Privacy Policy

1. Introduction

VCodeworks LLC ("we," "us," or "our") owns and operates EnrollSure®, the platform at enrollsure.io (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. We are committed to protecting the privacy and security of all personal and health-related information processed through our platform in compliance with applicable federal and state laws, including the Health Insurance Portability and Accountability Act (HIPAA).

2. Information We Collect

Account Information

When you register for an account, we collect your name, email address, and password (stored in hashed form). Organization administrators may also provide agency names, office addresses, phone numbers, and professional license information.

Beneficiary Information

When a Medicare beneficiary completes an intake survey, we collect personal information including but not limited to: name, date of birth, gender, phone number, email address, mailing address, county, Medicare Beneficiary Identifier (MBI), Medicare Part A and Part B effective dates, current health or drug plan, whether they receive Extra Help with prescription drug costs, prescription medications, healthcare providers (doctors, hospitals, pharmacies), and Medicare product preferences. We also collect digital signatures, consent timestamps, and IP addresses for compliance documentation.

Document Signing

Agents can upload PDF documents and send them to clients for electronic signature. When a client signs, we collect the signer's name, the signature and initials they draw, anything they enter in the document's fields, their consent to sign electronically, and the IP address used. Entering an email address is optional: if the signer enters one, we collect it, and if a one-time code is sent to it, we record whether the code was verified. When IP geolocation is switched on, we also record the city, region, and country looked up from the IP address (see Usage and Technical Data). We keep the signed PDF with its audit trail.

Appointment Information

When a client books an appointment with an agent, we collect the client's name, email address, phone number, any notes the client adds, the appointment time, and the IP address used to book. An agent can also add an appointment with a client themselves; we then store the client's name, the phone number and email address if the agent enters them, the agent's notes, and the appointment time.

Calendar Events Added by Agents

Agents can add their own events to their calendar in EnrollSure, such as a meeting or a day off. For each event we store its title, any notes, its date and start and end times (or that it lasts all day), and whether it hides booking times. Because a title or notes can name a client, they are encrypted with AES-256-GCM before they are stored. These events are not sent to connected calendars.

Requests to Be Contacted

If you use the form on our Find an Agent page, we collect your name, email address, phone number, street address, ZIP code, any comments, how you prefer to be contacted, your permission to be contacted, and your IP address. We store this information, email it to VCodeworks LLC, and pass your request to an available licensed insurance agent so they can contact you. If you use the contact form on an agent's public page, we collect your name, email address, phone number, any message, how you prefer to be contacted, your permission to be contacted, and your IP address. We store this information with the agent's name and email it to VCodeworks LLC and, if the agent has added a public contact email address to their profile, to that address. If you use the contact form on our website, your name, email address, subject, and message are emailed to our support address.

Reviews

Anyone can leave a review on an agent's public page. We collect the reviewer's name, email address (optional), star rating, and comment. A review is published only after the agent or their organization's administrator approves it (see Section 8).

Client Lists Uploaded by Agents

Agents on eligible plans can upload a list of clients to send surveys or documents in bulk. For each client we store the first and last name and, if the list includes them, the email address, phone number, ZIP code, and project name. We also store the name of the uploaded file.

Calendar Connections

Agents may connect a Google Calendar, Microsoft Outlook or Microsoft 365, or Apple iCloud calendar, and may disconnect it at any time. To keep a calendar connected, we store:

• Google and Microsoft: the access and refresh tokens the provider issues when the agent grants access, and the account's email address, so the agent can see which account is connected. We ask Google for permission to manage calendar events and see the account's email address, and Microsoft for permission to read and write the account's calendars and read its basic profile.
• Apple iCloud: the agent's Apple ID, an app-specific password the agent creates for EnrollSure at appleid.apple.com, and the address of the iCloud calendar we use.

Tokens and app-specific passwords are encrypted with AES-256-GCM before they are stored. For each connected calendar we also store the agent's settings and the connection's status: whether client details are hidden, whether conflict checking and "Show on my calendar" are on, when events were last synced and the last sync error, when busy times were last read and the last error, and whether the calendar needs to be reconnected. We also store the IDs of the events EnrollSure itself added to the agent's calendars. If an appointment is deleted but its Google or Microsoft event could not be removed, we keep that event's ID and the appointment's end time with the calendar connection, so the leftover event is not treated as busy time. We stop using that ID once the appointment's end time has passed, and it is deleted if the agent disconnects the calendar. Busy times read from a calendar are not stored in our database (see Section 3).

