Privacy policy

Most forms on this site are short and ask for little. The two intake forms are long, optional, and the only ones that ask about your health. The forms for employers are listed further down, in their own section.

• The short form on the home page: your first and last name, one way to reach you (email address or phone number, your choice), your ZIP code, which of the two paths you are asking about, which topic you picked, how you heard about us if you say, and whatever you choose to write in the message box.
• The question form on the contact and booking pages: your first and last name, email address, ZIP code, which of the two paths you are asking about, the topic, whether you’d rather be called or emailed, an optional phone number, how you heard about us if you say, and whatever you choose to write in the message box.
• Both question forms also record which page you were on, the site that sent you here if your browser says, and any campaign tags in the address bar (theutm labels an ad or a newsletter link carries). That is how we learn which ad brought a question. It goes to the client records system with the question and into no email.
• The employer form on the small business pages: the company’s name, your first and last name, your role there, a phone number and an email address, the company’s ZIP code, how many people work there, whether at least one of them is not an owner or an owner’s spouse, whether the company offers health coverage now, the current carrier and the month it renews if you say, which kinds of coverage you are interested in, the month you would like coverage to start, your payroll provider, whatever you write in the message box, and how you heard about us, and that you ticked the box agreeing to be contacted, with the words beside it. Like the question forms, it also records the page you were on, the site that sent you and any campaign tags. It asks nothing about the people who work there.

• The individual and family worksheet: who is in your tax household, how each person is related to you and when they were born, who is filling it in if you opened it from your booking email, the city, ZIP code and county you live in, how you heard about us and who sent you (filled in from your booking if you answered there, and yours to change), what you expect to earn this year and how you expect to file taxes, whether an employer offers you money toward a plan of your own, whether anyone has lost coverage, moved, married, had or adopted a child or gained lawful status lately and when, whether anyone is a member of a tribe, your prescriptions, the doctors you want to keep, whether you fill prescriptions nearby or by mail and at which pharmacies, and anything else you decide to tell us. It is the longest thing on this site and nobody has to fill it in. If you price plans on coloradohealthinsurance.com, book a call there and start this form right away, it opens with what you told that site already filled in: your phone, ZIP code and county, each person’s date of birth, whether they need coverage and use tobacco, and your household income. That link goes only to your own browser, and every answer is yours to change.
• The Medicare intake form: whether it is for the person who booked, their spouse or partner, or someone else if you opened it from your booking email, your date of birth, your address, a second phone number if you have one, how you heard about us and who sent you (filled in from your booking if you answered there, and yours to change), where you are with Medicare Parts A and B, whether coverage from a job ended recently and when, your Medicare number if you choose to give it, the coverage you have now (the company and the plan name), whether you are a veteran or the spouse of one, whether you have Medicaid and whether you get Extra Help, and your Health First Colorado number if you choose to give it, whether the person helping you holds a power of attorney, your prescriptions, your pharmacy, the doctors you want to keep, whether a doctor has told you that you have diabetes or a heart condition, and anything else you decide to tell us. The health question is optional, and so is everything else on this form that is not needed to reach you. Nobody has to fill this one in either.

The two short forms never ask about your health. Not your conditions, not your medications, not your doctors. You don’t need any of that to get an answer from us, and the message box says so.

A question goes to Grove’s client records system, the same one the intake forms use, so whoever answers it has it on your record. If that system cannot take it, it is emailed to Grove’s team instead. This website keeps no copy of it. If you gave us an email address, we send you one short email saying your question arrived, with our phone number, email address, website and hours in it. It repeats nothing you wrote. The employer form goes to the client records system too, or to Grove’s team by email if that system cannot take it, and the same short email goes to the address you gave. Unlike a question, this website also keeps a copy of an employer form so the team can read it. It is stored encrypted, with the intake forms, only Grove can open it, and it deletes itself after 90 days, or sooner if you ask us to remove it. It holds no health information.

The intake forms ask, because that is the whole of what they are for. An advisor who has your prescriptions in front of them before the appointment can check them against a plan’s drug list, instead of asking you to read labels down the phone and getting one wrong. You can book a time and never open it.

