Privacy · Spectre Spaces
SPECTRE SPACES

Policies

Privacy

Spectre Software Solutions LLC ("S2olutions", "we") operates Spectre Spaces. This page explains what Spectre Spaces collects, why, who helps us run it, how long we keep things, and the choices you have. It is not legal advice.

This page

Effective October 22, 2026.

This page covers the Spectre Spaces app, this site (spaces.s2olutions.com), the lead forms that deliver into an agency's space (including Plan Shop at form.s2olutions.com), and Medicare data a beneficiary chooses to share. The request-access form and developer application on s2olutions.com are covered by the S2olutions company privacy page.

Spectre Spaces™ is a product of Spectre Software Solutions LLC, Lorain, Ohio. A licensed agency's name on a space is a tenant label. It does not make that agency the owner of this page.

What Spectre Spaces is

Spectre Spaces is a Client Relationships Management Space for licensed insurance agencies. Agents and staff keep their agency's book of clients, leads, notes, tasks, documents, and meetings in one place. It is not a Medicare plan, not a carrier, and not a way for an agent to look up someone else's Medicare history.

Whose information this is

Each agency decides what goes into its book and how it uses it. For that information we act for the agency and follow its instructions. The agency is responsible for telling its clients how it uses their information and for getting the consents the law requires.

We decide how to handle account and sign-in information, seat requests, and visits to our public pages.

This covers agents and staff who sign in, clients and prospects an agency records, people who send a lead form, Medicare beneficiaries who authorize a connection, and visitors to this site.

Information in the book

An agency can record: names, phone numbers, email addresses, mailing address and county, date of birth, household members and relationships, policies (carrier, plan, policy number, premium, and health or Medicare lines), appointments, Scope of Appointment and consent records, notes, call logs and call notes, uploaded documents, text message threads, emails and letters written in the space (with the full text and mailing address), budget and utility reviews (household size, income, homeowner status, veteran disability status, and whether bills affect medicine), and field visit lists with map points.

Social Security numbers are never a search key. A Medicare number is used only by the HealthSherpa connection, which is held (see below). Where the book shows a last four or an identifier slot, it is a pointer for the agency, not a pull against Medicare.

The vault encrypts items in your browser before they reach us. We can't read vault contents.

Accounts and sign-in

Seats are by invitation only. An account holds name, email, role, agency, and, if you add them, a mobile number and an email signature. Passwords are stored as one-way hashes. Before you can open client records, you must set up two-step sign-in with an authenticator app. Its secret is encrypted.

Signing in with Google requests openid, email, and profile, and works only for an account that already exists. Signing in with Microsoft requests openid, email, profile, and User.Read, and we keep the Microsoft tenant and account IDs to link your seat.

The "Ask for a seat" form on this site asks for your name, email, an optional phone number, the kind of seat, and a message.

Lead forms and lead sources

An agency can send leads into its space from its own website forms, Plan Shop, Google Ads lead forms, Google Business Profile messages, Meta (Facebook and Instagram) lead ads, X, TikTok, or LinkedIn lead forms when the agency connects them, lead vendors, Dot Card through Zapier, and spreadsheet imports.

A lead can include a name, phone, email, ZIP or postal code, a note, the page and campaign it came from (UTM tags and ad click IDs), and the answers on the form. When a form asks for consent, we record the consent text, its version, the time, the IP address, and the browser details sent with it. We keep each submission as it arrived. Dot Card leads drop fields with the standard names for Social Security numbers, Medicare numbers, tax IDs, and passwords; a field named some other way is kept. A lead vendor's submission is kept exactly as the vendor sent it, and spreadsheet rows held back for a missing name or ZIP code are kept with every column as uploaded. So don't send those numbers in a lead.

When someone asks for a call on a Meta lead form, that is permission to call back only. Spectre Spaces won't text them until they give permission to text. When the request is added to a broker's book from the Leads page, the dashboard, or Pemby, Spectre Spaces also refuses to draft or send email to that person or to the address on the form. A request added to a book another way, such as from a field visit on the map, or not yet in any book, isn't held that way yet, so the agency must not email that person.

S2olutions hosts Plan Shop at form.s2olutions.com for the agency named on it. Plan Shop asks for an Ohio ZIP code, name, phone, email, when you need coverage, which Medicare coverage you're interested in (such as Medicare Advantage or a Supplement), an optional note, and your consent. It also records your IP address, browser details, and ad tags (such as UTM tags and the Facebook click ID). Plan Shop's pages load their fonts from Google, so Google receives your IP address and browser details. The agency named on the form receives your request, may contact you the ways your consent allows, and its own privacy notice applies too. Plan Shop itself doesn't keep a copy. Each request goes straight into the space of the agency named on the form. Earlier Plan Shop requests that went through leads.s2olutions.com, a separate S2olutions service, are kept in Cloudflare storage with no expiry timer.

