Privacy Policy
Effective Date: August 25, 2026 · Last Updated: August 25, 2026
Enrova.ai ("we," "our," or "us") is a benefits enrollment platform operated by Northgate Benefit Group. This Privacy Policy explains how we collect, use, disclose, and protect information when you use the Enrova.ai platform at enrova.ai (the "Platform"). By accessing or using the Platform, you agree to the practices described in this policy.
1. Who We Are
Enrova.ai is operated by Northgate Benefit Group, Matthew LaMarche, Founder & Managing Partner.
For privacy-related inquiries: privacy@northgatebenefitgroup.com
2. Who This Policy Covers
This policy applies to employees who use the Platform to enroll in benefits, employers and HR administrators who manage benefit programs, brokers who configure offerings for clients, and visitors to enrova.ai.
3. Information We Collect
Information You Provide
- Account information: name, email address, job title, employer name
- Employee enrollment data: benefit plan elections, tier selections, elected monthly cost
- Employer configuration data: company name, employee classes, benefit period dates, plan offerings
- Communications submitted through Lumi (our AI advisor) or support channels
Information Collected Automatically
- Usage data: pages visited, features used, session duration, browser and device type
- Authentication events: login timestamps and session data (managed by Clerk)
- AI interaction logs: Lumi conversation inputs and outputs are logged for security audit purposes and retained for 12 months
Information from Third Parties
- Payroll providers (via Finch): employee roster data such as name, email, hire date, and employment status, if your employer has connected a payroll system
- Benefit carriers: plan details and benefit schedules provided by your employer's broker
4. How We Use Your Information
| Purpose | Legal Basis |
|---|---|
| Deliver benefits enrollment services | Contract performance |
| Enable Lumi AI to answer benefits questions | Contract performance |
| Send enrollment confirmations and benefit notices | Contract performance |
| Maintain security audit logs (HIPAA requirement) | Legal obligation |
| Improve platform functionality and performance | Legitimate interest |
| Comply with HIPAA, CCPA, and applicable law | Legal obligation |
We do not sell your personal information. We do not use your information for behavioral advertising or train AI models on your data.
5. HIPAA Notice
Enrova.ai operates as a Business Associate under HIPAA for employer clients that are covered entities or business associates. We have executed a Business Associate Agreement (BAA) with Amazon Web Services covering our infrastructure.
- Benefit enrollment data related to health plans may constitute Protected Health Information (PHI) under HIPAA
- PHI is stored in encrypted, HIPAA-eligible systems
- We maintain audit logs of all access to PHI-related systems
- We will notify affected individuals of any breach of unsecured PHI within 60 days of discovery, as required by the HIPAA Breach Notification Rule
Lumi AI and PHI: Lumi is designed to help employees understand their benefit options. Lumi does not ask about, collect, or process health conditions, diagnoses, claims history, or other clinical information.
6. How We Share Your Information
| Recipient | What Is Shared | Why |
|---|---|---|
| Your employer | Benefit elections and enrollment status | To administer your benefits |
| Your broker | Enrollment data for groups they manage | To provide brokerage services |
| AWS (Amazon Web Services) | All platform data | Hosting, AI inference, storage (BAA in place) |
| Neon | Database content | Postgres database provider |
| Clerk | Login identity (name, email, org) | Authentication |
| Resend | Your email address | Transactional emails |
| Payroll providers (via Finch) | Enrollment data | Payroll deduction sync, if enabled by your employer |
7. Data Retention
| Data Type | Retention Period |
|---|---|
| Employee benefit elections (health plans / PHI) | 7 years (HIPAA minimum) |
| Employee benefit elections (voluntary/non-health) | 3 years after relationship ends |
| Employer group configuration | 3 years after relationship ends |
| Account information | Duration of account + 3 years |
| Lumi AI conversation logs | 12 months |
| Authentication event logs | 12 months |
8. Data Security
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Role-based access controls — users access only their own data
- HIPAA-eligible infrastructure with signed AWS BAA
- AI model invocation logging with tamper-resistant audit trail
- Multi-factor authentication required for all administrative access
- Annual security policy review by our Security Officer
9. Your Rights
All Users
- Access: Request a copy of the personal information we hold about you
- Correction: Request correction of inaccurate information
- Deletion: Request deletion of your information (subject to legal retention requirements)
- Portability: Request your data in a portable format
California Residents (CCPA)
California residents have the right to know what personal information is collected, used, and disclosed; to delete personal information; and to opt out of sale (we do not sell personal information). To exercise your CCPA rights, contact us at privacy@northgatebenefitgroup.com. We will respond within 45 days.
10. Changes to This Policy
We may update this policy periodically. We will notify registered users of material changes via email. The "Last Updated" date at the top reflects the most recent revision.
11. Contact Us
Matthew LaMarche, Security & Privacy Officer
Northgate Benefit Group / Enrova.ai
Email: privacy@northgatebenefitgroup.com
Phone: (803) 354-6310