Elderplan/HomeFirst Website Privacy Policy
1. Who We Are
Elderplan, Inc. and HomeFirst (collectively, “Elderplan,” “we,” “us,” or “our”) operate elderplan.org. Elderplan offers Medicare Advantage plans regulated by CMS, and HomeFirst offers Managed Long-Term Care plans regulated by the New York State Department of Health.
2. Information We Collect
Information you provide directly. When you fill out a contact form, request information, enroll in a plan, or opt in to communications, you may provide your name, address, phone number, email address, ZIP code, date of birth, Medicare or Medicaid ID, and health-related information relevant to your plan.
Where this information is collected. Information you submit through forms on this website—whether embedded directly on elderplan.org or transmitted through an API integration—is collected in our customer relationship management (CRM) system, Salesforce Sales Cloud. When this information includes protected health information (PHI), Salesforce processes it as a HIPAA business associate under a Business Associate Agreement (BAA).
Information collected automatically. When you visit our site, we and our service providers automatically collect technical information such as your IP address, approximate location, browser and device type, pages visited, and referring source. We use Google Analytics and Freshpaint for this purpose.
We use Freshpaint, a customer data platform, to capture analytics events on our site and send them to Google Analytics. Freshpaint operates as a HIPAA business associate under a Business Associate Agreement and is configured to filter out protected health information before any data is sent to downstream destinations.
3. How We Use Your Information
We use this information to:
- Respond to inquiries and process enrollment applications
- Send plan information, benefit updates, and health-related reminders that you have requested or agreed to receive
- Improve website functionality and the experience for members and prospective members
- Manage relationships through our CRM system
- Comply with applicable laws, including the CMS Medicare Marketing Guidelines and NYS DOH regulations
- Detect and prevent fraud and security incidents
4. How We Share Your Information
Elderplan does not sell your personal information. We share information only as follows:
Service providers. We share information with vendors who help us operate this website and provide services, including our website host, Liquid Web; Fresh Paint (analytics data platform); Google Analytics; Salesforce Sales Cloud (CRM); and our text messaging vendor. These vendors are contractually required to protect your information and use it only on our behalf. Vendors that handle PHI, including Salesforce, are HIPAA business associates operating under a fully executed BAA.
Regulators and government authorities. We share information with CMS, the New York State Department of Health (NYS DOH), and law enforcement as required by law and when legally compelled to do so.
Care coordination. We share information with healthcare providers, care management agencies, and home care providers as needed to coordinate your care, in accordance with HIPAA and your Notice of Privacy Practices.
Business transfers. If Elderplan is involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction.
Third-party links. Our website contains links to external sites (e.g., Medicare.gov). We are not responsible for their privacy practices.
5. Cookies and Tracking Technologies
We use cookies and similar technologies to ensure the site functions properly (e.g., session management), to remember your preferences, and for analytics through Google Analytics. You can manage or disable cookies through your browser settings: [IF YOU HAVE A CONSENT BANNER, REFER TO IT HERE]. Disabling certain cookies may affect the site’s functionality.
6. Text Messaging
Members who opt in may receive text messages from Elderplan or our partners regarding coverage, benefits, surveys, and health-related reminders. We do not send marketing texts. You may opt out at any time by replying STOP. Opt-out requests are honored within 15 days for Elderplan messages and 30 days for partner messages.
7. Data Security
We maintain administrative, technical, and physical safeguards to protect your information, including encryption in transit, role-based access controls, and employee training. Information stored in Salesforce is protected by Salesforce’s enterprise security controls, in addition to our own. No system is completely secure, and we cannot guarantee the absolute security of information transmitted to or from this website.
8. Data Breach Notification
If a security incident affects your personal information, we will notify you as required by the New York SHIELD Act and other applicable laws. To report a privacy concern, contact our Privacy Officer (see Section 12).
9. Your Rights and Choices
You may have the following rights regarding information collected through this website:
| Right | How to Exercise |
|---|---|
| Access, correct, or delete | Contact our Privacy Officer (subject to legal retention requirements) |
| Opt out of text messages | Reply STOP, or contact Member Services |
| Manage cookies | Use your browser settings |
| HIPAA Rights (Members) | See our Notice of Privacy Practices |
10. Children’s Privacy
This website is not intended for children under 13, and we do not knowingly collect personal information from them. If we learn that we have done so, we will delete it promptly.
11. Changes to This Policy
We may update this Policy from time to time. When we do, we will update the “Last Updated” date above. Your continued use of this website after changes have been posted constitutes your acceptance of the updated Policy.
12. Contact Us
| Privacy Officer, Elderplan, Inc. / HomeFirst Address: [MAILING ADDRESS] Email: [PRIVACY OFFICER EMAIL] Phone: [PRIVACY OFFICER PHONE]Member Services: 1-800-353-3765 | TTY: 711 | 8 a.m. – 8 p.m., 7 days a week |