Categories of Information We May Collect and How We Collect It

We may collect information directly from you and from other sources to provide the products and services you have requested, to service your policy and to determine your eligibility for other products and services. We may collect the following categories of information about you from the following sources:

• Information we receive from you on applications, or other forms and other oral, written or electronic communications, such as your name, address, Social Security number, assets, income and medical information;
• Information about your transactions with us or others, such as transaction history, policy coverage, premiums, payment history and claims history;
• Information we receive from third parties, including consumer reporting agencies and persons providing services in connection with your transactions, such as credit reports, driving records and medical claims;
• Information collected from our Internet websites, such as information you provide to us and information necessary to manage your online session with us; and
• Information we obtain from health care providers about your past and current health condition.

Disclosure of Information to Third Parties

We do not disclose information about you to third parties, except as required or permitted by law. For example, in the course of our general business practices, we may disclose information contained in applications and other forms we collect, as previously described, to the following types of third parties for the reasons described:

• To a third party to perform a business, professional or insurance function for us;
• To an insurance company, agent, insurance support organization or self-insurer to detect or prevent fraud, criminal activity or misrepresentation in connection with an insurance transaction;
• To an insurance company, agent or insurance support organization to perform a function in connection with an insurance transaction involving you;
• To a medical care provider to verify coverage or benefits;
• To an insurance regulatory authority, law enforcement or other governmental authority to prevent or prosecute fraud, or if we believe you have conducted illegal activities; and
• To a group policyholder for the purpose of reporting claims experience.

In addition, where permitted by law, we may disclose the information we collect about you, as previously described, to other companies that perform marketing services on our behalf and to companies with which we have joint marketing agreements.

Disclosure of Medical Information

We will not use or share personally identifiable medical information with our affiliates or with third parties except for the purpose of underwriting or administering your insurance account, policy, or claim, and as otherwise required or permitted by law, such as disclosures to insurance regulatory authorities or in response to a subpoena. We do not use or share personally identifiable medical information for marketing purposes.

Notification of Your Right to Opt-Out of Certain Disclosures

If you prefer that we not disclose non-public personal information about you to non-affiliated third parties, you may opt out of those disclosures; that is, you may direct us not to make those disclosures (other than those disclosures that are expressly permitted by law).

If you wish to opt-out of such disclosures to non-affiliated third parties, you may call us at (319) 364-5193 or (800) 798-4080. We will provide you with a required signatory form. Unless you elect otherwise, your opt-out will pertain to all of the accounts we have on record for you.

Please note: If you are a new customer, we can begin sharing your information thirty (30) days from the date we delivered this notice. If a time comes when you are no longer our customer, we will continue to share your information as described in this notice and pursuant to our record retention practices. However, you can contact us at any time to limit our sharing.

Our Security Procedures

We maintain physical, technical, and administrative safeguards that comply with federal guidelines to protect customer information. Our employees are bound by confidentiality agreements and policies to access customer information only for legitimate business purposes and to keep information about you confidential.

Other Privacy Protections

Certain jurisdictions extend enhanced personal information rights to residents of or persons located in the jurisdiction. You may have some or all of the following rights in relation to the personal information we collect about or from you, depending on the jurisdiction and our reason for processing your information:

• Right of access: You may ask us to confirm whether we are processing your personal information and the specific pieces of personal information we have collected and, if necessary, provide you with a copy of that personal information (along with certain otherdetails).
• Right to correct: If the personal information we hold about you is inaccurate or incomplete, you may be entitled to request to have it corrected, taking into account the nature of the personal information and the purposes of the processing of your personal information.
• Right to delete: You may have a right in some circumstances, such as where we no longer need it or if you withdraw your consent (where applicable), to request that we delete or remove your personal information.
• Right to restrict/limit processing: You may have a right to restrict the processing of your personal information in certain circumstances, such as where you contest the accuracy of that personal information or you object to us.
• Right to data portability: You may have the right to receive a copy of personal information we've obtain from you, where technically feasible, in a structured, commonly used and machine-readable format, and to reuse it elsewhere or to ask us to transfer this to a third party of your choice.
• Right to withdraw consent: If we rely on your consent (or explicit consent) as our legal basis for processing your personal information, you may have the right to withdraw that consent. If you withdraw your consent, we may not be able to carry out your instructions or perform the contract we have or are trying to enter into with you.
• Right to lodge a complaint: If you have a concern about any aspect of our privacy practices, including the way we've handled your personal information, you may report it to the relevant supervisory or regulatory authority. You may contact us as provided at the bottom of this Privacy Notice if you would like to receive contact information for your local authority.
• Right to Non-Discrimination: You may exercise your rights under law without discrimination.

Please note that some of these rights may be limited where we have an overriding legitimate interest or legal, regulatory or contractual obligation to continue to process the personal information, or where the personal information may be exempt under applicable law.

CALIFORNIA RESIDENTS: If you are a resident of California, California law may provide you with additional rights regarding our use of your personal information. To learn more about your California privacy rights, visit California Residents' Notice of Collection.

Insurance Providers

Please be advised that the insurance companies that issue your policies may have personal information about you. This Notice does not govern their use of information about you. You should review the privacy notices of your insurance providers to understand how they collect, use, and disclose information.

Reservation of the Right to Disclose Information in Unforeseen Circumstances

In connection with the potential sale or transfer of its interests, TrueNorth Companies reserves the right to sell or transfer your information (including but not limited to your name, address, age, sex, zip code, state and country of residency and other information that you provide through other communications) to a third party entity that (1) concentrates its business in a similar practice or service; (2) agrees to be TrueNorth Companies' successor in interest with regard to the maintenance and protection of the information collected; and (3) agrees to the obligations of this Privacy Policy.

Dispute Resolution

Any controversy or claim arising out of or relating to our Privacy Policy, or the breach thereof, shall be settled by arbitration in accordance with the rules of the American Arbitration Association, and judgment upon the award rendered by the arbitrator(s) may be entered in any court having jurisdiction thereof.

Restriction on Children's Information

We do not knowingly collect personal data online from children under the age of thirteen (13) or sell their personal information. If we learn that we have received information directly from a child who is under the age of thirteen (13), we will take appropriate action in accordance with applicable law. To learn more about the Children’s Online Privacy Protection Act (COPPA) please visit the Federal Trade Commission's (FTC) website at: https: //www.ftc.gov/.

Changes to Our Privacy Policy Notice

We may update this Privacy Policy Notice to reflect changes to our information practices or certain regulations. When we make changes to this Notice, we will post the updated notice on the website and update its effective date accordingly. Your continued use of our website following the posting of changes constitutes your acceptance of such changes.