Privacy Notice
Last updated: 22 October 2026
I. About this Privacy Notice
This Privacy Notice explains how Milliman Solutions and its affiliates (“Milliman”, “we”) collect, use and otherwise process Personal Data relating to individuals who interact with Integrate’s chatbot (“you”) through the Integrate platform (the “Services”).
Integrate’s chatbot is a client-facing AI-powered chatbot that helps users find and understand Integrate’s platform documentation. The current version retrieves content from Integrate-owned user guides, configuration guides, release notes, control documents and knowledge-base materials. It generates responses grounded in those sources using a retrieval-based architecture and a GPT model deployed through Microsoft Azure OpenAI in Microsoft Foundry.
The current version is limited to platform-support use cases. It is not connected to client business datasets or client-specific knowledge bases and is not fine-tuned on client data. However, any Personal Data or client information that a user types into a prompt may still be processed as part of that interaction.
II. Definitions
“Applicable Data Protection Laws” refers to all applicable laws, regulations, and codes of practice related to privacy, data security, and data protection, including, but not limited to, the European General Data Protection Regulation No. 679/2016 (“GDPR”) and U.S. Data Privacy Laws.
“Data Controller” refers to the legal person which, alone or jointly with others, determines the purposes and means of the processing of Personal Data and is responsible for the security and lawfulness of the processing of your Personal Data. The term “Data Controller” includes any functionally equivalent or comparable term used in Applicable Data Protection Laws.
“Data Processor” refers to the legal person which processes Personal Data on behalf of the Data Controller. The term “Data Processor” includes any functionally equivalent or comparable term used in Applicable Data Protection Laws.
“Data Subject(s)” refers to a natural person concerned by the processing of his/her Personal Data. The term “Data Subject(s)” includes any functionally equivalent or comparable term used under Applicable Data Protection Laws. In the context of this Privacy Notice, you will be considered as the Data Subject.
“International Transfer(s)” refers to a transfer of, or remote access to, Personal Data from one country or jurisdiction to another, where relevant under Applicable Data Protection Laws, including transfers requiring additional data protection safeguards.
“Personal Data” refers to any information relating to an identified or identifiable natural person. The term includes any functionally equivalent or comparable term used in Applicable Data Protection Laws.
“U.S. Data Privacy Laws” refers to applicable laws and regulations concerning the privacy and security of information reasonably identifying or linked to an individual, including, without limitation, the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq., as amended by the California Privacy Rights Act of 2020 (collectively the “CCPA”).
III. Description of Processing Activities
Categories of Personal Data
As part of normal chatbot operation, security, monitoring, troubleshooting, auditing and service improvement, the platform processes the following categories of Personal Data:
This list identifies the subprocessors, their locations, and their use for processing personal data in relation to the services delivered by Milliman for the Integrate platform.
| Category | Information Processed |
|---|---|
| Client and network identifiers | Client organisation identifier; client IP address; X-Forwarded-For request information. |
| Chat inputs and conversation context | User prompts/questions, including any Personal Data entered voluntarily or inadvertently; session ID and turn ID; message/conversation context and follow-up indicators. |
| AI and retrieval records | Query rewrites and generated search queries; intent/scope classification and topic normalization; retrieval mode, index used, retrieved document references, evidence chunks and source citations. |
| Chat outputs and feedback | AI-generated responses; response completeness, grounding and citation indicators; user feedback and associated feedback identifiers. |
| Runtime and observability records | processing duration; token/model usage; cost metrics; trace/session information and application-monitoring data, including records that may capture relevant prompts, outputs and retrieval information. |
Information may be obtained directly from you (for example, questions or feedback), automatically from your use of the Integrate platform (for example, network identifiers and session information), or generated during chatbot processing (for example, retrieval queries, AI responses and diagnostic traces).
Using the chatbot is optional; however, a prompt and certain operational records are necessary for the chatbot to respond and operate securely. If you choose not to use it, consult the relevant Integrate documentation or support channel instead.
Purposes of Processing
The information described in the section “Categories of Personal Data” is processed for the following purposes:
| Purpose | How the information is used |
|---|---|
| Service delivery and contextual support | Identify the client organisation and support client-level monitoring; maintain conversation context and correlate individual requests; understand user questions, retrieve relevant approved content and generate responses. |
| Retrieval quality and explainability | Determine retrieval and processing strategies; provide source-grounded responses with citations and explainable source attribution; assess response completeness, grounding and quality. |
| Security, audit and troubleshooting | Validate network access; monitor security; detect and investigate suspicious activity; support technical troubleshooting, auditing and incident response. |
| Feedback and service improvement | Link feedback to the relevant responses, investigate issues and improve the quality and reliability of the chatbot. |
| Technical operations and monitoring | Monitor platform performance, AI usage, capacity, costs and service health; maintain operational traces; support performance troubleshooting and incident investigation. |
The chatbot is intended solely to provide documentation support and does not perform automated decision-making or make decisions affecting individuals.
