Policies & compliance
HiLi Bridge and insurance-only HL Memory. Hi Memory Personal is a separate service.
Version 2026-10-24-draft-1. These drafts do not certify compliance, activate proposed controls or constitute accepted contract terms. Current published notices remain linked below.
Regulatory update status
Other states, countries, counties and cities require registered official sources. This selection displays notices; it does not determine a customer's legal jurisdiction.
Loading update status…
Coverage boundaries
In-app hourly source monitoring configured for deployment. Baselines and change history are stored in the application database. Minimal validated informational amendments can publish automatically; unresolved changes remain pending.
| Jurisdiction | Coverage |
|---|---|
| United States federal | Initial official-source watch configured |
| Texas | Initial official-source watch configured |
| Other states, counties and cities | Source registration and applicability review needed |
| Other countries | Not enabled |
Hourly checking is not instant or exhaustive. Publication requires matching jurisdiction, exact source evidence, a final rule with an effective date, and independent validation. Changes requiring new controls or consent remain pending. Existing customer assent is never fabricated.
TDI bulletins · Medicare agent requirements · FTC health-breach rules · HHS cloud guidance
Draft policy pack
Privacy and data use
Purpose and product boundaries
HiLi Bridge supports insurance-agent workspaces. HL Memory is an insurance-only communication and archive add-on. Hi Memory Personal is a separate product; records, permissions and subscription entitlements must not be treated as shared.
Information and access
Current functions process account details, agency membership, agent profiles, client/policy records, uploaded documents, inquiries, authorized social tokens and assistant conversations. Access follows verified membership and assigned-client or portal links. Inquiry forms must not collect medical histories, Social Security numbers or identity documents.
Identity and voice workflows
Government ID, license verification, profile photos, meeting audio, translated speech and captions are proposed additional workflows. Before enabling them, present a specific collection notice covering purpose, recipients, retention and applicable rights. Public profile images are distinct from private ID/license documents. Optional marketing, recording and voice processing must not be bundled into one mandatory consent.
Requests and providers
Contact your agent for insurance-record requests, or victor3192patel@gmail.com for platform privacy requests. Verify requester authority and applicable response duties; assess deletion exceptions and legal holds. Maintain an accurate processor register and cross-border assessment. A written privacy notice does not establish provider eligibility or HIPAA compliance.
Service terms
Service and insurance responsibility
HiLi supplies software; it is not an insurer and does not issue coverage, determine underwriting eligibility or guarantee sales, rankings, leads or commissions. Agents remain responsible for accurate policy information, authorized activities and their carrier/plan obligations.
Accounts and authority
Use an individual account and provide accurate practice details. Do not access another person's records, impersonate an agent or share account credentials. Selling-agent activation is intended to require government ID, license verification and a profile photo; those integrations must be completed before the service represents an agent as verified.
Automation and availability
Supported automation can organize records, recover supported interrupted tasks and perform scoped requests. No promise is made that every error will heal automatically or that availability is uninterrupted. Preserve records and use bounded recovery when a workflow is uncertain. AI output and commission estimates require verification against original materials.
Version and acceptance
These clauses are a draft for review, not an automatically accepted contract. Before binding terms are activated, identify the contracting legal entity, contact/address, effective version, material-change notice, cancellation procedure and applicable dispute provisions. Do not invent jurisdiction, arbitration, liability waivers or retroactive acceptance.
Subscriptions, cancellation and revenue separation
Prices and checkout
Owner-approved individual list prices are HiLi $69.99 per agent/month and optional HL Memory $29.99 per agent/month. Enterprise allowances/pricing remain proposed unless explicitly approved. Display currency, taxes, billing interval, included usage, renewals and the actual seller before payment. Paid advertising and insurance premiums are separate.
Payments and cancellation
Live checkout and recipient routing are not yet implemented. Before activation, provide a working cancellation process, clear renewal disclosures, receipts and refund terms consistent with applicable requirements. No undisclosed automatic usage charges. Cancellation and deletion are separate requests; access and retention must follow the applicable policy.
Financial separation
HiLi proceeds are intended for Kinjal's business; HL proceeds for Vic/VERAS8 LLC. Actual routing requires verified Stripe accounts and the relevant terms. Processing, Billing, Connect, refunds, disputes and other agreed costs must be allocated transparently. Do not promise gross subscription prices arrive unchanged in a bank account.
Identity, license and profile verification
Activation requirements
Every selling agent, including enterprise agents, must provide a government photo ID, insurance-agent license/number and a profile image. Upload through a private workflow. Extract only needed fields, let the person correct extraction errors, and check identity consistency and active license/state/line authority against an authoritative source.
Pending and renewal
An upload is not approval, and a profile photograph is not biometric verification. Source outages, name conflicts or uncertain matches remain pending with a correction path. Do not automatically reject a person based on an unverified AI inference. Recheck relevant license expiration, status changes and additional states/lines before enabling those activities.