Connected Google accounts

A person can connect their Google account to use Gmail and Google Calendar from the space. That connection requests gmail.readonly to show recent messages and their previews, gmail.send to send email you write, and calendar.events to see your upcoming events and add appointments. When you ask Pemby about your inbox or calendar, Pemby reads the sender, subject, and preview of your 10 most recent inbox messages, or the events on your main Google calendar for the next 7 days, to answer you. What Pemby read is saved with that chat or workflow run in your space. Pemby's AI model service, described below, receives it only once the safeguards described there allow it; until then, nothing from your inbox or calendar goes to an AI model. The connection's tokens are encrypted. Disconnecting deletes them from Spectre Spaces. You can also remove access in your Google account settings.

Spectre Spaces' use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements, and, for Workspace data, the Google Workspace API User Data and Developer Policy. We use it only to provide the features you turn on, including Pemby answering your own questions about your inbox and calendar. We don't use it for advertising, and we don't use it to develop, improve, or train generalized AI or machine-learning models.

Spectre Spaces does not connect to Google Drive.

Pemby, the AI assistant

Pemby is the AI assistant in the space. Pembys in Spaces is our name for this AI staff. Today each person has one Pemby.

Pemby's AI model service is Anthropic's Claude, reached through the Anthropic API. When you ask Pemby for something, Pemby may send your request, the conversation so far, your saved preferences, and the details it looks up for that request to Anthropic. Those details can include whatever in the book the request needs: names, contact details, addresses, dates of birth, households and relationships, policy details including Medicare plan lines, appointments, tasks, notes and call notes, consent and Scope of Appointment records (including the consent wording), compliance, commission, and production records, document titles and file names, each client's activity history, emails and letters written in the space, field visit lists with map points, and, if you ask, your inbox previews and calendar events. Pemby uses no other AI model service.

Our code sends nothing to Anthropic until a business associate agreement covering that exact service is recorded and every HIPAA safeguard check in our code passes. Until then, no request leaves our servers for an AI model, and Pemby runs only its built-in desk steps.

In Pemby chats, a message with text that looks like a Social Security number or a Medicare number, or a password, secret, or API key written right after the word "password", "secret", or "API key" and a colon or equals sign (for example "password:" or "API key="), is replaced with a note that it was removed, before it is saved or sent, and Pemby doesn't act on it. Don't paste other keys or passwords into a chat. Saved workflow-run results aren't filtered this way. Pemby drafts. A person sends.

Pemby's saved preferences and routines are for desk habits, not client details. Saved preferences turn away text that looks like a Social Security or Medicare number, a password, contact details, dates, and a few health words. Routines check a shorter list of words. Neither catches every health detail, so don't put health details in them.

Listen (voice dictation) runs only on your device, using your browser's on-device speech recognition. If your browser can't do that, Listen doesn't start. Read-aloud uses only voices on your device. Our own voice server is off.

Pemby's own web browser is off. When it is on, it visits only approved public sites, such as medicare.gov and the NAIC.

Medicare data from Blue Button is not sent to Pemby. We do not use agency or client data to train or fine-tune AI models. Chats, saved preferences, and workflow runs stay with the agency's space.

Other Pembys in Spaces features, such as a team of Pembys for each broker, are not part of Spectre Spaces yet. We will update this page before they are.

Medicare data, only after the beneficiary authorizes it

CMS Blue Button 2.0 is a beneficiary-authorized API. Spectre Spaces uses Version 2 (FHIR R4 and OAuth 2.0). This connection is held: it doesn't run in Spectre Spaces today, so nothing is requested from Medicare and nothing new is stored. When it runs, this is what it does.

The beneficiary signs in with Medicare and chooses whether to share. Spectre Spaces asks only for coverage and Explanation of Benefits for Medicare Part A, Part B, and Part D claims. It does not ask for demographics. Blue Button does not provide Medicare Part C claims.

Medicare data is stored on a separate Medicare Data record for that client, not on the ordinary book row. Only the agent who set up the connection, the agency owner, and people with agency-wide access can see it. Access tokens are encrypted and never sent to the browser. Until CMS approves production access, the connection uses CMS's sandbox and synthetic data.

The agency can disconnect at any time. Disconnecting removes the access tokens and the stored claim details of that client's most recent connection. If a client was connected more than once, ask us to delete the earlier connections too. A short record stays: the Medicare patient and resource IDs, summary labels such as a coverage status or a claim date, and an audit line of the connection. A beneficiary can also revoke the app at Medicare.gov. That stops new data but doesn't delete what is already stored, so ask the agency or us to delete it.

HealthSherpa

An agency can connect its own HealthSherpa account. This connection is held: it doesn't run today, and nothing is sent to or received from HealthSherpa. When it runs, this is what it does.

