At Secure Path Advisory Group, a Leavitt Group subsidiary, and its affiliated entities, protecting your privacy is important. We want you to understand what information we collect and how we use it. This notice describes our privacy policy. By visiting the website https://thesecurepath.com/, and/or the websites of any of parent or affiliated entities, you are accepting the practices described in this Privacy Notice.

What Information We Collect and From Whom We Collect It

We may collect nonpublic personal information about you from the following sources:

• Information we receive from you on applications or other forms;
• Information about your transactions with us, our affiliates, or others; and
• Information we receive from non-affiliated third parties, including consumer reporting agencies.
• Information we receive from group and individual plans in the operation of their plan.

In addition, we may use “cookies” (small text files transferred from our website to your hard drive) to recognize repeat users, track usage, gather personal information, and facilitate your access to and use of the site.

“Nonpublic personal information” is nonpublic information about you that we obtain in connection with providing a financial or insurance product or service to you.

Sharing of Data—Non-affiliated Third Parties to Whom Disclosures May Be Made

Information about our customers is an important part of our business, and we are not in the business of selling it to others. We share customer information only as described below and with subsidiaries or affiliates that Leavitt Group Enterprises controls that either are subject to this Privacy Notice or follow practices at least as protective as those described in this Privacy Notice.

We may disclose your personal information to our service providers, suppliers, subcontractors, and other parties who provide services to us or act on our behalf. Phone numbers collected for SMS consent are not shared with any 3rd parties or affiliates.

We may also disclose nonpublic information about you to non-affiliated third parties as permitted by law, such as when required to do so by a court order or subpoena.

SMS Communications

By opting into SMS from a web form or other medium, you agree to receive SMS messages from Secure Path Advisory Group. This includes SMS messages for payments due, policy expiry dates, policy renewals, and billing notifications. Message frequency varies. Message and data rates may apply. See privacy policy. Message HELP for help. Reply STOP to any message to opt out.

• Consent for SMS Communication—Information obtained as part of the SMS consent process will not be shared with third parties.
• Types of SMS Communications—If you have consented to receive text messages from Secure Path Advisory Group, you may receive messages related to servicing your account, including updates about policy due dates, status, or other relevant information.
• SMS Messaging Disclosures
  • Message and data rates may apply
  • You can opt-out at any time by texting “STOP”
  • Message frequency may vary
  • For assistance, text “HELP”
  • Carriers are not liable for delayed or undelivered messages

Opt Out

If you no longer want to receive emails or marketing-related materials from us, you may opt out of receiving these materials by following the unsubscribe instructions in such messages or by contacting via email at: optout@leavitt.com. Please note that even if you opt out of receiving promotional emails from us, we may continue to send you transactional or informational email communications.

Why Do We Collect Your Private Information

Secure Path Advisory Group may collect your Personally Identifiable Information (PII) or Protected Health Information (PHI) from you or your employer for purposes of underwriting your financial or insurance product, and, in servicing that plan/policy. The types of information that may be collected include name, address, social security number, date of birth, employer, bank account information, insurance identification numbers, and/or other identifying information. We may access this information through your application process or enrollment with your employer health and ancillary plan products.

Our Security Procedures

We restrict access to your nonpublic personal information and only allow disclosures to persons and companies as permitted by law to assist in providing products or services to you. PHI and PII will never be shared with a third party without express written authorization or where permitted by law.

We maintain physical, electronic, and procedural safeguards to protect your nonpublic personal information; including, encrypting PHI in transmission over the internet. PHI and PII are not accessible outside of the Secure Path Advisory Group secure website (e.g., SSL configuration). Data is only accessible by authorized personnel using unique, audited access controls and/or pursuant to a HIPAA Business Associate Agreement. Secure Path Advisory Group maintains integrity controls to ensure PHI and PII are not tampered with. All PHI and PII are backed up and encrypted in storage.

As part of Secure Path Advisory Group security procedures, annual reviews are conducted of the security and privacy controls for effectiveness. Logs are maintain for any uses and disclosures of PHI made outside of HIPAA’s legal operational permissions and the Business Associate Agreement(s). Any requests for access to logs for use and disclosure of PHI are responded to within 45 business days.

Disposal

PHI and PII are subject to the Leavitt Group HIPAA Disposal Policies & Procedures. Disposal shall occur after 7 years where law does not mandate otherwise. All PHI and PII are destroyed by shredding, deleting or, if not possible to do so, maintaining HIPAA safeguards throughout the duration of Secure Path Advisory Group housing PHI and PII. Any deletions will include deleting backups and keys.

Consent, Authorization, Revocation, Access

Secure Path Advisory Group requires written consent and authorization when sharing PHI and PII with third parties outside of the legal permissions to use and disclose PHI and PII provided for under HIPAA and any subsequent regulations. You may revoke consent to use your PHI or PII where the law may permit by submitting your request to your Secure Path Advisory Group representative who will forward this to the Secure Path Advisory Group HIPAA Privacy Officer. Any request to restrict use and disclosure will be considered within 30 business days; however, any for claims unresolved, any requests are not able to be complied with until all claims have been resolved. If withdrawing consent to use your PII or PHI, Secure Path Advisory Group may not be able to place your insurance or financial product or fully service that policy.

Request for access to records maintained by the Secure Path Advisory Group for consulting services may be submitted to matt-loporto@leavitt.com. Access will be provided within 45 business days. Customers requesting updates to their HIPAA PHI records may request such through their Secure Path Advisory Group representative. Any requests will be considered within 30 business days.

Conditions of Use, Notices, and Revisions

If you choose to visit https://thesecurepath.com/ and/or the websites of any affiliated entities, your visit and any dispute over privacy is subject to this Notice and our Conditions of Use, including limitations on damages, arbitration of disputes, and application of the law of the state of Utah. If you have any concern about privacy at https://thesecurepath.com/ and/or the websites of any affiliated entities, please send us a thorough description to data.privacy@leavitt.com, and we will try to resolve it.

Our business changes constantly, and our Privacy Notice and the Conditions of Use will change also. You should check our Web site frequently to see recent changes. Unless stated otherwise, our current Privacy Notice applies to all information that we have about you and your account. We stand behind the promises we make, however, and will never materially change our policies and practices to make them less protective of customer information collected in the past without the consent of affected customers.