Privacy Policy

This Privacy Policy ("Policy") describes how Smith Insuratech LLC ("Company," "we," "us," or "our") collects, uses, discloses, and safeguards personal information in connection with your use of the Smith Insuratech mobile application (the "App" or the "Service"), available on iOS and Android.

By downloading, accessing, or using the App, you acknowledge that you have read, understood, and agree to this Policy and our Terms and Conditions. If you do not agree, do not use the App.

Information We Collect

1.1 Categories of Information

In connection with your use of the App and related Services, Company collects, receives, and processes the following categories of information, which may include personal information as defined by Applicable Law:

• Account Information: Name, email address, telephone number, mailing address, subscription level, payment credentials, and other account registration details.
• Professional Information: Medicare insurance license number, agency or brokerage affiliation, and related professional credentials.
• Client Information: Names, contact information, insurance carrier names, and insurance plan details pertaining to your clients, as entered or submitted by you.
• Communications Data: Content and metadata of messages, correspondence, or other communications transmitted through the Service.
• Device and Technical Information: Device type, operating system, unique device identifiers, IP address, network information, App version, and usage analytics or telemetry data automatically collected through cookies, APIs, SDKs, or similar technologies.
• Images and Media: Photographs or images you submit for inclusion in client communications, marketing materials, or thank-you cards.

1.2 Sources of Information

We collect the information described above: (a) directly from you when you create an account, submit data, or communicate with us; (b) automatically through your use of the App, including via cookies and similar tracking technologies; and (c) from integrated third-party services or platforms that you authorize to interoperate with the Service.

1.3 Voluntary Nature of Certain Submissions

To the extent that you submit client data, images, or communications content, you represent and warrant that you have obtained all necessary authorizations, consents, and permissions required under Applicable Law, including but not limited to HIPAA and TCPA, prior to submission. You further acknowledge that Company acts solely as a processor or service provider of such information on your behalf.

1.4 Exclusions

We do not intentionally collect biometric data, geolocation data, audio or video recordings, contact lists, or calendar information unless expressly requested or authorized by you for a specific purpose. If such access is requested in the future, we will provide additional notice and obtain any consents required by Applicable Law prior to collection.

How We Use Information

2.1 Primary Business Purposes

Company collects, processes, and uses the information described in Section 1 solely for lawful business purposes, including but not limited to the following:

• Provision and Operation of the Service: To provide, operate, maintain, and support the App and its associated features, functionalities, and services.
• Account Administration: To establish, authenticate, and manage user accounts; process subscription fees and payments; and provide technical support and customer service.
• Facilitation of Communications: To enable User-initiated communications with clients, including messages, reminders, and updates transmitted through the Service.
• Personalization and User Experience: To customize content, interfaces, and features based on User preferences and usage patterns, and to improve the performance, usability, and functionality of the App.
• Analytics and Service Improvement: To monitor, analyze, and enhance the quality, performance, and effectiveness of the Service, including the development of new features and services.
• Legal and Regulatory Compliance: To comply with applicable federal, state, and local laws and regulations, including HIPAA, TCPA, and data privacy statutes, and to respond to lawful requests and legal process.
• Security and Fraud Prevention: To maintain the security and integrity of the Service, detect and prevent unauthorized access, fraud, abuse, or other unlawful activity, and enforce our Terms of Service and other agreements.

2.2 Secondary Uses Consistent with Original Purpose

We may also use information for purposes that are reasonably related to, compatible with, or ancillary to the purposes described above, provided that such uses are consistent with Applicable Law and do not materially differ from the original purpose of collection.

2.3 No Sale or Unauthorized Secondary Use

We do not sell personal information as defined under Applicable Law, nor do we use personal information for targeted advertising, cross-context behavioral advertising, or profiling in furtherance of decisions that produce legal or similarly significant effects, except as expressly authorized by you or required by law.

2.4 De-Identified or Aggregated Data

We may create and use de-identified or aggregated information derived from personal information for statistical analysis, research, reporting, or product development. Such information is not considered personal information under this Policy, and we will not attempt to re-identify it except as permitted by law.

How We Share Information

3.1 Service Providers and Processors

We may disclose certain personal information to vendors, contractors, and service providers who process data on our behalf and under our instructions solely to operate, support, or improve the Service — for example, providers of hosting, infrastructure, analytics, payment processing, and messaging services. Such providers are contractually required to maintain the confidentiality and security of the information and to use it only for the purposes for which it was disclosed.

All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties, excluding aggregators and providers of the text messaging services. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes.

3.2 Legal and Compliance Disclosures

We may disclose personal information where necessary to comply with Applicable Law, respond to lawful requests, protect our rights or property, detect or prevent fraud or illegal activity, or enforce our agreements.

