Privacy Policy & Data Architecture
Effective Date: September 15, 2026
Last Updated: September 15, 2026
Claridad Platforms, Inc. (“Claridad,” “we,” “us,” or “our”) provides enterprise software and artificial-intelligence technology designed to help organizations organize, retrieve, explain, and present employee-benefit information.
This Privacy Policy explains how Claridad collects, uses, discloses, retains, and protects personal information in connection with our websites, applications, portals, and related services (collectively, the “Services”).
Claridad is committed to protecting personal information and maintaining appropriate safeguards for information entrusted to us by our customers and users.
1. CLARIDAD'S ROLE
Claridad primarily provides its Services to businesses and organizations, including partner agencies, employers, benefits organizations, and other enterprise customers (“Customers”).
Depending on the circumstances, Claridad may process personal information in different capacities.
Customer-Directed Processing
When Claridad processes employee, benefits, census, enrollment, or other personal information on behalf of a Customer and according to that Customer's instructions, the Customer generally determines the purposes for which that information is processed.
In these circumstances, Claridad processes the information as a service provider, processor, or similar role as defined by applicable privacy law.
Individuals seeking to exercise privacy rights regarding information controlled by their employer, partner agency, plan administrator, or another Claridad Customer may need to direct their request to that organization.
Claridad's Own Processing
Claridad may separately determine the purposes and means of processing certain information relating to our own business operations, including account administration, website operations, security, fraud prevention, customer relationships, billing, support, and legal compliance.
The privacy obligations applicable to particular information may therefore depend on the context in which Claridad receives and processes it.
2. INFORMATION WE COLLECT
The information Claridad processes depends on how the Services are used.
A. Information Provided by Customers
Customers may provide information such as:
employee names;
business or corporate email addresses;
employee or internal identifiers;
employment or eligibility status;
organizational information;
employee census information;
benefits eligibility information;
benefit elections and enrollment information;
benefit-plan documentation;
insurance and coverage information;
HRIS-derived information;
employer contribution information; and
other information necessary to configure or operate the Services.
Depending on a Customer's configuration and applicable relationship with Claridad, Customer Data may contain sensitive personal information or information relating to healthcare or employee benefits.
Some information may constitute Protected Health Information (“PHI”) under the Health Insurance Portability and Accountability Act (“HIPAA”) where applicable.
B. Account Information
When an individual accesses the Services, Claridad may process information such as:
name;
email address;
organization;
role;
account identifiers;
authentication information;
permissions and authorization attributes; and
account activity.
C. Service Usage and Technical Information
When the Services are accessed, Claridad may automatically collect certain technical information, which may include:
IP address;
device and browser information;
authentication events;
timestamps;
application events;
system and security logs;
error information;
API activity;
feature usage;
session information; and
other diagnostic information.
We use this information to operate, secure, troubleshoot, monitor, and improve the Services.
D. Support Information
When Customers or users contact Claridad, we may process:
contact information;
correspondence;
support requests;
screenshots;
diagnostic information; and
other information voluntarily submitted in connection with the request.
Users should not provide passwords, authentication credentials, private encryption keys, or unnecessary sensitive personal information through support communications.
E. AI Interactions
When users interact with Claridad's AI functionality, we may process:
user prompts and questions;
relevant benefit information;
authorized employee-specific context;
applicable plan or policy information;
retrieved source material;
generated responses;
technical metadata associated with the interaction; and
diagnostic information necessary to operate and secure the Services.
The precise information processed depends on the Customer's configuration and the user's authorization.
3. HOW WE USE INFORMATION
Claridad may process personal information to:
provide and operate the Services;
authenticate users;
enforce user permissions and access controls;
retrieve information relevant to authorized user requests;
process benefit and plan documentation;
generate contextualized AI responses;
perform calculations and information retrieval;
maintain tenant separation and access restrictions;
detect and prevent unauthorized activity;
investigate security events;
troubleshoot technical problems;
provide customer support;
monitor Service reliability and performance;
administer subscriptions and customer relationships;
comply with legal obligations;
enforce applicable agreements; and
protect Claridad, our Customers, users, and the Services.
Where Claridad processes Customer Data on behalf of a Customer, Claridad processes that information subject to the applicable agreement with that Customer and its authorized instructions.
