PRIVACY POLICY
Journey Health
Effective Date: April 16, 2026 | Last Updated: April 16, 2026
Journey Health (“Journey,” “we,” “our,” or “us”) respects your privacy. This Privacy Policy explains what information we collect, how we use and share it, how we protect it, and the choices you have when you visit journeyhealthadvisors.com (the “Site”), use our services, or communicate with us by phone, email, SMS, chat, web form, or through our AI-powered onboarding assistant.
Please read this Policy carefully. If you do not agree with it, please do not use the Site or our services.
Journey Health is a marketing and advisory company headquartered in Charlotte, North Carolina. We help individuals, families, and employers access alternatives to traditional health insurance, including:
Important: Journey Health is not an insurance company, and the cost-sharing programs we market are not insurance and are not regulated as insurance.
Several of the programs Journey Health markets are delivered in partnership with third parties. Although these programs may carry Journey branding, information you provide in connection with them is shared with, and administered by, those partners:
Each of these partners has its own privacy practices. We encourage you to review their privacy notices, which are available upon request or from the partner directly. This Policy describes how Journey handles information; it does not replace the privacy practices of our partners.
The Health Insurance Portability and Accountability Act of 1996 (“HIPAA”) applies to “covered entities” (healthcare providers, health plans, and healthcare clearinghouses) and their Business Associates.
Journey Health is generally not a HIPAA covered entity or Business Associate in the ordinary course of its marketing and advisory activities. We do not provide medical care, operate a health plan, or process healthcare claims. The cost-sharing programs we market are not health insurance, and DPC practices maintain their own patient records.
In the ordinary course of business, Journey does not collect or store health data. However, during sales conversations, inquiries, and intake — by phone, email, SMS, chat, or through our AI onboarding assistant — you may voluntarily share information about your health (for example, asking whether a particular condition is addressed by a program). We refer to information of this type as Incidental Health Information.
Although Journey Health is generally not subject to HIPAA, we have chosen to treat Incidental Health Information with HIPAA-aligned safeguards where it makes sense, including:
Where Journey Health actually does act as a HIPAA Business Associate — for example, under a written Business Associate Agreement with a DPC practice or other covered entity — we comply with the HIPAA Privacy, Security, and Breach Notification Rules with respect to protected health information we handle under that agreement.
Depending on how you interact with us, we may collect the following categories of information across all of our collection channels — including the Site, web forms, phone calls, voicemail, SMS/text, email, live chat, our AI-powered onboarding assistant, paper forms, in-person conversations, events, webinars, and referral or affiliate programs.
We use your information to:
We use Incidental Health Information only to help you understand whether a Journey Health program is appropriate for your situation and to route you to the right partner or resource. We do not use Incidental Health Information for marketing purposes, for targeted advertising, or for building member profiles for sale or sharing, at any time or under any circumstance, unless you provide explicit, written, program-specific consent.
We do not sell your personal information. We share information only as described below.
As described in Section 2, when you engage with a program we market, we share the information reasonably necessary to enroll you and deliver the program with Sedera, Health Access Solutions, and/or the DPC practice you select.
We use trusted third-party service providers who need access to information to perform services on our behalf, including:
These service providers are contractually obligated to protect your information and to use it only for the purposes we authorize. Where they may access Incidental Health Information on our behalf, we seek Business Associate Agreements or equivalent confidentiality commitments.
If you were referred by a creator affiliate or an existing member, we share limited information (such as the fact of enrollment — not health information) with the referring party as needed to administer our referral and affiliate programs.
If Journey Health is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction. We will require the receiving party to honor the commitments in this Policy or provide notice and choice where required by law.
Journey Health uses artificial intelligence to support activities such as:
We do not permit our AI service providers to use your information to train their underlying models. We do not use Incidental Health Information for AI model training. Human oversight is maintained for any material decision affecting your enrollment, partner referral, or service experience. You can always request to speak with a human representative instead of interacting with our AI assistant.
We maintain administrative, technical, and physical safeguards designed to protect your information against unauthorized access, alteration, disclosure, or destruction, including:
No method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.
Journey Health commits to notify affected individuals and, where required, regulators in the event of a data breach affecting personal information we hold about you. We will provide such notification in accordance with HIPAA (where applicable), the North Carolina Identity Theft Protection Act, and the breach-notification laws of your state of residence. Our notification will include, to the extent known: the nature of the incident, the categories of information affected, the steps we are taking in response, and the steps you can take to protect yourself. Where required by law, notification will be made without unreasonable delay and within statutorily mandated timeframes.
We and our service providers use cookies, pixels, SDKs, and similar technologies to:
You can control cookies through your browser settings and through any cookie-consent banner we display. Disabling certain cookies may affect Site functionality. Where required by applicable state law, we honor browser-based opt-out signals such as the Global Privacy Control (GPC).