Nothing here ever asks for a Social Security number, a driver’s license, a bank account, a card number, or your Connect for Health Colorado password. If a page appears to be asking for any of those, it is not ours. The Medicare form does ask for your Medicare number and your Health First Colorado number, because a plan application needs them, and both are optional.

Our web host records ordinary server logs — the kind every web server keeps — and our booking tool will collect whatever you give it when you book a time. Those are their systems, under their policies. Our own server writes down one kind of visit, a visit from one of our ads, and the section on cookies says exactly what it keeps. When a worksheet arrives we write down the state it came from, how many people are on it, and whether you told us you cannot log in to Connect. When a Medicare intake arrives we write down the state, where you are with Parts A and B, how many kinds of coverage you named, and whether you arrived from a link we emailed you. No answer about anybody’s health goes in either line.

We use it to answer you. That’s the whole purpose.

A worksheet, we read before your appointment. It is how we work out what you qualify for and which plans cover the doctors and the medications you told us about, so that the hour we spend together is spent on the answer rather than on the questions.

If you later decide to apply for a plan, the information you give us for that application goes to the carrier or to Connect for Health Colorado, because that is how an application works. We’ll tell you what’s being sent before it goes.

• We don’t sell it, rent it, or trade it. Not to lead brokers, not to other agencies, not to anyone.
• We don’t use it to advertise to you anywhere else — there are no advertising pixels on this site to make that possible.
• We don’t share it with carriers unless you’re applying for something.

The Medicare and marketplace lead business runs largely on selling contact details, which is why the phone starts ringing after you fill in a comparison form somewhere. We are telling you this because it is what you should know about the industry you’ve just entered.

The two intake forms are the only things on this site that collect health information, so they get a section of their own rather than a clause in a longer paragraph. What follows is true of both, except where it says Medicare.

• It goes to Grove and nowhere else. It is kept in storage Grove rents from Amazon Web Services, in Grove’s own account, encrypted with a key that belongs to Grove. Both forms also send your answers to Grove’s client records system, which runs in the same Grove account, so your advisor has them on your record. Neither is sent to an insurance company, to Connect for Health Colorado, to Medicare, or to anyone else. When the time comes to apply we will ask you first, and tell you what is going where.
• Suggestions send only what you typed. When you type a medication, a doctor, a pharmacy or a hospital, the form suggests matches. To find them, Grove’s own server sends what you typed to a public government list: the National Library of Medicine’s drug names, the federal NPI Registry for doctors and pharmacies, or Medicare’s list of hospitals. A doctor or pharmacy search also sends a city and state to look near, which start as the ones you gave us. A doctor search sends the last name, and the first name if you typed one. A doctor search in Colorado asks the Colorado Care Index first, a list of licensed Colorado clinicians that Grove publishes on its own site, coloradohealthinsurance.com. That sends only the first two letters of the last name, and Grove’s server finds the match itself. When that list has fewer than a full page of matches, or can’t be reached, the NPI Registry is asked as well, as above. The street box can suggest addresses too. For those, Grove’s server sends what you have typed of your street address to Amazon Location Service, an address service Grove pays for through its own Amazon Web Services account, and when you pick a suggestion it asks Amazon for that one address, to fill in your city, state, ZIP code and county. Your browser never contacts any of these services, so they see Grove’s server and not you, and nothing else on the form goes with what you typed. We do not log what you type there or write it to disk. The server holds each search and its matches in memory, for up to a day or, for an address, ten minutes, with nothing to say who typed it, so the same search is not run twice, and forgets them when it restarts. A suggestion becomes part of your answers only if you pick it and send the form.
• Only Grove’s licensed advisors can read a stored one, each signing in as themselves. The page they read it on is linked from nowhere and answers to nobody who cannot sign in.
• The message that tells us one arrived holds none of it. It carries your name, how to reach you, the town you live in, for the worksheet how many people are on it, and a link — and not one of the health answers, not the prescriptions, not the doctors. That message is sent by Resend and arrives in Grove’s Google Workspace mailboxes, which is exactly why it carries so little: an email passes through companies that are not us, lands in whichever mailbox each of us reads, and is the one copy we could not delete for you afterward.
• The email we send you holds none of it either. Once a form reaches us you get one short note saying so, with our phone number, email address, website and hours. It does not repeat your name or a single answer, and it is sent by Resend.
• You can download a copy of your answers, and it is never emailed. When the form goes through, the confirmation page offers a PDF of what you told us. Grove’s server draws it from your answers, hands it to your browser in that same reply, and keeps no copy of it and writes it nowhere. It is not attached to any email. If you close the page without downloading it, it is gone, and you can ask us for your answers by phone.
• It deletes itself after 90 days. Not a promise one of us has to remember on the right morning — the storage removes it on a rule of its own, whether or not anybody is looking, and whether or not you ever called us.
• Ask, and it goes sooner. Call (970) 840-1250 and we will delete it while you are on the line. Both forms’ answers also become part of your client record with us, which is not on this 90-day clock.

