Privacy Policy
Effective Date: January 1, 2026
Last Updated: August 26, 2026
1. Introduction and Scope
EBA Hub LLC d/b/a Benegrate (“Benegrate,” “we,” “us,” or “our”) is a third-party administrator of employer-sponsored benefit and human resources programs. This Privacy Policy describes how we collect, use, disclose, and safeguard personal information in connection with the services we provide and the websites we operate.
Our services include benefits administration and eligibility management, payroll and carrier data exchange, carrier billing and reconciliation, COBRA administration, leave administration and compliance operations, consumer-directed health plan administration (including health and dependent care flexible spending accounts, health savings account coordination, ICHRA, and Section 125 cafeteria plans), and benefit card programs including New York wage parity.
This Policy applies to:
- Participants — employees of our client employers who are enrolled in, or eligible for, a benefit program we administer;
- Dependents, spouses, and beneficiaries — individuals covered under, or eligible for, a participant’s benefits, including COBRA qualified beneficiaries;
- Client and employer users — personnel of our client employers, and brokers or enrollment partners, who access our administrative systems; and
- Website visitors — individuals who visit benegrate.com.
Relationship to your employer. Benegrate acts as a service provider to your employer or plan sponsor, which determines eligibility, benefit levels, and plan design. We administer those programs on their behalf. We do not sell insurance and we do not provide advice regarding your benefit elections. Where your employer’s own privacy practices govern the information they provide to us, their policies apply in addition to this one.
Health plan information. Some programs we administer — including health flexible spending accounts, health reimbursement arrangements, and COBRA continuation of group health coverage — are subject to the Health Insurance Portability and Accountability Act (“HIPAA”). Where we administer such a plan, we do so as a business associate of the plan, and our handling of protected health information is governed by our business associate agreement with the plan and by HIPAA, in addition to this Policy. Where the two differ, HIPAA and the business associate agreement control.
2. Information We Collect
2.1 Information provided by your employer or its vendors
We receive personal information from your employer, or from the payroll, human resources, or benefits administration vendor your employer has designated to transmit it on their behalf:
- Full name, residential mailing address, telephone number, and email address
- Date of birth and Social Security number
- Employee identification number and employer identification number
- Employment status, hire and termination dates, job classification, and work location
- Benefit eligibility dates, plan elections, coverage tiers, and contribution or deduction amounts
- Qualifying life events and leave of absence dates
- The same categories of information for your spouse, dependents, and beneficiaries where they are enrolled in or eligible for coverage
2.2 Information generated through plan administration
- Enrollment and eligibility records exchanged with insurance carriers, including 834 eligibility files
- Premium amounts, billing records, payments, remittances, and account balances
- COBRA qualifying events, election records, notice delivery records, and premium payment history
- Flexible spending account and reimbursement arrangement claims, including claim dates, amounts, providers or merchants, and substantiation status
- Leave of absence records, including leave dates, benefit continuation status, and premium collection during leave
- Reconciliation, discrepancy, and correction records
2.3 Information generated through use of a benefit card
Where your employer’s program includes a benefit card:
- Card identifiers, including the last four digits of the card number
- Card status and issuance, mailing, activation, and expiration dates
- Transaction records, including transaction date, posting date, amount, merchant name, merchant location, and merchant category code
- Authorization outcomes, including approvals, declines, and decline reasons
- Account balances and available funds
2.4 Information you provide directly
- Communications you send us by telephone, text message, email, or through a participant portal
- Identity verification information, which may include the last four digits of your Social Security number, your date of birth, or your postal code
- Documentation you submit in support of a claim, an election, or an appeal
- Recordings of telephone calls to our support line, which may be recorded for quality assurance and training purposes
2.5 Information collected automatically
We do not use cookies, web beacons, analytics services, or other tracking technologies on benegrate.com. We do not collect information about your device or browsing activity when you visit our website.
