Enough! Health
Privacy Policy
This policy covers the Enough! Health member app. It says what the app collects, what we do with it, who else sees it, and what you can ask us to do about it. The app handles Protected Health Information, so this is written to be read, not filed.
Last updated 13 October 2026 · Effective 13 October 2026
1. Overview
Open Enrollment, Inc.(“we”, “us”, “our”), trading as Enough! Health, operates the member app (the “App”) for individuals enrolled in an Open Enrollment health benefit plan. This policy describes what personal information we collect through the App, how we use it, and the choices you have.
The App processes Protected Health Information (PHI) as defined by HIPAA. We are a HIPAA Covered Entity or Business Associate, as applicable, and our use and disclosure of PHI is governed accordingly.
2. Information we collect
2.1 Information you provide
- Account identity: email address, phone number, mailing address, date of birth, and Social Security Number or ITIN.
- Authentication secrets: your password (hashed via AWS Cognito, never stored in plaintext), a TOTP seed if you enable it, and biometric authorisation — which the operating system handles on your device. We never see your face or your fingerprint.
- Health data you enter: Health Assessment responses, appeal statements, notification preferences, profile updates.
- Support content: messages you send through in-app support or an appeal.
2.2 Information we receive about you
- Plan and claims data: enrollment records, plan benefits, claim status, deductible accumulators and account balances — from our own systems and from partners such as the payer, brokerage and registries.
- Health records: conditions, medications, labs, allergies and immunisations, sourced from your Health Assessment, clinical encounters, pharmacy, and any device you opt into.
- Device readings (optional): weight, glucose, blood pressure and similar, only if you explicitly connect a device. See section 4.2.
2.3 Information we collect automatically
- Device identifiers: install ID, device model, OS version, app version — for security, support and push delivery.
- Crash and performance data: stack traces, breadcrumbs and feature usage, via Sentry, scrubbed of PHI before it leaves your device. Section 6 says exactly what is stripped.
- Network metadata: IP address, request timestamps, rate-limit state.
- Push notification token: the APNs or FCM token used to deliver notifications you opted into.
Device location, only if you ask for it
When you tap “Use my location” in Price Shop, the App asks the operating system for a one-time, while-you-are-using-it location fix, and uses it on your device to centre the price map on hospitals near you. To scope results by distance, the App sends our servers a deliberately coarse point — rounded to roughly two-thirds of a mile — never your precise coordinates.
Your location is not stored on our servers, not attached to your member record, not shared with any hospital, and not included in analytics or crash reports. We never collect location in the background. You can decline the prompt and type a ZIP code instead, you can revoke the permission at any time in your device settings, and the App keeps working either way.
We do not use third-party advertising SDKs, behavioural ad trackers, cross-app analytics, or fingerprinting.
3. How we use your information
| Purpose | Basis |
|---|---|
| Provide what you asked for — view your plan, file an appeal, manage your family | Treatment, Payment and Operations (TPO) |
| Authenticate you and protect your account | Our legitimate interest in security |
| Contact you about your plan, an appeal, or something we need from you | TPO |
| Meet compliance obligations under ACA, HIPAA and state insurance law | Legal obligation |
| Detect fraud, waste and abuse | Legal obligation and legitimate interest |
| Improve the app's stability and performance | Legitimate interest, with PHI scrubbed |
We do not sell personal information, and we do not use PHI to market to third parties.
5. How long we keep it
- Account and plan records: as long as HIPAA and state insurance law require, typically six years after last use.
- Appeals and compliance records: six years minimum under HIPAA; longer where a state statute or a litigation hold requires it.
- PHI access audit logs: six years.
- Device readings:while the device is connected, plus 90 days after you disconnect it — unless a reading populated your health record, in which case that record’s retention applies.
- Crash and performance logs: 90 days, then deleted.
- Session tokens: access tokens about an hour, refresh tokens about 30 days or until you sign out.
Deleted data is removed from operational systems. Encrypted backups age out on a rolling schedule, typically 90 days.
6. What is stripped before a crash report leaves your phone
- Request and response bodies are never sent — only a redacted URL path and a status code.
- Social Security Number, ITIN, date of birth, member ID and email are replaced with a redaction token before any breadcrumb or stack trace is transmitted.
- Free-text fields — appeal statements, support messages — are never included in breadcrumbs.
Sentry access is limited to engineers under a BAA. No third-party analytics tracker or advertising SDK is embedded in the App.
7. Security
- In transit: TLS 1.2 or better, with certificate pinning on our API endpoints.
- At rest: PHI encrypted with AES-256-GCM. Social Security Numbers are tokenised with envelope encryption and searchable only through an HMAC blind index.
- Sign-in:OAuth 2.0 with PKCE. Biometric unlock uses your device’s secure enclave; biometric data never leaves your device.
- On your device: tokens are held in the iOS Keychain or Android EncryptedSharedPreferences.
- Access control: row-level security in the database, with PHI access audit-logged and kept for six years.
8. Your rights
Depending on where you live, you may have the right to:
- See the PHI we hold about you.
- Ask us to correct information that is wrong.
- Ask for a copy of the PHI access audit log for your own record.
- Withdraw consent for optional integrations — connected devices, non-treatment messaging.
- Complain to us, or to the US Department of Health and Human Services Office for Civil Rights.
To exercise any of these, email hello@joinenoughhealth.com. We do not discriminate against members who exercise their privacy rights.
9. Children
The App is intended for adult subscribers and their enrolled dependents under 18 whose guardian has authorised access. Dependents under 13 are managed through the subscriber’s account; we do not collect information directly from children under 13 within the meaning of COPPA.
10. Where this applies
The App is built for residents of the US states where Open Enrollment operates — currently Idaho, Iowa, Montana, North Dakota, Wyoming, New Hampshire and Vermont. Data is stored in the United States. If you are not a US resident, please do not use the App.
11. Changes to this policy
We will tell members about any material change at least 30 days before it takes effect, by in-app notification and email. For a prior version of this policy, email hello@joinenoughhealth.com.
12. Contact us
Privacy questions, requests and HIPAA complaints: hello@joinenoughhealth.com.
You may also complain directly to the US Department of Health and Human Services, Office for Civil Rights.
See also our Terms of Use and the Help Centre.