Your privacy is not for sale. Ever.

1. Who we are

ReachABLE is a public financial platform for people with disabilities, hosted at joinreachable.com. It is built by Professor Michelle Yin with support from the U.S. Department of Health and Human Services under Cooperative Agreement HHS-2026-ACL-AOD-DFLA-0025.

The data controller for the free consumer tier is Northwestern University, 2120 Campus Drive, Evanston, IL 60208. For ReachABLE Premium and Enterprise clients, the data controller may be ReachABLE Inc. or the licensing institution as specified in the applicable agreement.

2. What we collect, and what we do not

What we do not collect, at all

• Social Security numbers
• Medical diagnoses, treatment history, or provider names
• Bank account or credit card numbers
• Voice audio recordings
• Precise geolocation data
• Data from children under 13 without parental consent

What we may collect if you use certain tools

• Eligibility Concierge: Your first name, last name, email, phone, ZIP code, date of birth, disability onset age, and benefits status. This data lives only in your browser session. When you press "Open state portal," the data is passed to your state's ABLE portal as URL parameters. We never store it.
• Ask ReachABLE chatbot: The text of your questions. The chatbot runs in your browser and matches your question against a fixed knowledge base stored in JavaScript. Nothing is sent to ReachABLE servers.
• ReachABLE Premium (when launched): Only what you provide when signing up: name, email, saved family profiles (with your explicit save action), and billing information processed by our payment processor. See Section 3.
• Anonymous usage data: We may collect page views, referrer, browser type, and country-level location for aggregate analytics. IP addresses are anonymized before storage or discarded. No individual user is identified.

3. How we use information

The narrow set of information we do collect is used only to:

• Deliver the specific feature you asked for (checking eligibility, comparing state plans, sending a monthly digest)
• Improve the tools based on aggregate usage patterns, never individual behavior
• Send you Premium subscription communications you have opted into
• Meet legal obligations, including responses to lawful subpoenas

We do not use your data to train external AI models. We do not use your data for behavioral advertising. We do not use your data to profile you.

4. Who we share information with

We do not sell your data. Ever. This is a written contractual commitment in our governance charter and cannot be changed without notification to every user.

We may share your information with:

• State ABLE program administrators, only at your direction and only when you press "Open state portal." Your data is passed as URL parameters to their site, which has its own privacy policy governing its handling from that point.
• Payment processors for ReachABLE Premium billing. We use industry-standard providers (Stripe or similar) that are PCI-DSS certified.
• Cloud hosting providers (Hostinger, and later AWS or Azure for Premium) that provide infrastructure. These providers are contractually bound to not access your data.
• Law enforcement, only in response to valid legal process (subpoena, warrant, court order) and only the minimum information required.

We never share your data with advertising networks, data brokers, insurance companies, credit reporting agencies, or affiliated marketing partners.

5. Voice, speech, and biometric data

When you use the microphone in the Ask ReachABLE chatbot or the voice simulator:

• Your browser converts your speech to text using the built-in Web Speech API. This happens on your device. No audio is uploaded.
• The transcribed text is what we work with, and it is treated the same as if you had typed it.
• We do not build voice fingerprints. We do not use voice for identification. We do not store voice recordings.

This design specifically avoids collection under the Illinois Biometric Information Privacy Act (BIPA) and equivalent Texas and Washington state biometric statutes.

6. Children and youth

ReachABLE serves people of all ages, including children with disabilities. When a parent or guardian uses ReachABLE on behalf of a child under 13, all information provided is treated as parental information, and the parent's rights under this policy apply.

We comply with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal information directly from children under 13 without verifiable parental consent.

7. How we protect your data

Zero-persistence architecture for the free tier is our primary security control. Data that is never stored cannot be breached.

For the narrow set of data we do handle (Premium account information, aggregated analytics), we implement:

• HTTPS with TLS 1.3 for all connections
• Encryption at rest for stored data using AES-256
• Access controls limiting production data access to a minimum set of authorized personnel
• Annual penetration testing beginning Year 1 of the DHHS cooperative agreement
• SOC 2 Type II audit planned for post-award Year 1

8. Your privacy rights by state

Regardless of where you live in the United States, you have the following rights:

• The right to know what information we have about you
• The right to request correction of inaccurate information
• The right to request deletion of your information
• The right to opt out of any data sharing
• The right to a copy of your data in a portable format
• The right not to be discriminated against for exercising these rights

Depending on your state, additional rights may apply under the California Consumer Privacy Act (CCPA / CPRA), Virginia Consumer Data Protection Act (VCDPA), Colorado Privacy Act (CPA), Connecticut Data Privacy Act, Utah Consumer Privacy Act, Oregon Consumer Privacy Act, Texas Data Privacy and Security Act, or the New York SHIELD Act. We honor the strictest applicable standard for every user regardless of residence.

To exercise any of these rights, email privacy@joinreachable.com. We verify your identity and respond within 15 business days for California residents and 45 days for all others (state law maximum).

9. HIPAA and health information

ReachABLE is not a covered entity under the Health Insurance Portability and Accountability Act (HIPAA). We are not a healthcare provider, health plan, or healthcare clearinghouse. Disability status alone is not Protected Health Information (PHI) under HIPAA.

That said, we treat all information you share about your disability or benefits with HIPAA-grade care. For Enterprise clients (financial institutions and employers) who require it, we make a Business Associate Agreement (BAA) available on request even though we do not legally need to sign one.

If you use ReachABLE to prepare for a conversation with your healthcare provider or benefits counselor, those conversations occur outside ReachABLE and are governed by your provider's or counselor's own privacy practices.

10. Data retention

Free tier: Nothing is retained. Your session ends when you close the tab.

Premium tier: We retain your subscription account information for as long as your subscription is active, plus seven years after cancellation for tax and legal recordkeeping. You can request earlier deletion of your account, and we honor that unless legally prohibited.

Enterprise tier: Data retention is defined by the applicable Enterprise contract, with a default of three years plus one year post-termination.

11. How to contact us

For privacy questions, requests, or complaints:

Email: privacy@joinreachable.com

Postal mail: ReachABLE Privacy Officer, c/o RISEI Lab, Northwestern University, 2120 Campus Drive, Evanston, IL 60208

For California residents, you may also file a complaint with the California Attorney General or the California Privacy Protection Agency.

12. Changes to this policy

If we make material changes to this policy, we notify you by posting a prominent notice on joinreachable.com at least 30 days before the changes take effect. For Premium subscribers, we also email you directly. The current version and version history are always available on this page.