3.3 Business Transfers

We may transfer personal information in connection with a merger, acquisition, reorganization, or sale of assets, provided that the recipient agrees to process such information in a manner consistent with this Policy.

3.4 User-Directed Disclosures

If you instruct us to share information with a third party (for example, by enabling an integration), such disclosure will occur under that third party's terms and policies. We are not responsible for any use of data you direct us to disclose.

Data Retention and Deletion

4.1 Retention Periods

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, to comply with Applicable Law, to satisfy contractual or regulatory obligations, to maintain accurate business and financial records, to resolve disputes, and to enforce our agreements. Unless otherwise required by law, we may retain certain information indefinitely for legitimate business, legal, or compliance reasons, including but not limited to insurance regulatory retention requirements, professional licensing audits, and obligations under HIPAA and related federal or state healthcare regulations.

4.2 User-Initiated Deletion Requests

You may request deletion of your account and associated personal information at any time by submitting a verified request to info@smithinsuratech.com. Upon verification, we will delete, anonymize, or de-identify personal information as required by Applicable Law, subject to the exceptions described in Section 4.3 below.

4.3 Exceptions to Deletion

We may deny, delay, or limit deletion of certain personal information if retention is reasonably necessary for any of the following purposes:

• Legal and Regulatory Compliance: To comply with a legal obligation, including record-retention requirements imposed by insurance regulators, healthcare laws such as HIPAA, or other governmental authorities.
• Security and Fraud Prevention: To detect, investigate, or protect against security incidents, fraudulent, deceptive, or illegal activity, or to prosecute those responsible.
• Contractual Obligations: To fulfill a contractual requirement, complete a transaction you initiated, or provide a service you requested.
• Litigation Hold and Defense: To establish, exercise, or defend legal claims, enforce our agreements, or comply with litigation hold obligations.
• System Integrity: To maintain the integrity of backup systems or business continuity mechanisms, provided that such retained data will be securely isolated and not used for any other purpose.

4.4 Backup and Archival Data

Information retained in backup or archival systems will be deleted or overwritten in the ordinary course of our data lifecycle and business continuity processes. While such data remains in backup form, it will be isolated from active processing and subject to appropriate safeguards until deletion occurs.

4.5 De-Identification and Aggregation

Where feasible, and in accordance with Applicable Law, we may de-identify or aggregate personal information instead of deleting it. Once de-identified or aggregated, such information will no longer be treated as personal information under this Policy, provided that we do not attempt to re-identify it except as permitted by law.

Your US State Specific Privacy Rights

For the avoidance of doubt, text messaging originator opt-in data and consent will not be shared with any third parties, except for aggregators and providers of the text messaging services, and will never be shared for marketing or promotional purposes.

5.1 Applicability

Residents of certain U.S. states, may have additional rights under local consumer data privacy legislation ("Applicable States"). The rights described below apply to the extent such laws apply to your personal information and our processing of it.

5.2 Your Rights

Subject to verification of your identity and any applicable exceptions, you may have the following rights:

• Right to Know / Access: To request confirmation as to whether we process your personal information and, if so, to request a copy of the categories and specific pieces of personal information we have collected about you, the purposes for which we collected it, the categories of sources, and the categories of third parties with whom we have shared it.
• Right to Delete: To request that we delete personal information we have collected from or about you, subject to the exceptions set forth in Section 4.3 and as permitted by Applicable Law.
• Right to Correct: To request that we correct inaccuracies in the personal information we maintain about you, taking into account the nature of the data and the purposes of the processing.
• Right to Opt-Out of Sale or Targeted Advertising: To request that we not "sell" your personal information or process it for targeted advertising, as those terms are defined by Applicable Law.
• Right to Non-Discrimination: To exercise your privacy rights free from discrimination, retaliation, or denial of goods or services.

5.3 Definition of "Sale"

For purposes of this Policy, "sale" refers to the exchange of personal information for monetary or other valuable consideration as defined under Applicable Law. Disclosures of personal information to Service Providers, processors, or contractors acting on our behalf for business purposes, or disclosures directed by you, do not constitute a "sale."

5.4 Exercising Your Rights

To exercise any of the rights described above, you may submit a request by emailing us at info@smithinsuratech.com. We will verify your identity using reasonable methods appropriate to the nature of the request and the sensitivity of the personal information involved. If we are unable to verify your identity, we may deny the request and will inform you of the reason.

