Privacy, Security & Compliance
At PayFlex, we value the trust you place in us and we take great care to help protect the information you share.
This Privacy Statement describes our practices in connection with data we collect through software applications.
This includes mobile applications and websites we host that contain a link to this Privacy Statement.
We describe our privacy practices so it’s easy to navigate, read, and understand. We’re committed to treating your data with care and respect.
And we manage our applications in a manner that’s compliant with law.
Types of information we collect
We may collect two types of data: Personal Information and Non-Personally Identifiable Information.
“Personal Information” means data that’s unique to you as an individual. This could mean your name, address, social security number, e-mail address, and telephone number.
It could mean certain personal device information too. We describe this further below.
“Non-Personally-Identifiable Information” means data that doesn’t identify you personally. An example is usage data, either individually or taken together.
And it may include demographic data, or data related to multiple members which does not include member-specific information, and certain data collected automatically through your device.
This could be web browser data, server log files, cookies, pixel tags or beacons. And it could be other technologies and other non-personally identifiable data collected by us or given to us by you.
By collecting this data, we can provide you with better access to our services.
How we collect your information
We get Personal Information when you register or create a personal profile with us. And we get it when you request products, services, or information from us.
We may collect certain personal device information to authenticate you or your device. We do this for application security. It can help prevent fraud and data loss.
Device information we collect may be: physical location, IP address, battery information, application activity, data usage, accelerometer data, and malware information.
Where required by law or regulation, you’ll be able to update your data by sending us an e-mail. Or, if you have set up a personal profile, you’ll be able to update your data online.
Protecting the confidentiality and security of member information
We have adopted and adhere to stringent security standards designed to help protect non-public personal information against accidental or unauthorized access or disclosure.
We maintain physical, electronic, and procedural safeguards to help secure the information and comply with federal standards.
PayFlex employees are kept informed of all current security and privacy practices. They complete training annually. And we remind them of the importance of member privacy.
Our employees play a vital role in protecting your data.
Here are some ways PayFlex protects your data
17 steps for securing health information
Protecting your account
You should take the following steps to help safeguard your account:
- Create a new, unique and strong password every three months.
- Use unique usernames and strong passwords that others can’t easily figure out. Avoid using your first initial, last name, e-mail, date of birth, initials, work ID number, etc.
- Choose usernames and passwords that are at least 8 characters in length and a mix of upper and lower case letters, plus numbers and special characters.
- Avoid using information that can be found publicly, like mother’s maiden name, address, email address, birthdate, etc.
- Use a different password for each online account.
- Register directly at payflex.com. This is true even if you typically use Single-Sign-On (SSO) to access your PayFlex account.
You should use a different username and password for SSO and for the payflex.com registration.
- Review your account often. This includes all transaction history, personal and account information (like phone number, e-mail address, etc.).
- Call or e-mail us immediately if you notice any suspicious account activity. You can either call us using the number on the back of your PayFlex debit card or our fraud line at (855) 542-5988.
Or you can e-mail us at firstname.lastname@example.org.
- Always be on the lookout for e-mail phishing attempts. We will never send you an e-mail asking you to enter or re-enter your login information to verify your account.
You should never click on a link inside of an e-mail; you should always log in to your account as you normally do.
Parties to whom we disclose data
Access to client and member data is strictly limited. We don’t disclose any personal data unless the law requires or permits it.
PayFlex may use and disclose your personal data when administering your benefits.
In limited cases we may disclose it to unrelated third parties as permitted or required by law.
In all cases, we stress the confidential nature of the data we share and require any third party receiving it to keep it confidential.
Data won’t be distributed or shared for marketing purposes. And we won’t share it for any other purpose outside the scope of our business requirements.
Collecting and using non-personally identifiable information
When you visit our website, we collect certain information about you to help us analyze and improve the usefulness of the information we provide on this website.
The information we collect does not identify you personally. It’s anonymous "usage data," such as the number of unique visitors we receive, what pages are visited most often and the navigation preferences and characteristics of our visitors.
We have included information below on what we collect and how we do it.
- Web browser information - Web browsers collect and store information about the type of device and operating system you are using to access our website, as well as your device’s Media Access Control (MAC) address for facilitating network communications.
Accessing this information helps us establish a secure and consistent connection to you during your visits to our website.
- "Cookie" technology - A "cookie" is an element of data that a website can send to your browser when you link to a website. It is not a computer program and has no ability to read data residing on your computer.
It also does not instruct your computer to perform any step or function. By assigning a unique data element to each visitor, the website is able to recognize repeat users, track usage patterns and better serve you when you return to that site.
The cookie does not extract other personal information about you, such as your name or address.
- Client-side page tagging - This technology uses code on each web page to write certain information about the page and the visitor to a log when a page is rendered to you by your web browser.
It will not read any of your data files and will not execute any additional programs. It does not extract any personal information about you, such as your name or email address.
- Tracking pixels or beacons - These techniques use electronic files to track your navigation of our website, your completion of transactions and other browsing behavior.
- IP Address - When you subscribe to an Internet Service Provider (ISP), your computing device is assigned an IP Address. We track and store this address to help us manage security and monitor usage volume and patterns.
Health Insurance Portability and Accountability Act (HIPAA) Compliance
PayFlex complies with all applicable regulatory requirements pertaining to the services it provides. This includes the Health Insurance Portability and Accountability Act of 1996/Health Information Technology for Economic Clinical Health Act (HIPAA/HITECH).
We’ve set up technical and physical safeguards to help protect the privacy of your personal health information. And we set limits on the use and disclosure of such information without your authorization.
Changes to this statement
PayFlex may change this statement from time to time. When updates are made, we’ll also update the privacy statement version date located at the bottom of this privacy statement.
We encourage you to periodically review this privacy statement to see if there have been any changes that may affect you. This statement is not intended to and does not create any contractual or other legal rights in or on behalf of any party.
Account Security concerns?
Contact us if you have any questions or concerns with our Privacy, Security & Compliance policies.