Privacy Policy | Contract X-Ray | Nautilus Health Institute

1. Who we are

Nautilus Health Institute is a 501(c)(3) nonprofit organization. Contract X-Ray is an independent, standards-based evaluation of benefits contracts that helps employer plan sponsors understand their contractual protections and fulfill their fiduciary obligations to plan members.

2. Information we collect

If you browse the website without submitting

Beyond the functional cookies discussed below, we do not currently collect personal information from visitors who browse the website without submitting a contract or completing the intake form. We do not run advertising trackers, third-party analytics scripts, or social media pixels on this website.

Standard server logs may record your IP address and browser type as part of routine web infrastructure operation. These logs are used solely for security monitoring and are not linked to any personal profile.

If you submit a contract

When you submit a contract through the Contract X-Ray intake form, we collect:

Your name and email address.
Your organization name and the name of the PBM party to the contract.
The contract documents you upload, including all schedules, exhibits, and amendments.
For Premium tier: Stripe handles payment processing. We do not store your card number, CVV, or bank account details. Stripe processes and holds payment credentials directly.
Submission metadata: date, tier selected, and whether a coalition or partner access code was used.

Information we do not collect

We do not collect sensitive personal categories such as health information, Social Security numbers, government identification, or financial account details beyond what Stripe processes for payment or what is included in your submitted contract documents. We do not build user profiles or collect information from social media platforms.

3. How we use your information

Your contract documents

We use contract documents solely to conduct the Contract X-Ray analysis and deliver your reports. We do not use your contract language for any other purpose, commercial or otherwise. We never disclose your specific pricing terms, rebate structures, or contract provisions to competitors, to other PBMs, to other clients, or to any party outside your engagement.

Our scoring reflects Nautilus's expert opinion. Our experts refine the methodology over time by reviewing patterns across our findings. This is a human calibration process. We do not use your submission to automatically train a model, and your contract does not teach the scoring rubric on its own.

The specific text of your contract is used only to analyze your contract. We never incorporate your contract's language into the scoring of any other party's contract, and we never use it in the model contract language we may propose to any other party.

Your contact information

We use your email address and name to deliver your analysis reports, respond to follow-up questions, and send material policy updates. We do not add you to marketing lists without your consent. We do not sell or share your contact information with third parties for marketing purposes.

Aggregate and anonymized data

We may incorporate scores and analytical findings derived from contract evaluations into Market Analytics and Market Reports. Market Analytics are aggregate statistics computed from the evaluated contract population. Market Reports are published outputs built from those statistics. Neither contains information that identifies you, your organization, or your contract's specific terms. Your score may appear in a statistic. It will never appear with your name.

4. Cookies and tracking

What we currently use

We currently use only functional cookies: small data files strictly necessary for the service to operate correctly. Functional cookies are not used for advertising or tracking. Current uses include:

Session state management: remembering where you are in a multi-step submission flow so you are not asked to repeat information.
Payment return state: if you complete payment through Stripe and return to the intake form, a session token confirms your payment so you are not sent to the payment screen again.
Coalition or partner access: if you arrive via a partner link, a session token attributes your submission to the correct partner for revenue-sharing purposes. This token does not identify you personally.

What we may add in the future

We may add analytics cookies in the future to understand how visitors use the website and improve the service. If we do, we will update this policy with notice before analytics tracking begins, and we will add an opt-out option.

How to control cookies

You can control cookies through your browser settings. Blocking functional cookies may prevent parts of the intake form from working correctly, including payment confirmation and session continuity.

5. Sub-processors

Several third-party services process data on our behalf as part of delivering Contract X-Ray. Each is bound by contractual obligations to protect data and use it only for the stated purpose.

Service	What it does	Data handling note
Anthropic	AI analysis of contract documents. Contract text is sent to Anthropic's API to run the scoring analysis.	Under Anthropic's commercial API terms, which govern our use, Anthropic does not use API inputs or outputs to train its models. Contract text is retained by Anthropic only briefly for abuse monitoring before deletion, and is not used for any other purpose.
Stripe	Payment processing for Premium tier submissions.	Stripe holds all payment credentials directly. Nautilus receives only a transaction confirmation. Stripe's privacy policy governs payment data.
Automation pipeline (Make.com)	Workflow automation connecting form submission, AI analysis, and report delivery for Quick Look submissions.	Make.com briefly holds submission data so that a failed run can be re-submitted automatically, without action on your part. This data is not used for long-term storage and clears on Make.com's standard schedule, typically within 30 days.
Cloud storage and delivery	Secure storage of submitted contracts, analysis files, and report delivery.	Google Drive stores submitted contracts, analysis files, and reports in US-based infrastructure that encrypts data at rest. Access is limited to authorized personnel with a need to complete or support your analysis.

