While this website is accessed over the public Internet, your connection to the site is encrypted and secure. We also employ a wide range of measures for the security of data entrusted to us by customers.

• Infrastructure – redundant and fault-tolerant servers, multiple data centers, battery and diesel generator backup power sources, multiple network connections, and fire suppression
• Technology – data encryption, intrusion prevention, firewalls, backups, server hardening, routine security updates, anti-virus scanning, vulnerability scanning, penetration testing, and e-mail encryption
• Secure facilities – biometric locks, on-site security, and video monitoring
• Security-aware company culture – security and privacy training, individual acknowledgement, and frequent password changes
• Business process – code reviews, testing, release planning, need-to-know access, and data disposal
• Internal Controls – ensure that sensitive data is adequately protected and reduces the risk of compromise cause by error, accident, natural disasters or malicious actions

While our security measures are extensive, you should always make sure that you are accessing the website via a secure connection and that you never transmit files you download from the website over an unsecured connection.

HTTPS

HTTPS (the Hyper Text Transfer Protocol over SSL) is the method your web browser uses to connect to the website. SSL delivers server authentication and data integrity using a digital certificate issued by a trusted certificate authority. The digital certificate is used to verify the connection between the server's public key and the server's identity. This means that when you connect with the website, you are assured that the server is not sponsored by an imposter.

Communication via HTTPS is secured using an advanced encryption algorithm which prevents tampering and eavesdropping. Depending on what web browser you use, you may be able to request a Security Report that describes how secure the connection is.

You can tell whether a document comes from a secure server by looking at the location (URL) field. If the URL begins with https:// (instead of http://), the document comes from a secure server. Your web browser will notify you if there is a problem with the website certificate. If your browser notifies you that there is a problem with the website certificate, you should not log onto the site because your connection to the site will not be secure.

Infrastructure

The servers that host the website reside in separate data centers in the United States. To reduce the risk of both data centers being impacted by the same catastrophic event, the data centers are located hundreds of miles apart, are connected to different network providers, and are powered by separate power grids. Service at one data center can be transferred in minutes to the other data center, if required.

Both the data centers provide extensive security measures to protect access to the servers, including:

• Man traps and biometric locks, providing two- factor authentication
• 24-hour on-site security with escorted access
• Security cameras with digital recording and storage
• Sign in/sign out for all individuals
• Locked cabinets housing servers

The facilities also provide extensive on-site support to ensure the continuous operation and high availability.

• 24-hr. remote hands support
• Battery backup
• Diesel generator backup
• Fire suppression

Some information sent you by the website may be delivered by a Content Delivery Network ("CDN"). The CDN is used to distribute some web page assets, such as images, videos, style sheets, and script libraries via local servers co-located with various Internet providers. By keeping local copies of these assets, the CDN can deliver them to your web browser directly, thereby reducing Internet traffic. For security reasons, your personal information is never sent over the CDN.

Backups

In addition to data replication between the primary and secondary data centers, customer information is protected by frequent backups. At each facility, we have deployed dedicated archive servers that store backups for all customer databases. These backups are automatically copied from one data center to the other continuously. Backups are tested frequently to ensure that the backup files are valid.

For each client database, we retain:

• Incremental backups every few minutes for two weeks
• Full backups every week for two months
• At least one full backup each month for an entire year

All backups are compressed and encrypted using a symmetrical encryption algorithm known as the Advanced Encryption Standard ("AES"), which is widely considered to be among the most secure types of encryption and adopted by both U.S. and Canadian governments.

Technical Safeguards

We have implemented extensive technical safeguards to assure network and host security and to manage server vulnerability.