“Do Not Track” (DNT) is a browser setting that signals to websites that a user does not wish to be tracked. There is no industry or legal standard for how to interpret DNT signals, and Journey Health’s Site does not currently respond to DNT signals. However, you can exercise choices about analytics and advertising through the cookie-consent controls on our Site and through the opt-out mechanisms described in Section 10.
Depending on where you live, you may have rights under state law — including under the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), the Virginia Consumer Data Protection Act (VCDPA), the Colorado Privacy Act (CPA), the Connecticut Data Privacy Act (CTDPA), the Utah Consumer Privacy Act (UCPA), the Texas Data Privacy and Security Act (TDPSA), the Oregon Consumer Privacy Act, and similar laws. These rights may include:
We do not sell personal information for money. Some uses of advertising cookies and pixels may be considered “sharing” or “targeted advertising” under certain state laws. You can opt out of such activity as described in Section 9.
If Journey Health is acting as a HIPAA Business Associate with respect to specific information we handle on behalf of a covered entity (such as a DPC practice), you have the HIPAA rights applicable to that information, including rights of access, amendment, restriction, accounting of disclosures, and revocation of prior authorization. Those rights are generally exercised through the covered entity; we will cooperate with the covered entity as required by HIPAA and our Business Associate Agreement.
To exercise any of these rights, contact our Privacy Officer using the information in Section 14. We will respond within the time frames required by applicable law (typically 30–45 days). We may need to verify your identity before fulfilling certain requests, and an authorized agent may submit a request on your behalf with proper authorization. We will not retaliate against you for exercising any privacy right.
If you receive marketing email from us, you can unsubscribe at any time using the link in any marketing message or by contacting us. Transactional messages about your account or services will continue as needed.
Journey Health’s SMS program is provided in compliance with the Telephone Consumer Protection Act (TCPA), Federal Communications Commission rules, and CTIA messaging guidelines.
Calls between you and Journey Health personnel may be recorded and transcribed for quality, training, and compliance purposes, in accordance with applicable state law. You are informed at the beginning of a recorded call. If you prefer not to be recorded, please tell the representative and we will accommodate your request to the extent possible.
We retain your information only as long as reasonably necessary to provide our services, meet legal obligations, resolve disputes, and enforce our agreements. The table below reflects our standard retention periods. Where law, a partner agreement, or an open legal matter requires a longer period, we follow that longer period. Where you exercise a valid deletion right under applicable law, we delete information as required by that law.
When information is no longer needed, we securely delete or de-identify it. De-identified and aggregated information may be retained indefinitely.
Our Site and services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. We comply with the Children’s Online Privacy Protection Act (COPPA). If you believe we have collected information from a child under 13, please contact our Privacy Officer (Section 14) and we will promptly delete it.
When a parent or legal guardian enrolls a family in one of our programs, information about minor family members is provided by the parent or guardian and is handled consistent with this Policy and applicable law. Parents and guardians may review, update, or delete their child’s information by contacting us.
If you have questions, concerns, complaints, or requests regarding this Privacy Policy or our privacy practices, please contact:
Privacy Officer
Journey Health Advisors
8810 Blakeney Professional Drive, Suite 100
Charlotte, NC 28277
Email: info@JourneyHealthAdvisors.com
Phone: 704-412-1916
You may also file a complaint with the attorney general or privacy regulator of your state of residence, or — where HIPAA applies — with the U.S. Department of Health and Human Services Office for Civil Rights at hhs.gov/ocr/privacy/hipaa/complaints/. We will not retaliate against you for filing a complaint.
Journey Health’s services are offered in the United States. Our cost-sharing programs are not available in all states. If you access the Site from outside the United States, you acknowledge that your information will be processed in the United States, which may have privacy protections that differ from those in your country. By using our services, you consent to this transfer.
We may update this Privacy Policy from time to time. When we do, we will revise the “Last Updated” date at the top of this Policy and, where required by law or where changes are material, provide additional notice (such as a banner on the Site or an email to registered members). Your continued use of the Site or our services after the effective date of an updated Policy indicates your acceptance of the updated terms.
By checking the acknowledgment box on any Journey Health web form or intake flow, typing or stating your agreement in our AI onboarding assistant, clicking “I agree,” or otherwise enrolling in a Journey Health program, you affirm that:
If you do not agree with any part of this Policy, do not provide your information, check the acknowledgment box, or proceed with enrollment.
Journey Health Advisors — Whole Care, not just Health Care.
8810 Blakeney Professional Drive, Suite 100 • Charlotte, NC 28277 • journeyhealthadvisors.com