We do not sell data to any third party. Sub-processors receive only the data necessary to perform their specific function and may not use it for any other purpose.

6. Data security

We apply the following protections to all submitted data:

Encryption in transit: all data transmitted between your browser and our service uses TLS encryption.
Encryption at rest: submitted contracts, analysis files, and reports are stored in Google Drive, which encrypts stored data at rest.
Access controls: access to submitted contract materials is limited to authorized personnel directly involved in your analysis.
AI processing boundary: contract text sent to Anthropic's API is not used to train Anthropic's models, and is retained by Anthropic only briefly for abuse monitoring before deletion.

No security system is absolute. If we become aware of a data breach affecting your information, we will notify you and applicable regulators as required by law.

7. Data retention

Data	Retention
Submitted contracts, analysis files, reports, and contact information	Retained to deliver your reports, answer your follow-up questions, and support comparisons over time. We do not run a fixed deletion clock. We delete them within 30 days of your request.
Payment records	Retained as required by applicable financial regulations, typically seven years. Payment card credentials are never stored by Nautilus.
Aggregate and anonymized benchmark data	Retained indefinitely as part of the Contract X-Ray market record. Cannot be traced back to any individual submission or organization.
Server logs (IP address, browser type)	Retained for a limited period for security monitoring, then deleted.

These retention timelines are intended to support the purpose and scope of use of our services, including supporting rescoring as methodologies may be updated, in case of dispute resolution, and to comply with applicable laws and regulations.

To request deletion of your data, contact . We honor deletion requests within 30 days, except where technically unfeasible or retention is required by law or active legal proceedings. Our working papers, which document our findings and form our audit record, and aggregate de-identified statistics, which contain no information that identifies you, are not affected by a deletion request.

8. Your privacy rights

Regardless of where you are located, you have the following rights with respect to personal information Nautilus holds about you:

Access: request a copy of the personal information we hold about you, including your contact information and submission records.
Correction: request correction of inaccurate personal information.
Deletion: request deletion of your personal information and submitted contract materials, subject to legal retention requirements.
Portability: request your personal information in a structured, machine-readable format.
Objection: object to specific uses of your personal information.

California residents

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

The right to know the categories of personal information collected and the purposes for which it is used.
The right to know whether your personal information is sold or shared, and to whom.
The right to opt out of the sale or sharing of personal information. Nautilus does not sell or share personal information for advertising or commercial purposes. There is nothing to opt out of.
The right to limit use of sensitive personal information. We do not collect sensitive personal information as defined by CPRA.
The right to non-discrimination for exercising your privacy rights.

Other state residents

Residents of Colorado, Virginia, Connecticut, Texas, and other states with comprehensive privacy laws have similar rights to those described above. We apply these rights universally. You do not need to invoke a specific state law to exercise them.

To exercise any privacy right, contact with your name, email address, and a description of your request. We will respond within 45 days. Complex requests may require an additional 45-day extension, which we will notify you about.

9. We do not sell your information

Nautilus does not sell, rent, or trade personal information or contract data to any third party. We are a nonprofit operating in furtherance of an educational mission.

Aggregate, anonymized analytical outputs, such as scores, benchmarks, and trend statistics, may be shared with coalition partners and member associations to further our mission. These outputs contain no personal information and cannot be reverse-engineered to identify you or your contract.

10. Children

Contract X-Ray is a professional service for employer plan sponsors, benefits advisors, and related professionals. It is not directed at children. We do not knowingly collect personal information from anyone under 18 years of age.

11. Changes to this policy

When we make changes to this Privacy Policy, we will post the updated version at contractxray.com and www.nautilushealth.org with a new effective date. Continued use of the Contract X-Ray website or service after an updated policy takes effect constitutes acceptance of the changes.

12. Contact

Privacy questions, data requests, and deletion requests:

Nautilus Health Institute
· www.nautilushealth.org