Privacy Policy

In the course of its activity as a health insurer and as a health management services provider, Alan is required to process sensitive personal data. We attach the utmost importance to the security and confidentiality of the data of Alan's services’ users, whether on the alan.com website or on the mobile application made available to them.

The purpose of this privacy policy is to help you understand how we treat the personal data you provide us with, in accordance with the GDPR, the Personal Information Protection and Electronic Documents Act ("PIPEDA") and, when applicable, the Personal Health Information Protection Act of Ontario ("PHIPA").

This privacy policy may be updated regularly, to enrich it, according to Alan's needs, circumstances or if required by law. We therefore invite you to check for updates on a regular basis, although we will always notify you of any significant changes affecting the way your data is processed.

Version dated July 2024

Above all, we have set ourselves two key principles which are also included in our contracts:

• Alan will never sell the data collected about its members in connection with the services offered. We make our living by building and managing insurance products and services around health, not by reselling our users' data. Users remain in control of their data.

• As a health insurer, Alan will never use health data to apply differentiated rates based on a member's situation or history. We strongly believe in the strength of solidarity and risk sharing between insured members.

Furthermore, in accordance with the regulations and particularly the PIPEDA and GDPR, we undertake to collect and process only the data that is strictly necessary for their purpose. Similarly, we undertake to ensure that the data collected is kept in a form that allows your identification for a period that does not exceed the time required for the purposes for which the data is collected and processed.

Alan, including all of its affiliates (Alan Insurance, Alan Services, Alan Tech, Marmot Belgium, Marmot Iberia, and Alan CA) is responsible for collecting your personal data.

🇪🇺️  For EU residents:

Alan is a health insurer and does not mainly act as a data processor for our clients but as a data controller in the sense of article 4 of the GDPR on all operations relating to its insurance and health services described in this policy. 

Alan, including all of its affiliates (Alan Insurance, Alan Services, Alan Tech, Marmot Belgium and Marmot Iberia, Alan CA) is a health insurer and does not mainly act as a data processor for our clients but as a data controller in the sense of article 4 of the GDPR on all operations relating to its insurance and health services described in this policy :

• Alan determines the means and purposes of data processing necessary for the implementation of the complementary health protection of employees. In practice, only employees' professional email addresses are transmitted by the company to Alan. Other information is directly communicated by the employee or his beneficiary;

• The operations carried out on the data by Alan are necessary for its own activity as a health insurer and not for that of the companies that choose Alan as insurer for their employees. The criteria mentioned in the data processor’s guide issued in September 2017 by the CNIL exclude Alan's qualification as a subcontractor.

However, Alan can also process personal data on behalf of its client companies, within the scope of certain services provided on the Alan platform, in particular administrative management assistance services for human resources. Alan acts as a "data processor" of the company, and the processing of personal data is done under the responsibility of the company, which then acts as the data controller. The General Conditions governing the relationship between Alan and the client companies include a data processing agreement (DPA) reflecting this distribution. You can take a look at the privacy policies of the client companies directly for more details on how they process your personal data.

 Your consent

If you are a Canadian resident, Alan requires your consent to collect, use, or disclose your personal data, except under the exceptions permitted by law. Please note that your consent may be either expressed (verbal or written) or implied (inferred from your actions).

You have the right to withdraw your consent at any time, subject to our legal, regulatory, or contractual obligations. However, this may limit your access to some of our services and products. To withdraw your consent, please contact our Data Protection Officer (DPO), the contact details are in the section below.

If you have any questions regarding security and personal data, or to exercise your rights of access, correction, deletion, withdrawal of consent, limitation of processing, opposition to processing or portability, you may contact us and our Data Protection Officer (DPO) at [email protected]. Alan will ensure that you receive a response promptly.

For any complaint concerning your personal data, you can either contact our DPO or contact:

• 🇪🇺️ For EU residents: the Commission Nationale Informatique et Liberté (CNIL) directly at https://www.cnil.fr.

