Privacy Notice

ICHRAx Privacy Policy
Effective Date: September 28th, 2026

ICHRAx operates a data exchange platform that transmits health benefit enrollment information between ICHRA administrators and insurance carriers, and the public website at ichrax.com. This policy explains what information we collect, how we use and share it, and how we protect it.

ICHRAx does not sell insurance, bind coverage, provide quotes, or make coverage decisions. We transmit information between the ICHRA administrators and insurance carriers that use our platform, on their instructions.

1. Information We Collect

Account information. If you hold a user account on the platform, we collect your name, work email address, work phone number, and login credentials.

Enrollment data. ICHRA administrators and insurance carriers send enrollment information about individuals through the platform. ICHRAx receives this information from the sending organization and delivers it to the receiving organization as directed. We do not collect it from individuals directly. Payment and medical details within an enrollment record are encrypted before they reach ICHRAx and stay encrypted while passing through our systems. ICHRAx does not decrypt, access, or use them.

Much of the enrollment data is protected health information under HIPAA. ICHRAx handles it as a business associate of the ICHRA administrators and insurance carriers it serves, under written business associate agreements.

Technical information. Our website and platform use cookies and analytics tools to collect standard technical information such as IP address, browser type, pages visited, and timestamps. We use it to operate, secure, and improve the website and platform. You can control cookies through your browser settings.

2. How We Use Information

We use information to operate, secure, and support the platform and website, to communicate with account users, to deliver enrollment data as our customers direct, and to meet our legal and contractual obligations. We do not use enrollment data for any other purpose.

3. How We Share Information

We do not sell personal information. We share information only:

·      With the organizations our customers direct us to deliver it to. That is the purpose of the platform.

·      With service providers that help us operate the platform, such as cloud hosting and contracted technical personnel. They are bound by written confidentiality obligations and, where they may access protected health information, by business associate agreements.

·      When required by law, such as in response to a subpoena, court order, or regulatory request, or to protect the safety, rights, or property of individuals, our customers, or the public.

4. How We Protect Information

Information is encrypted in transit using Transport Layer Security and at rest using AES encryption. Access is limited to personnel who need it to do their jobs. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

5. Data Retention

We retain information for as long as needed to provide the platform to the customer that sent it and as our agreements and applicable law require. When a customer relationship ends, we return or securely destroy that customer's data in accordance with our agreement with them.

6. Your Rights

If your enrollment information was sent through the platform, you exercise your HIPAA rights through your insurance carrier or through the ICHRA marketplace or employer benefit administrator that handled your enrollment. Those rights are to access or amend your health information and to receive an accounting of its disclosures. If you contact us directly, we will direct your request to the appropriate organization.

If you hold a user account, you may ask us to provide, correct, or delete your account information by contacting us below.

7. Complaints

If you believe ICHRAx has handled your information improperly, contact our Privacy Official at the address below. We will investigate and respond, and we will not retaliate against anyone for raising a privacy concern.

8. Changes to This Policy

We may update this policy. The current version is posted at ichrax.com/privacy-policy with its effective date, and we will notify customer account contacts of any material change.

9. Contact Us

ICHRAx
Attention: Privacy Official
Email: privacy@ichrax.com
Mailing address: 10000 N Central Expy, Suite 438, Dallas, TX 75231

10. Subprocessors

ICHRAx uses a small number of third party service providers, known as subprocessors, to deliver the platform. A subprocessor is a company that processes data on our behalf as part of providing our service to you.

We require every subprocessor to enter into a written agreement that obligates them to protect the data they process, to use it only for the purposes we specify, and to notify us of any unauthorized disclosure.

The subprocessors we currently use are:

Microsoft Corporation (Microsoft  Azure): Cloud hosting, database and  infrastructure services for the ICHRAx platform

Zuplo: API gateway services for  platform integrations

‍

To ask about our subprocessors or how they handle your data, contact us at privacy@ichrax.com.

‍

‍