Privacy Policy

Who we are

Smart TPA LLC (“SmartTPA,” “we,” “us”) is a third-party administrator for self-funded employer health plans. This policy describes how we handle information collected through this website, smarttpa.com (the “Site”). It does not govern the SmartTPA administration platform, which operates under separate written agreements — see “Protected health information” below.

Information we collect on this Site

The Site is informational. We collect far less than you might expect:

• Information you submit through our forms. When you submit the contact form (for example, to request a proposal or apply to the broker program), the information you provide — typically your name, work email, company, role, and message — is transmitted to and stored on our systems so we can respond to your inquiry. If you email us directly instead, we receive whatever you choose to send.
• Chat messages. The chat on this Site is answered by an automated AI assistant. Messages you type are sent to and processed on our systems to generate a response and to improve how we answer common questions. Please don’t include personal health information in the chat.
• Analytics. When analytics are enabled, we use Google Analytics 4 to understand aggregate Site usage (pages viewed, approximate location, device and browser type). Google Analytics sets cookies for this purpose. We do not run advertising trackers, social media pixels, or cross-site behavioral profiling on this Site.
• Operational data. Our hosting and security providers (for example, Cloudflare) process standard server logs — IP address, user agent, requested URL — to serve the Site and defend it against abuse. Pre-launch staging areas of the Site also use an access-control cookie limited to that purpose.

Protected health information (PHI)

The SmartTPA platform processes protected health information in its role as a business associate (and, where applicable, as a plan administrator delegate) under the Health Insurance Portability and Accountability Act (HIPAA). That processing is governed by written Business Associate Agreements and administrative services agreements with the health plans we serve — not by this website policy. Members receive privacy rights information through their health plan’s Notice of Privacy Practices.

Please do not send PHI through this Site or to our sales inboxes. If you are a plan member with a question about your claims or benefits, use your plan’s member portal or the contact information on your ID card so your information stays inside HIPAA-protected channels.

How we use information

• To respond to inquiries and proposals.
• To operate, secure, and improve the Site.
• To meet legal, regulatory, and audit obligations.

We do not sell personal information, and we do not share it for cross-context behavioral advertising.

Sharing

We share information only with the service providers that run our infrastructure (listed on our subprocessors page), with professional advisors, and where required by law. Each vendor that could touch regulated data signs a Business Associate Agreement before any such data flows to it.

Retention

Business correspondence is retained for as long as needed to serve the relationship and meet legal obligations. Analytics data is retained per Google Analytics’ standard retention controls. Platform records subject to HIPAA follow the retention schedules in our plan agreements (typically seven years or longer where law requires).

Your choices and rights

• You can browse the Site without submitting any information.
• You can block or delete cookies in your browser, or use Google’s Analytics opt-out tools; the Site keeps working.
• You can ask us what we hold about you, ask us to correct it, or ask us to delete it (subject to legal retention duties). Depending on where you live, these may also be statutory rights.

To make a privacy request, email support@smarttpa.com with the subject line “Privacy request.” We respond within 30 days.

Children

The Site is a business-to-business resource and is not directed to children under 13. We do not knowingly collect information from children through the Site.

Changes to this policy

We will update this policy as the Site and our services evolve, and we will revise the effective date above with each change. Material changes will be highlighted on this page.