• 🇨🇦️ For Canadian residents: the Office of the Privacy Commissioner of Canada directly at:

  Office of the Privacy Commissioner of Canada

  30 Victoria Street

  Gatineau, Québec

  K1A 1H3

  Telephone: 1-819-994-5444

  Toll Free: 1-800-282-1376

  Website: www.priv.gc.ca

•  For Ontario residents, you can also contact the Information and Privacy Commissioner of Ontario at:

  ‍Information and Privacy Commissioner of Ontario

  2 Bloor Street East, Suite 1400

  Toronto, Ontario M4W 1A8

  Telephone: 1-416-326-3333

  Toll Free: 1-800-387-0073

  Website:www.ipc.on.ca

INSURANCE SERVICES

Management of company contracts

Administrators

When registering for a company contract, we collect the following personal data for each administrator:

• Name and surname

• Professional email address

• Messages to our customer service department

🇪🇺️ For EU residents - On what legal basis?

• Pre-contractual measures and performance of the insurance contract

What do you do with it?

This data is used for the electronic signature of the contract, any communication with the company's representatives, and for access to the account used to manage the contract. In the case of delegated contracts, this data is also received from the contract insurer.

How long do you keep this data?

• 5 years after the end of the contract for health insurance contracts

• 2 years after the last connection if the contract has not been signed

How can I consult or modify this data?

From the Alan dashboard.

Can I ask to have my data deleted?

Only if the contract has not been signed. Otherwise we are required to keep the data.

Employees

The company contract administrators are led to send us data concerning their employees, including those who have left the company for less than a year ( as part of the portability of health insurance rights):

• Name, surname and social security number

• Employees' professional email address

• Personal e-mail address of former employees

• Dates of arrival and departure from the company

• Birth date

• Gender

This is a legal obligation of the employer from which employees cannot escape, even when they do not wish to benefit from health coverage (exemption mechanism).

🇪🇺️ For EU residents - On what legal basis?

Alan processes this data on the basis of pre-contractual measures and the execution of the insurance contract between Alan and its members.

What do you do with it?

This data is used in order to invite (by email) employees to register on alan.com or on our mobile application and choose to be insured or exempted.

How long do you keep this data?

• 5 years after the end of the contract for health insurance contracts

• 2 years after the last connection if the contract has not been signed

How can I consult or modify this data?

Contract administrators can do this directly from their Alan dashboard. In some cases, an intervention of our customer service is necessary (for example for certain retroactive modifications).

Can I ask to have my data deleted?

No, Alan has to keep it for 5 years after the end of the cover.

Health insurance

Personal data is transmitted to us directly by or on behalf of the insured members with their explicit consent (e.g. to automate the retrieval of receipts from a third party site), in particular :

• Name and surname

• Personal email address

• Insurance policy number

• Birth date

• Postal address

• Name, surname, birth date and gender of the spouse and/or children where applicable

• Bank details (for payments and reimbursements including when available for direct billing by credit card for beneficiaries)

• Documents required for reimbursement of care acts

• Messages to our customer service department

• Data necessary for the reimbursement (date of treatment, act code, amount paid, recognized rights, prescription, Drug Identification Number, etc.)

• Other insurance plan information (if any, for coordination of benefits)

• Proof of good health, if applicable

• Proof of exemption where applicable

🇪🇺️ For EU residents - On what legal basis?

This data is required for the execution of the contract concluded with Alan (or with your insurer that delegates your contract to Alan), either by your employer or by you as an insured member. They are therefore not subject to prior consent. We also have a legal obligation to ask you for this information in order to comply with the regulations that apply to our insurance activities and to our health and management service providers activities.

In addition, we use it for some of the secondary purposes listed below on the basis of our legitimate interest in managing our insurance activities.

What do you do with it?

We use this data mainly to process requests for reimbursement of expenses according to the guarantees of the contract which covers the insured members and any declared beneficiaries. In particular, this involves receiving and processing the health documents and information provided to justify the care received, determine coverage, generate payments and manage the recovery of undue payments.

Your documents are analyzed within the European Union and, as part of a test, in Tunisia. These transfers are adequately covered by binding corporate rules (BCR) validated by the CNIL and its European counterparts. They are also used for :

• the execution of legal, regulatory and administrative provisions

• the prevention of fraud, in particular the analysis and detection of anomalous acts or the management of alerts and procedures following a case of fraud

• management of complaints and disputes

• the prevention of money laundering and the financing of terrorism

• the drawing of statistics and actuarial studies, the development and management of insurance products

• management of financial aspects, performance and risk

• management of Alan's websites and applications (including bug and error management)

• customer relationship management and service improvement

• user research and surveys

How long do you keep this data?

