Last Updated: October 7, 2026
PLEASE READ THIS NOTICE CAREFULLY BEFORE USING OUR SERVICES. BY USING THE ICARIO PROGRAMS AND SERVICES YOU ARE AGREEING TO THE TERMS OF THIS PRIVACY NOTICE AND THE ASSOCIATED TERMS AND CONDITIONS. ICARIO MAY UPDATE THE TERMS OF THIS NOTICE FROM TIME TO TIME. WE WILL NOTIFY YOU IF WE MAKE MATERIAL CHANGES TO THIS NOTICE. IF YOU DO NOT ACCEPT THIS NOTICE THEN YOU MAY NOT PARTICIPATE IN ICARIO PROGRAMS.
Icario provides health engagement programs to members enrolled in client health plans (the “Program”). If you are enrolled in the Program, your health plan (the “Program Sponsor”) will pay for the Program and Icario, Inc. (“Icario”, “us”, “we” or “our”) will operate the Program. Because we work with your Program Sponsor, we are their Business Associate under the Health Information Portability and Accountability Act (“HIPAA”), a law that protects certain health information.
We are committed to protecting your rights and your privacy. This Privacy Notice (the “Notice”) explains what data we collect about you and how we store, analyze and share the data we collect about you through the platform (“Personal Data”). This Notice applies to all Personal Data whether collected online through this website or offline through call centers, phone calls, or mail. The Notice also explains your rights with regards to your data, and how to contact us to request access, corrections, transfer, restriction, or deletion of the data we have collected about you.
Information We Collect
Any information that identifies you and relates back to your health or your insurance coverage will be Protected Health Information (PHI) protected by HIPAA. Because we are a Business Associate, virtually all of the Personal Data we collect is PHI. To the extent that any Personal Data does not relate to health or insurance information, it may be subject to state laws such as the California Consumer Privacy Act/California Privacy Rights Act and the Minnesota Consumer Data Privacy Act.
The Personal Data we collect includes, but is not limited to:
- Contact Information, including your first name and last name, home address, personal email addresses and your phone number;
- Demographic Information, such as your gender, date of birth and age;
- Health and Insurance Information, such as enrollment status, whether you are enrolled in Medicare/Medicaid, your responses to health surveys. ;
- Program Information, Information about your participation and performance in the Program and related incentive activities;
- Internet or Network Activity, including any username you may create for our site, IP address, device information, cookies and analytics; and
- Additional Information, anything you may provide as you submit queries and requests to us.
We also collect anonymous information and Personal Data about you to provide you with the Program and our services. Anonymous information includes information about how you use the Program without capturing any identifiable information about you personally. Anonymous information includes things like how frequently web pages are loaded, dates and times that someone loaded a web page, what browser versions people are using to access the website, etc.
How We Use Personal Data
We will use the Personal Data collected to provide you with access to our services, including:
- To administer and manage the Program;
- To communicate with you via text, live calls, recorded calls, or paper mail to provide updates on health engagement activities and potential health incentives;
- To identify you when you enroll or sign-in;
- To track and issue your Program incentives and rewards;
- To provide you with information about the Program and Program features;
- To respond to your questions and requests; and
- To provide appropriate security and confidentiality controls to protect your Personal Data.
Our platform includes propensity modeling, which is a type or profiling that is addressed under some state data protection laws. This propensity modeling evaluates demographic information we have about you to determine the best way to contact you, for example, are you more likely to respond via email, text, or a recorded call? This profiling does not have any legal effects or similarly significant effects.
Additionally, we may create “De-Identified Data” records by removing any Personal Data that would allow the record to be linked back to you. We may use the De-Identified Data for internal purposes, such as analyzing patterns and Program usage to improve our services. We may use De-Identified Data to analyze and understand demographic trends, behavior patterns and preferences, and information that can help us improve the quality of the Program.
Sensitive Information and Consent
Various state and federal laws require us to collect consent for certain activities:
- Sending text messages
- Making recorded voice calls
- Processing sensitive information, such as information about children or health related information
Because we process your Personal Data on behalf of your Program Sponsor, we rely on the consent you provided when you enrolled in your health insurance plan. If you revoke your consent for any of these activities, we will pass that revocation back to the Program Sponsor, which may restrict your ability to participate in the Program.
How We Communicate with You
Sometimes, we may send you e-mails or text messages, or we may call you using recorded messages containing healthcare-related messages subject to HIPAA. You may opt-out of our communications, free of charge, at any time, by following the directions in the communication, such as by responding STOP to a text message, using the Opt-Out features in an email message, by telling the live agent on a phone call, or selecting the opt out option through our interactive voice response (IVR) system.