4. ARTIFICIAL INTELLIGENCE AND MODEL TRAINING
Claridad uses enterprise artificial-intelligence and cloud infrastructure to provide portions of the Services.
Claridad does not use Customer tenant data, personal information, or PHI processed on behalf of Customers to train public or generally available foundation AI models.
Claridad does not pool Customer tenant data for the purpose of training public AI models.
Customer Data submitted to Claridad's AI functionality is processed for purposes associated with providing and operating the Services, subject to applicable agreements and Claridad's technical configuration.
Claridad may process appropriately de-identified or aggregated operational information for security, reliability, analytics, and Service improvement where permitted by applicable law and contractual obligations, provided such information does not identify an individual or Customer where required by applicable commitments.
Specific contractual commitments concerning Customer Data and artificial-intelligence processing may also be contained in a Customer's Data Processing Addendum, Business Associate Agreement, Order Form, or other agreement with Claridad.
5. TENANT SEPARATION AND ACCESS CONTROL
Claridad operates a multi-tenant software environment designed to maintain logical separation between Customer environments.
Claridad employs access-control mechanisms designed to ensure that users may access only information authorized for their authenticated account, organization, role, and applicable permissions.
These safeguards may include:
role-based access controls;
authentication and authorization controls;
tenant-scoped data-access rules;
least-privilege principles;
encryption in transit and at rest;
logging and monitoring;
cloud infrastructure security controls; and
application-level authorization.
No Customer or user is authorized to access another Customer's information except where such access has been explicitly and lawfully authorized.
6. HOW WE DISCLOSE INFORMATION
Claridad does not sell Customer Data.
Claridad may disclose or make information available to third parties only as reasonably necessary for legitimate business and operational purposes, including:
Service Providers and Subprocessors
We may use cloud infrastructure providers, artificial-intelligence providers, document-processing services, authentication providers, monitoring providers, communications providers, and other vendors that assist us in operating the Services.
These providers may process information on Claridad's behalf subject to applicable contractual and security requirements.
Customers and Authorized Users
Information may be made available to the Customer responsible for the applicable account and to individuals authorized by that Customer in accordance with configured permissions.
Legal Requirements
Claridad may disclose information where reasonably necessary to comply with applicable law, regulation, subpoena, court order, legal process, or lawful governmental request.
Where legally permitted and appropriate, Claridad may notify the affected Customer before disclosing Customer Data in response to compulsory legal process.
Protection of Rights and Security
Claridad may disclose information where reasonably necessary to investigate fraud, security incidents, misuse, violations of our agreements, or threats to the rights or safety of Claridad, our Customers, users, or others.
Corporate Transactions
Information may be transferred in connection with an actual or proposed merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar corporate transaction, subject to applicable legal requirements.
7. WE DO NOT SELL CUSTOMER DATA
Claridad does not sell Customer Data for monetary consideration.
Claridad does not use Customer tenant data to create advertising profiles or serve behavioral advertising to employees through the Claridad Service.
If Claridad's practices materially change in a manner requiring additional notice, consent, or opt-out rights under applicable privacy law, Claridad will provide such mechanisms as required.
8. DATA RETENTION
Claridad retains personal information for only as long as reasonably necessary for the purposes for which it was collected, to provide the Services, satisfy contractual requirements, maintain security and operational records, resolve disputes, enforce agreements, and comply with applicable law.
Different categories of information may be subject to different retention periods.
Claridad may apply automated Time-to-Live (“TTL”) or similar lifecycle controls to certain categories of conversational, temporary, or operational data.
Deletion from active systems may not result in immediate deletion from encrypted backups, security records, or disaster-recovery systems. Information maintained in such systems may remain until overwritten or deleted through applicable retention cycles, subject to legal and contractual requirements.
Specific enterprise retention commitments may be established in an applicable Order Form, Data Processing Addendum, Business Associate Agreement, or other written agreement.
9. SECURITY
Claridad maintains administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, acquisition, alteration, destruction, use, or disclosure.
Depending on the applicable system and information, safeguards may include:
encryption in transit and at rest;
identity and access management;
role-based access controls;
tenant-scoped authorization;
least-privilege access;
authentication controls;
security logging;
monitoring;
infrastructure security controls;
application security measures; and
incident-response procedures.