• 5 years after the end of the contract for health insurance contracts

Can I ask to have my data deleted?

No, because we are obliged to keep this data. However, you have the possibility to ask us not to use them for purposes based on our legitimate interest, by sending an email to [email protected].

Dependent data

I have been added as a dependent

When the possibility is offered to him/her and an insured member declares a dependent (spouse or child) to his/her contract, he/she vouches that the beneficiary agrees to become a party to its insurance contract (or gives consent as a parent of a minor). Alan treats the personal data of the dependent in the same way as those of any other user insured member in this capacity.

Account sharing

Our insured members and their dependents share a single Alan account. By default, both the insured members and the dependents (if they are of legal age and choose to access Alan's online insurance or management services themselves) will be able to view all account information related to the insurance services, without separation. Members with an Alan account can also choose to restrict visibility of their care acts to other members covered under the same policy.

How can I have access to this privacy setting?

Through the "Privacy and security" section on your member profile.

STATISTICS AND PERFORMANCE

Measuring our members’ satisfaction

Because it is important for us to build a tailored service for our members, we measure their satisfaction over time through a rating system that our members can choose to enter in the application. This is the "Net Promoter Score" or "NPS".

🇪🇺️ For EU residents - On what legal basis?

It is in Alan's legitimate interest to improve its services based on member satisfaction.

What do you do with it?

We use the NPS to monitor our performance with our members, through the Metabase tool. In concrete terms, this allows us to identify factors of dissatisfaction that may allow us to improve our services or, conversely, things that need to be reinforced because they are highly appreciated.

How long do you keep this data?

We keep them for the time needed to carry out analyses and measure their evolution over several development cycles. We then anonymise or delete them.

Can I ask to have my data deleted?

Yes, simply send a request to [email protected].

Audience measurement (analytics) and technical data

Certain data is collected automatically when you visit alan.com (including other websites published by Alan such as blog.alan.com and map.alan.com) and when you use our mobile app. The data collected includes :

• IP address and service provider;

• user ID;

• information about your equipment, for example: type of internet connection, type of device used, browser used and version, etc;

• time stamp information and length of visit;

• pages visited;

• clicks and other interactions on individual pages;

• possible errors (on the browser, the mobile application or our servers).

🇪🇺️ For EU residents - On what legal basis?

Where applicable, the collection is subject to the explicit consent of the user (cookie banner). This consent is valid for 13 months from the date of registration. Otherwise, it is in our legitimate interest to analyse the use of our site in order to improve it.

What do you do with it?

This data is used for the following purposes:

• to comply with legal, regulatory and administrative provisions (connection logs, etc.);

• customer knowledge and customer relationship management;

• operations relating to canvassing and the compilation of commercial statistics;

• identification of customers or prospects to improve service by offering products or services to reduce the number of claims, or to offer a complementary contract or a service;

• analysing the use made of the product and improving the product;

• management of people's opinions on products, services or content.

How long do you keep this data?

• 2 years

• 3 years for data relating to prospects

• 13 months for cookies

Can I ask to have my data deleted?

Absolutely (with the exception of data collected in the framework of a legal obligation), simply make a request to [email protected].

Marketing and Ad targeting

To build our audience and client basis, Alan may reach out to prospects by emails and organize online advertising campaigns before sending them mails or emails. In this context, Alan handles email addresses available online (such as on Linkedin) but also from providers already used by Alan (Societeinfo.com, Kaspr) for audience-building purposes on social networks.

🇪🇺️ For EU residents - On what legal basis?

On the basis of Alan legitimate interests to fulfill our marketing and growth needs, in compliance with direct marketing regulatory requirements.

What do you do with it?

We are reaching prospects via online ads before sending mails or emails. To do so, we import prospects database into the audience of different platforms. The email addresses is the only data import on the ads platform. We import only prospect data and we do not bring in any customer data or leads who have unsubscribed from any previous campagin. To do so, we ensure and remove our customers data in our ads audience before any data import. In addition, users can opt-out and unsubscride from seeing Alan’s ads directly on the ads platform.