Usage and Technical Data

We automatically collect certain technical information when you use our Service, including IP addresses, browser type, and timestamps of actions taken within the platform. This data is used for security, audit logging, and compliance purposes. We also count page views ourselves, without third-party analytics tools: for each page viewed we record the page address (without its query string), the referring page, any campaign (UTM) tags in the link, the browser's user-agent string, the IP address, and a random visit ID (see Section 10). When a client submits an intake survey or signs a document, we also record the browser's user-agent string and device details (screen resolution, time zone, language, platform, color depth, number of touch points, and number of processor cores) with the submission or signature, as part of its compliance record. If IP geolocation is switched on, we also look up the city, region, and country of the IP address used to submit an intake survey or sign a document and record them with it; to do this, we send that IP address to the geolocation service we use.

Payment Information

Payment processing is handled entirely by Stripe, Inc. We do not store credit card numbers, bank account details, or other sensitive financial information on our servers. We retain only Stripe customer and subscription identifiers for billing management.

3. How We Use Your Information

We use collected information for the following purposes:

• To provide and maintain the EnrollSure platform and its features
• To generate required Medicare compliance documents (Scope of Appointment, Permission to Contact, Client Summaries)
• To authenticate users and manage account access
• To process subscription payments through Stripe
• To send transactional emails (survey links, verification codes, password resets)
• To maintain audit trails as required for Medicare compliance
• To sync submission data to configured CRM systems at the organization's direction
• To facilitate provider lookups (doctors, hospitals, pharmacies) through the CMS National Provider Identifier (NPI) Registry
• To add appointments to an agent's connected calendars and, where the agent switches them on, to hide booking times when the agent is busy and to show the agent's busy times on their own calendar in EnrollSure (see Calendar Integrations below)
• To answer questions agents and administrators ask the in-app AI help assistant
• To improve and optimize the Service

Calendar Integrations

Adding appointments to the agent's calendar. When an appointment is booked, or an agent adds one themselves, EnrollSure adds it to each calendar the agent has connected, updates the event's title on Google and Microsoft calendars when the appointment is marked completed or no-show, and deletes the event when the appointment is cancelled or deleted. On Google and Microsoft calendars the event includes, by default, the client's name, the client's email address (the client is added as an attendee, so the calendar provider may send the client an invitation), the agent's organization name, and any appointment notes. If the agent turns on "Hide client details on this calendar," the event carries no client information: only the title "EnrollSure Appointment," the appointment time, and a link back to EnrollSure. Apple iCloud events always use this minimal format and the setting cannot be turned off, because Apple does not offer a Business Associate Agreement for iCloud; iCloud events also list the agent's own name and email address as the organizer. Client details reach a Google or Microsoft calendar under the agent's own account with that provider, so agents are responsible for using an account that is appropriate for protected health information or for turning on "Hide client details on this calendar." For an appointment an agent adds themselves, the client's email address is included (and the client invited) only if the agent chooses to email the client a confirmation, and the agent's notes are included only if the agent does not. Events agents add to their own calendar in EnrollSure (Section 2) are not sent to connected calendars.

Checking the agent's calendar for conflicts. Conflict checking is off by default and is switched on separately for each connected calendar ("Hide times I'm busy on this calendar"). When it is on, EnrollSure reads the calendar it adds appointments to, from today through the last date the agent's booking page offers (and, each time the agent switches checking on, the next 14 days, to show the agent that it works). We request only: (1) each event's ID and its start and end times; (2) status fields: whether it is an all-day event, whether it is marked busy or free, whether it is tentative or cancelled, its event type (Google only), and invitation responses (Google and Microsoft only), without any attendee's name or email address; and (3) on iCloud, each repeating event's repeat rule and exceptions, so that the times of its occurrences can be worked out. We never request event titles, descriptions, locations, or attendee names or email addresses. On iCloud, the agent's own reply to an invitation is not read, so an invitation the agent declined or answered "Maybe" still counts as busy. This information is used only to hide booking times when the agent is busy, to show the agent that the check is working, and for the two uses described next.

