Privacy Policy

Effective October 20, 2026

1. Introduction and scope

Lean Health Services LLC, doing business as LeanBrokers (“LeanBrokers,” “we,” “us”), runs the LeanBrokers CRM at crm.leanbrokers.com, along with the website at leanbrokers.com. This policy explains what information we collect, how we use and protect it, and the choices you have.

The policy covers:

• Agents who use the CRM to manage their book of business.
• Agencies and their staff, who use the agency portal to manage their agents.
• Partners and their staff, such as medical groups, pharmacies and community organizations, who use the partner portal.
• Consumers: the clients and prospects of our users. They reach us through campaign pages, personal client pages, Scope of Appointment signing, appointment booking, consent and unsubscribe links, and our data-request form.

Our role. Agents and agencies decide which client information to enter and how to use it. For that information we act as their service provider and, where HIPAA applies, as their business associate. We process it for them under our agreements with them. If you are a consumer, the agent or agency you work with is responsible for your information, and you may want to contact them first. We will also help you directly (see section 8).

2. Information we collect

Some of this information is protected health information (PHI) under HIPAA, and Social Security and Medicare numbers are especially sensitive. We encrypt both of these in our database (see section 6).

3. How we use information

We use information to:

• Provide the CRM: storing and showing client records, plan comparison, appointments, Scope of Appointment signing, commission reconciliation, and the agency and partner portals.
• Send the emails our users request, such as outreach from an agent to their own clients, with unsubscribe links and the agent’s postal address.
• Send the text messages our users send to their own clients who agreed to receive them (see section 9).
• Record and honor consent and opt-out choices.
• Create and secure accounts, bill subscriptions, and prevent fraud and misuse.
• Send service messages, such as account notices, security alerts, product announcements and policy changes.
• Answer support and data requests.
• Keep an audit trail of who viewed or exported a client record, as HIPAA requires.
• Fix problems and improve the service, using usage data that does not include client records wherever we can.
• Meet legal and regulatory obligations, including CMS Medicare marketing rules.

What we don’t do:

• We do not sell personal information.
• We do not share it for cross-context behavioral advertising.
• We do not use client information to market to consumers ourselves.
• We do not use client information to train AI models.

4. Protected health information and HIPAA

When an agent or agency is a HIPAA covered entity, or a business associate of one, we handle PHI as their business associate. That PHI is used and disclosed only:

• as our agreement with them allows;
• as HIPAA allows; and
• to the minimum necessary.

If the terms of a business associate agreement conflict with this policy, the agreement controls.

The vendors that store or process PHI for us sign their own business associate agreements. Today those are our hosting and backup provider, and our email provider for messages that may contain PHI. We do not send PHI to any vendor that has not signed one.

We will notify affected users of a breach of unsecured PHI as HIPAA requires, and we keep a written incident-response procedure.

5. How we share information

We share personal information only in the ways listed below.

Within the service, at our users’ direction

• An agency sees the records of the agents in its downline.
• A partner sees a client’s information only after that client agrees to share it with that partner.
• An agent’s outreach email goes to the agent’s own clients.

Service providers

These providers work for us under contract and may use information only to serve us.

The CRM also looks up public data, such as the NPI Registry, CMS plan data and carrier provider directories. Those lookups send a search term, never a client’s identity.

Other disclosures

We may also disclose information:

• to comply with law, a subpoena or a regulator such as CMS or a state insurance department;
• to protect rights, safety and security; and
• to a successor in a merger or sale, which would be bound by this policy and by any BAA we have signed.

6. Security

We use administrative, technical and physical safeguards suited to sensitive health and financial data. They include:

• encryption in transit (HTTPS);
• AES-256 encryption at rest for Social Security and Medicare numbers;
• one-way hashed passwords and API keys;
• role-based access;
• an audit log of who views and exports client records;
• consent records that cannot be edited after the fact; and
• nightly encrypted backups held by a provider under a BAA.

Our systems are hosted in the United States.

No system is perfectly secure. Keep your password private, and tell us right away at privacy@leanbrokers.com if you think your account has been misused.

7. Retention

We keep account and client information while the account is active, and afterward as long as our agreements and the law require. Medicare marketing and enrollment rules, for example, often require records to be kept for 10 years.

