This notice supplements our General Privacy Notice and applies only to California residents.
Direct Marketing Requests
California Civil Code Section 1798.83 permits California residents to request information about the manner in which we share personal information with third parties for their direct marketing purposes.
Do Not Track Settings
We honor Do Not Track signals sent by your browser. For more information, visit www.donottrack.us.
California Consumer Privacy Act/California Privacy Rights Act Supplemental Notice
This supplemental notice is provided pursuant to the California Consumer Privacy Act of 2018 (CCPA) as amended by the California Privacy Rights Act of 2020 (CPRA).
Applicability
This notice applies to California residents whose personal information is subject to the CCPA. It does not apply to information exempt under the CCPA, including health information governed by HIPAA or financial information governed by the Gramm-Leach-Bliley Act.
Personal Information
Under the CCPA, "personal information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. For more details about the types of information we collect, please see our General Privacy Notice.
We collect the following categories of personal information as defined by the CCPA:
- Category A: Identifiers (name, email, SSN, etc.)
- Category B: California Customer Records (Cal. Civ. Code § 1798.80(e))
- Category C: Protected classification characteristics
- Category D: Commercial information
- Category E: Biometric information
- Category F: Internet or similar network activity
- Category G: Geolocation data
- Category H: Sensory data
- Category I: Professional or employment-related information
- Category J: Non-public education information
- Category K: Inferences drawn from other personal information
- Category L: Sensitive personal information
Retention
We retain personal information for as long as necessary to fulfill the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements. For details about our retention practices, please refer to our General Privacy Notice.
Categories of Sources of Personal Information
We collect personal information from various sources, including directly from you, from your employer or benefits administrator, from service providers, and from publicly available sources. For a detailed description of sources, please see our General Privacy Notice.
How We Use and Share Personal Information For Business or Commercial Purposes
We use and disclose personal information for business or commercial purposes as described in our General Privacy Notice. We may also share personal information with service providers and contractors who perform services on our behalf, in accordance with our Terms of Use.
No Sale of Personal Information
HealthEquity does not sell your personal information as defined by the CCPA.
Consumer Rights
California residents have the following rights under the CCPA:
- Right to Know, Access, Rectify, and/or Delete your personal information
- Right to Opt-out of Sale or Sharing of personal information
- Right to Limit Use of Sensitive Personal Information
- Right to Non-Discrimination for exercising your rights
To exercise your rights, you may submit a request through our Data Subject Access Requests portal, or for teammates through the Teammate Data Subject Access Requests portal, or by emailing datasubjectrequest@healthequity.com.
Verification
We will verify your identity before fulfilling your request by matching information you provide with information in our records.
Agent Authorization
You may designate an authorized agent to submit requests on your behalf. We may require the agent to provide written authorization and verify your identity directly.
Notice of Financial Incentive
HealthEquity does not offer any financial incentive programs that require CCPA disclosure at this time.
Changes to Our Privacy Notice
We may update this notice from time to time. When we make changes, we will revise the effective date. We encourage you to review our privacy notices periodically. For the complete privacy notice, please visit here.
Requesting Notice in Alternative Format/Language
If you need this notice in an alternative format or language, please contact us using the information below. You may also refer to our Team Member Privacy Notice for employment-related privacy information.
Contact Information
If you have questions about this notice or wish to exercise your rights, you may contact us at:
HealthEquity, Inc.
15 W Scenic Pointe Dr, Ste 100
Draper, UT 84020
Phone: 1-866-629-6347
Phone: 1-801-727-1000
Email: Privacy@healthequity.com
Effective Date
This notice is effective as of October 2025.