3. How We Use Personal Information
We use personal information to administer the programs our clients have engaged us to administer, and for related operational purposes:
- Eligibility and enrollment — to enroll participants and dependents, process qualifying life events, maintain eligibility records, and manage plan classes and annual renewals;
- Carrier data exchange — to build, transmit, monitor, and reconcile eligibility files with insurance carriers;
- Payroll coordination — to align deduction codes, reconcile payroll to benefits, and process retroactive adjustments and corrections;
- Billing and reconciliation — to audit carrier invoices, reconcile eligibility to billing, resolve discrepancies and overpayments, and coordinate direct billing;
- COBRA administration — to identify qualifying events, coordinate required notices, process elections, and track premium payments and coverage continuity;
- Leave administration — to determine leave eligibility, maintain benefit continuity, collect premiums during unpaid leave, and process return-to-work reinstatement;
- Consumer-directed plan administration — to process and substantiate claims, track contributions against limits, and coordinate reimbursements;
- Benefit card services — to issue, mail, activate, replace, and deactivate cards, load funds, and authorize or decline transactions under the rules your employer has approved;
- Participant support — to respond to inquiries by telephone, text message, email, or portal;
- Notifications — to send service communications regarding your account, coverage, or card;
- Reporting — to provide participation, utilization, funding, and reconciliation reporting to your employer;
- Fraud prevention and security — to detect, investigate, and prevent fraudulent, unauthorized, or unlawful activity; and
- Legal and regulatory compliance — to satisfy our legal, tax, audit, recordkeeping, and contractual obligations, including ACA data coordination and reporting support.
We do not sell personal information. We do not share personal information with third parties for their own direct marketing or cross-context behavioral advertising purposes. We do not use personal information for advertising or profiling.
4. How We Disclose Personal Information
We disclose personal information only as described below.
4.1 Your employer or plan sponsor, and the brokers or enrollment partners it has authorized — to confirm enrollment, provide participation, utilization, funding, and reconciliation reporting, and enable your employer to meet its own legal and contractual obligations.
4.2 Insurance carriers and plan providers — to enroll and maintain coverage, transmit eligibility, resolve billing, and coordinate claims and continuation of coverage.
4.3 Service providers. We engage third parties to perform services on our behalf. Each is contractually restricted to using personal information solely to provide services to us, and is prohibited from using it for any independent purpose. The categories of service provider we use are:
| Category | Function | Examples |
|---|---|---|
| Benefits administration platforms | Systems of record for eligibility, accounts, claims, and reporting | DataPath |
| Payroll and HR platforms | Eligibility and demographic data exchange; employee self-service portal integration | Employee Navigator, and the payroll or HR system your employer uses |
| Card processing and issuing | Card issuance, authorization, settlement, and automated telephone servicing | Fiserv; the issuing bank; Visa and Mastercard |
| Communications | Text message delivery and telephone call routing | Twilio |
| Banking | Funds movement to and from benefit and premium accounts | Our depository bank |
| Professional advisors | Legal, accounting, audit, and tax services | — |
Examples are illustrative and may change as our operations change. A current list of the service providers used in connection with a specific program is available to that program’s plan sponsor on request.
4.4 Legal and regulatory disclosures — where required by applicable law, regulation, legal process, subpoena, court order, or governmental request, or where necessary to establish, exercise, or defend legal claims.
4.5 Business transfers — in connection with a merger, acquisition, reorganization, financing, or sale of all or part of our business, personal information may be transferred as an asset of the transaction. We will require any successor to honor the commitments in this Policy.
4.6 Text messaging data. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All of the categories above exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.
5. Text Message and Telephone Communications
5.1 Service messages. Where your employer has provided your mobile telephone number, we may send text messages relating to your benefits or benefit card, including enrollment and coverage notices, card issuance and delivery notifications, transaction declines, and account funding notices. These are transactional service messages relating to your account and are not marketing communications.
