Privacy Policy.

Olive Branch Administration Inc. ("Olive Branch," "we," "us," or "our") values your privacy and is committed to protecting your personal information. This Privacy Policy explains what personal information we collect, how we use and disclose it, how long we keep it, and the choices and rights you have. It is intended to meet the requirements of the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") and its regulations, the California Online Privacy Protection Act ("CalOPPA"), Nevada Revised Statutes Chapter 603A, other applicable U.S. state privacy laws, the Children's Online Privacy Protection Act ("COPPA"), and the CAN-SPAM Act.

This Privacy Policy applies to information we collect through our website at www.obatpa.com and any related web pages, online forms, and portals that link to this policy (together, the "Website"), and through our other interactions with you, such as by email, phone, or at events (together, our "Services").

1. Health and Plan Information (HIPAA Notice)

Olive Branch provides third-party administration services to employer-sponsored and other benefit plans. When we receive protected health information ("PHI") on behalf of a health plan, we act as a "business associate" under the Health Insurance Portability and Accountability Act of 1996 and its regulations ("HIPAA"). PHI is used and disclosed only as permitted by HIPAA, our business associate agreements, and the applicable plan's Notice of Privacy Practices, and is not governed by this Privacy Policy. For questions about how your health plan uses your PHI, or to exercise your HIPAA rights, please refer to your plan's Notice of Privacy Practices or contact your plan administrator. Similarly, information we process solely on behalf of a client employer or plan sponsor is handled according to our contract with that client, and requests about it may be referred to the client.

Many state privacy laws, including the CCPA, exempt PHI and certain other regulated information. Where an exemption applies, the rights described in Sections 10 through 12 may not apply to that information.

2. Information We Collect

In the preceding 12 months, we have collected the following categories of personal information. The categories below use the terms defined in the CCPA.

We do not collect inferences about you to create a profile reflecting your preferences, characteristics, or behavior. Please do not submit health information, Social Security numbers, or other sensitive information through general Website contact forms or email; use the secure channels provided by your plan instead.

3. Sources of Information

• Directly from you, for example when you fill out a form, request information, contact us, or communicate with us.
• Automatically, when you use the Website, through cookies, server logs, and similar technologies (see Section 5).
• From our clients, such as employers and plan sponsors, in connection with the services we provide to them.
• From service providers that help us operate the Website and our business, such as hosting and communications providers.

4. How We Use Your Information

We use personal information for the following business and commercial purposes:

• To provide our Services, respond to your inquiries, and communicate with you.
• To operate, maintain, secure, and improve our Website, products, and Services, including debugging and fixing errors.
• To send you administrative messages and, with your consent where required, marketing communications.
• To detect, prevent, and respond to security incidents, fraud, unauthorized transactions, and other illegal activities.
• To comply with our legal, regulatory, and contractual obligations, and to establish, exercise, or defend legal claims.
• For other purposes we describe to you at the time of collection, or with your consent.

We will not use personal information for purposes that are materially different from, unrelated to, or incompatible with the purposes described above without notifying you and, where required by law, obtaining your consent.

5. Cookies, Analytics, and Do Not Track

Our Website uses cookies and similar technologies only where they are necessary for the Website to function, such as to keep you signed in to a portal; the public pages at www.obatpa.com do not set cookies. We do not use analytics, advertising, retargeting, or social media pixel tools on the Website. To deliver the Website, we use third-party services, such as Fly.io (website hosting) and Google Fonts (typefaces), which receive your IP address and basic browser information when your browser loads a page. You can control or delete cookies through your browser settings; disabling cookies may affect how the Website works.

Third-party tracking. We do not use third-party analytics services, and we do not allow third parties to collect information about your activities across different websites for advertising purposes through our Website.

Do Not Track. Some browsers offer a "Do Not Track" ("DNT") setting. Because there is no uniform standard for how websites should respond to DNT signals, our Website does not currently respond to DNT signals. See Section 10 for how we honor Global Privacy Control signals.