The short period is deliberate, and it is there for the person who fills one in and never rings. Anyone can send us one of these forms without booking anything first, so Grove would otherwise be sitting on health answers about people it never spoke to. 90 days is long enough to prepare for an appointment and short enough that the pile does not grow.

Before we can discuss specific Medicare Advantage or Part D plans, federal rules ask for a signed Scope of Appointment, and you can sign ours on this site. It asks for your name, phone number, address, an email address if you want to give one, the kinds of plan you’re willing to discuss, which advisor you are working with if you pick one from the list (an advisor’s own link picks that advisor for you), and, if you opened it from your booking email, whether it is for the person who booked, their spouse or partner, or someone else. Somebody signing as a representative also gives their own name, email address and relationship to the person with Medicare. Nothing about your health. At the end of the Medicare form it opens on the same page, filled in with the name, phone and address you just gave, which you can change before you sign.

• It’s kept for eleven years, and can’t be deleted sooner. Medicare requires these records to be kept for ten years, so this is the one thing on the site we can’t delete when you ask. It’s stored in Grove’s own Amazon Web Services account, encrypted with Grove’s key, and locked so that nobody can change it.
• The signed copy records how it was signed: the time, the internet address and browser it came from, and the name on the button you pressed to sign. That’s what makes an electronic signature hold up.
• Copies go to you, to Grove’s client records, and to the advisors. You can download it the moment you sign; we don’t email it to you, so download it then if you want to keep one. A copy goes into the client records system your advisor works from. The message telling the advisors one arrived carries your name, how to reach you, and a link, not your address.
• The form checks it’s a person signing. Like every form here, it uses Vercel BotID to tell a person from an automated script. Here it is strict: if the check itself can’t run, the form asks you to call rather than accept the signature, because these records can’t be deleted.
• You can ask us to call instead. On a form opened from your booking email, a button under the signature asks your advisor to take it by phone. It sends the client records system whatever the form holds when you press it: the name, phone number and whose form it is. Nothing is signed, and this site keeps no copy of the request.

Three things on the small business pages are for employers rather than for individuals. The employer form is described with the other forms above. The other two are below.

