Privacy Policy

SmartSEP ("we," "us," or "our") operates the SmartSEP application and website at app.smartsep.net (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

1. Information We Collect

Account Information: When you register, we collect your full name, email address, and a password. Passwords are securely hashed using bcrypt and are never stored in plain text.

Determination Data: When you use the Service to perform Medicare Special Election Period (SEP) determinations, we collect and store the data you enter, including:

• Medicare Part A and Part B effective dates
• Date of birth
• Zip code, county, and state of residence
• Extra Help/LIS and Medicaid status
• Current plan enrollment information
• Responses to probing questions

Payment Information: We use third-party payment processors — Paddle (for web) and Apple In-App Purchase (for iOS) — to handle subscription payments. We do not store your credit card numbers or payment details directly. We store your Paddle customer ID and Apple original transaction ID for subscription management purposes.

Usage Data: We may collect information about how you access and use the Service, including your device type, browser type, and general usage patterns.

Geographic Data: We use zip codes you enter to resolve county and state information via the HUD USPS Crosswalk API for the purpose of determining plan availability. We do not track your physical location.

2. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the Service
• Process Medicare SEP determinations on your behalf
• Manage your account and subscription
• Send transactional emails (account verification, password resets)
• Process payments through Paddle and Apple IAP
• Improve and develop the Service
• Comply with legal obligations

3. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information to third parties. We may share information only in the following circumstances:

• Service Providers: We use Paddle for payment processing, Apple for iOS in-app purchases, and Resend for transactional email delivery. These providers only receive the minimum information necessary to perform their services.
• Legal Requirements: We may disclose your information if required to do so by law or in response to valid requests by public authorities.

4. Data Security

We implement industry-standard security measures to protect your data, including:

• HTTPS encryption for all data in transit (enforced via Cloudflare)
• Bcrypt password hashing
• Parameterized SQL queries to prevent injection attacks
• JWT-based authentication with short-lived tokens
• Security headers (HSTS, X-Frame-Options, X-Content-Type-Options)
• Rate limiting on authentication endpoints

5. Data Retention

We retain your account information and determination history for as long as your account is active. You may request deletion of your account and associated data by contacting us at [email protected].

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict processing of your data
• Request a copy of your data in a portable format

To exercise any of these rights, contact us at [email protected].

7. Children's Privacy

The Service is intended for use by licensed Medicare sales agents and is not directed at individuals under the age of 18. We do not knowingly collect personal information from children.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Effective Date." Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

9. Contact Us

If you have questions about this Privacy Policy, please contact us at:

Email: [email protected]
Website: smartsep.net