Pavella Privacy Policy

SMS Conversational AI Service for Employer-Sponsored Group Health Plans

Effective Date: May 14, 2026

1. Introduction

This Privacy Policy ("Policy") describes how Pavella, Inc., a Delaware corporation ("Pavella," "we," "us," or "our"), collects, uses, discloses, and safeguards personal information in connection with the SMS conversational artificial intelligence service and related email communications (collectively, the "Service") that we provide to Plan Participants of employer-sponsored group health plans. This Policy is designed to be read together with the Pavella Terms of Service for the SMS Conversational AI Service, available at www.pavella.io/terms, and the Business Associate Agreement between Pavella and each employer-sponsored group health plan that engages our Service.

2. Who We Are and Our Role

Pavella operates the Service as a HIPAA Business Associate of an employer-sponsored group health plan (the "Plan") and on behalf of your employer in its capacity as the Plan Sponsor. Together, the Plan and Plan Sponsor are the "Covered Entity." Pavella has entered into a written Business Associate Agreement with the Covered Entity that governs the handling of Protected Health Information ("PHI") in accordance with the Health Insurance Portability and Accountability Act ("HIPAA") and its implementing regulations. Because we act on behalf of the Covered Entity, the Covered Entity remains the primary steward of your health-related information, and certain rights described in Section 10 are exercised through the Covered Entity.

3. Scope of This Policy

This Policy applies to personal information we collect, use, and disclose through the Service, including: SMS text messages between you and the Service. Email communications between you and the Service. Information provided to Pavella by the Covered Entity in connection with your enrollment in the Plan. Information you submit through Pavella's web-based consent capture flow. Technical information necessary to operate and secure the Service. Where Pavella acts as a HIPAA Business Associate, our handling of PHI is also governed by the Business Associate Agreement between Pavella and the Covered Entity. In the event of any conflict between this Policy and the Business Associate Agreement with respect to PHI, the Business Associate Agreement controls.

4. Information We Collect

4.1 Information We Receive from Your Employer or the Plan

To operate the Service, we receive the following categories of information from your employer or the Plan through your benefits enrollment record: Identifiers such as your name, employee identifier, and demographic information necessary to support Plan communications. Contact information such as your mobile phone number and email address on file. SMS consent designation and email consent designation. Eligibility information relevant to Plan communications, such as effective dates, coverage tier, dependents, and enrollment status. Limited PHI necessary to answer benefits-related questions and deliver plan administration notices, handled subject to the Business Associate Agreement.

4.2 Information We Collect Directly from You Through the Service

When you interact with the Service by SMS, email, or through our web-based consent capture flow, we collect: The content of messages you send to the Service. The timestamps of your interactions and the timing of message delivery. Your responses to prompts, questions, and opt-out keywords (such as STOP or HELP for SMS, or unsubscribe requests for email). Your submissions and consent selections on Pavella's web-based consent capture page, if you use that flow to establish or confirm your SMS consent.

4.3 Technical and Operational Information

We collect limited technical information necessary to operate the Service securely and reliably: Message delivery status information from wireless carriers and email service providers. Carrier and network information associated with SMS delivery. Aggregate, de-identified performance metrics used to monitor service quality.

5. How We Use Your Information

Pavella uses your information only to operate the Service and to support the Covered Entity's plan administration obligations. Specifically, we use your information to: Deliver plan administration messages (Category 1), such as enrollment deadline alerts, coverage change notices, and required plan communications. Deliver messages about optional Plan-sponsored programs (Category 2) that may be available to you, based on your enrollment consent. Respond to your questions about your benefits, using an AI-assisted assistant. Establish and record your SMS consent when you provide it through Pavella's web-based consent capture flow. Process your opt-out requests and update your communication settings on the applicable channel. Monitor service performance, prevent abuse, and maintain the security and reliability of the Service. Comply with our legal, regulatory, and contractual obligations, including under HIPAA, the Business Associate Agreement, the Telephone Consumer Protection Act, the CTIA Short Code Monitoring Handbook, and applicable state privacy laws.

6. SMS Program Privacy Disclosures

The following disclosures apply specifically to SMS communications sent through the Service.

6.1 We Do Not Share Your Mobile Number for Marketing

‍ ‍Pavella will not sell, rent, share, or otherwise disclose your mobile phone number, your SMS opt-in status, or any information collected through the SMS Service to third parties, affiliates, or advertisers for their marketing, promotional, or advertising purposes. Mobile information is used solely to operate the Service.‍ ‍

6.2 Message Frequency

Message frequency varies based on your interaction with the Service, Plan administration events (such as open enrollment periods, deadline alerts, coverage changes, and required plan notices), and your participation in optional programs. You may receive multiple messages throughout the year as Plan administration events occur.

6.3 Message and Data Rates

Message and data rates may apply. Standard messaging rates from your wireless carrier will apply to messages sent to and received from the Service. Pavella does not charge a fee to use the Service. Please contact your wireless carrier for details about your messaging plan.

6.4 Opt-Out Handling for SMS

You may reply STOP to any SMS message at any time to opt out of all SMS communications from the Service, including both Category 1 and Category 2 messages. Once we receive your STOP request, we honor it immediately and it is also enforced at the wireless carrier level in accordance with CTIA and Twilio A2P 10DLC messaging requirements. Your SMS opt-out is recorded and, where applicable, communicated back to the Covered Entity so that your benefits enrollment record reflects your current preference.