• The census upload takes a spreadsheet or PDF of the people a group plan would cover, and with it the company’s name, your name, your email address, a phone number if you give one, a note if you write one, and whether you would rather your employees fill in a survey. Our template asks for each person’s first name and last name (an initial is enough), date of birth, ZIP codes, hours, hire date and the coverage they would choose, and for salary and job title only when life or disability coverage is being quoted. It asks for no Social Security numbers, no employee ID numbers and nothing about anyone’s health, and we ask you to leave those out of anything else you send.
• The file goes straight to Grove’s storage. Your browser sends it to the same kind of encrypted storage, in Grove’s own Amazon Web Services account and with Grove’s key, that holds the intake forms, using a link that works for ten minutes and for that one file. The part of this site that receives it can only write, never read back. Only Grove’s advisors, each signing in as themselves, can open it, and each download link they use lasts five minutes. We never copy what is in the file anywhere else: not into our client records system, which is told only that a census arrived, for which company, your name, email address and phone number, whether you asked for the survey, and where to find it; and not into an email.
• The messages hold none of it. The note telling our team a census arrived carries the company’s name, your name and contact details, the file’s name and size, and a link. You get one short email saying we received it, which repeats nothing you sent.
• It is deleted after 90 days. The storage removes it on a rule of its own, 90 days after the upload. If your company becomes our client, we keep the census on file to look after your plan.
• A broker of record letter is the letter an employer signs to name Grove Benefit Advisors as the broker of record on its group plan, with one of our advisors as the agent who looks after it. Signing one here records the company’s name, address and phone number, the carriers, policy or group numbers and kinds of coverage it covers, the advisor, the date it takes effect, and the signer’s name, title and email address. Your logo, if you add one, and a drawn signature are kept only inside the letters themselves. The street box can suggest addresses, the same way it does on the other forms: Grove’s server sends what you typed of the company’s street address to Amazon Location Service, and when you pick one, asks it for that one address to fill in the city, state and ZIP code. With the signature we keep how it was signed: the time, the internet address and browser it came from, and a fingerprint of each letter that shows whether it was changed later. We email the signed letters to the address the signer typed, and send our team and the advisor a summary with no letter attached. The letters and that record are kept for seven years in Grove’s own encrypted storage, and are not locked: we can delete one made by mistake. Choosing to print a letter and sign it in ink stores and sends nothing. Our client records system is told what the letters say (the company, its address and phone number, the signer’s name, title and email address, the carriers, policy numbers and coverage, the advisor and the date), with a fingerprint of each letter and where to find it, but not the letters themselves, your logo, your signature, or the internet address and browser it came from.

When you book an appointment, or when an advisor sets one up with you in person or by phone, we send you one email with a link to the client intake form. For Medicare, the Scope of Appointment opens when you finish it. If an advisor needs only the Scope of Appointment from you, the email carries that link and nothing else. When you book a follow-up, we send it only if we still need one of those forms from you. Cal.com tells us about the booking, and we also check Cal.com every 15 minutes for any booking whose notice did not arrive; the email goes out through Resend, the same service that sends our other messages.

• The links are made for you, and the code in them is encrypted. Each one carries a code that tells the form which advisor and which appointment it belongs to, and holds your name, email address, phone number and ZIP code, and your answers to “How did you hear about us?” and “If someone sent you, who?” if you gave them when you booked, so the forms can fill them in for you. You can change what they fill in. Your date of birth is never in the code, and neither is your address. Anyone you forward a link to can see those answers when they open the form. The links stop working two weeks after the appointment, or a month after the email when no time was set, and the forms still work without them.
• Our client records system is told the email went out, with the links to your forms, so your advisor can see the forms were sent and the system can send one reminder before the appointment. For Medicare that includes a link to the Scope of Appointment on its own, which the reminder uses if the intake form is done and the Scope of Appointment is not. When only one form was sent, it is told which.
• We don’t add tracking to it. The email has no tracking images: its one picture, our logo, is the same file for everyone who gets one. Its links go straight to the forms and to our own pages, not through redirects we run.

Grove’s own code sets no cookies on the pages you visit, and we run no session recording. The only exception is the sign-in for Grove’s advisors, on staff pages no visitor is sent to.

We do count visits. The site runs on Vercel, and Vercel’s Web Analytics tells us which pages get read, which website or search sent you here, what kind of device and browser you used, and the country and region your connection comes from. It sets no cookies. It tells one visit from another with a code worked out from your connection, which it throws away after 24 hours, so it cannot follow you from one day to the next or onto another website, and it never tells us who you are. Your browser trims the page address before anything is sent: the pages our advisors use, where they read the intake forms and run their calculators, are left out entirely. What you type into a form is never part of it.

Google’s advertising tag. Grove advertises on Google, and to learn whether an ad led anywhere, the site carries Google’s tag. If you arrive from one of our ads and then book an appointment, send us a question or tell us about your business, or tap our phone number, the tag tells Google that it happened. It sends that it happened, not who you are and not anything you typed. To do this it sets Google’s own cookies, under Google’s privacy policy. We have told it not to use your visit to build advertising audiences, so it is not used to follow you around the web with our ads. It is never loaded on the intake forms or on the pages our advisors use, and it is not loaded at all if your browser sends a Global Privacy Control signal. You can also turn off ad personalization in your own Google account.