For Medicare, Spectre Spaces can send a client's Spectre Spaces record ID, name, contact details, date of birth, sex, Medicare number, Part A and Part B start dates, Medicaid eligibility and Medicaid number, Extra Help status, and, if it is entered, the client's prescription drug list to HealthSherpa. Before anything is sent, the person sending must pick a client in the book whose written permission naming HealthSherpa is confirmed and who hasn't asked not to be contacted. That check is made on the client picked, not on the details typed into the request, so the agency is responsible for sending only that client's information.

Enrollment submissions HealthSherpa sends back are stored encrypted in full. The applicant's name, plan, plan type, carrier, effective date, confirmation number, and the submitting agent's email are also kept unencrypted so the agency can see the submission. A submission is linked to a client in the book only when it carries that client's Spectre Spaces record ID; otherwise it is kept unlinked.

For marketplace (ACA) quotes, Spectre Spaces sends ZIP code, county and state, household size, income, each applicant's age and relationship (primary, spouse, or dependent), tobacco use, pregnancy, the coverage start date, the coverage type, and any plan filters chosen to HealthSherpa. When someone searches for a doctor or facility, the name they type and the ZIP code go to HealthSherpa too. Neither request includes the client's name.

Carrier screens

The Anthem screens in an agency's space are practice only. They don't send agency or client information to Anthem, and live sending to Anthem isn't built. Our own staff can send test requests to Anthem's partner test system.

Texts, email, letters, and calls

Meetings, chat, Spaces Ink, cards, and maps

Billing

Agency subscriptions are paid through Stripe's hosted checkout. We keep the agency, the admin email, and each billing event Stripe sends us, stored as Stripe sent it. Depending on how billing is set up, those events can include the billing name and contact details given at checkout. Spectre Spaces never sees full card numbers.

Who can see a record

Agents see the records their permissions allow. An agency owner and people given agency-wide access see the agency's book. People in charge at the agency can read its text message threads and see commission and production records. Everyone with a seat at an agency can see its sales board: each colleague's name, email, and role, with counts for the current period of sits, leads added, door knocks, and policies written (active, applied for, or pending). It shows no dollar amounts. People at other agencies can't see any of this. Our staff access an agency's information only to run and secure the service, to answer the agency's request, or when the law requires it.

Service providers

These companies help run Spectre Spaces. Each gets only what its job needs:

We do not sell personal information. We share information outside these providers only when the agency directs it, when the law requires it, to protect people or the service, or as part of a sale or merger of our business, where this page keeps applying.

How long we keep it

Most book records, such as clients, households, policies, appointments, tasks, and documents, stay in the app until the agency deletes them. Deleting a book record hides it from the app, and the row stays in the database. Desk notes added to a client's activity history can't be deleted. The Notes field on the client's own record can be edited like the rest of the record. If a client is added with notes and no source, those first notes are also copied into the client's first activity line, which stays. Text threads (the words of texts sent, received, or written and not sent), budget and utility reviews, field visit lists and their attachments, and Scope of Appointment forms Spaces Ink prepares for a client have no automatic timer and no self-serve delete yet; ask us to remove them. Call logs have no automatic timer and no self-serve delete yet; ask us to remove them. A call logged on the Calls page also writes its outcome and notes to the client's activity history, and that line stays even if the call log is removed.

Spaces Ink documents you upload and mark up can be deleted by the people allowed to manage them, and deleting one removes it. Every client added in the app starts with a line in their activity history, and our admin tool won't remove a client for good while that client has activity history, a consent record, or a kept document, so a deleted client's record and its kept records stay. We handle a request to delete someone's information as the law that applies requires. Consent records, including Scope of Appointment consents, and their evidence are kept for at least 10 years from when they are recorded, our house policy. Nothing deletes them automatically after that. A signed Scope of Appointment copy is kept for 10 years from when it is stored in Spectre Spaces, and it can't be changed, deleted, or removed on request during that time. Nothing deletes it automatically after that. Consent records, the text log, and the audit trail can't be changed or deleted in the app or with our admin tool. People can't change or delete a client's activity history there either. Some lines follow the record they describe: editing a policy rewrites the line for its latest change, and editing a closed task in the app rewrites its closed line. Spectre Spaces also updates some of its own lines in place, such as the line listing the email addresses held for a call request.

Lead submissions, held spreadsheet rows, emails and letters written in the space, Pemby chats, saved preferences, workflow runs, and the workflow steps Pemby saves for each broker have no automatic timer; ask us to remove them. A Meta lead-form call request added to a book from the Leads page, the dashboard, or Pemby keeps its call-request line, which can't be changed, and the lead's record, which people at the agency can still edit or hide. Our admin tool won't delete either. Billing events are kept as Stripe sent them, with no automatic timer and no self-serve delete.

