Effective July 2026. PlanMax is a not-for-profit research project. This policy explains, in plain language, what health information PlanMax uses, how, and the choices you have.
PlanMax is an academic, not-for-profit research project studying health plan costs and health care decision-making. It is operated by Christian Wilson (Boston University), who serves as the officer responsible for these data practices. Contact: privacy@planmax.org.
When you choose your insurer and sign in, your insurer asks whether you consent to share your data with PlanMax. If you agree, PlanMax receives — through your insurer's Patient Access API — your claims and Explanation of Benefit records: the services you received, their dates, and the amounts your plan allowed and paid. We access this only with your authorization, using the secure SMART on FHIR / OAuth 2.0 standard. You enter your credentials on your insurer's own website; PlanMax never sees or stores your insurer password.
PlanMax does not access any other information from your device — no contacts, location, photos, files, camera, or microphone. The only information we use is the health plan data you authorize through your insurer.
We ask for your clear, express consent before we access, use, or exchange your health information. Before you connect your coverage, you confirm that you have read this policy by checking a box. We would also request your express consent before ever sharing or selling your health information — and, as stated, we do not sell it.
For research and development, we use a de-identified version of your data — direct identifiers (such as your name, contact details, and the other identifiers listed under the HIPAA Safe Harbor method) are removed so the data cannot reasonably be used to identify you.
We do not use your information for targeted advertising, and we do not use it for automated decision-making that produces legal or similarly significant effects on you.
Your claims records can sometimes reveal information about other people — for example, family or genetic history that relates to your relatives. We use your information only to serve you, and we handle any such information with the same protections described in this policy.
If the PlanMax project is transferred to another organization, or is wound down, we will — before your identifiable data is affected — do at least one of the following: give you the opportunity to securely download or delete your data; ensure the successor is bound by commitments consistent with this policy; or allow you to close your account. We will notify you of any such change as described under "Changes to this policy."
You can withdraw PlanMax's access at any time:
When you withdraw consent, we stop accessing new data and delete your identifiable data within 30 days. De-identified data that can no longer reasonably be linked to you may be retained for ongoing research, consistent with this policy and the CARIN Code of Conduct.
If your account becomes dormant — you stop using PlanMax and your insurer authorization lapses — we treat it the same way: we stop accessing new data and delete your identifiable data, keeping only de-identified data as described above.
We comply with all applicable breach-notification laws, including the FTC's Health Breach Notification Rule. If your information is improperly disclosed, we will notify you and take steps to address the breach as those laws require.
Connecting your health data is your decision, and it has benefits and risks. Sharing your claims lets PlanMax show you personalized cost estimates; it also means your data is processed as described here. To learn more about your rights and choices when sharing health data with apps, see the ONC's consumer guidance on accessing your health records. Questions are always welcome at privacy@planmax.org.
PlanMax adheres to the CARIN Code of Conduct for consumer-facing health applications.
PlanMax is not directed to children under 13, and we do not knowingly collect their information.
If we change this policy, we will post the updated version here with a new effective date.
Your use of PlanMax is also governed by our Terms of Use. See our Trust & Attestations page for our CARIN Code of Conduct endorsement and Model Privacy Notice.