6. How We Disclose Your Information

We may disclose personal information to the following categories of recipients:

• Service providers and contractors that perform services for us, such as website hosting, IT and security, email and communications, and data storage. They are contractually required to use personal information only to provide services to us and to protect it.
• Clients (employers and plan sponsors) on whose behalf we provide administration services, as needed to perform those services.
• Affiliates under common ownership or control with Olive Branch, for the purposes described in this policy.
• Legal authorities and others when required by law, subpoena, or court order, or when we believe disclosure is necessary to protect the rights, property, or safety of Olive Branch, our clients, or others.
• Professional advisors, such as lawyers, auditors, and insurers, in the course of the professional services they provide to us.
• Successors in a business transfer, in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our assets, subject to this Privacy Policy.
• Others with your consent or at your direction.

No sale or sharing. We do not sell your personal information and do not "share" it for cross-context behavioral advertising, as those terms are defined under the CCPA, and we have not done so in the preceding 12 months. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.

7. Sensitive Personal Information

We use and disclose sensitive personal information only for purposes permitted by Cal. Code Regs. tit. 11, § 7027(m), such as providing the Services you request, ensuring security and integrity, and preventing fraud. We do not use or disclose sensitive personal information to infer characteristics about you. Because of this, we do not offer a right to limit the use of sensitive personal information.

8. Data Retention

We keep personal information only as long as reasonably necessary for the purposes for which it was collected, including to meet legal, accounting, contractual, and reporting requirements. We use the following criteria to set retention periods:

When personal information is no longer needed, we delete or de-identify it. Where we keep information in de-identified form, we will not attempt to re-identify it, except as permitted by law.

9. How We Protect Your Information

We maintain reasonable technical, administrative, and physical safeguards designed to protect personal information against unauthorized access, destruction, use, modification, disclosure, or loss, as required by NRS 603A.210 and other applicable laws. These include access controls, encryption where appropriate, and training for our personnel. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we discover a security breach affecting your personal information, we will notify you as required by applicable law.

10. Your California Privacy Rights

If you are a California resident, you have the following rights under the CCPA, subject to certain exceptions:

• Right to Know and Access. You may request that we disclose the categories of personal information we have collected about you, the categories of sources, the business or commercial purposes for collecting it, the categories of third parties to whom we disclose it, and the specific pieces of personal information we have collected about you, including information collected on or after January 1, 2022 that we still retain.
• Right to Delete. You may request that we delete personal information we collected from you, subject to legal exceptions.
• Right to Correct. You may request that we correct inaccurate personal information we maintain about you.
• Right to Opt Out of Sale or Sharing. We do not sell or share personal information. If this changes, we will update this policy and provide a "Do Not Sell or Share My Personal Information" link.
• Right to Limit Use of Sensitive Personal Information. As explained in Section 7, we use sensitive personal information only for permitted purposes.
• Right to Non-Discrimination. We will not discriminate or retaliate against you for exercising any of your privacy rights, including by denying you services, charging different prices, or providing a different level of quality.

How to Submit a Request

You may submit a request by any of the following methods:

• Email: Admin@obatpa.com (subject line: "Privacy Request")
• Toll-free phone: 1-888-320-5111
• Mail: Olive Branch Administration Inc., c/o Compliance Officer, 1368 Paseo Verde Pkwy, Ste 200, Henderson, NV 89012

Verification and Authorized Agents

To protect your information, we will verify your identity before responding to a request to know, delete, or correct. We will ask you to provide information that matches what we already have, such as your name, email address, and phone number. We will use the information you provide in a request only to verify your identity and respond.

You may use an authorized agent to submit a request on your behalf. We may require the agent to provide your signed written permission and may ask you to verify your identity directly with us, unless the agent holds a valid power of attorney under California Probate Code §§ 4121 to 4130.

Response Timing

We will confirm receipt of a request to know, delete, or correct within 10 business days and respond within 45 calendar days. If we need more time (up to an additional 45 days), we will tell you why in writing. If we cannot fully comply with your request, we will explain why. We do not charge a fee for responding unless a request is manifestly unfounded or excessive.

Global Privacy Control

Our Website recognizes the Global Privacy Control ("GPC") browser signal as a valid request to opt out of the sale or sharing of personal information for that browser and any profile we associate with it. Because we do not sell or share personal information, no further action is needed, and we will display whether we have processed your opt-out preference signal.

Automated Decision-Making

We do not use automated decision-making technology to make significant decisions about consumers, as defined in the CCPA regulations.

