Privacy Policy
01 Who we are
Crystal Ball operates a medical underwriting query platform for licensed insurance professionals. This policy explains what we collect, why we collect it, how long we keep it, and the rights you have over it. Questions about privacy can be directed to privacy@crystalballunderwriting.com.
02 Information we collect
- Account details — your email, name, and a securely hashed password.
- Usage information — the queries you run and system logs associated with your account.
- Client health profiles — stored in encrypted form, used only to answer your underwriting queries.
- Technical data — IP addresses and browser information.
We collect and geo-enrich IP addresses for all visitors as a security measure.
03 How long we keep it
- Account data — retained for 30 days after deletion, then purged.
- Query logs — retained for 12 months.
- Audit logs — retained for 24 months.
- Client profiles — retained until you manually delete them.
04 How we share data
We do not sell your personal data. Information is shared only with the infrastructure vendors that operate our platform, and only when legally required to do so.
05 How we protect it
Data in transit is protected with TLS encryption. Passwords are hashed with bcrypt. Access to the platform is governed by role-based access controls so that people only see what their role requires.
06 Your rights
Users in the EU have rights under the GDPR, including the right to access, correct, and delete their personal data. California residents have rights under the CCPA/CPRA, including a 45-day response timeframe for verified requests. To exercise any right, contact privacy@crystalballunderwriting.com.
07 Tracking
Crystal Ball does not use third-party tracking cookies, advertising trackers, or analytics services.
08 Legitimate interest
Our collection of IP addresses balances the security monitoring required of a sensitive healthcare platform against the privacy expectations of our users. We limit this collection to what is necessary to keep the platform secure.
09 Updates to this policy
If we make material changes to this policy, we will provide at least 30 days' advance notice before they take effect.
10 Contact
Privacy questions: privacy@crystalballunderwriting.com
General support: support@crystalballunderwriting.com