Your privacy is not for sale. Ever.

1. Who we are

ReachABLE is a public financial platform for people with disabilities, hosted at joinreachable.com. It is built by Professor Michelle Yin with support from the U.S. Department of Health and Human Services under Cooperative Agreement HHS-2026-ACL-AOD-DFLA-0025.

ReachABLE, founded by Michelle Yin, operates this educational website. The arrangements governing the platform's operation under Project ReachABLE are being established.

2. What we collect, and what we do not

What we do not collect, at all

• Social Security numbers
• Medical diagnoses, treatment history, or provider names
• Bank account or credit card numbers
• Voice audio recordings
• Precise geolocation data
• Data from children under 13 without parental consent

What we may collect if you use certain tools

• Eligibility Concierge: Your first name, last name, email, phone, ZIP code, date of birth, disability onset age, and benefits status. This data lives only in your browser session. When you press "Open state portal," the data is passed to your state's ABLE portal as URL parameters. We never store it.
• Ask ReachABLE chatbot: The text of your questions. The chatbot runs in your browser and matches your question against a fixed knowledge base stored in JavaScript. Nothing is sent to ReachABLE servers.
• Anonymous usage data: We may collect page views, referrer, browser type, and country-level location for aggregate analytics. IP addresses are anonymized before storage or discarded. No individual user is identified.

3. How we use information

The narrow set of information we do collect is used only to:

• Deliver the specific feature you asked for (checking eligibility, comparing state plans, sending a monthly digest)
• Improve the tools based on aggregate usage patterns, never individual behavior
• Meet legal obligations, including responses to lawful subpoenas

We do not use your data to train external AI models. We do not use your data for behavioral advertising. We do not use your data to profile you.

4. Who we share information with

We do not sell your data. Ever.

We may share your information with:

• State ABLE program administrators, only at your direction and only when you press "Open state portal." Your data is passed as URL parameters to their site, which has its own privacy policy governing its handling from that point.
• Cloud hosting providers (Hostinger) that provide infrastructure. These providers are contractually bound to not access your data.
• Law enforcement, only in response to valid legal process (subpoena, warrant, court order) and only the minimum information required.

We never share your data with advertising networks, data brokers, insurance companies, credit reporting agencies, or affiliated marketing partners.

5. Voice, speech, and biometric data

When you use the microphone in the Ask ReachABLE chatbot or the voice simulator:

• Your browser converts your speech to text using the built-in Web Speech API. This happens on your device. No audio is uploaded.
• The transcribed text is what we work with, and it is treated the same as if you had typed it.
• We do not build voice fingerprints. We do not use voice for identification. We do not store voice recordings.

This design specifically avoids collection under the Illinois Biometric Information Privacy Act (BIPA) and equivalent Texas and Washington state biometric statutes.

6. Children and youth

ReachABLE serves people of all ages, including children with disabilities. When a parent or guardian uses ReachABLE on behalf of a child under 13, all information provided is treated as parental information, and the parent's rights under this policy apply.

We comply with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal information directly from children under 13 without verifiable parental consent.

7. How we protect your data

Zero-persistence architecture for the free tier is our primary security control. Data that is never stored cannot be breached.

For the narrow set of data we do handle (aggregated analytics), we implement:

• HTTPS with TLS 1.3 for all connections
• Encryption at rest for stored data using AES-256
• Access controls limiting production data access to a minimum set of authorized personnel
• Annual penetration testing beginning Year 1 of the DHHS cooperative agreement
• Security review (in development) audit planned for post-award Year 1

8. Your privacy rights by state

Regardless of where you live in the United States, you have the following rights:

• The right to know what information we have about you
• The right to request correction of inaccurate information
• The right to request deletion of your information
• The right to opt out of any data sharing
• The right to a copy of your data in a portable format
• The right not to be discriminated against for exercising these rights

Depending on your state, additional rights may apply under the California Consumer Privacy Act (CCPA / CPRA), Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act, Utah Consumer Privacy Act, Oregon Consumer Privacy Act, Texas Data Privacy and Security Act, or the New York SHIELD Act. We honor the strictest applicable standard for every user regardless of residence.

To exercise any of these rights, email info@joinreachable.com. We verify your identity and respond within 15 business days for California residents and 45 days for all others (state law maximum).

9. HIPAA and health information

ReachABLE is not a covered entity under the Health Insurance Portability and Accountability Act (HIPAA). We are not a healthcare provider, health plan, or healthcare clearinghouse. Disability status alone is not Protected Health Information (PHI) under HIPAA.

We treat information you share about your disability or benefits carefully. ReachABLE is not a covered entity under HIPAA and does not offer Business Associate Agreements. Please do not enter Social Security numbers, banking credentials, or medical records into ReachABLE educational tools.

If you use ReachABLE to prepare for a conversation with your healthcare provider or benefits counselor, those conversations occur outside ReachABLE and are governed by your provider's or counselor's own privacy practices.

10. Data retention

Free tier: Nothing is retained. Your session ends when you close the tab.

Enterprise tier: Data retention is defined by the applicable Enterprise contract, with a default of three years plus one year post-termination.

11. How to contact us

For privacy questions, requests, or complaints:

Email: info@joinreachable.com

For California residents, you may also file a complaint with the California Attorney General or the California Privacy Protection Agency.

12. Changes to this policy

If we make material changes to this policy, we notify you by posting a prominent notice on joinreachable.com at least 30 days before the changes take effect. For Premium subscribers, we also email you directly. The current version and version history are always available on this page.