PURPOSE OF THIS NOTICE As provided by law, we are generally prohibited from sharing nonpublic personal information about you with a third party unless we provide you with this notice of our privacy policies and practices describing the type of information that we collect about you and the categories of persons or entities to whom that information may be disclosed. Accordingly, we are providing you with this document, which notifies you of the privacy policies and practices of INDEMNUS Corporation. Furthermore, we wish to inform you that we do not share your personal information with any non-affiliated third parties for any purpose that is not specifically authorized by law unless we obtain your affirmative permission. OUR PRIVACY POLICIES AND PRACTICES Information we collect Categories of Information Collected and Sources from Which We Collect It We collect nonpublic personal information about you from the following sources: Information we receive from you on applications or other forms you submit to us, from your dealings with us, and from our website. Information about your transactions with us, our affiliates or others. Information we receive from consumer reporting agencies. Information we receive from MVRs (moving violation reports) and CLUE (claims loss underwriting exchange) reports. Information we receive from medical records or medical professionals. Unless it is specifically stated otherwise in an amended Privacy Policy Notice, no additional information will be collected about you. Persons From Whom Information is Collected We may collect nonpublic personal information from individuals other than those proposed for coverage. Information From Credit Reports or Investigative Consumer Reports If you authorize us to do so, we may obtain information about you from credit reports or other investigative consumer reports prepared by third parties at our request. If you authorize us to request such information and we request such information, you should be aware that: You have the right to request to be interviewed in connection with the preparation of an investigative consumer report. Upon request, you are entitled to receive a copy of the consumer reports. The information obtained from the reports prepared by a third party may be retained by the third party and disclosed to other persons. Information we may disclose to third parties In the course of our general business practices, we may disclose the information that we collect (as described above) about you or others without your permission to the following types of institutions for the reasons described: To a third party if the disclosure will enable that party to perform a business, professional or insurance function for us. To an insurance institution, agent, or credit reporting agency in order to detect or prevent criminal activity, fraud or misrepresentation in connection with an insurance transaction. To an insurance institution, agent, or credit reporting agency for either this agency or the entity to whom we disclose the information to perform a function in connection with an insurance transaction involving you. To a medical care institution or medical professional in order to verify coverage or benefits, inform you of a medical problem of which you may not be aware, or conduct an audit that would enable us to verify treatment. To an insurance regulatory authority, law enforcement, or other governmental authority in order to protect our interests in preventing or prosecuting fraud, or if we believe that you have conducted illegal activities. To a group policyholder for the purpose of reporting claims experience or conducting an audit of our operations or services. To an actuarial or research organization for the purpose of conducting actuarial or research studies. In addition to those circumstances listed above, and unless you direct us not to by completing the attached Opt Out Form, we may disclose certain information about you to third parties whose only use of the information will be for the purpose of marketing a product or service. Under no circumstances will we disclose for marketing purposes: any medical information; information relating to a claim for a benefit or a civil or criminal proceeding involving you; or personal information relating to your character, personal habits, mode of living or general reputation. Your right to access and amend your personal information: You have the right to request access to the personal information that we record about you. Your right includes the right to know the source of the information and the identity of the persons, institutions or types of institutions to whom we have disclosed such information within two (2) years prior to your request. Your right includes the right to view such information and copy it in person, or request that a copy of it be sent to you by mail (for which we may charge you a reasonable fee to cover our costs). Your right also includes the right to request corrections, amendments or deletions of any information in our possession. Our practices regarding information confidentiality and security: We restrict access to nonpublic personal information about you to those employees who need to know that information in order to provide products or services to you. We maintain physical, electronic, and organizational safeguards to protect information about you. Internet Policies and Procedures INDEMNUS respects the privacy of the individuals and businesses accessing/using ("Users") its website ("Website"). INDEMNUS collects limited information about Users who visit areas of INDEMNUS' Website accessible to the public ("Public Areas"). This information is automatically collected on an aggregate basis ("Aggregate Information") to measure traffic on the Website, including to the carrier. Aggregate Information is collected through the use of a "cookie" or small text file placed on the User's hard drive by the User's Internet browser. The cookie allows INDEMNUS to track the number of hits or visits to various pages on the Website, including to the carrier. When INDEMNUS' Website is accessed through a hyperlink on another website, the cookie will identify and track the Internet Protocol address ("IP") that linked the User to the Website. If the User did not hyperlink to INDEMNUS' Website from the most recently visited IP, then INDEMNUS will only identify the User's Internet Service Provider (e.g., aol.com, msn.com, etc.). The cookie is used only during a single connection to the Website and to the carrier website, and is not used to track User activity after leaving the Website and Agent Locator. It is permanently disabled when the User exits the Website, and information about individual Users is not collected, saved or distributed to others by INDEMNUS. Aggregate information and other information gathered through voluntary User surveys and forms assists INDEMNUS to better understand Users' needs and improve the Website, and to enable INDEMNUS to demonstrate to vendors and others information about the volume and nature of its Website traffic. The Website and Carrier contain hyperlinks to Internet sites of INDEMNUS members and other businesses and resources, and each Internet site may have its own privacy and data collection policies and practices. INDEMNUS is not responsible for the privacy and data collection policies and practices of any of its members or other businesses and resources, or for the content of their Internet sites. Users interested in the privacy and data collection policies and practices of INDEMNUS members or other businesses and resources should review their policies. INDEMNUS makes no representations of any kind about the internet sites of its members or other businesses and resources, and INDEMNUS disclaims all warranties and responsibilities of any kind, including, without limitation, warranties and responsibilities with respect to INDEMNUS members' and other businesses' and resources' Internet sites, content privacy and data collection policies and practices, and actions. This notice is being provided on behalf of INDEMNUS Corporation. REV: December 2004