Data minimization
Restrict ID/license access, log legitimate access, separate public image use, and define a justified retention schedule. Prefer verification evidence over unnecessary long-term raw identity-document copies where appropriate. The provider integration and activation gate are not implemented yet.
Meetings, translation and voice consent
Before any capture
Each participant must receive a clear recording and AI-processing disclosure and give their own session-specific choices. The intended product requires all participants' consent before recording, transcription/translation or voice preservation. Agent consent cannot stand in for a customer's. If a required consent or recording condition is missing, do not start the affected session.
How translated speech is presented
Identify translated speech as synthesized AI output using an authorized voice profile, not the person's original live words. Display original/translated captions clearly without obscuring the call, allow important terms to be checked, and preserve distinctions between original audio, generated audio and transcript. Do not promise perfect accuracy, identical voice or zero latency.
Limits, records and withdrawal
Use the voice only for the disclosed authorized purpose and scope. No impersonation, unrelated cloning, unapproved training or advertising use. Provide prospective withdrawal and stop controls; explain lawful retention of prior records separately. Assess participant locations, applicable insurance rules and processor arrangements. Live recording/translation and withdrawal controls are not active yet.
Acceptable use and insurance marketing
Permitted use
Use truthful, authorized materials appropriate to the agent's state, license and product. Do not imply government/carrier endorsement, guaranteed coverage, guaranteed savings or verified status without evidence. Do not place competitors' promotions inside private customer or agent workspaces.
Contact and consent
Maintain purpose-specific evidence for marketing contacts and applicable calling/texting/email requirements, including opt-outs, suppression and relevant hours. Keep service communications separate from marketing. Do not send automated outreach or activate a paid ad budget from a general account signup. Apply carrier, CMS and jurisdictional rules where actually applicable.
Social publishing
Publishing requires the agent's separate network authorization and enabled account settings. Public content follows platform rules and applicable approvals. Current integrations and export-only limitations must be disclosed. AI content preparation does not remove agent/carrier approval duties or guarantee reach.
Retention, export, deletion and legal holds
Category-specific retention
Maintain a reviewed retention schedule for verification evidence, policies, customer documents, messages, consent evidence, original recordings, generated audio, transcripts, financial records and security logs. Identify the applicable rule, contract and effective dates. No single duration is automatically valid for every record, jurisdiction or insurance product.
Deletion and holds
Verify the requester, identify the affected records and assess statutory duties and legal holds. Explain why a request is granted, limited or deferred and how backup expiration is handled. Preserve held evidence; do not promise immediate deletion after cancellation or keep every identity/voice record indefinitely.
Evidence and security
Log changes and access with record IDs and version references. Current application audit history is not immutable storage. Tamper-evident records, independently protected archives, retention enforcement and restore/deletion verification need implementation before they can be represented as operational safeguards.
Security and incident response
Safeguards and recovery
Use least-privilege scoped access, secure sessions, protected secrets, private storage paths and bounded recovery. Do not log secret keys or put identity/health information into public alerts. Maintain backup/restore procedures, tested changes and rollback readiness. Describe implemented controls accurately; no blanket encryption, biometric or compliance-certification claim.
Incident handling
Identify and contain a suspected incident, preserve relevant evidence, investigate scope, assess affected jurisdictions/data categories, and prepare required regulator/customer/provider notifications against applicable deadlines. Automated detection must escalate uncertainty rather than issue a fabricated all-clear. Notification obligations require an applicability assessment.
Vendor and health-data review
Review each hosting, verification, social, payment and AI provider's actual service scope, subprocessors, data use and retention. Where HIPAA applies, assess covered-entity/business-associate roles and required BAAs across the processing chain. Other privacy, insurance-security or health-breach rules may also apply. Do not enable a restricted health-data workflow merely because a vendor offers encryption.
Jurisdiction and regulatory change management
Rule applicability
Use the agent's license states/lines, agency and customer jurisdictions, product, transaction and participants' relevant locations. Countries, states, counties and cities are separate dimensions. Do not infer physical location from a telephone area code or assume local rules replace state/federal obligations. Record unknown applicability instead of guessing.
Official-source watch
An external hourly watch has been created for US federal and Texas official sources. Other jurisdictions require configured sources and applicability review. A proposed bill, NAIC model, carrier rule, court order and enacted regulation are not interchangeable. Publication, effective date and compliance deadline are separate fields. Source outages must be reported as coverage gaps.
Change approval
Flag source changes, assess affected workflows and draft amendments with citations and exact versions. The owner authorizes minimal source-verified, jurisdiction-matching amendments to be published automatically after validation. Preserve version history, required notice and prospective acceptance; never fabricate consent. Ambiguous changes or missing controls remain pending with a reason. Maintain a change register and test implementation. The full in-app scanner, jurisdiction rule engine and acceptance-evidence system are not yet implemented.