Effective Date: February 10, 2026
Last Updated: February 10, 2026
This California Privacy Supplement (“Supplement”) applies to California residents and supplements the Privacy Policy and Notice of Privacy Practices published at rivendell.health/privacy by Elrond Health Inc., doing business in California as Rivendell Insurance & Administration Services (California Department of Insurance Entity Number B20260025795, National Producer Number 22113786).
This Supplement is provided pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, “CCPA”), and the California Insurance Information and Privacy Protection Act (Insurance Code §§791–791.27) (“IIPPA”).
Insurance services in California are provided by Rivendell Insurance & Administration Services, a licensed insurance services entity operating under the California Department of Insurance (Entity Number B20260025795, National Producer Number 22113786). Our California office is located at 156 2nd St, Unit 310, San Francisco, CA 94105. All references to “Rivendell” in our Privacy Policy and Terms of Service refer to this entity when your interaction relates to California insurance services.
Under the CCPA, we have collected the following categories of personal information from California residents within the preceding 12 months:
Name, mailing address, email address, phone number, Social Security number, date of birth, employer identification number, IP address, and device identifiers. Collected from you directly, your employer, and automatically from your device.
Name, address, telephone number, insurance policy number, employment information, and financial information related to insurance enrollment. Collected from you directly and from insurance carriers and plan administrators.
Age, date of birth, sex, and marital status as provided in enrollment and health disclosure forms. Collected from you directly.
Browsing history, search history, and information about your interaction with our website. Collected automatically via cookies and analytics tools.
Approximate geographic location derived from your IP address. Collected automatically.
Employer name, job title, and employment status for group plan enrollment purposes. Collected from you directly and from your employer.
Social Security number and health insurance information. Collected from you directly and used only as necessary to provide the insurance enrollment and administration services you have requested.
We use personal information for the business and commercial purposes described in our Privacy Policy, including facilitating health insurance enrollment and administration, providing customer support, complying with legal obligations, and maintaining the security of our platform. We do not use or disclose sensitive personal information for purposes other than those permitted under CCPA §1798.121, which include performing the services you have requested, ensuring security and integrity, and complying with legal obligations.
We do not sell personal information as defined under the CCPA. We do not share personal information for cross-context behavioral advertising purposes. We have not sold or shared personal information of California residents in the preceding 12 months.
As a California resident, you have the following rights under the CCPA:
You may request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected the information, the business or commercial purposes for collection, and the categories of third parties with whom we have shared the information.
You may request that we delete personal information we have collected from you, subject to legal exceptions including HIPAA retention requirements, CMS record retention obligations (minimum 10 years for insurance broker and enrollment records), and other applicable law.
You may request correction of inaccurate personal information that we maintain about you.
We do not sell or share your personal information. If this practice changes, we will provide a “Do Not Sell or Share My Personal Information” mechanism and update this Supplement accordingly.
You may request that we limit our use of sensitive personal information to purposes necessary to perform the services you have requested. We already limit our use in this manner.
We will not discriminate against you for exercising any of your CCPA rights, including by denying you services, charging different prices, providing a different level of service, or suggesting that you will receive a different price or level of service.
To the extent that your personal information constitutes Protected Health Information (PHI) governed by HIPAA, such information is exempt from CCPA requirements pursuant to CCPA §1798.145(c)(1)(A). Your rights with respect to PHI are governed by HIPAA and are described in our Privacy Policy and Notice of Privacy Practices.
Pursuant to California Insurance Code §791.04, we provide the following notice:
In connection with insurance transactions including applications, enrollment, servicing, and administration, we collect personal information from the following sources:
We may disclose personal information to:
We will not disclose your personal information to affiliates or nonaffiliated third parties for marketing purposes without your prior written authorization. We will not unfairly discriminate against you for declining to authorize disclosure of your personal information.
You have the right to access personal information in our files by contacting us at the address below. You have the right to request correction of information you believe is inaccurate. You have the right to receive an accounting of disclosures made within the preceding two years.
You or your authorized agent may submit a privacy rights request by contacting:
Privacy Officer — Rivendell Insurance & Administration Services
156 2nd St, Unit 310, San Francisco, CA 94105
Email: [email protected]
Phone: (646) 600-8840
We will verify your identity before processing your request. For requests to know or delete, we will verify your identity by matching at least two data points you provide with information we already maintain. For requests submitted by an authorized agent, we require written proof of the agent's authorization (such as a power of attorney or a signed declaration) and may independently verify your identity.
We will acknowledge receipt of your request within 10 business days and will respond substantively within 45 calendar days as required by law. If we need additional time, we will notify you of the extension and the reason, for up to an additional 45 days.
If you are not satisfied with our response to your privacy request, you may contact: