Family Privacy Disclosure

Mona Health lets employees add eligible family members (spouses, domestic partners, and dependent children) to their account so those family members can access relevant health and benefits information. This page explains what that means for the personal and health data of the family members you add.

This disclosure applies to family members added through an employee's Mona Health account. It does not cover data practices of your employer's other benefits vendors or any third-party apps your family member may separately connect.

Your Family Member's Mona Health Account

When you add a family member to your Mona Health account, they may be able to:

• View their own coverage, claims, and benefits information
• Complete health assessments, screenings, or wellness program activities assigned to them
• Track personal health metrics (e.g., biometric screening results, activity data) where enabled by your employer's plan
• Message care coordinators or benefits support through the platform
• Receive plan notifications and compliance reminders relevant to them
• Set and manage their own login credentials, separate from yours, once their account is activated

Whether a family member gets their own login or is managed entirely through your account depends on your employer's plan configuration and, for minors, applicable consent requirements.

Controls for the Adding Employee

As the employee who added the account, you can:

• Choose which family members to add or remove, subject to your employer's eligibility rules
• Set visibility permissions controlling what you, versus your family member, can see (e.g., you may see claims summaries but not detailed clinical notes once your family member manages their own account)
• Revoke a family member's platform access if their eligibility ends
• Manage consent for dependents under 18, since minors cannot independently consent to health data processing

HR administrators at your employer do not see individual health data for you or your family members; their access is limited to enrollment, eligibility, and aggregate compliance reporting, as described in our main Privacy Policy.

Data We Collect on Family Members

Depending on which features your employer enables, we may collect:

• Identity and eligibility information (name, date of birth, relationship to employee) needed to verify plan eligibility
• Health data your family member submits or that is generated through platform use (screening results, assessment answers, biometric data, activity/wellness data)
• Usage data (login activity, feature use) for security and support purposes

Health data collected here may be subject to HIPAA depending on your employer's plan type. Where HIPAA applies, it governs how this data is used and disclosed, in addition to this notice.

How We Use This Data

We use family member data to:

• Administer the health benefit or wellness program your employer has enrolled them in
• Provide the account features listed above
• Communicate plan-relevant notices and reminders
• Meet compliance and audit obligations tied to the benefit program
• Improve the security, reliability, and functionality of the platform

We do not use family member health data for advertising, and we do not sell it.

Who We Share It With

• The adding employee, to the extent permitted by the visibility settings above and applicable law
• Your employer, limited to eligibility and aggregate, de-identified reporting — not individual health details, unless your employer is the plan administrator and is legally entitled to specific data under the plan
• Service providers who process data on our behalf (e.g., hosting, claims processing), under contractual confidentiality obligations
• Regulators or authorities, where required by law
• A successor entity, in the event of a merger or acquisition, subject to the same protections described here

We do not share family member data with third parties for their own marketing purposes.

Access, Correction, and Deletion

Family members with their own login can access and update their information directly in their account settings. For dependents who don't yet have independent access, the adding employee can request access, correction, or deletion on their behalf by contacting hello@monahealth.us.

For minors, the parent or guardian who added the account manages these rights until the dependent reaches the age at which they can independently access the platform, per your employer's plan rules.

Consent

By adding a family member to your Mona Health account, you confirm that you are authorized to do so and, where the family member is a minor, that you are providing consent on their behalf for the collection and use of their health data as described here and in our full Privacy Policy.

If you have questions about this disclosure, contact us at hello@monahealth.us.