6.5 Web-Based SMS Consent Capture

If you send an inbound SMS to Pavella without pre-existing SMS consent recorded on your benefits enrollment record, Pavella may respond with a courteous message containing a secure link to a Pavella-hosted consent capture page. On that page, you can review the required disclosures (program name, message types, message frequency, message and data rates, STOP and HELP instructions, and links to these Terms and this Privacy Policy) and affirmatively provide consent. Pavella records the disclosures shown to you, the time of your submission, and your consent selection. After you submit consent, Pavella sends a confirmation SMS to your mobile phone number to verify the number, place the required disclosures in your SMS thread with Pavella, and give you an immediate opportunity to reply STOP if the consent was submitted in error.

7. How We Share Your Information

Pavella shares your information only in limited circumstances and only as necessary to operate the Service, satisfy legal obligations, or fulfill our contractual duties to the Covered Entity.

7.1 With the Covered Entity

We share information with the Covered Entity (your employer-sponsored group health plan and Plan Sponsor) as necessary to support Plan administration, communication preference management, and other functions contemplated by the Business Associate Agreement.

7.2 With Service Providers and Subcontractors

We share limited information with service providers, subcontractors, and technology partners who help us operate the Service. These providers are contractually bound to protect the information they receive, to use it only for the purposes specified by Pavella, and to comply with applicable privacy and security requirements. Examples of the categories of service providers we use include: SMS delivery infrastructure providers (such as our A2P 10DLC messaging platform). Email delivery infrastructure providers. Cloud hosting and data storage providers. Analytics and monitoring providers used to measure service performance in aggregate or de-identified form.

7.3 As Required by Law or Legal Process

We may disclose information when we reasonably believe disclosure is required by applicable law, subpoena, court order, or other valid legal process, or to protect the rights, property, or safety of Pavella, the Covered Entity, or others.

7.4 What We Do Not Do

For clarity, Pavella does not engage in any of the following: We do not sell your personal information to any third party. We do not share your mobile phone number, email address, or personal information with third parties or affiliates for their marketing, promotional, or advertising purposes. We do not share your information with data brokers. We do not use your SMS or email content to train third-party artificial intelligence models outside of our approved service providers or without appropriate contractual and technical safeguards consistent with HIPAA and the Business Associate Agreement.

8. Data Security

Pavella maintains administrative, physical, and technical safeguards designed to protect the confidentiality, integrity, and availability of the information we handle. These safeguards are designed to satisfy the HIPAA Security Rule and industry-standard practices for information security, and include: Encryption of information in transit and at rest, where appropriate. Access controls and role-based permissions for personnel with access to personal information. Periodic security assessments, monitoring, and incident response procedures. Contractual and technical safeguards imposed on service providers and subcontractors. No system is entirely secure. If Pavella becomes aware of a security incident affecting your information, we will follow our incident response procedures and comply with applicable breach notification requirements under HIPAA and applicable state law.

9. Data Retention

Pavella retains personal information for as long as necessary to provide the Service and to comply with our legal, regulatory, and contractual obligations, including retention periods required or permitted under HIPAA, the Business Associate Agreement, and applicable state law. When information is no longer needed, we take reasonable steps to securely delete or de-identify it.

10. Your Rights and Choices

10.1 SMS Opt-Out

You may reply STOP to any SMS message at any time to opt out of all SMS communications from the Service. This is described in more detail in Section 6.4 and in the Terms of Service.

10.2 Email Opt-Out

You may click the unsubscribe link in any Category 2 (Optional Program) email to opt out of Category 2 emails. To opt out of all email communications from the Service, including Category 1 plan administration emails, contact your employer's Human Resources or Benefits representative and ask them to update your email consent on your benefits enrollment record.

10.3 HIPAA Rights Through the Covered Entity

Because Pavella acts as a Business Associate of the Covered Entity, certain rights you have with respect to PHI, including the right to access, amend, and receive an accounting of disclosures of your PHI, are exercised through the Covered Entity. Please contact your employer's Human Resources or Benefits representative or the Plan Administrator to exercise these rights.

10.4 State Privacy Rights

Depending on your state of residence, you may have additional privacy rights under applicable state law, including the California Consumer Privacy Act, the California Privacy Rights Act, and similar laws in other states. These rights may include the right to know what personal information we hold about you, to request deletion, to request correction, to opt out of certain uses and disclosures, and to be free from discrimination for exercising your rights. Please note that many of these rights operate through the Covered Entity where PHI is involved, and are subject to statutory exemptions applicable to HIPAA-regulated information. To exercise state privacy rights that apply to information Pavella holds, please contact us using the information in Section 14.

10.5 Updating Your Contact Information

If your mobile phone number or email address changes, please notify your employer's Human Resources or Benefits representative so that your benefits enrollment record can be updated. This helps ensure that Plan communications continue to reach you at the correct address.

11. Children's Privacy

The Service is intended for adult Plan Participants (or, where applicable, for use with the consent of a parent or legal guardian). Pavella does not knowingly collect personal information directly from children under the age of thirteen. If we become aware that we have collected information from a child under thirteen in a manner inconsistent with applicable law, we will take reasonable steps to delete that information.

12. Users Located in the United States

The Service is intended for use by residents of the United States. If you access the Service from outside the United States, please be aware that information we collect is processed in the United States and is subject to United States law.

13. Changes to This Policy

Pavella may update this Policy from time to time. When we make material changes, we will update the Effective Date at the top of this Policy and, where appropriate, notify enrolled Plan Participants through the Service or by other reasonable means. Continued use of the Service after the updated Effective Date constitutes acceptance of the revised Policy.

14. Contact Us

If you have questions about this Privacy Policy or about how Pavella handles your information, please contact us: Pavella, Inc.
Mailing Address: 10364 Highland Dr, Brecksville, OH 44141
Email: privacy@pavella.io
Website: https://www.pavella.io For Plan-specific questions, including questions about your coverage, eligibility, HIPAA rights with respect to your PHI, or to update your communication preferences on your benefits enrollment record, please contact your employer's Human Resources or Benefits representative.