Removing a seat turns the account off and keeps the record, and an account that has written activity history or a consent record can't be deleted. Our code sets no deletion schedule for backups. Copies kept by Twilio, Lob, Stripe, our mail relay, and a sender's own Gmail or Google Calendar follow those services' rules. The data retention page lists the timers the code sets and those copies.

Cookies and browser storage

The app uses a session cookie that ends after 30 minutes without activity, a security cookie that blocks forged requests (1 year), and a short sign-in cookie for Google or Microsoft (10 minutes). The site at spaces.s2olutions.com sets a 1-hour security cookie that blocks forged requests when you open the home page or the contact page. When that site's own sign-in service is used, it sets a 12-hour session cookie and the same 1-hour security cookie.

Public pages on spaces.s2olutions.com, including its privacy page and contact page, load Meta's pixel (see below). Meta's script sets its own cookies on spaces.s2olutions.com: _fbp, a browser ID, and _fbc when you arrive from a link with a Facebook click ID. It may also use your browser's local storage. Meta sets how long they last. The copies of this page and the terms at privacy.s2olutions.com and terms.s2olutions.com load no pixel.

The app keeps an offline copy of the book in your browser so you can work without a signal. It is cleared when you sign out. If your session ends for inactivity, or you close the tab without signing out, the copy stays in that browser until you sign in there again and sign out; another person signing in doesn't clear it. Always sign out on a shared device. Your browser also keeps the encrypted vault, unsent drafts, and Pemby's saved preferences and routines.

This host and the pixel

Public pages on spaces.s2olutions.com, including its privacy, terms, and contact pages, load a Meta Pixel, id 3752929798220720. Our code sends a PageView event only and adds no email or phone number. Meta's automatic event setup may also record basic page interactions, such as button clicks, and Meta receives the standard information your browser sends, such as your IP address and the page address. The data retention page and the signed-in app do not load the pixel, and neither do the copies of the privacy and terms pages at privacy.s2olutions.com and terms.s2olutions.com. You can block it, and its cookies, with your browser's privacy settings.

Security

Each agency's space is separate. Passwords are hashed. Everyone must set up two-step sign-in before opening client records, and app sessions end after 30 minutes without activity. Ending a session doesn't clear the offline copy of the book in your browser; signing out does. Sign-in tokens for Medicare, Google, HealthSherpa, and other connections are encrypted. The app's link to its database must be encrypted, and the site uses HTTPS. Before our servers write a log line, they mask text shaped like email addresses, phone numbers, Social Security and Medicare numbers, dates, and street addresses. No method of storage is perfect, and each agency still has to protect its own logins. If a security incident affects information in an agency's space, we will tell that agency without undue delay so it can meet its own duties, and we will give any notice the law requires of us. Where a business associate agreement covers the information, we also follow its notice terms.

Health information

A book of insurance clients, and Medicare claims in particular, can be health information. Spectre Spaces keeps Medicare claims off the ordinary client row.

An agency covered by HIPAA must sign our business associate agreement (BAA) before putting health information in Spectre Spaces. Under that BAA, S2olutions works as the agency's business associate: we use and disclose the agency's protected health information only to run Spectre Spaces for that agency, as the BAA sets out, and we report a breach of unsecured protected health information to the agency as the BAA requires. The app's safeguards are the ones under Security above: separate spaces for each agency, required two-step sign-in, sessions that end after 30 minutes without activity, encrypted connection tokens, an encrypted database link, and masked logs. Where this page and the BAA differ about protected health information, the BAA controls. The agency remains responsible for its own duties under HIPAA.

Render hosts the app and its database. Cloudflare's network sits between your browser and the app, so client information passes through it on the way to and from Render.

Pemby's AI model service, Anthropic, receives client information only after a business associate agreement covering that exact service is recorded and our HIPAA safeguard checks pass. Until then, nothing is sent to it. The HealthSherpa and Medicare Blue Button connections stay held behind the same kind of checks.

For Medicare data a beneficiary shares with us, we follow the breach rules that apply to us, including the FTC Health Breach Notification Rule where it applies. This policy does not make S2olutions anyone's doctor, plan, or insurer.

Your choices

Children

Spectre Spaces is a tool for agencies and is not directed at children under 13. An agency may record household members, who can include children, as part of a client's file. The agency is responsible for that information.

Changes

When this page changes, the date at the top changes with it. If a change is significant, we will tell agency admins by email or in the app before it takes effect. A beneficiary can revoke Medicare access at Medicare.gov, or ask the agency to disconnect, at any time, including after a change.

Contact

Spectre Software Solutions LLC, Lorain, Ohio
Privacy questions: privacy@s2olutions.com
Site: s2olutions.com

Terms · Data retention · Company privacy