Showing busy times on the agent's calendar. "Show on my calendar" is also off by default and is switched on separately for each connected calendar, on the agent's Appointments page. When it is on, EnrollSure reads the same calendar in the same way, requesting the same fields listed above and never event titles, descriptions, locations, or attendee names or email addresses, for the dates the agent is viewing (or the day of an appointment they are adding), and shows each busy time on the agent's own calendar in EnrollSure labelled only "Busy" and the calendar's name. When an agent adds an appointment themselves, EnrollSure also reads the calendars it reads for either setting, for that appointment's time, to warn the agent about an overlap. A calendar's busy times are read only while conflict checking or "Show on my calendar" is on for it.

Busy times are never written to our database. They are held only in our cache (Upstash Redis), which stores event IDs and start and end times together with the date range and time zone they cover and a one-way hash identifying the connected account. Each result is cached for about five minutes, and the most recent successful result is kept for up to 24 hours, to be used only when the calendar cannot be read. Only reads for the booking page replace that saved result; the reads for "Show on my calendar" and for overlap warnings use the same five-minute cache and may show the saved result when the calendar cannot be read. That saved result is deleted, and the five-minute copies stop being used, when the agent switches conflict checking off, reconnects, or disconnects the calendar; the five-minute copies also stop being used when the agent switches "Show on my calendar" on or off. The check skips EnrollSure's own events, using the event IDs described in Section 2 (Calendar Connections), which also lists what our database records about each check.

"Add to calendar" links. Appointment confirmations may include links that open Google Calendar or Outlook with the appointment details filled in. These details reach the provider only if the recipient chooses to click a link.

Limits on calendar data. Information we receive from a connected Google, Microsoft, or Apple calendar is used only to provide the calendar features described above. It is not used for advertising, is not sold, and is not sent to the AI help assistant, and it is shared only with the infrastructure providers that run the Service (Section 4). EnrollSure's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Third-Party Services

We use the following third-party services to operate the platform. Each service processes data as described below. Calendar sync, conflict checking, and "Show on my calendar" involve a calendar provider only for agents who connect a calendar. The "Add to calendar" links described in Section 3 are separate: they reach Google or Microsoft only if the recipient clicks one. Your organization's CRM or Partner API endpoint receives data only if your organization configures one. If IP geolocation is switched on (Section 2), IP addresses are also sent to the geolocation service we use.

Amazon Web Services (Amplify)

Purpose: Application hosting and delivery

Data shared: All platform traffic passes through AWS infrastructure (covered by an executed Business Associate Agreement)

Neon (PostgreSQL)

Purpose: Database storage

Data shared: All user accounts, submissions, and compliance data

Upstash (Redis)

Purpose: Short-lived cache and counters

Data shared: Rate-limit counters keyed by IP address or by an internal account, survey, or API key identifier (expire within one hour); a pending two-factor authentication setup secret while an authenticator app is being set up (expires after 15 minutes); and, for calendars with conflict checking or "Show on my calendar" switched on, busy times: event IDs and start and end times, never event titles or other details (about 5 minutes; the last successful result up to 24 hours; see Section 3)

Stripe

Purpose: Payment processing

Data shared: Billing name, email, and payment method (handled by Stripe)

Paubox

Purpose: HIPAA-compliant transactional email delivery

Data shared: Recipient email addresses and email content (covered by an executed Business Associate Agreement)

CMS NPI Registry

Purpose: Provider and facility search

Data shared: Search queries (names, zip codes) — no personal data sent

U.S. Food and Drug Administration (openFDA)

Purpose: Medication name and dosage lookup in intake surveys

Data shared: The medication name being searched, sent from our servers. No name, contact details, or other personal information is sent

Google Calendar (Google LLC)

Purpose: Calendar sync and optional busy-time features (conflict checking, "Show on my calendar"), only for agents who connect a Google account

Data shared: Sent: each appointment's time and, unless the agent hides client details, the client's name and email address (as an event attendee), the organization name, and appointment notes. Read: the account's email address when connecting and, only if conflict checking or "Show on my calendar" is on, event IDs, start and end times, and status fields

Microsoft (Outlook and Microsoft 365, via Microsoft Graph)