Safeguards include:

• DMZ – The most accessible network zone, which houses the servers that interact directly with the Internet
• Firewalls – dedicated rules-based security appliances that regulate the flow of information to and from the DMZ
• A "defense in depth" security control method in which multiple layers of defense prevent direct attacks against critical systems
• IDPS’s (Intrusion Detection and Prevention Systems) – appliances that detect attacks against the computer network
• Server hardening – disabling services that are not needed on the server and restricting the ways in which the server can communicate with the network
• Vulnerability management – systematically reviewing, testing, and deploying operating system patches as they become available
• Anti-virus and anti-spyware scanning on servers and employee workstations

We perform vulnerability scans every month to validate the security measures.

Secure Coding Practices

System security also depends heavily on managing the software development life cycle (SDLC) effectively. Each phase of the SDLC includes certain security tasks to make sure that security is an integral part the process. The SDLC requires that:

• The impact on security of each change is considered.
• Security patches and software configuration changes are adequately tested.
• Production and test environments are separated, with sufficient access controls in each environment.
• The duties of personnel assigned to test and production environments are separated sufficiently.
• Production data is not used for testing or development.
• User inputs are validated to prevent system vulnerabilities.
• Errors are handled properly.
• Role-based access controls are enforced consistently.
• Communications are secure.
• Cryptography is applied to protect sensitive data, where appropriate.
• Code changes are subjected to reviews by knowledgeable personnel.
• Automated tools be used regularly to detect vulnerabilities.

Independent Auditing and Testing

We utilize an independent third-party auditor accredited by the American Institute of Certified Public Accountants (AICPA) to conduct annual Service Organization Control 2 (SOC 2, Type 2) examinations of our security practices and business process controls. We also insist that the data centers hosting the websites undergo similar accreditation. The SOC 2, Type 2 examination is widely recognized, and assures our ability to handle data securely though the evaluation and testing of internal processes, procedures, and controls.

Use of this website is subject to the Terms of Use Agreement, which identifies the Sponsor. The Sponsor is strongly committed to protecting your privacy online when using this web site. We know that you care how information about you is used and shared, and we appreciate your trust that we will do so carefully and sensibly. This Privacy Policy outlines the information we collect and how we will use that information. By logging onto the website, you are accepting the practices described in this Privacy Policy.

For more information about how your information is protected on this website, see the Security Information.

Types and Uses of Personal Information

By necessity, the site keeps track of personal information required for benefit enrollment. This personal information may include:

• Your name, Social Security Number, date of birth, gender, mailing address, phone number, and e-mail address.
• Personal information about dependents and family members who might be insured or named as beneficiaries.
• Employment information, work history, and salary information.
• Medical information, also known as Personal Health Information ("PHI"), disclosed during the enrollment or application process.

Certain other information may be collected automatically during your use of the website. This general information includes:

• Your Internet domain,
• Your IP address,
• The list of pages you access,
• The time and date of access.

Personal information and automatically collected information is kept strictly confidential by the Sponsor and is used for internal purposes only, including, without limitation, providing you with requested services, improving our marketing and promotional efforts, statistically analyzing web site usage, improving our content and web site offerings, and to customize our web sites' content and layout. Except as disclosed in this Privacy Notice, the Sponsor will not sell, lend, rent, or otherwise disclose any personal information to any third parties. However, your personal information may be shared with affiliates, agents, or contractors of the Sponsor in the course of providing the services.

HIPAA Information

In the course of using this website, you may share information that qualifies as Protected Health Information ("PHI") under the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"). Please refer to the HIPAA Notice for information about PHI may be used and disclosed.

User Profile

Your User ID and Password (or Personal Identification Number) provide access to the site and are associated with your user profile. Your user profile may contain preferences, such as language, email format, and interests.

Cookies

Cookies are pieces of information that a web site transfers to an individual's hard disk for record keeping purposes. The website uses cookies to keep track of your on-line session, which allows the web server to keep track of information as you navigate from page to page. Most internet browsers enable you to erase cookies from your computer hard drive, block all cookies, or receive a warning before a cookie is stored. Please note that the website may not function properly if you block cookies entirely.