Microsoft’s advertising tag. Grove also advertises on Microsoft’s Bing, and the site carries Microsoft’s tag for the same reason. It reports the same three things, that you booked an appointment, sent us a question or told us about your business, or tapped our phone number, and like Google’s it sends that it happened, not who you are and not anything you typed. The page address it is given is trimmed the same way; the one thing kept is the code Microsoft adds to its own ad links, which is how it knows an ad sent you. It sets Microsoft’s own cookies, under Microsoft’s privacy statement. It is never loaded on the intake forms or on the pages our advisors use, and it is not loaded at all if your browser sends a Global Privacy Control signal.

Meta’s advertising pixel. Grove also advertises on Facebook and Instagram, and the site carries Meta’s pixel to measure those ads. It counts the pages you visit here and the same three things, that you booked an appointment, sent us a question or told us about your business, or tapped our phone number, along with whether it was about Medicare, individual and family coverage, or a business. It sends that it happened, not who you are and not anything you typed, and we have told it not to read the buttons and labels on our pages. Unlike Google’s and Microsoft’s tags, it reads the page address itself, so it gets the whole address; no page that carries the pixel puts anything about you in its address. It sets Meta’s own cookies, under Meta’s privacy policy. It is never loaded on the intake forms or on the pages our advisors use, and it is not loaded at all if your browser sends a Global Privacy Control signal.

Reddit’s advertising pixel. Grove also advertises on Reddit, and the site carries Reddit’s pixel to measure those ads. It counts the pages you visit here and the same three things, that you booked an appointment, sent us a question or told us about your business, or tapped our phone number. It sends that it happened, not who you are and not anything you typed. Like Meta’s, it reads the whole page address itself, and no page that carries it puts anything about you in its address. It also reads each page’s title and description. It sets Reddit’s own cookies, under Reddit’s privacy policy. It is never loaded on the intake forms or on the pages our advisors use, and it is not loaded at all if your browser sends a Global Privacy Control signal.

When you arrive from one of our ads. We pay for every click on our ads, and some clicks come from software, or from people clicking on purpose to run up the bill. So when you reach this site from one of our ads, our own server writes down that visit: the code the ad company added to the link, the campaign it came from, the time, the page, the internet address your connection came from and the rough location that goes with it, the language your browser asks for, the website that sent you, and the description of itself your browser sends. That is all. It sets no cookie, it is never used to advertise to you, and visits that do not come from an ad are not written down. We use it to find clicks that look fake and ask the ad company for that money back, which means sending them the codes, times and addresses of those clicks; if we ever had to, we would also use it to show what happened in a dispute. Each record is kept for two years and is locked so that nobody can change or delete it before then, so it can be relied on. It is kept whether or not your browser sends a Global Privacy Control signal, because it is a record of a click we paid for, not a way to advertise to you.

Apart from those, every page except the two below carries nothing but the page.

The exceptions are /book-appointment and /book-follow-up, the page for a second appointment, which our advisors send you and the booking page links to. Each carries the same appointment calendar, and that calendar is Cal.com’s software rather than ours. It loads when the page does, and it brings its own cookies under its own privacy policy. We opened it in a clean browser on August 6, 2026, and wrote down exactly what arrived, so you do not have to take a general statement for it:

• Three cookies, all of them Cal.com’s own housekeeping. Two belong to the machinery that submits the booking — one stops the form being sent from another website, the other remembers where to put you back. The third is Cloudflare’s, which tells people apart from bots. Two go when you close the browser and the third inside half an hour.
• One other company’s script. Cal.com sends its own error reports to a service called Sentry — what broke, and on which page. If you pick an advisor by name, that advisor’s photograph loads from Google.
• Nothing that follows you. No payment processor, no session recording, no advertising, and nothing that works out where you are from your connection.

None of it is ours and we never see what it collects. If you would rather none of that happened, do not open that page — call (970) 840-1250 instead and we will book the time for you. That is not the second-class way to do this.