5.5 Limitations and Conditional Denial

We may deny, delay, or limit a request where:

• We are unable to verify your identity with commercially reasonable effort;
• An exception under Applicable Law applies;
• The request would conflict with our ability to comply with legal, regulatory, or contractual obligations;
• Retention is necessary for security, fraud prevention, or abuse detection;
• Compliance would infringe upon the rights or freedoms of others; or
• The request is manifestly unfounded, excessive, or repetitive.

5.6 Appeals

If we deny your request in whole or in part, certain Applicable State laws entitle you to appeal our decision. You may submit an appeal by replying to our denial communication with the word "APPEAL" in the subject line or by following the instructions provided in our response. We will review and respond to any appeal in accordance with Applicable Law.

HIPAA and TCPA Compliance

6.1 HIPAA Compliance

The Service is designed for use by licensed Medicare insurance professionals and may involve the collection, storage, transmission, or processing of information that constitutes "protected health information" ("PHI") under the Health Insurance Portability and Accountability Act of 1996, as amended, and its implementing regulations ("HIPAA"). Company is not a covered entity under HIPAA and acts solely as a "business associate" or "downstream service provider," as those terms are defined under Applicable Law, only to the extent applicable.

User acknowledges and agrees that:

• User Responsibility: User is solely responsible for determining whether and how HIPAA applies to their operations and for complying with all obligations imposed on covered entities and business associates under HIPAA and any other Applicable Law.
• Minimum Necessary Standard: User shall ensure that only the minimum necessary PHI is uploaded, stored, or processed through the Service.
• Authorization and Consent: User represents and warrants that they have obtained all necessary authorizations, consents, and permissions from individuals before uploading, transmitting, or otherwise providing PHI through the Service.
• Business Associate Agreement: If required under Applicable Law, User agrees to enter into a Business Associate Agreement ("BAA") with Company governing the use and disclosure of PHI. Company may condition continued access to the Service on execution of such a BAA.

Company implements administrative, technical, and physical safeguards designed to protect PHI in accordance with HIPAA's Security Rule. However, User understands and agrees that compliance with HIPAA is a shared responsibility, and Company shall not be liable for any User violation of HIPAA or other healthcare-related laws arising from User's actions or omissions.

6.2 TCPA Compliance

The Service may include functionality that allows User to send text messages, emails, voice communications, or other electronic messages to clients or prospective clients. The Telephone Consumer Protection Act of 1991 ("TCPA"), as amended, and similar federal and state laws regulate such communications.

User acknowledges and agrees that:

• Consent Obligations: User is solely responsible for obtaining any and all legally required consents, authorizations, or permissions prior to initiating communications using the Service, including prior express written consent where required by the TCPA.
• Content Compliance: User shall ensure that all communications sent through the Service comply with the TCPA and all other Applicable Laws, including rules promulgated by the Federal Communications Commission ("FCC") and relevant state regulators.
• Indemnity: User shall defend, indemnify, and hold harmless Company from and against any Claims arising out of or related to User's violation of the TCPA, FCC rules, state telemarketing laws, or other applicable communications laws.

Company expressly disclaims any responsibility or liability for User's compliance with the TCPA or any other communications-related legal requirements.

Security Measures

7.1 Administrative, Technical, and Physical Safeguards

We implement and maintain a comprehensive information security program that includes administrative, technical, and physical safeguards designed to protect personal information and PHI against unauthorized access, disclosure, alteration, loss, misuse, or destruction. These safeguards are intended to meet or exceed the requirements of Applicable Law, including the HIPAA Security Rule where applicable, and include, without limitation:

• Encryption: All data is encrypted in transit and at rest using industry-standard encryption protocols (e.g., TLS/SSL and AES-256) to help prevent unauthorized access.
• Access Controls: Role-based access controls, multi-factor authentication (MFA), strict credential management, and least-privilege principles are applied to limit access to authorized personnel only.
• Key Management: Encryption keys are securely stored, rotated on a regular schedule, and protected from unauthorized access.
• Network and Infrastructure Security: Firewalls, intrusion detection and prevention systems, network segmentation, and continuous vulnerability monitoring are implemented to secure infrastructure and prevent unauthorized intrusion.
• Audit Logging and Monitoring: Comprehensive logging, monitoring, and auditing of system activity is conducted to detect, investigate, and respond to suspicious behavior or security incidents.
• Data Segregation: Logical separation of user data in a multi-tenant environment to prevent unauthorized cross-access.
• Vendor Oversight: Third-party service providers and infrastructure partners, including our CRM platform provider, are contractually required to maintain security and privacy practices consistent with Applicable Law and industry standards.
• Personnel Training: Employees and contractors with access to personal information receive regular training on privacy, data protection, and information security obligations.