No method of electronic transmission, storage, or information-security control can guarantee absolute security.
Accordingly, Claridad cannot guarantee that unauthorized parties will never defeat security safeguards.
10. PROTECTED HEALTH INFORMATION AND HIPAA
Certain information processed through the Services may constitute PHI under HIPAA depending upon the parties, information, and circumstances involved.
Where Claridad acts as a business associate of a HIPAA covered entity or another business associate, Claridad will process applicable PHI in accordance with an effective Business Associate Agreement (“BAA”) and applicable legal requirements.
This Privacy Policy does not independently create a business-associate relationship or expand the scope of information considered PHI under applicable law.
Where a BAA applies and conflicts with this Privacy Policy concerning PHI, the BAA will control to the extent of the conflict.
11. PRIVACY RIGHTS
Depending on where an individual resides and the context in which Claridad processes personal information, applicable law may provide certain rights concerning personal information.
Such rights may include the right to:
request access to personal information;
request correction of inaccurate personal information;
request deletion of certain personal information;
obtain information regarding certain processing activities;
receive a portable copy of certain information;
opt out of certain processing where applicable; and
appeal certain decisions concerning privacy requests where required by law.
These rights are subject to exceptions and limitations under applicable law.
Customer-Controlled Information
Where Claridad processes personal information solely on behalf of a Customer, individuals should ordinarily direct requests concerning that information to the applicable employer, partner agency, plan administrator, or other Customer.
If Claridad receives a request relating to Customer-controlled information, Claridad may refer the individual to the applicable Customer or assist the Customer as required by applicable law and contract.
Claridad-Controlled Information
Requests concerning personal information for which Claridad determines the purposes and means of processing may be submitted using the contact information below.
Claridad may take reasonable steps to verify the identity and authority of an individual submitting a privacy request.
Claridad will not discriminate against an individual for exercising privacy rights provided by applicable law.
12. COOKIES AND ONLINE TECHNOLOGIES
Claridad's public websites and Services may use cookies, local storage, authentication technologies, and similar technologies necessary to:
maintain user sessions;
authenticate users;
remember preferences;
maintain security;
prevent fraud;
measure Service performance; and
understand operation of our websites and Services.
Where required by applicable law, Claridad will provide appropriate notice or choices concerning non-essential cookies or similar technologies.
13. CHILDREN
The Services are intended for enterprise and employment-related use and are not directed to children under thirteen (13).
Claridad does not knowingly collect personal information directly from children under thirteen through consumer-directed Services.
This provision does not prohibit Claridad from processing dependent or beneficiary information lawfully provided by enterprise Customers where necessary to provide the Services and permitted by applicable law and contract.
14. INTERNATIONAL DATA TRANSFERS
Claridad and its service providers may process information in the United States and other jurisdictions in which authorized service providers operate.
Where applicable law requires safeguards for international transfers of personal information, Claridad will implement appropriate transfer mechanisms as required.
Enterprise Customers should consult their applicable Data Processing Addendum for any specific international data-transfer commitments.
15. THIRD-PARTY SERVICES
The Services may integrate with or contain links to third-party services.
Claridad is not responsible for independent privacy practices of third parties where those third parties process information for their own purposes.
Third-party subprocessors processing information on Claridad's behalf are addressed through Claridad's applicable contractual and vendor-management arrangements.
16. CHANGES TO THIS PRIVACY POLICY
Claridad may update this Privacy Policy periodically to reflect changes to our Services, information practices, legal requirements, or operational procedures.
When we make material changes, we will update the “Last Updated” date above and provide additional notice where required by applicable law.
17. CONTACT US
Questions about this Privacy Policy or Claridad's privacy practices may be directed to:
Claridad Platforms, Inc.
Attn: Privacy
800 N. King St, Suite 304
Wilmington, DE 19801
Privacy and Compliance: support@claridadai.com
Technical Support: support@claridadai.com
Individuals submitting privacy requests should include sufficient information for Claridad to identify the request and determine whether Claridad or one of its Customers is responsible for responding.
© 2026 Claridad Platforms, Inc. All rights reserved.