Other California Rights

Shine the Light. Under California Civil Code § 1798.83, California residents may request information about disclosures of their personal information to third parties for their own direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes.

Minors. If you are a California resident under 18 and have posted content on our Website, you may request removal of that content by contacting us. Removal may not ensure complete removal of all traces of the content.

Employees and job applicants. If you are a California job applicant, employee, or contractor of Olive Branch, we provide a separate notice describing how we handle your personal information. Please contact us for a copy.

11. Your Nevada Privacy Rights

Olive Branch is headquartered in Nevada. Under NRS 603A.300 to 603A.360, Nevada consumers have the right to direct us not to sell their "covered information." We do not sell covered information as defined under Nevada law. You may still submit a verified request to opt out of any future sale by emailing Admin@obatpa.com with the subject line "Nevada Opt-Out Request." We will respond within 60 days of receiving a verified request, which we may extend by up to 30 days with notice to you.

Reviewing and correcting your information. You may review and request changes to the covered information we collect through the Website by contacting us using the details in Section 19.

Consumer health data. Our Website does not collect "consumer health data" as defined in NRS 603A.400 to 603A.550 (or similar laws in other states). Health information we process for benefit plans is PHI governed by HIPAA, as described in Section 1.

12. Privacy Rights for Residents of Other States

Depending on where you live, state privacy laws (including those of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia) may give you rights to: confirm whether we process your personal data and access it; correct inaccuracies; delete it; obtain a portable copy; and opt out of targeted advertising, sale of personal data, or profiling in furtherance of decisions with legal or similarly significant effects. These laws contain exemptions, including for HIPAA-regulated entities and data, and may not apply to all of our activities. We will honor requests where required by law.

To submit a request, use the methods in Section 10. We will respond within 45 days, which may be extended by an additional 45 days where reasonably necessary.

Right to appeal. If we decline to take action on your request, you may appeal our decision by emailing Admin@obatpa.com with the subject line "Privacy Request Appeal" within a reasonable time after receiving our decision. We will respond to your appeal in writing within the period required by your state's law (generally 45 or 60 days). If we deny your appeal, you may contact your state Attorney General.

13. Marketing Communications

Email. You can opt out of marketing emails at any time by clicking the "unsubscribe" link in any marketing email or by contacting us. We will process your request within 10 business days. Even if you opt out, we may still send you transactional or administrative messages.

Text messages. We use text messages only for account security, such as one-time codes for two-factor sign-in. We do not send marketing text messages. If you agree to receive text messages from us, message frequency varies and message and data rates may apply. Reply STOP to opt out or HELP for help. Consent to receive texts is not a condition of any purchase or service. We do not sell or share mobile phone numbers or text messaging opt-in data with third parties or affiliates for their marketing purposes.

14. Children's Privacy

Our Website is not directed to children under 13, and we do not knowingly collect personal information online from children under 13. If we learn that we have collected personal information from a child under 13 without verified parental consent, we will delete it promptly. If you believe a child has provided us with personal information, please contact us.

15. Third-Party Websites

Our Website may contain links to third-party websites, including client, insurer, or plan portals. We are not responsible for the privacy practices of those websites. We encourage you to review the privacy policies of any website you visit.

16. Where Your Information Is Processed

Olive Branch is located in the United States, and the Website is intended for users in the United States. Information we collect is stored and processed in the United States.

17. Accessibility

We are committed to making this Privacy Policy accessible to individuals with disabilities. If you need this policy in an alternative format, please contact us at Admin@obatpa.com or 1-888-320-5111.

18. Changes to This Privacy Policy

We review this Privacy Policy at least once every 12 months and may update it from time to time. When we make changes, we will post the updated policy on this page and revise the "Last Updated" date above. If we make material changes, we will notify you by a prominent notice on the Website or by email before the change takes effect, where required by law. We encourage you to review this policy periodically.

19. Contact Us

If you have any questions or concerns about this Privacy Policy or our privacy practices, please contact us:

Email: Admin@obatpa.com

Toll-free phone: 1-888-320-5111

Mail: Olive Branch Administration Inc.
c/o Compliance Officer
1368 Paseo Verde Pkwy, Ste 200
Henderson, NV 89012