When reaching out by email, Alan provides easy-way to opt-out notably through unsubscription links in each communication and honor prospects opt-out in the future.

How long do you keep this data?

We keep this data for 2 years, in line with CNIL’s recommendation.

A purge of the database to remove any inaccurate is carried out on a monthly basis.

Can I ask to have my data deleted?

Yes, you can opt-out from marketing communications at any time. You can exercise any of your rights simply in making a request to [email protected].

Statistics and scientific research

Data collected by Alan in the performance of our services, may be further used in a way compatible with the original purpose for which it was collected. Only aggregated and/or anonymized data may become subject to scientific research and/or for statistical studies, including for statistical learning. It could for instance be used in the selection and creation of relevant health stories to improve our services and Members' health, create aggregated usage reports or to streamline and improve the management of exchanges with Alan medical team.

Data security is an extremely important issue for Alan: we do our utmost to be worthy of the trust you place in us. Here are a few examples of the measures we have taken. If you have any questions on a specific point, we will be happy to answer them at [email protected].

Application security

We use Datadog App Security (previously Sqreen. com) to detect and block in real time attacks such as XSS, SQL injection, account theft, etc.

We also use Cloudflare.com to protect us from Distributed Denial of Service (DDoS) attacks.

Encryption of data in transit

All HTTP traffic to and from alan.com and api.alan.com is encrypted (HTTPS / TLS). You can evaluate our configuration here.

The first time a user logs on, we tell their browser (via the HSTS mechanism) that all subsequent connections must be encrypted (HTTPS), including when a link to alan.com starts with http:// instead of https://.

Hosting and database

For data hosting and processing, Alan uses AWS, which is HDS-certified. Our entire infrastructure is located in the Frankfurt region, in Germany. In order to fulfill all the purposes for which we collect your data, we may transfer some of your data to third parties, who host it in data centers located within and outside the European Union. When data is hosted outside the European Union, we make sure that hosting is subject to European data protection standards (for example, by including standard contractual clauses in our contracts with such third parties). You can find more information on data privacy with AWS security here, and our blog post on the subject here.

Encryption of data at rest

We use PostgreSQL databases. The data is encrypted using the AES-256 standard and the encryption keys are managed by AWS.

The backup archives are also encrypted.

Password policy and storage

We use the open-source zxcvbn library to let users know the strength of the password they choose. The minimum size is 9 characters, and the minimum score is 3.

We do not store these passwords: we only store a non-reversible hash calculated by the open-source bcrypt library, with the following parameters :

• a cost of 12 (i.e. 4096 iterations) to limit brute force type attacks

• one random salt per user to protect against rainbow tables

Organisational measures

All Alan employees receive mandatory training in security (including social engineering) and data privacy. They use complex and unique passwords and strong authentication (2FA) whenever possible. The use of a password manager such as 1Password is also mandatory.

Our computers are automatically updated and have their hard disk encrypted (in case of theft). Our screens lock automatically.

Access to our internal administration tools requires individual access from an authorised IP address and all data modifications (by an Alan employee or by a user himself) are audited.

We organise intrusion tests by independent companies.

All Alan services and applications are developed in-house. Our code is validated by automated tools (static analysis, security, etc.) and manually by a second pair of eyes.

👩‍💻️ What can I do on my side?

In order to protect your data on your computer or mobile phone, you can take a few simple measures:

• apply regular system updates to benefit from security patches;

• use antivirus software to detect the presence of malware or spyware, or to disable security features;

• protect your passwords well (your Alan account password, your mailbox password...);

• enable Privacy mode in the mobile application. You will then be prompted for biometric authentication (Face ID/TouchID) or a PIN every time you open the application.

You can also consult the official recommendations on good IT security practices.

 Who else besides Alan has access to my data?

The data collected may be communicated as required to Alan's partners, reinsurers, subcontractors, legal and financial advisors, and service providers. These data transfers are carried out solely within the framework of the operations mentioned above and to the extent necessary for the performance of the tasks we entrust to third parties. These third parties are fully informed by Alan of the confidentiality of the data communicated to them in this context, and these partners have an obligation to ensure the protection of this data. They are also bound by their own confidentiality and privacy policies, which can be consulted on their websites. When the nature of the operation carried out allows it, the data is subject to prior anonymisation before being communicated to third parties.