Disclosure Required by Law

Under certain circumstances, the Sponsor may be required to disclose information to federal or state authorities. The sponsor may disclose any information about you to law enforcement or other government officials that we, in our sole discretion, believe necessary or appropriate. By accepting this Privacy Policy, you specifically authorize us to do so.

External Links

The website may contain links to other internet web sites. We encourage all of our partners, contributors, and third parties to implement policies and practices that respect the privacy of our users. However, the Sponsor is not responsible for the privacy practices or the content of such web sites. To the extent that you disclose your information to other parties, even if they are linked from this website, different rules may apply to the use or disclosure of personal information you disclose to them. Because the Sponsor does not control the privacy policies of third parties, you are subject to the privacy customs and policies of that third party.

Public Forums

The Sponsor may provide its users with chat rooms, forums, message boards, and/or news groups. Please remember that any information disclosed in these areas becomes public information and you should exercise caution when deciding to disclose your personal information.

Amendments and Updates

Please note that we review our privacy practices from time to time, and that such practices are subject to change. The Sponsor reserves the right to change this privacy notice at any time by posting revisions on the web site. We ask that you periodically review this page to insure familiarity with the most current version of our Privacy Policy. However, this Privacy Policy is not intended to, and does not, create any contractual or other legal rights in or on behalf of any party.

Business Transfers

In the course of business, the Sponsor, or substantially all of its assets may be acquired. In such a transaction, customer information will of course be one of the transferred business assets.

Feedback

If you have any comments, questions, or concerns about this Privacy Policy, please contact us by e-mail or standard mail at the address given in the Terms of Use Agreement. Our business changes constantly, and we welcome your feedback.

This website provides access to enroll in benefits provided by your employer or group. By necessity, the site keeps track of personal information required for benefit enrollment. This Terms of Use Agreement (the "Agreement") consists of two important parts:

• Consent to Enroll Electronically – a statement on your part permitting the general use of electronic records and electronic signatures.
• Terms and Conditions – a legal notice describing certain conditions of use and limitations on the site sponsor's liability.

Please review the Agreement carefully before you use the website.

Portions of the website is licensed by Selerix Systems, Inc. to TBX Employee Benefits, LLC, a Texas Limited Liability Company (herein referred to as the "Sponsor"). By using this website, associated software, services, media, printed material, electronic documentation, and related materials (the "Product"), you are accepting the terms of this Agreement. If you are not willing to be bound by the terms of this Agreement, you may not access or otherwise use the Product. Your continued use of the Product indicates your acknowledgement that you have read, understand and accept the terms and conditions in this Agreement. This Agreement represents the entire agreement concerning the Product between you and the Sponsor, and it supersedes any prior proposal, representation, or understanding between the parties.

Please note that the permitted use of your personal information is limited and set forth in the Privacy Policy. Your personal information is protected by extensive technological, physical, and organizational safeguards, as described in the Security Information.

Consent to Enroll Electronically

This is an electronic enrollment for personal insurance coverage using electronic records, transactions, and signatures. By completing this electronic enrollment process, you understand and are consenting to be bound by the terms and conditions of the insurance policies for which you are enrolling and are adopting this electronic enrollment process with the intent that completing such process will serve as your electronic signature.

By presenting your user ID and password (or Personal Identification Number) you agree to conduct this transaction by electronic means and understand that this transaction will be submitted electronically. Your electronic signature will be as legally binding and enforceable as if you had signed on paper.

Following the enrollment, the companies that administer your coverage may deliver your insurance policies or certificates to you by mail, electronic mail, or through the Internet. The company may or may not offer access to certain electronic records of your enrollment through the Internet.

Terms and Conditions

By using the Product in relation to an application for insurance, you agree with the following Terms and Conditions (the "Terms ") without limitation or qualification. Please read these Terms carefully before using the Product. If you do not agree with these Terms, you are not granted permission to use this Web site and must exit this Web site immediately. The Sponsor may revise these Terms at any time by updating this posting. You are bound by any such revisions and should therefore periodically visit this page to review the current Terms governing the Product.