When a user deletes a client record, it is removed from the user’s view. It may stay in our systems and backups until retention obligations expire. Consent and opt-out records are kept even after the client record is deleted. That way an unsubscribe or a revoked consent stays honored, and we can show what someone agreed to and when.

8. Your choices and rights

• Email. Every outreach and marketing email has an unsubscribe link that works in one click. An unsubscribe applies across all LeanBrokers agents, not only the one who emailed you.
• Calls, texts and email consent. You can withdraw consent you gave on a campaign page at any time. Tell the agent, reply STOP to a text, or contact us. Consent is never a condition of buying a plan. Section 9 covers texts in full.
• Partner sharing. You can ask your agent to stop sharing your information with a partner.
• Access, correction and deletion. Depending on where you live, you may have the right to:
  • know what personal information we hold about you;
  • get a copy of it;
  • correct it;
  • delete it; and
  • limit the use of sensitive information.

  California residents have these rights under the CCPA, as amended by the CPRA. HIPAA also gives you rights over your health information, which you can use through your agent or agency.

  Make a request at crm.leanbrokers.com/data-request or by email to privacy@leanbrokers.com. We will confirm we received it within 10 business days and respond within 45 days, as the law allows. We may need to verify who you are. You may use an authorized agent.

  Where we hold your information for an agent or agency, we may refer your request to them or act on it with them. We will not discriminate against you for using your rights.

• Users. Agents, agencies and partners can update their account information in their profile settings. They can close their account by contacting support.

9. Text messages

Agents who use LeanBrokers can text their own clients from our toll-free number. These texts are sent only to people who have agreed to receive them.

• How you agree. You can agree to texts from LeanBrokers by:
  • ticking the box on your personal client page; or
  • texting START to our number.
  We keep each agreement with the agent whose client you are. We record the exact wording you saw, the time and your IP address. Agreeing on an agent’s own sign-up form covers that agent’s calls and texts from their own phone, not texts from our number.
• What you may receive.
  • Links to your private client page.
  • Appointment reminders.
  • Notices that something is ready for you.
  • Where you agreed to them, news and offers about Medicare Advantage, Medicare Supplement and Prescription Drug Plans.
  Every text starts with “LeanBrokers” and names the agent it is for.
• Not a condition of purchase. You never have to agree to texts to buy a plan or get help from an agent.
• Frequency and cost. How often you get texts varies. Message and data rates may apply. We send texts only between 9am and 8pm, your local time.
• Stopping and help. Reply STOP at any time to stop all texts from our number, from every agent. Reply START to receive texts again. Reply HELP for help, or email support@leanbrokers.com.
• Your mobile number is not shared. We do not share mobile numbers, or your agreement to receive texts, with third parties or affiliates for their marketing or promotional purposes. We do not sell or rent them. We share them only with Telnyx, which delivers the texts for us under contract (see section 5), and as required by law.
• Records. We keep a record of each text, and of every agreement and STOP. That record stays even if your client record is deleted, so a STOP keeps being honored.

Mobile carriers are not liable for delayed or undelivered messages.

10. Cookies and similar technologies

We use a small number of first-party cookies and browser storage:

• Session cookie: keeps you signed in. It is deleted when your session ends.
• Campaign visit cookie: a random ID set on campaign pages, kept for up to 1 year. It counts visits and clicks for the agent who runs the page.
• Notification and preference storage: remembers which notices you’ve read and your display settings, such as list views and help articles you’ve read.
• Client-page cookie: a short-lived cookie, lasting 30 minutes, set after you confirm your date of birth on your personal client page.

We do not use advertising cookies, third-party analytics or tracking pixels. We do not respond to Do Not Track signals differently, because we do no cross-site tracking. We do honor Global Privacy Control as an opt-out of sale or sharing, although we do neither.

Some pages load code libraries from public content networks, such as jsDelivr and cdnjs. Those providers can see your IP address when your browser fetches a file.

11. Children, changes and contact

Children. The service is for licensed insurance professionals and their adult clients. It is not directed to children under 16, and we do not knowingly collect their information except as a dependent’s details entered by an agent.

Changes. We will post changes here with a new effective date. If a change materially affects how we use personal information, we will notify users by email or in the app before it takes effect.

Contact