The main persons and tools that receive the data in the context of our processing operations include:

Insurance and prévoyance data

Amazon Web Services (hosting and storage) Stripe.com (payment) Revolut.com (refunds) Intercom.com (online chat and customer service) Google Vision (document recognition) Sendgrid.com (emails) Rollbar.com (monitoring) Linear (ticket management) Customer.Io (emails) Hubspot (CRM) Outreach (CRM) Salesforce (CRM) Snowflake Datadog Scale Studio (document annotation) Microsoft Azure (Azure OpenAI for document parsing) Xodus (travel insurance partner) OmbudService for Life & Health Insurance or the Financial Services Regulatory Authority of Ontario (external review of complaints)

Audience and usage measurement data

Segment.com (audience analysis) Amplitude.com (audience analysis) Google Ads (targeted advertising) Google Maps (Alan Map) Google Optimize Google Speech-To-Text Google Calendar Facebook Pixel (audience analysis and targeted advertising) Twitter Ads (targeted advertising) LinkedIn Insights (targeted advertising) Customer.io (e-mails) PixelMe.me (audience analysis) Bing (audience analysis and targeted advertising) Datadog App Security (security) Cloudflare.com (network, security and audience analysis) Hubspot Piwik Lifen

Furthermore, in order to meet legal and regulatory obligations, we may be required to communicate personal information to administrative or judicial authorities at their request. In this case, we ensure that only the data strictly required by the authorities is transmitted.

 What about cookies ?

What's a cookie?

In addition to being a delicious biscuit, a cookie is a file on your device that contains data. You can delete or limit the storage of these files at any time in the settings of your internet browser (see below).

What's it for?

• First of all to identify yourself once you are connected to the application.

• Some cookies also allow us to reply to you in the online chat, in the window that opens at the bottom of your screen when you visit our website.

• Audience measurement cookies enable us to know the use and performance of our website, to establish statistics, traffic volumes and use of the various elements of our website (content visited, paths) enabling us to improve the interest and ergonomics of our services. The data collected is analysed solely by Alan and its subcontractors, and used solely by Alan.

• Cookies linked to targeted advertising operations enable us to measure the effectiveness of our advertising campaigns and to limit the number of times an advertisement for Alan is offered to you. None of these advertising cookies are used by Alan when members are authenticated.

Can I refuse?

Of course you can! During your first visit (or if you use your browser's private or incognito browsing), a banner (called a cookie banner) will be displayed asking you for permission to use cookies. Simply refuse and no cookies (other than those we need to operate the site and allow you to use our online chat) will be set. If you accept, your consent will be valid for 13 months from the date of registration.

 Are you going to bother me with e-mails and other notifications?

Simply put, no.

You will receive emails from us, but in the vast majority of cases it will be in the context of the execution of our contract, for example to invite you to register, to ask you for additional information to enable a refund or to inform you of contractual modifications or changes related to your account. There is no escaping this, but it is for your own good.

A small minority of emails are not directly related to our contract with you or your employer, but are still for a legitimate interest (e.g. to offer to sponsor a relative with a financial reward, to send you a quote, or to announce new services similar to those you currently enjoy).

If you are an administrator, you may also receive commercial offers from us. In these cases, you always have the possibility of unsubscribing from this type of message by following the link in each of our emails (opt-out).

You can also choose to subscribe to our newsletter or to our waiting lists to be notified of the availability of our new services (opt-in).

As for push notifications, we will ask for your permission directly in the mobile application and you will be able to deactivate or reactivate them from your phone.

Travel Assistance (Xodus)

In order to provide travel assistance and allow you to be covered in case of problems while traveling abroad, we transmit the following information to our partner Xodus:

• First name, last name

• e-mail address, date of birth,

• Policy start date with Alan and membership card number

🇪🇺️ For EU residents - On what legal basis?

On the basis of the contract between us and the insured (you ask us to provide a service, which we pay for) as well as on the basis of our legitimate interest in measuring the use of this service

What do you do with this data?

This data is used to authenticate members in order to provide them with travel assistance abroad.

How long do you keep this data?

5 years after the end of the contract.

Can I ask to have my data deleted?

No, Alan must keep it for 5 years after the end of the coverage.