5.2 Message frequency and cost. Message frequency varies based on account activity. Message and data rates may apply.
5.3 Opt-out. You may opt out of text messages at any time by replying STOP to any message. You will receive a single confirmation message and no further messages thereafter. To resume messages, reply START. For assistance, reply HELP or contact us at (888) 905-6851, Monday through Friday, 9:00 a.m. to 5:00 p.m. Eastern Time.
5.4 Telephone calls. Calls to our support line may be recorded for quality assurance and training purposes. Our automated telephone system requires identity verification before disclosing account information.
6. Single Sign-On and Portal Integrations
Where your employer maintains an employee self-service portal — typically provided by its payroll or human resources vendor — you may be able to access your Benegrate benefit information through that portal without separate authentication. Upon first access, you will be presented with a consent screen and asked to authorize the connection. Once authorized, subsequent access proceeds directly.
Benegrate does not receive your employer portal credentials, and your employer does not receive Benegrate authentication credentials. The portal transmits an identity assertion; we return your benefit account information.
7. Data Retention
We retain personal information for the duration of our administration of your employer’s programs and thereafter for a period of seven (7) years, or such longer period as required by applicable law, our contractual obligations, or our recordkeeping and audit requirements. Certain records, including those relating to COBRA notices and elections and to ERISA plan administration, may be retained for longer where the law requires. Upon expiration of the applicable retention period, we delete or de-identify the information.
8. Information Security
We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These measures include role-based access controls limiting internal access to personal information, encryption of data in transit, and contractual security requirements imposed on our service providers.
Consistent with the New York Stop Hacks and Improve Electronic Data Security (SHIELD) Act, we maintain a data security program for the private information of New York residents.
No method of transmission or storage is completely secure. In the event of a security breach affecting your personal information, we will provide notification as required by applicable law.
9. Your Rights and Choices
9.1 Correcting enrollment information. Enrollment and eligibility data originates with your employer. To correct your name, address, date of birth, Social Security number, dependent information, or other enrollment information, contact your employer’s human resources or benefits department. Corrections are transmitted to us by your employer; we are not able to modify enrollment records independently.
9.2 Account and card servicing. To ask about a claim, a premium, a reimbursement, or a benefit card, or to report a card lost or stolen, contact us at (888) 905-6851.
9.3 Text message preferences. See Section 5.3.
9.4 Health plan information. Where we administer a plan subject to HIPAA, your rights with respect to protected health information — including rights of access, amendment, and an accounting of disclosures — are described in that plan’s Notice of Privacy Practices, which is provided by the plan.
9.5 State privacy rights. Depending on your state of residence, you may have the right to request access to the personal information we maintain about you, to request correction of inaccurate information, to request deletion, to obtain a copy in a portable format, and to be free from discrimination for exercising these rights. To submit a request, contact us at info@benegrate.com. We will verify your identity before responding. Where we maintain information on behalf of your employer or a plan, we may direct your request to that employer or plan.
10. Information About Minors
We do not direct our services to children and we do not knowingly collect information directly from anyone under eighteen (18) years of age.
We do, however, receive and maintain information about minor dependents — such as name, date of birth, and Social Security number — where a participant’s children are enrolled in or eligible for a benefit we administer, including as COBRA qualified beneficiaries. That information comes to us from the employer, the plan, or the participant, and we use it only to administer the benefit.
11. Third-Party Websites
Our website and communications may contain links to third-party websites, including those of your employer, insurance carriers, and our service providers. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies.
12. Jurisdiction
Benegrate operates in the United States, and personal information is processed and stored in the United States. Our services are not directed to individuals outside the United States.
13. Changes to This Policy
We may update this Policy from time to time. Any changes will be reflected in the “Last Updated” date above and posted at this address. Where a change materially affects how we handle personal information, we will provide additional notice as required by applicable law.
14. How to Contact Us
Questions, requests, or complaints regarding this Policy may be directed to:
EBA Hub LLC d/b/a Benegrate
400 Rella Boulevard
Montebello, NY 10901
Email: info@benegrate.com
Telephone: (888) 905-6851