Privacy Policy

SureWell, Inc. ("SureWell," "we," "us," or "our") is committed to protecting the privacy and security of your personal information. This Privacy Policy describes how we collect, use, disclose, and safeguard information when you use our platform, website, and related services (collectively, the "Services").

By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, please do not use the Services.

Personal Information

• Full legal name, date of birth, and Social Security Number (tokenized and encrypted)
• Residential address, email address, and phone number
• Employment status, employer name, and annual income
• Marital status, number of dependents, and beneficiary designations
• Financial information including annual income, account balances, monthly cash flow, debt, coverage amounts, and investment experience

Health Information

• Height, weight, tobacco use status, and medical history disclosures as required for simplified-issue life insurance underwriting

Financial Account Data

• Bank account details linked through Plaid for ACH transfers
• External retirement and savings account information imported for Secure Net Value calculations

Technical Information

• IP address, browser type, device identifiers, and operating system
• Usage data including pages visited, features used, and session duration
• Cookies and similar tracking technologies for authentication and analytics

We use the information we collect to:

• Open, maintain, and service your SureWell account across all three pillars (life insurance, retirement, and savings)
• Process insurance applications through our licensed carrier partners
• Execute investment transactions through our custodial brokerage partner
• Calculate and display your Secure Net Value, Future Secure Value, and related metrics
• Verify your identity and comply with Know Your Customer (KYC) and Anti-Money Laundering (AML) requirements
• Detect and prevent fraud, unauthorized access, and other security threats
• Communicate account updates, regulatory notices, and service changes
• Improve our Services through aggregated, de-identified analytics

We do not sell, rent, or trade your personal information to third parties for marketing purposes. We share information only in the following circumstances:

• Insurance Carriers: When you request a life-insurance quote or apply for coverage, application and health information you provide is shared with the licensed third-party carrier(s) that quote or issue the policy, for underwriting and issuance.
• Brokerage & Custody Partner (Alpaca): SureWell Retirement (IRA) is not yet available. When it launches and you open an account, identity, tax, and account data required to open and maintain the account will be shared with Alpaca Securities LLC, our brokerage and custody partner, for KYC, account opening, and custody.
• Bank Linking (Plaid): When you link an external bank account, Plaid Inc. authenticates you with your bank and returns account and routing information to SureWell so we can display balances and initiate ACH transfers you authorize. SureWell does not receive or store your online banking credentials.
• Service Providers: Identity verification vendors, email/SMS delivery, and infrastructure providers operate under data-processing agreements and only receive the data necessary to perform their service.
• Regulatory & Legal: We may disclose information as required by law, regulation, subpoena, or other legal process.

SureWell Retirement, SureWell-branded cash / high-yield savings, and taxable SureWell Brokerage accounts are not live today. When those products launch, this policy will be updated to describe the specific partner banks, brokerages, and custodians involved before any data is shared with them.

We implement industry-standard security measures to protect your information:

• TLS 1.2 or higher for data in transit and AES-256 encryption for data at rest
• Social Security Numbers are tokenized immediately upon collection and never stored in plaintext
• Hosted on SOC 2 Type II–audited infrastructure with continuous monitoring
• Role-based access controls and comprehensive audit logging
• Regular third-party penetration testing and vulnerability assessments

We retain personal information for as long as your account is active or as needed to provide Services. After account closure, we retain records as required by applicable securities, insurance, and tax regulations — typically seven years for financial records and the duration of any insurance policy plus applicable statute of limitations periods.

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your information, subject to regulatory retention requirements
• Opt out of non-essential communications
• Receive a portable copy of your data

To exercise any of these rights, contact us at privacy@surewell.co.

The Services are not directed to individuals under 18 years of age. We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 18, we will take steps to delete that information promptly.

We may update this Privacy Policy from time to time. Material changes will be communicated through the Services or via email at least 30 days before they take effect. Your continued use of the Services after changes become effective constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or our data practices, contact: