Legal

Blosum Privacy Policy

Sovra Care, Inc.  ·  Effective September 18, 2026

This Privacy Policy explains how Sovra Care, Inc. (“Sovra Care,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you use Blosum, our websites, applications, software, AI-enabled features, and related services (collectively, the “Services”).

Blosum is a product operated by Sovra Care, Inc. This policy applies when you use Blosum directly.

Section 01

Information We Collect

Account and contact information

  • Full name, email address, phone number, ZIP code, authentication information, and account preferences
  • Customer-support, survey, feedback, and communication records

Health and provider information you choose to add

  • Medications and doctors or other healthcare providers you choose to add
  • Healthcare searches, upcoming care, and receipt images or other documents you choose to upload

Healthcare spending and planning information

  • Healthcare expenses, dates, categories, amounts, payment-method labels, planned care, estimates, and reserve goals or balances you choose to track

Content you provide

  • Questions, prompts, responses, feedback, and other content exchanged with Genie, Blosum's AI health-finance navigator
  • Messages and information you send to support or otherwise provide through the Services

Device, usage, and cookie information

  • IP address, browser and device type, operating system, identifiers, approximate location derived from IP address, log data, pages viewed, feature interactions, and diagnostic information
  • Cookie and similar technology data used for authentication, security, preferences, analytics, and service performance
Section 02

Where Information Comes From

We collect information:

  • Directly from you
  • Automatically from your device and use of the Services
  • From service providers that support pricing, provider search, analytics, authentication, AI processing, communications, and customer support
  • From public or licensed data sources used to provide healthcare pricing and provider information
Section 03

Consumer Health Data

Some information described above may be considered health information, sensitive personal information, or “consumer health data” under applicable law. Providing this information is generally optional, but certain features may not work without it.

We use consumer health data to provide the features you request, personalize cost and planning guidance, respond to questions, maintain and secure the Services, and comply with law. We do not sell consumer health data. We do not use consumer health data for targeted advertising.

Not all health information held by a consumer application is protected by HIPAA. If we process protected health information on behalf of a HIPAA-covered entity under a business associate agreement, that agreement and applicable HIPAA requirements govern that processing.
Section 04

How We Use Information

  • Provide, personalize, maintain, and secure Blosum
  • Search and compare healthcare pricing, support provider discovery, track spending, and build planning estimates
  • Provide customer support
  • Communicate about accounts, security, features, policies, and—where permitted—Blosum news or offers
  • Monitor performance, troubleshoot problems, prevent fraud and misuse, and improve our Services
  • Comply with law, enforce agreements, and protect users, Sovra Care, and others
  • Create aggregated or de-identified information that does not reasonably identify an individual
Section 05

Genie and AI Processing

Genie is Blosum's AI health-finance navigator. When you use Genie, we process the questions and information you submit to generate a response. With your permission, we may also include relevant information from your Blosum account, such as medications, providers, healthcare expenses, upcoming care, or reserve-planning information.

Information used to generate a response may be transmitted to contracted AI and infrastructure service providers acting on our behalf. We require these providers to protect the information consistently with our contractual requirements and applicable law and to process it only for authorized purposes.

Do not submit information about another person unless you have permission. Genie responses and conversation history may be stored with your account to provide the Services, maintain continuity, investigate safety or quality concerns, and comply with law, subject to our retention practices and your available controls.

Section 06

How We Disclose Information

We may disclose personal information to:

  • Vendors that provide hosting, security, authentication, AI processing, analytics, communications, and customer support
  • Pricing, pharmacy, provider, or other information partners when needed to provide a feature you request
  • A provider, pharmacy, marketplace, or other third party when you ask us to connect you, submit information, or take another action
  • Professional advisers, regulators, courts, law enforcement, or other parties when reasonably necessary to comply with law or protect rights and safety
  • A buyer, investor, successor, or other participant in a merger, financing, reorganization, sale, or similar corporate transaction, subject to appropriate protections

We require service providers that process personal information on our behalf to protect it consistently with our contractual requirements, this Privacy Policy, and applicable law and to process it only for authorized purposes. We may also disclose aggregated or de-identified information that does not reasonably identify you.

Section 07

Sale, Advertising, and Analytics

We do not sell personal information or consumer health data. We do not use consumer health data for targeted advertising. We may use privacy-conscious analytics to understand service performance and improve Blosum.

If our practices change in a way that triggers an opt-out or consent requirement, we will provide the notices and choices required by applicable law before using information in that manner.

Section 08

Data Retention

We retain information for as long as reasonably necessary to provide the Services, maintain your account, comply with legal obligations, resolve disputes, prevent fraud and abuse, and enforce agreements. Retention periods vary based on the type and sensitivity of information, the feature involved, and legal requirements.

When information is no longer needed, we delete or de-identify it, subject to lawful backups and records we must retain. You may request account deletion as described below.

Section 09

Security and Breach Notification

We use administrative, technical, and physical safeguards designed to protect personal information. These safeguards may include encryption in transit and at rest, access controls, monitoring, and vendor-security requirements. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

If a security incident affects information and notification is required, we will provide notice consistent with applicable law.

Section 10

Your Choices and Privacy Rights

Depending on where you live and subject to applicable exceptions, you may have rights to:

  • Know, access, or receive a copy of personal information we maintain about you
  • Correct inaccurate personal information
  • Delete personal information
  • Withdraw consent for certain processing
  • Opt out of marketing communications
  • Appeal a decision concerning a privacy request
  • Exercise applicable rights concerning consumer health data

You may initiate account deletion through the account settings in Blosum or submit a privacy request by emailing legal@sovra.care. Account deletion removes your account and associated personal information except information we must retain for legal, security, fraud-prevention, or dispute-resolution purposes. We may need to verify your identity and authority. You may use an authorized agent where permitted. We will not discriminate against you for exercising applicable privacy rights.

Section 11

Cookies and Communications

You can control certain cookies through your browser or device settings, although disabling essential cookies may prevent parts of Blosum from working. You may unsubscribe from marketing emails using the link in the message. We may still send transactional, security, and service-related communications.

Section 12

Children

Blosum is not intended for anyone under 18, and we do not knowingly collect personal information from children under 18. If you believe a child has provided information to us, contact legal@sovra.care.

Section 13

Changes to This Policy

We may update this Privacy Policy as our Services or legal obligations change. We will post the updated policy, revise the effective date, and provide additional notice when required by law. Material changes will apply prospectively unless otherwise permitted by law.

Section 14

Contact

Questions or privacy requests may be sent to:

Legal contact
Sovra Care, Inc.