Your privacy matters. Here's how we protect it.
Last updated: February 1, 2026
OPM Benefits, Inc. ("OPM Benefits," "we," "us," or "our") is committed to protecting the privacy and security of the personal information entrusted to us by our clients, their employees, and visitors to our website. This Privacy Policy describes how we collect, use, disclose, and safeguard your information when you visit our website, use our benefits administration platform, or interact with our services.
As a benefits administration provider, we understand the sensitive nature of the data we process, including protected health information (PHI) as defined under the Health Insurance Portability and Accountability Act (HIPAA). We maintain strict compliance with HIPAA, the California Consumer Privacy Act (CCPA), the General Data Protection Regulation (GDPR) where applicable, and all other relevant federal and state privacy laws.
We collect personal information that you or your employer provide directly to us in connection with our benefits administration services. This information may include:
When you access our platform or website, we automatically collect certain technical information, including:
We use cookies, web beacons, pixels, and similar tracking technologies to enhance your experience, analyze usage patterns, and maintain security. For detailed information about our cookie practices, please see Section 7 below.
We use the information we collect for the following purposes:
We do not sell your personal information. We have never sold personal information and have no plans to do so. We share your information only in the following limited circumstances:
We share personal information with third parties who perform services on our behalf or on behalf of our clients, including:
All service providers are contractually obligated to protect your data and may only use it for the specific purposes we authorize. Where PHI is involved, we maintain Business Associate Agreements (BAAs) as required by HIPAA.
We may disclose your information when required to do so by law, regulation, subpoena, court order, or other legal process. We will notify the affected client and, where possible, the affected individuals before making such disclosures, unless prohibited from doing so by law or court order.
In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or substantially all of our assets, your information may be transferred to the acquiring entity. We will provide notice of any such transfer and any choices you may have regarding your information.
We may share your information for purposes not described in this policy with your explicit consent or at your direction.
We take the security of your data extremely seriously and implement comprehensive administrative, technical, and physical safeguards designed to protect your information from unauthorized access, disclosure, alteration, and destruction.
All data is encrypted in transit using TLS 1.2 or higher. Data at rest is encrypted using AES-256 encryption. Database fields containing sensitive identifiers such as Social Security numbers are subject to additional application-level encryption with key management through a dedicated hardware security module (HSM).
We enforce role-based access control (RBAC) throughout our platform. Access to personal information is limited to employees and contractors who require it to perform their job functions. All access is logged and subject to regular review. Multi-factor authentication (MFA) is required for all administrative access to our systems.
OPM Benefits maintains SOC 2 Type II certification, demonstrating our commitment to the highest standards of security, availability, processing integrity, confidentiality, and privacy. Our SOC 2 report is available to clients and prospective clients upon request and under NDA.
We retain personal information for as long as necessary to fulfill the purposes for which it was collected, to comply with our legal and regulatory obligations, and to support the legitimate business needs of our clients.
Specifically:
Upon written request from a client following the termination of their service agreement, we will securely delete or return all client data within ninety (90) days, subject to our legal retention obligations. Individual employees may also request deletion of their personal data, subject to our clients' retention requirements and applicable law.
Depending on your location and applicable law, you may have certain rights regarding your personal information:
You have the right to request access to the personal information we hold about you. We will provide this information in a commonly used, machine-readable format upon verified request.
You have the right to request that we correct inaccurate or incomplete personal information. For benefits-related data, correction requests should typically be submitted through your employer's HR department to ensure proper authorization and carrier notification.
You have the right to request the deletion of your personal information, subject to certain exceptions including our legal retention obligations, ongoing service obligations to our clients, and the exercise or defense of legal claims.
You may opt out of non-essential communications such as marketing emails at any time by clicking the "unsubscribe" link in any marketing communication or by contacting us directly. Please note that you cannot opt out of transactional communications related to your benefits enrollment or account security.
If you are a California resident, you have the additional right to:
If you are a resident of the European Economic Area or the United Kingdom, you have additional rights including the right to data portability, the right to restrict processing, and the right to object to processing based on legitimate interests. Our legal basis for processing your data will depend on the specific context, but typically relies on contractual necessity, legitimate interests, or your consent.
To exercise any of these rights, please contact us at privacy@opm-benefits.com. We will respond to verified requests within thirty (30) days, or within the timeframe required by applicable law.
We use cookies and similar technologies to provide, secure, and improve our services. Here is a breakdown of the types of cookies we use:
These cookies are essential for our platform to function and cannot be disabled. They include session cookies that maintain your authenticated state, security cookies that prevent cross-site request forgery (CSRF), and load-balancing cookies that ensure reliable service delivery. These cookies do not store any personally identifiable information.
These cookies enable enhanced functionality and personalization, such as remembering your language preferences, theme settings, and previously viewed plan comparisons. While not strictly necessary, they significantly improve your experience.
We use analytics cookies to understand how visitors interact with our website and platform. This data is aggregated and anonymized to help us improve our services. We use tools such as Google Analytics (with IP anonymization enabled) and our own first-party analytics.
You can manage your cookie preferences through your browser settings. Most browsers allow you to block or delete cookies, though this may impact your ability to use certain features of our platform. For our benefits administration platform, strictly necessary cookies must be enabled for the system to function properly.
Our website and services are not directed to individuals under the age of thirteen (13), and we do not knowingly collect personal information from children under 13. The only circumstance in which we may process information relating to minors is when a parent or legal guardian enrolls a minor child as a dependent in an employer-sponsored benefits plan. In such cases, the information is provided and authorized by the parent or guardian and is processed solely for the purpose of benefits enrollment and administration.
If we become aware that we have inadvertently collected personal information from a child under 13 outside of the dependent enrollment context, we will take steps to delete that information as promptly as possible. If you believe we may have collected information from a child under 13, please contact us immediately at privacy@opm-benefits.com.
OPM Benefits, Inc. is headquartered in Chicago, Illinois, United States. Our platform infrastructure is hosted within the United States using data centers that maintain SOC 2 Type II and ISO 27001 certifications. If you access our services from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country of residence.
For transfers of personal data from the European Economic Area (EEA), United Kingdom, or Switzerland to the United States, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented by additional technical and organizational measures where necessary. We also conduct transfer impact assessments to evaluate the level of protection afforded to personal data in the receiving jurisdiction.
Our clients operating internationally should contact us to discuss specific data transfer mechanisms and supplementary measures appropriate to their circumstances.
We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes, we will:
We encourage you to review this policy periodically. Your continued use of our services after changes become effective constitutes your acknowledgment of the modified policy.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
OPM Benefits, Inc.
Attn: Privacy Team
200 West Madison Street, Suite 2100
Chicago, IL 60606
Email: privacy@opm-benefits.com
Phone: (312) 555-0180
For HIPAA-related inquiries, please reference our HIPAA Notice or contact our HIPAA Privacy Officer directly at privacy@opm-benefits.com.
If you are not satisfied with our response to your privacy concern, you may have the right to lodge a complaint with your local data protection authority.