How We Collect Personal Data From You
We collect Personal Data you voluntarily provide as you submit it through the web-based platform, returning paper-based surveys, responding to our Integrated Voice Response system, or by interacting with one of our live agents.
We also collect additional information when you visit our web-based platform or mobile application, including the type of browser used, date and time stamps of activity on the platform, the accessing IP address (the unique address that identifies your device on the internet) and the operating system your device uses. We use this additional information to derive a broad, non-specific understanding of the locations from which users access our services, to enhance our security controls, and analyze trends.
Information Contained in Health Assessments
Depending on your Program design, you may have access to a health assessment questionnaire. Health assessments can be customized by Program Sponsors and may be used to assess your overall health or identify specific risk areas. Your Program Sponsor may use this information to develop an individual care plan custom-designed for you. You do not have to complete the health assessment if you do not want to share this type of information, but you may miss out on benefits and incentives available to you based on the assessment.
Collecting Data on Children
We do not knowingly collect Personal Data directly from children under 13. Some Programs, however, are available for children under 13, and we may collect data about them from their parents or legal guardians. We use this information to determine if there are additional benefits available to children based on the Program design. If you have reason to believe that we have inappropriately collected Personal Data from anyone under the age of 13, you can contact us to remove the Personal Data.
Getting Data from Third Party Sources
We may receive information about you from various sources to support the Program and services included in it. The sources may include:
Your Program Sponsor
Your Program Sponsor will provide us with your Personal Data to identify that you may participate in the Program. Please contact your Program Sponsor directly if you want your Program Sponsor to stop sending us information about you. Keep in mind that if you do so, you will no longer have access to the Program and may not receive all your benefits.
Public Databases
We may receive information about you from other sources including publicly available databases or third parties from whom we have purchased data. We combine this data with information we already have about you. We may also combine publicly available aggregated census and demographic data with your Personal Data. This can help us analyze our records to better evaluate the effectiveness of our services.
Examples of the types of Personal Data that we may obtain from public databases include:
- Address information about you from third-party sources, such as the U.S. Postal Service, to verify your address before we send you mail;
- The U.S. Federal Do Not Call registry, to verify do not call preferences recorded there;
- Census and other aggregate data sources containing statistical information about people who share some of your traits and demographic markers.
- Data we have licensed from authorized data aggregators to improve the accuracy of our records and enhance our ability to deliver relevant information to you on our clients’ behalf.
Tools and Cookies to Collect Personal Data
Icario and its vendors use Cookies, tags, scripts and other similar technologies to enhance and support your experience on the platform. These technologies help us administer the web-based platform and mobile application, measure traffic patterns and to personalize and customize the platform’s content, so that your settings are “remembered” when you login.
“Cookies” are small pieces of text sent to your browser by a website you visit. Cookies help our web-based platform to remember information about your visit, like your preferred settings. Cookies play an important role, they can make your next visit easier and the web-based platform more useful to you.
You may disable or block Cookies but doing so may prevent you from using some of our website features.
Third Party Data Sharing
We share information about you with specific third parties for very specific purposes, generally for your benefit. This may include:
Your Program Sponsor
We regularly and consistently share any information we collect about you with your Program Sponsor. They use this information to provide you with benefits under the program, to track your participation in the Program, and to evaluate our performance in communicating with you.
Vendors
We may sometimes share your Personal Data with third-party service providers to allow us to provide you with our services. This includes call centers, rewards vendors, and print vendors. We will require those third parties to protect your information to the same degree that we protect it. If we need to share your Personal Data with third parties, we will limit the information disclosed to the minimum amount necessary to ensure the provision and quality of the services we offer you. We never use, disclose, or share your Personal Data collected through the Program for third-party marketing purposes, and we never sell, rent or lease your Personal Data to third parties for their own purposes.
Government Agencies and Law Enforcement
We may also need to share Personal Data with government agencies if:
- Legally required to do so by governments, tribunals, law enforcement and regulatory agencies (for example as part of an ongoing investigation, subpoena, similar legal process or proceeding);
- As otherwise required under any applicable law, regulation, or rule; and
- If we believe, in good faith, that such disclosure is necessary to protect or defend our rights or the rights of others, to assist in an investigation or to prevent illegal activity.
Mergers or Reorganizations
If we (a) undergo reorganization or liquidation under bankruptcy, (b) are sold to a third party, or merge with another entity, any Personal Data we hold may be transferred to the reorganized entity or third party, in accordance with applicable laws. In any such event, the new entity will continue to use your Personal Data in accordance with and within the limits of this Notice to continue to provide you with the services you are due.
Data Storage
We store and process Personal Data in data centers located in the United States of America (USA). We will not process your Personal Data outside of the United States.
Data Security
We are committed to protecting your data and your privacy. To ensure data security, we follow reasonable physical, electronic and managerial procedures designed to safeguard and secure your data and Personal Data. However, no company can fully eliminate security risks associated with the provision of online services.
We may require that you create and use a username and unique password to access the web-based platform and mobile application. You are responsible for maintaining the security and confidentiality of your access credentials. We use multiple layers of security to protect your Personal Data and data, including firewalls, intrusion detection tools and antivirus software. We also follow role-based security model to restrict access to our own staff, so they only have access to data that they need to do their jobs.
Data Rights
Because Icario works with health insurance plans, we are a Business Associate and any data classified as PHI is subject to HIPAA. HIPAA guarantees you certain rights with respect to your data. Those rights are summarized below, but for more detailed HIPAA privacy rights, you should review your Program Sponsor’s Notice of Privacy Practices. If you are not satisfied with how we respond to any of your HIPAA data privacy requests, you may contact your Program Sponsor or the Department of Health and Human Services’ (HHS) Office of Civil Rights (OCR).
Depending on what state you live in, state law may give you additional data privacy rights. For example, the California Consumer Privacy Act/California Privacy Rights Act, the Minnesota Consumer Data Privacy Act, and other applicable state privacy or data protection laws give you certain rights described below to control how your data is collected. It is Icario’s intention to comply with all applicable state data protection laws to allow you to control your personal data. If you are not satisfied with how Icario responds to a data protection right request you submit under applicable state law, you may appeal that decision to that state’s Attorney General or their state agency for consumer data protection.
In addition to the basic rights of confidentiality, your rights include:
- Access Records. You have the right to access information that we have about you.
- Delete Records. You have the right to request that we delete your data. But we have the right to keep some data for reporting purposes. We also may not be able to delete your data without cooperation from your Program Sponsor.
- Object to Data Use. You have the right to object to how we are using your data. We will tell you if we can change how we use your data to address your objection. In some cases, we will be limited in what we can change based on applicable laws.
- Opt-Out of Certain Profiling Activities. You have the right to request that we do not profile you in ways that may have an adverse effect on services or rights.
- Opt-Out of Communications. You have the right to ask us to stop calling you, texting you, or emailing you.
- Opt-Out of Selling Data. You have the right to request we do not sell your data, but Icario does not sell your data. If you ask, we will confirm that we will not do this.
- Opt-Out of Target Marketing. We do not conduct targeted marketing.
- Portability. You have the right to ask us to share your Personal Data under certain circumstances.
- Question Profiling. You have the right to question results you believe are related to profiling.
- Right to Accounting. You have the right to request a list of third parties with whom we have shared your Personal Data.
- Submit Complaints. You have the right to complain to us, and to relevant government agencies, about our data practices. If possible, we will address the complaint.
- Update Records. You have the right to amend or change your data if what we have is wrong. But note, in some cases we may not be able to update information unless you change this information with your Program Sponsor.
Exercising Your Rights
- You may exercise your rights by submitting a request to Privacy@IcarioHealth.com, or by contacting your Program Sponsor directly Privacy@IcarioHealth.com.
- Your rights are subject to certain limitations based on whether we can fill the request within legal rights.
- Before we fulfill any of your requests, we may need to contact you for additional identifying information that will confirm your identity and allow us to confirm the nature of your request.
- In some cases, Icario will need to coordinate your request with your Program Sponsor.
- We may respond to your request to (a) confirm that we have honored your request or (b) explain why we were unable to complete your request.
- You may appeal any decision regarding your rights requests by sending an email to Privacy@IcarioHealth.com with the word APPEAL in the subject line, or by contacting your Program Sponsor directly.
Privacy Notice Updates
We may update this Notice occasionally to reflect changes in our information practice and services offered. The date indicating the last update can be found at the top of the Notice.
Record Retention
Icario keeps Personal Data for 10 years for audit purposes. We retain Personal Data not subject to the CMS audit requirement for as long as we need to provide you services or as long as required by applicable laws.
Official Version
Please note that any translation of this Notice is intended solely to facilitate your access to this information. The English version is the only official version of this Notice, and any translation inaccuracies or discrepancies are not binding and have no legal effect.
Contact Information
If you have any questions, comments or concerns about this Notice, you may contact us via email at Privacy@IcarioHealth.com.
Or you can write to us at:
Icario, Inc
Attn: Privacy Officer
120 S Riverside Plaza, Suite 400
Chicago, IL 60606