Disclaimer

To the fullest extent permissible, the Product is provided "as is" and without warranties of any kind, either expressed or implied. The Sponsor, its officers, directors, employees, and agents (collectively "Representatives") and suppliers disclaim all warranties, including, but not limited to, implied warranties of merchantability and fitness for a particular purpose.

Neither the Sponsor, its Representatives, nor suppliers warrant that the Product will be uninterrupted or error–free, that defects will be corrected, that the Product is free of defects, or that they will bear the cost, in whole or in part, for correcting any defects.

This Product may be linked to websites that are not maintained by the Sponsor. Neither the Sponsor nor its representatives or suppliers, are responsible for the contents of other such websites. The inclusion of any link to such websites does not imply approval of or endorsement by the Sponsor, its Representatives, or suppliers.

TBX NON–FIDUCIARY ROLE.

TBX EmployBenefits, LLC (TBX) facilitates the referral or placement of insurance coverage and related Services as a producer acting on behalf of its clients who maintain insurance benefit programs for their employees or other participants ("Program Sponsor"). TBX may also facilitate the referral or placement of other insurance coverage and services. TBX is not a fiduciary to you or your plan. Neither TBX, your Program Sponsor nor this TBX website recommends any particular coverage or service for you, or makes any representation or warranty that any coverage or service you obtain through TBX is best aligned with your own needs. Coverage and service options available to you through TBX are limited to those selected by your Program Sponsor and presented to you on TBX. While the TBX tools may indicate certain benefit options are the "best match" based on your answers to certain "Benefit Guru" questions you will encounter on the website. You are responsible for independently ensuring that your selection of coverage or service through TBX is appropriate for you. You may bypass the TBX "best match" tool and can choose any coverage and service from options selected by your Program Sponsor, regardless of whether TBX designates it as a "best match" for you.

TBX'S COMPENSATION.

In accordance with industry custom, TBX's compensation includes commissions paid by insurers that are calculated as a percentage of the insurance premiums those insurers collect for the coverage you obtain. The rate of commissions paid to TBX and resulting commission payment amounts may vary depending on the type of insurance or service purchased, the insurer or service provider who provides such coverage or service, and other factors such as the volume, growth and/or retention of TBX's book of business with this insurer or service provider. TBX may also receive additional monetary and non–monetary compensation from insurers or others that includes payment for marketing or technology related expenses, and other service fees. TBX's compensation may vary depending on the type of insurance or service purchased, and the insurer or service provider selected.

Limitation of Liability

While the Company and its Representatives or suppliers use reasonable efforts to include accurate and up–to–date information in the Product, errors or omissions may occur. Under no circumstances shall the Sponsor, or its Representatives or suppliers, be liable to you for any direct, incidental, consequential, indirect, or punitive damages that result from the use of, or the inability to use, the Product, even if advised of the possibility of such damages.

Trademarks and Copyrights

Unless otherwise noted, all trademarks, service marks, trade names, logos, icons, and images are proprietary to the Sponsor, its Representatives, or suppliers. Nothing contained in the Product should be construed as granting any license or right to use any of the foregoing without the written permission of the Sponsor, its Representatives, or suppliers, as applicable. Your use of any of the foregoing, except as provided herein, is strictly prohibited and may violate copyright laws, trademark laws, the laws of privacy and publicity, and communications regulations and statutes.

Software Licenses

You acknowledge that any software which may be available or provided to you in the Product may contain technology that is subject to strict controls pursuant to export control laws and regulations of the United States of America and other countries and jurisdictions. You hereby agree that you will not transfer or export such software in violation of such applicable export laws and regulations. Neither the Sponsor, its Representatives, nor suppliers authorize the downloading or export of any software or technical data from the Product to any jurisdiction prohibited by such export controls laws and regulations.

Jurisdiction

This Agreement shall be construed and governed in accordance with the laws of the state of Texas without reference to its conflict of law rules. The application of the United Nations Convention on Contracts for the International Sale of Goods is expressly excluded. Should any term of this Agreement be declared void or unenforceable by any court of competent jurisdiction, such declaration shall have no effect on the remaining terms hereof. No modification or waiver of this Agreement or any provisions shall be binding unless made in writing and signed by the parties hereto. The failure of either party to enforce any rights granted hereunder or to take action against the other party in the event of any breach hereunder shall not be deemed a waiver by that party as to subsequent enforcement of rights or subsequent actions in the event of future breaches.

The Parties desire to facilitate certain transactions pursuant to this Agreement by exchanging documents, records and signatures electronically or by utilizing electronic agents. The use of electronic facilities or agents shall be in accordance with procedures established by the Sponsor and governed by the applicable provisions of the Uniform Electronic Transactions Act as adopted in the governing jurisdiction.

Should you have any questions concerning this Agreement, or if you desire to contact the Sponsor for any reason, please contact:

General Council
TBX Employee Benefits
1201 Elm St, Suite 4250
Dallas, TX 75270

In the course of using this website, you may share information that qualifies as Protected Health Information (“PHI”) under the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”). PHI is information created or received by us during your use of the site which identifies you, or for which there is a reasonable basis to believe the information can be used to identify you, and that relates to:

• the past, present or future physical or mental health condition of the individual; or
• the provision of health care to the individual; or
• the past, present or future payment for the provision of health care to the individual.

HIPAA, and other related federal and state legislation, defines a set of rules governing how companies maintain the privacy of customers’ PHI. HIPAA also requires that we provide customers with notice of our legal duties and privacy practices with respect to your PHI. This HIPAA Notice describes how we may use and disclose PHI to perform enrollment, claims handling, payment, general insurance operations, and for other purposes that are permitted or required by law.

Uses and Disclosures of PHI with Your Written Authorization

Except as described in the next section of this Notice, we will not use or disclose your PHI for any purpose unless you have signed a form authorizing the use or disclosure. You have the right to revoke that authorization in writing at any time. However, any action already taken by the Plan or others in reliance on the authorization cannot be changed.

Uses and Disclosures of PHI Without Your Written Authorization

For Payment. We may make use of and disclose your PHI without your written authorization as may be necessary for payment purposes. For example, we may use information regarding your medical procedures and treatment to process and pay claims or certify these services are covered under your Plan.

For Administrative Operations. We may make use of and disclose your PHI without your written authorization as necessary for our administrative operations. Administrative operations include our usual business activities, examples of which are management, licensing, peer review, quality improvement and assurance, enrollment, underwriting, reinsurance, compliance, auditing, rating, claims handling, complaint handling and other functions related to your benefits.

To Individuals Involved in Your Care. We may, without your written authorization, for the purposes of treatment, payment, or administrative operations, disclose the fact that you are covered under a plan or that payment has been processed to a family member, other relative, your close personal friend, or any other person you may identify. In these circumstances, we would not disclose any PHI which is not directly relevant to that person’s involvement with your care or with payment for your care.

If you have designated a person to receive information regarding payment of the premium or pay premium via credit card, we may inform that person or credit card facility when your premium has not been paid or received.

We may also disclose limited PHI to a public or private entity that is authorized to assist in disaster relief efforts in order for that entity to locate a family member or other persons that may be involved in some aspect of caring for you.

To Business Associates. Certain aspects and components of our services are performed through contracts with outside persons or organizations. Examples of these may include, but are not limited to insurance agents, financial auditors, reinsurers, legal services, enrollment and billing services, claim payment, and medical management services. We may provide access to your PHI without your written authorization to one or more of these outside persons or organizations who assist with payment or administrative operations. The Sponsor requires these business associates to safeguard the privacy of your information appropriately.

For Other Products and Services. The Sponsor may contact you without your written authorization to provide information regarding upgrades or additional benefits that may be of interest to you. For example, we may use the fact that you currently are insured under a plan for the purpose of communicating to you about changes to the plan or products that could enhance or add value to existing coverage.

For Other Uses and Disclosures. We are permitted or required by law to make some other uses and disclosures of your PHI without your authorization:

• If required by law to a government oversight agency conducting audits, investigations, or civil or criminal proceedings.
• If required to do so by a court or administrative ordered subpoena or discovery request. In most cases, you will have notice of such a release.
• For public health activities, such as required reporting of disease, injury, birth and death and for required public health investigations.
• To law enforcement officials as required by law to report wounds, injuries or crimes.
• As required by law if we suspect child abuse or neglect or if we believe you to be a victim of abuse, neglect or domestic violence.
• To the Food and Drug Administration if necessary to report adverse events, product defects, or to participate in product recalls.
• To coroners and/or funeral directors, consistent with law.
• For a national security or intelligence activity or, if you are a member of the military, as required by the armed forces.
• To workers' compensation agencies if necessary for workers' compensation benefit determination.

Unless otherwise excluded in this Notice, we will not disclose your PHI to any person or entity not specifically mentioned elsewhere in this Notice without your express written authorization.

Your Rights

Right to Inspect and Copy Your PHI. You may have access to our records that contain your PHI in order to inspect and obtain copies of the records. Under limited circumstances, we may deny you access to a portion of your records. If you desire access to your records, please submit a written request to the Privacy Office at the address noted in the Terms of Use Agreement. If you request copies, we may charge you copying and mailing costs.

Right to Amend Your PHI. You have the right to request that we amend your PHI maintained in our records. If you desire to amend these records, please submit an amendment request in writing to the Privacy Office at the address noted in the Terms of Use Agreement. We will comply with your request unless special circumstances apply. If your physician or other health care provider created the information that you desire to amend, you should contact the provider to amend the information.

Right to an Accounting of the Disclosures of Your PHI. Upon request, you may obtain an accounting of certain disclosures of your PHI made by us, excluding disclosures made earlier than six years before the date of your request. If you request an accounting more than once during any 12-month period, we will charge you a reasonable fee for the subsequent accounting statements.

Right to Request Confidential Communications. We will accommodate your reasonable request to receive communications of your PHI from us by alternative means of communication or at alternative locations if the request clearly states that disclosure of that information could endanger you.

Right to Request Restrictions on Use and Disclosure of Your PHI. You restrictions on some of our uses and disclosures of your PHI for medical treatment, payment, or administrative operations by notifying us of your request for a restriction in writing to the Privacy Office at the address noted in the Terms of Use Agreement. Your request must describe in detail the restriction you are requesting. We are not required to agree to your restriction request but will attempt to accommodate your requests. We retain the right to terminate an agreed-to restriction. In the event of a termination of an agreed-to restriction by us, we will notify you of such termination, but the termination will only be effective for PHI we receive after we have notified you of the termination. You also have the right to terminate any agreed-to restriction by contacting us in writing, as indicated above.

Personal Representatives. You may exercise your rights through a personal representative who will be required to produce evidence of his or her authority to act on your behalf. Proof of authority may be made by a notarized power of attorney, a court order of appointment of the person as your legal guardian or conservator, or if you are the parent of a minor child. We reserve the right to deny access to your personal representative.

Right to Receive Paper Copy of this Notice. You may obtain a copy of this Notice. You may obtain a paper copy of this Notice even if you agreed to receive such notice electronically. Please contact us and we will mail it to you.

Subject to Change

We may change the terms of this Notice at any time. If we change this Notice, we may make the new terms effective for all of your PHI that we maintain, including any information we created or received prior to issuing the new notice.

Complaints

If you believe your privacy rights have been violated, you can file a complaint with us or with the Secretary of the U.S. Department of Health and Human Services. To file a complaint with us, send it in writing to the Privacy Office at the address noted in the Terms of Use Agreement. There will be no retaliation for filing a complaint.