Last updated September 16, 2026
To get you real quotes we need real information about your people. Here is exactly what we take, who sees it, and how to get it deleted.
Decent is a health insurance brokerage. Nick Soman is the licensed broker on your account, national producer number 19077026, licensed in California and a number of other states. You ask us to shop your group health benefits, and we go to the carriers, PEOs, and general agents who can price them.
This policy covers the information we handle when we do that work. It applies to decent.com and to everything we receive by email.
A census. For each employee and dependent who would be covered, the five fields every carrier and PEO asks for:
The documents you already have. Your current invoice, the renewal packet, plan documents, rate sheets, and any proposal your current broker has given you.
Employment details, for a PEO or workers' compensation quote. Job title, employment status, work location, and annual pay. Workers' compensation is priced on payroll by job classification, so no PEO can quote it without pay and job data, and we also ask your current carrier for the loss runs, meaning the claim history on your policy. Some PEO submissions need the full home address rather than just the ZIP.
Contact details for the people we work with. Names, work email addresses, and phone numbers at your company.
We don't ask for Social Security numbers, member or subscriber IDs, or bank details. We don't want them. If something you send contains them, tell us and we'll delete it.
For a fully insured or PEO quote, nothing we collect is health information. It's personal information, and we treat it that way.
Self-funded and level-funded plans are priced on what your plan actually spent, so quoting one means asking your carrier or administrator for claims reports. That's normally a monthly paid-claims summary plus a large-claim report listing conditions and dollar amounts.
We ask for those reports without member names or member IDs. Where a report would identify individuals, we ask for a de-identified version first, and we won't take identified health information without a written agreement covering it. Claims reports go only to the stop-loss carriers and administrators quoting your plan.
If your plan is fully insured or you're on a PEO, this section doesn't apply to you.
Premiums are priced on age and location. Date of birth and ZIP are the two fields the rates are built from, and gender is used on some underwritten quotes. Without them nobody can give you a real number, only an estimate that changes when you try to buy it.
The carriers, PEOs, and general agents we ask to price your plan, and no one else. We name them for you before anything goes out, and we don't add to that list without asking you first.
Google hosts our email and our files through Google Workspace. HubSpot is our customer database, where we keep the contact details of the people we work with and our notes on the plans we're shopping. Those are the only two vendors with access to the census and the documents you send us. The services described under "This website" see your visit to this site, and the chat window there sees whatever you type into it. They never receive your census, your documents, or anything else you send us by email.
We don't sell your information, we don't use it for advertising, and we don't share it with anyone who isn't quoting your plan.
decent.com uses third-party services to work out who is visiting. Some of them tell us only the company behind a connection. Others try to identify you as an individual, and they can do that from your browser alone, without you having given us anything. They set cookies. What they return is partial and not always right.
We use this to see which companies are shopping for coverage, so we can be useful sooner. We don't use it for advertising, and we don't sell it. If your browser sends the Global Privacy Control signal, none of these services load and nothing about your visit reaches them. You can also email nick@decent.com and we'll exclude you. These services also record which pages you look at while you are here. There is no advertising pixel on this site.
They record more than pages. One of them also logs what you click on: the text of the link or button, where it sits on the page, and where it points. It logs files you download. And on the pages of this site that have a form, it logs that you started, submitted or abandoned one, and the names of the fields, though not what you typed into them. We had described these services as working out who is visiting, which was true and incomplete, so this paragraph now says the rest. The same Global Privacy Control rule covers all of it: send that signal and none of this loads.
The chat button is run by one of these services, so whatever you type into it goes to that vendor as well as to us. Keep your census and your documents to email, where we have told you who sees them.
Booking a meeting runs on HubSpot, which is also where we keep our notes on the people we talk to. On a wide screen the calendar is part of the page, so HubSpot loads when the page does, learns which page you are on, and sets cookies of its own, whether or not you book. On a narrow screen none of their code loads until you tap to book, though your browser does open a connection to them on every visit so the calendar is quick when it is wanted. Unlike the services above, the booking calendar still loads when your browser sends the Global Privacy Control signal, because it is the thing you came to use. If you would rather not load it at all, email nick@decent.com and we'll find a time that way. Whatever you type into the booking form goes to HubSpot.
If you're already in touch with us and open this site from a link in one of our emails, we can tell it was you, and that becomes part of our notes on you. We use it to know when a proposal has been read, not to advertise.
Our host, Cloudflare, keeps a server log of each page view: the page, the time, the name of the network the connection came from, its city and time zone, and a code derived from the connection that changes every day, so it can't be used to follow you over time. No IP address is stored. If your browser sends the Global Privacy Control signal, that page view isn't logged at all. We read the log to see which companies are looking at the site. It never leaves Cloudflare and us.
Ask us and we'll delete the browsing history along with the rest of your record.
As long as we're your broker. We work your plan through the year rather than only at renewal, so your census and plan documents are what that work runs on, and clearing them out every January would just mean asking you to send it all again.
Ask us to delete it and we will, at any point. The one exception is records a licensed broker is required to keep for a period set by state insurance law. We hold those for as long as the law says and no longer.
What you send is encrypted in transit and encrypted at rest by Google Workspace. The accounts that hold it require two-factor authentication, and the machines we work on use full-disk encryption. Access is limited to the licensed broker on your account.
If your security team needs a vendor questionnaire filled out, send it over and we'll complete it.
Ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Email nick@decent.com and we'll take care of it.
If you're an employee of a company we're quoting, your employer gave us your information as part of shopping their benefits. You can still email us directly and we'll handle your request.
If this policy changes, the date at the top changes with it.
Decent
Nick Soman, licensed broker · NPN 19077026
nick@decent.com
707-234-5671