7.2 Incident Response

We maintain an incident response plan designed to promptly investigate, mitigate, and remediate suspected or actual security incidents. Where required by Applicable Law, we will provide notice of a breach of personal information or PHI without unreasonable delay and in accordance with applicable breach notification laws.

7.3 Shared Security Responsibility

While Company implements commercially reasonable security measures, security is a shared responsibility. User is responsible for safeguarding account credentials, maintaining up-to-date devices and software, and using the Service in a secure manner. User is also responsible for promptly notifying Company of any unauthorized use of their account or any security incident they become aware of.

7.4 No Absolute Security Guarantee

Although we maintain robust safeguards consistent with industry standards, no system or transmission of data over the internet can be guaranteed to be completely secure. Accordingly, we cannot and do not warrant or represent that personal information or PHI will always remain secure. By using the Service, you acknowledge and accept these inherent risks.

Children's Privacy

The App is not directed to individuals under 18, and we do not knowingly collect personal information from anyone under that age. If we learn that we have inadvertently collected information from a minor without verified parental consent, we will promptly delete or anonymize such data.

If you believe a minor's data has been provided to us, please contact info@smithinsuratech.com.

Changes to This Policy

We may update this Policy periodically. We will notify you of material changes by email, in-app notification, or by updating the "Effective Date" above. Your continued use of the App following such notice constitutes acceptance of the updated Policy.

Cookie Policy for Smith Insuratech

Effective Date: October 13, 2025

This Cookie Policy ("Policy") explains how Smith Insuratech LLC ("Company," "we," "us," or "our") uses cookies and similar technologies in connection with your use of the Smith Insuratech mobile application and any associated websites, landing pages, or funnels hosted or powered by GoHighLevel (collectively, the "Service").

This Policy is incorporated into and made part of our Privacy Policy and Terms of Service. By accessing or using the Service, you consent to the use of cookies and similar technologies as described in this Policy. If you do not agree, you should disable cookies as described below, though certain features of the Service may not function properly.

1. What Are Cookies and Similar Technologies

"Cookies" are small data files placed on your device (computer, smartphone, or tablet) when you visit a website or use an application. They are widely used to make websites and apps work more efficiently, as well as to provide reporting information and personalize user experiences.

Cookies may be "session cookies" (which expire when you close your browser or app) or "persistent cookies" (which remain until they expire or are deleted). We may also use similar technologies such as local storage, web beacons, tracking pixels, and SDKs, which function similarly to cookies.

2. How We Use Cookies

We and our service providers, including GoHighLevel, use cookies and similar technologies for the following purposes:

• Essential / Strictly Necessary: To enable core functionality such as user authentication, account login, security, and navigation.
• Functional / Preferences: To remember your preferences and enhance your experience (e.g., language selection or saved settings).
• Analytics / Performance: To understand how users interact with our Service, measure usage, and improve performance.
• Marketing / Advertising: To deliver relevant content or measure marketing effectiveness (if applicable and where permitted).

Some cookies are first-party (set by us or our Service) and others are third-party (set by analytics or service providers such as Google Analytics).

3. Cookies Used Through GoHighLevel

Because the Service is built and delivered in part through GoHighLevel's platform, cookies used by GoHighLevel may also be deployed when you use our Service. These cookies may support essential functionality, session management, analytics, and performance monitoring.

4. Your Choices Regarding Cookies

You can manage or disable cookies in several ways:

• Browser Settings: Most web browsers allow you to control cookies through their settings. You can choose to block all cookies or only certain types.
• Device Settings: Mobile devices may allow you to restrict the use of certain tracking technologies.
• Cookie Consent Tools: On web properties built with GoHighLevel, we may use a cookie consent banner allowing you to accept or reject non-essential cookies.
• Third-Party Opt-Outs: Some third parties provide opt-out mechanisms for their cookies, such as Google Analytics' opt-out browser add-on.

Disabling cookies may limit the functionality of certain parts of the Service.

5. No Sharing of Mobile Information or SMS Consent Data

We do not share mobile device information, text messaging originator opt-in data, or consent information with any third parties or affiliates for marketing or promotional purposes.

All categories of data sharing described in this Policy exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties, except for aggregators and providers of the text messaging services necessary to deliver such services.

6. Updates to This Cookie Policy

We may update this Policy from time to time to reflect changes in our cookie practices, the cookies we use, or applicable legal requirements. When we do, we will revise the "Effective Date" above and provide notice as required by law. Your continued use of the Service constitutes your acceptance of any updates to this Policy.

7. Contact Us

If you have any questions about this Cookie Policy or our use of cookies and similar technologies, please contact us at:

Smith Insuratech LLC
735 27th Avenue North
St. Petersburg, FL 33704
Email: jakob@insuratech.biz