comes From

We collect information:

  • Directly from you
  • Automatically from your device and use of the Services
  • From an organization that invites you or sponsors your access, such as your name, email address, eligibility, and invite information
  • From service providers and partners that support pricing, provider search, insurance-related information, payments, analytics, authentication, and customer support
  • From accounts or services you choose to connect and from public or licensed data sources
Section 03

Consumer Health Data

Some information described above may be considered health information, sensitive personal information, or “consumer health data” under applicable law. Providing this information is generally optional, but certain features may not work without it.

We use consumer health data to provide the features you request, personalize cost and planning guidance, respond to questions, maintain and secure the Services, and comply with law. We do not sell consumer health data. We do not use consumer health data for targeted advertising.

Not all health information held by a consumer application is protected by HIPAA. If we process protected health information on behalf of a HIPAA-covered entity under a business associate agreement, that agreement and applicable HIPAA requirements govern that processing.
Section 04

How We Use Information

  • Provide, personalize, maintain, and secure Blosum
  • Search and compare healthcare pricing, explain plan information, support provider discovery, track spending, and build planning estimates
  • Process subscriptions and provide customer support
  • Communicate about accounts, security, features, policies, and—where permitted—Blosum news or offers
  • Monitor performance, troubleshoot problems, prevent fraud and misuse, and improve our Services
  • Comply with law, enforce agreements, and protect users, Sovra Care, and others
  • Create aggregated or de-identified information that does not reasonably identify an individual
Section 05

Genie and AI Processing

When you use Genie or another AI-enabled feature, we process the information you submit and related account context to generate a response or perform the requested function. We may use contracted AI and infrastructure providers to process this information on our behalf subject to contractual safeguards.

Do not submit information about another person unless you have permission. AI outputs may be stored with your account to provide conversation history, improve continuity, maintain safety, and support the Services, subject to our retention practices and your available controls.

Section 06

How We Disclose Information

We may disclose personal information to:

  • Vendors that provide hosting, security, authentication, AI processing, analytics, payment processing, communications, and customer support
  • Pricing, pharmacy, provider, coverage, financial-account, or other partners when needed to provide a feature you request
  • An insurer, broker, provider, marketplace, or other third party when you ask us to connect you, submit information, or take another action
  • Professional advisers, regulators, courts, law enforcement, or other parties when reasonably necessary to comply with law or protect rights and safety
  • A buyer, investor, successor, or other participant in a merger, financing, reorganization, sale, or similar corporate transaction, subject to appropriate protections

We may also disclose aggregated or de-identified information that does not reasonably identify you.

Section 07

Organization-Sponsored Accounts

If an employer or another organization invites you or pays for access, we may provide that organization with limited administrative information such as invitation status, eligibility, account activation, subscription status, and aggregated or de-identified participation metrics.

We do not provide the sponsoring organization with your specific health conditions, medications, insurance documents, healthcare searches, expenses, receipts, planned care, reserve amounts, or Genie conversations unless you direct us to do so, the disclosure is necessary for a feature you request, or disclosure is required by law.

Section 08

Sale, Advertising, and Analytics

We do not sell personal information or consumer health data. We do not use consumer health data for targeted advertising. We may use privacy-conscious analytics to understand service performance and improve Blosum.

If our practices change in a way that triggers an opt-out or consent requirement, we will provide the notices and choices required by applicable law before using information in that manner.

Section 09

Data Retention

We retain information for as long as reasonably necessary to provide the Services, maintain your account, complete transactions, comply with legal obligations, resolve disputes, prevent fraud and abuse, and enforce agreements. Retention periods vary based on the type and sensitivity of information, the feature involved, and legal requirements.

When information is no longer needed, we delete or de-identify it, subject to lawful backups and records we must retain. You may request account deletion as described below.

Section 10

Security and Breach Notification

We use administrative, technical, and physical safeguards designed to protect personal information. These safeguards may include encryption in transit and at rest, access controls, monitoring, and vendor-security requirements. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

If a security incident affects information and notification is required, we will provide notice consistent with applicable law.

Section 11

Your Choices and Privacy Rights

Depending on where you live and subject to applicable exceptions, you may have rights to:

  • Know, access, or receive a copy of personal information we maintain about you
  • Correct inaccurate personal information
  • Delete personal information
  • Withdraw consent for certain processing
  • Opt out of marketing communications
  • Appeal a decision concerning a privacy request
  • Exercise applicable rights concerning consumer health data

To submit a request, email legal@sovra.care. We may need to verify your identity and authority. You may use an authorized agent where permitted. We will not discriminate against you for exercising applicable privacy rights.

Section 12

Cookies and Communications

You can control certain cookies through your browser or device settings, although disabling essential cookies may prevent parts of Blosum from working. You may unsubscribe from marketing emails using the link in the message. We may still send transactional, security, and service-related communications.

Section 13

Children

Blosum is not intended for anyone under 18, and we do not knowingly collect personal information from children under 18. If you believe a child has provided information to us, contact legal@sovra.care.

Section 14

Changes to This Policy

We may update this Privacy Policy as our Services or legal obligations change. We will post the updated policy, revise the effective date, and provide additional notice when required by law. Material changes will apply prospectively unless otherwise permitted by law.

Section 15

Contact

Questions or privacy requests may be sent to:

Legal contact
Sovra Care, Inc.