Elderplan/HomeFirst Website Privacy Policy
1. Who We Are
Elderplan, Inc. and HomeFirst (collectively, “Elderplan,” “we,” “us,” or “our”) operate elderplan.org. Elderplan offers Medicare Advantage plans regulated by CMS, and HomeFirst offers Managed Long-Term Care plans regulated by the New York State Department of Health.
2. Information We Collect
Information you provide directly. When you complete a contact form, request information, enroll in a plan, or opt in to communications, you may provide your name, address, phone, email, ZIP code, date of birth, Medicare or Medicaid ID, and health-related information relevant to your plan.
Where this information is collected. Information you submit through forms on this website — whether embedded directly on elderplan.org or transmitted through an API integration — is collected into our customer relationship management (CRM) system, Salesforce Sales Cloud. Where this information includes protected health information (PHI), Salesforce processes it as a HIPAA business associate under a Business Associate Agreement (BAA).
Information collected automatically. When you visit our site, our service providers and we automatically collect technical information such as IP address, approximate location, browser and device type, pages visited, and referring source. We use Google Analytics and Freshpaint for this purpose.
We use Freshpaint, a customer data platform, to capture analytics events on our site and route them to Google Analytics. Freshpaint operates as a HIPAA business associate under a Business Associate Agreement and is configured to filter protected health information before any data is sent to downstream destinations.
3. How We Use Your Information
We use this information to:
- Respond to inquiries and process enrollment applications
- Send plan information, benefit updates, and health-related reminders you have requested or consented to receive
- Improve website functionality and the member and prospect experience
- Manage relationships through our CRM system
- Comply with applicable law, including CMS Medicare Marketing Guidelines and NYS DOH regulations
- Detect and prevent fraud and security incidents
4. How We Share Your Information
Elderplan does not sell your personal information. We share information only as follows:
Service providers. We share information with vendors who help us operate this website and deliver services, including our website host, Liquid Web; Fresh Paint (analytics data platform); Google Analytics; Salesforce Sales Cloud (CRM); and our text messaging vendor. These vendors are contractually required to protect your information and use it only on our behalf. Vendors that handle PHI, including Salesforce, are HIPAA business associates operating under a fully executed BAA.
Regulators and government authorities. We share information with CMS, NYS DOH, and law enforcement as required by law and when legally compelled.
Care coordination. We share information with healthcare providers, care management agencies, and home care providers as needed to coordinate your care, consistent with HIPAA and your Notice of Privacy Practices.
Business transfers. If Elderplan is involved in a merger, acquisition, or asset sale, your information may be transferred as part of that transaction.
Third-party links. Our website links to external sites (e.g., Medicare.gov). We are not responsible for their privacy practices.
5. Cookies and Tracking Technologies
We use cookies and similar technologies for site functionality (e.g., session management), to remember your preferences, and for analytics through Google Analytics. You may manage or disable cookies through your browser settings: [IF YOU HAVE A CONSENT BANNER, REFERENCE IT HERE]. Disabling certain cookies may affect site functionality.
6. Text Messaging
Members who opt in may receive text messages from Elderplan or our partners about coverage, benefits, surveys, and health-related reminders. We do not send marketing texts. You may opt out at any time by replying STOP. Opt-out requests are honored within 15 days for Elderplan messages and 30 days for partner messages.
7. Data Security
We maintain administrative, technical, and physical safeguards to protect your information, including encryption in transit, role-based access controls, and employee training. Information stored in Salesforce is protected by Salesforce’s enterprise security controls, in addition to our own. No system is completely secure, and we cannot guarantee the absolute security of information transmitted to or from this website.
8. Data Breach Notification
If a security incident affects your personal information, we will notify you as required by the New York SHIELD Act and other applicable law. To report a privacy concern, contact our Privacy Officer (see Section 12).
9. Your Rights and Choices
You may have the following rights regarding information collected through this website:
| Right | How to Exercise |
|---|---|
| Access, correct, or delete | Contact our Privacy Officer (subject to legal retention requirements) |
| Opt out of text messages | Reply STOP, or contact Member Services |
| Manage cookies | Use your browser settings |
| HIPAA rights (members) | See our Notice of Privacy Practices |
10. Children’s Privacy
This website is not directed at children under 13, and we do not knowingly collect personal information from them. If we learn we have, we will delete it promptly.
11. Changes to This Policy
We may update this Policy from time to time. When we do, we will update the “Last Updated” date above. Your continued use of this website following posted changes constitutes acceptance of the updated Policy.
12. Contact Us
| Privacy OfficerElderplan, Inc. / HomeFirstAddress: [MAILING ADDRESS]Email: [PRIVACY OFFICER EMAIL]Phone: [PRIVACY OFFICER PHONE]Member Services: 1-800-353-3765 | TTY: 711 | 8 a.m. – 8 p.m., 7 days a week |