Purpose: Calendar sync and optional busy-time features (conflict checking, "Show on my calendar"), only for agents who connect a Microsoft account

Data shared: Sent: each appointment's time and, unless the agent hides client details, the client's name and email address (as an event attendee), the organization name, and appointment notes. Read: the account's basic profile when connecting (only its email address is kept) and, only if conflict checking or "Show on my calendar" is on, event IDs, start and end times, and status fields

Apple iCloud Calendar (CalDAV)

Purpose: Calendar sync and optional busy-time features (conflict checking, "Show on my calendar"), only for agents who connect an iCloud calendar

Data shared: Used to sign in: the agent's Apple ID and app-specific password. Sent: each appointment's time, the title "EnrollSure Appointment," a link to EnrollSure, and the agent's own name and email address as organizer — never client details. Read: the names of the account's calendars when connecting and, only if conflict checking or "Show on my calendar" is on, event IDs, start and end times, and status fields

Anthropic (Claude API)

Purpose: AI help assistant for signed-in agents and administrators

Data shared: The messages you type into the help chat and the assistant's earlier replies in that conversation. Your name, email address, and organization are not sent. Please do not enter client information in the help chat

Cloudflare (Turnstile)

Purpose: Bot protection on the sign-up form

Data shared: Your browser loads Cloudflare's check, which receives your IP address and browser information. Our server sends Cloudflare the check's result token and your IP address to verify it

OpenStreetMap (OpenStreetMap Foundation)

Purpose: Service-area map on agent pages

Data shared: When a visitor opens an agent's public page, the visitor's browser loads the map from the OpenStreetMap Foundation's servers, which receive the visitor's IP address and browser information and the approximate map area: a box around the center of the agent's ZIP code, with a marker at that center point. The address of the agent's page is not sent. No client or account data is sent

Have I Been Pwned (Pwned Passwords)

Purpose: Checking new passwords against known data breaches (sign-up and password reset)

Data shared: Only the first five characters of a SHA-1 hash of the password. The password itself is never sent

Your organization's CRM or Partner API endpoint

Purpose: Integrations your organization configures (not chosen by us)

Data shared: CRM sync, started by an organization administrator: the client's name, contact details, date of birth, gender, address and county, current health or drug plan, whether they receive Extra Help, medications, doctors, hospitals, pharmacies, and consent status. Partner API completion notice, for surveys created through the Partner API: the client's name and email address, the agent's email address, the completion time, and document links that expire after 10 minutes

5. Data Security

We implement appropriate technical and organizational measures to protect your information:

• Data sent to and from EnrollSure is encrypted in transit using TLS (HTTPS), and HTTPS is enforced with HSTS
• Passwords are hashed using bcrypt with a cost factor of 12
• Authentication tokens are stored in secure, HTTP-only cookies
• Multi-tenant data isolation ensures organizations can only access their own data
• Role-based access controls limit data visibility (Superadmin, Admin, Agent)
• Comprehensive audit logging tracks all significant platform actions
• Two-factor authentication (2FA) is available for enhanced account security
• Database hosted on Neon with encryption at rest
• Calendar access tokens and Apple app-specific passwords are encrypted with AES-256-GCM before they are stored
• The titles and notes of calendar events agents add are encrypted with AES-256-GCM before they are stored

6. HIPAA Compliance

EnrollSure is designed with HIPAA compliance in mind. Protected Health Information (PHI) is handled according to the HIPAA Privacy Rule and Security Rule. We keep audit logs of actions involving PHI, such as viewing a submission's full details, downloading PDFs and signed documents, sending surveys and documents, signing, and CRM syncs, and we log which intake submission fields change when a client submits, an agent signs, or a CRM sync runs. We implement access controls based on the minimum necessary standard, and use encryption for data in transit and at rest.

7. Data Retention

We keep intake survey submissions (with their SOA and Client Summary PDFs), signed documents, survey and document links, audit logs, and the records we store of requests to be contacted and of client lists uploaded by agents (Section 2) for 10 years from when they are created; a scheduled job then deletes them from our database. Account data is retained for as long as the account is active.