We tell the calendar how you reached us. When it opens, its address carries a short label for the first page you opened on this site in that tab: the name of one of our ad campaigns if a link carried one, or something like “google, organic”, “facebook, social” or the name of the website that linked you here. Cal.com saves it with the booking and includes it in what it sends our client records, and the advisor you book with can see it, so we can tell which of our advertising leads to appointments. It never includes an ad’s click code, the page you came from, or anything you typed. Your browser keeps the label in its own storage for that tab and forgets it when you close the tab.

Both intake forms keep a draft on your own device — in the browser’s own storage, not a cookie — so that going to find last year’s tax return does not cost you the ten minutes you have already typed. It never leaves your computer, it is not sent anywhere, and we cannot see it.

That draft leaves the health answers out. On the worksheet, the medications, the doctors, your pharmacy, the health questions and life changes, the tobacco answer, your answers about Medicaid, other coverage, an employer’s offer, tribal membership, where your coverage comes from and help with the premium, and what is not working about your plan are never written to your device. On the Medicare form the same goes for your date of birth, your Medicare number, your answers about Medicaid or Extra Help and your Health First Colorado number, the coverage you have now, your pharmacy, your medications, your doctors, the health question and anything else you wrote. If you leave and come back, it asks those again. The reason is that the computer somebody fills a form like this in on is often the family’s. A button on each form clears the draft whenever you want, and sending the form clears it too.

Inquiries stay in our client records (or in our email, if the records system could not take one) for as long as we’re working with you, and for a reasonable period after in case you come back — insurance is a relationship people return to.

An intake form is deleted from this website 90 days after you send it, by the storage itself rather than by one of us remembering. There is no archive it moves to here and no backup we keep of the health answers. An intake is also sent to our client records system, where your answers become part of your client record and are kept the way the rest of that record is.

Signed Scope of Appointment forms are kept for ten years. That one isn’t our choice; CMS requires it.

An employee census is deleted from this website’s storage 90 days after it is uploaded, by the storage itself. If the company becomes our client, we keep the census on file to look after its plan. A signed broker of record letter and the record of how it was signed are kept for seven years.

A record of a visit from one of our ads is kept for two years, locked so it cannot be changed or deleted before then, and then it can be removed.

Ask us to delete something and we will, unless a record is one we’re required to keep or one of those locked ad-visit records — in which case we’ll tell you which one and why.

Whatever the law where you live requires of us, you can:

• Ask what we have about you, and we’ll tell you.
• Ask us to correct something that’s wrong.
• Ask us to delete it, subject to records we’re required to keep.
• Tell us to stop contacting you, by any method or by all of them. Once is enough.

If it is an intake form you want gone, we can delete the copy on this website while you are on the phone — there is a button on our side of it, and no ticket to raise.

Call (970) 840-1250 or write to hello@groveba.com. No form exists for this and no department to be transferred to.

The site runs over HTTPS and everything a form sends is encrypted on the way. Inquiries are read by Grove’s licensed advisors and nobody else.

The intake forms get more than that, because they hold more. Each is encrypted where it sits, with a key that belongs to Grove. The part of this site that receives one can only write it down: it has no permission to read anything back, so a fault in a page open to the whole internet cannot be turned into somebody else’s medication list. Reading one on this site takes a separate sign-in that the public side of the site does not have, and each advisor signs in as themselves.

No one can promise perfect security and we won’t. What we can tell you is what was actually done: we ask for nothing we do not use, the health answers never travel in an email or a link, and the copy on this website removes itself after 90 days.

This site is for adults shopping for coverage, and we don’t knowingly collect anything from a child.

A parent filling in the enrollment worksheet does give us details about their children — a name, a date of birth, and a prescription if a child takes one — because that is what a family policy has to be quoted from. Everything on this page applies to those answers exactly as it applies to yours, the 90 days included.

If this policy changes we’ll update the date at the top. Material changes get said plainly here rather than absorbed into a longer document.

Grove Benefit Advisors, LLC, 2580 E Harmony Rd, #201, Fort Collins, CO 80528. (970) 840-1250, TTY 711, hello@groveba.com.