Accounts and organizations can be deleted only by VCodeworks LLC; to ask us to delete yours, contact us (Section 13). When an organization is deleted, we delete from our database its users, agent profiles, survey and document links, intake submissions and their PDFs, signed documents, reviews, appointments, scheduling settings, calendar connections, calendar events, saved document templates, uploaded client lists, API keys, and CRM settings. When a single agent's account is deleted, we delete that agent's profile, survey and document links, intake submissions and their PDFs, signed documents, reviews, appointments, scheduling settings, calendar connections, calendar events, and saved document templates; client lists the agent uploaded and API keys the agent created stay with the organization. Deletion does not remove audit log entries, which can include names, email addresses, and IP addresses, or the records of requests to be contacted, including requests sent to the agent: both are kept until they are 10 years old. An agent's page address stays reserved for that agent when it is replaced by a new one and when the agent's account or organization is deleted, so it is never given to anyone else. Deleted data can also remain in our database backups until those backups expire.

Calendar busy times read for conflict checking or "Show on my calendar" are kept only in our cache, for about five minutes, with the most recent successful result kept for up to 24 hours; they are never written to our database. When an agent disconnects a calendar, we delete the stored tokens or app-specific password and that calendar's settings. Page-view records (Section 2) are deleted after three years.

8. Data Sharing and Disclosure

We do not sell personal information. We may share information in the following circumstances:

• CRM Integrations: When an organization administrator initiates a CRM sync, submission data is sent to the organization's configured CRM endpoint. When a survey created through the Partner API is completed, a completion notice is sent to the callback URL the organization configured (see Section 4)
• Calendar Providers: When an agent connects a calendar, appointment information is sent to that agent's calendar provider as described in Section 3, with no client details when the agent hides them and never any client details for Apple iCloud
• Licensed Agents (Find an Agent): A request submitted through our Find an Agent page is passed to an available licensed insurance agent so they can contact you about your Medicare options (Section 2)
• Agents You Contact: A request sent through the contact form on an agent's public page is emailed to that agent if the agent has a public contact email address on their profile (Section 2)
• Published Reviews: An approved review is shown on the agent's public page with a shortened name, the rating, the comment, and the date. The shortened name is the first word of the name the reviewer entered followed by the first letter of the second word, so a one-word name is shown as entered. The reviewer's email address is not shown
• Service Providers: With third-party services listed in Section 4, solely for operating the platform
• Legal Requirements: When required by law, subpoena, court order, or government regulation
• Business Transfers: In connection with a merger, acquisition, or sale of assets, with notice provided to affected users

9. Your Rights

Depending on your jurisdiction, you may have the following rights:

• Access: Request a copy of the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete information
• Deletion: Request deletion of your personal information, subject to legal retention requirements
• Portability: Request your data in a structured, machine-readable format
• Opt-Out: Opt out of non-essential communications

Calendar connections. Agents can, at any time, switch conflict checking off, turn on "Hide client details on this calendar" (Google and Microsoft), or disconnect a calendar, in the Calendar Sync section of their Agent Settings page, and switch "Show on my calendar" off on their Appointments page. Disconnecting deletes the stored tokens or app-specific password; events already added to the calendar stay there until they are deleted in the calendar. Disconnecting does not by itself revoke the permission granted to EnrollSure at the provider: agents can also remove EnrollSure's access in their Google or Microsoft account settings, or revoke the app-specific password at appleid.apple.com.

To exercise any of these rights, please contact us at the email address provided below.

10. Cookies and Tracking

EnrollSure sets only first-party cookies: sign-in cookies (session and refresh tokens), security cookies (a cross-site request forgery token, and a cookie that lasts up to 10 minutes while an agent connects a Google or Microsoft calendar), and a random visit ID that expires after 30 minutes, which our own page-view counting uses to tell visits apart. We do not use advertising cookies, tracking pixels, or third-party analytics tools. No personal data is shared with advertising networks.

11. Children's Privacy

Our Service is designed for licensed insurance agents and Medicare-eligible beneficiaries (generally age 65 and older). We do not knowingly collect information from children under the age of 13. If we become aware that we have collected information from a child under 13, we will take steps to delete that information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes via email or a prominent notice on the platform. The "Last updated" date at the top of this page indicates when this policy was last revised. Continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact VCodeworks LLC at:

Email: privacy@enrollsure.io
Mail: VCodeworks LLC, 113 GA Hwy 94 E #10, Statenville, GA 31648
Website: https://enrollsure.io