Personal Data processed through the chatbot, including prompts, conversation context and chatbot outputs, will not be used to train or fine-tune general-purpose AI models. Milliman may use limited chatbot records solely for the purposes described in this Privacy Notice. In addition, chatbot data will not be used for unrelated purposes, advertising or profiling.
Milliman will not sell nor share your Personal Data within the meaning of US Data Privacy Laws. The term “sell refers to the disclosure of Personal Data for monetary or other valuable consideration, and “share” refers to the disclosure of Personal Data by a business to a third party for cross-context behavioural advertising whether for monetary or other valuable consideration.
Cookies and similar technologies
Integrate’s chatbot is integrated into the Integrate platform, which may use cookies and similar technologies in connection with the provision and operation of its services, including Integrate’s chatbot. For further information about the use of cookies and similar technologies, their purposes, and how to manage your preferences, please refer to the Integrate Cookie Policy.
IV. What is the legal basis for processing your Personal Data?
Where the GDPR or UK GDPR (the version of the GDPR applicable in the United Kingdom) applies, Milliman relies on its legitimate interests under Article 6(1)(f) to provide and improve Integrate’s chatbot as a documentation-support service, ensure its reliability and security, investigate faults and misuse, and maintain the associated operational records. These interests are pursued only where they are not overridden by individuals’ rights and interests, following an appropriate balancing assessment.
Where particular processing is necessary to comply with a legal obligation, Milliman may rely on the applicable legal obligation basis. Where Applicable Data Protection Laws require consent for a specific activity, location or technology (such as particular cross-border transfers), Milliman will obtain the relevant consent before undertaking that activity or use another lawful mechanism where permitted. Consent is not assumed merely because you use the chatbot.
In jurisdictions where the GDPR or UK GDPR does not apply, Milliman relies on the lawful basis, authorisation or permission available under the applicable local law that is functionally equivalent to legitimate interests under Article 6(1)(f), where appropriate. Milliman may also rely on a legal obligation basis, or its local equivalent, where the processing is necessary to comply with applicable law. Where consent is required for a particular processing activity, technology or international transfer, Milliman will obtain valid consent before undertaking that processing.
V. How long will your Personal Data be retained?
Milliman retains Personal Data only for as long as reasonably necessary for the stated purposes, subject to applicable legal requirements and defined deletion procedures. Different periods may apply to the following categories.
| Category of records | Retention period / criteria |
|---|---|
| Client and network identifiers | 1 year |
| Chat inputs and conversation context | 1 year |
| AI and retrieval records | 1 year |
| Chat outputs and feedback | 1 year |
| Runtime and observability records | 1 year |
Where a record must be retained for a longer period to comply with a legal obligation or address a documented security incident, dispute or legal claim, Milliman will restrict retention to what is necessary and delete or anonymise it thereafter in accordance with applicable law.
VI. Who has access to your Personal Data?
Access to chatbot-related data is restricted to authorised members of the Milliman team and relevant security personnel, according to their operational, support, monitoring, security and platform-improvement responsibilities.
Access is governed by role-based permissions and administrative controls. In particular, personnel authorised to use the production observability environment may access relevant prompts, outputs, sessions, traces, retrieval information, client/network metadata, performance information and feedback when necessary for the purposes described in this Notice.
Such processing is subject to appropriate technical and organisational measures, including role-based access controls, data minimisation and applicable retention requirements. Where reasonably practicable and consistent with the relevant processing purposes, Personal Data will be aggregated or anonymised.
Information may also be disclosed to service providers supporting the Services, including Microsoft as the Azure cloud service provider, under applicable contractual and confidentiality protections.
VII. Who is the Data Controller and Data Processor?
Data Controller:
Milliman Solutions, 1301 Fifth Avenue, Suite 3800, Seattle, WA 98101-2646, United States and 71 S Wacker Dr, Chicago, IL 60606, United States.
Data Protection Officer: [email protected]
Milliman determines the purposes and means of the chatbot processing described in this Notice.
- Microsoft Corporation, One Microsoft Way, Redmond, WA 98052, United States.
- Milliman LLP, Eastcheap Court, 11 Philpot Lane, London EC3M 8AA, United Kingdom.
- Milliman India Private Limited, AIPL Business Club, 11th Floor, Sector 62, Golf Course Extension Road, Gurgaon 122 011, Haryana, India.
Microsoft provides Microsoft Azure services, including Azure OpenAI in Microsoft Foundry, Azure AI Search and related cloud infrastructure services under the applicable enterprise agreement and Microsoft Products and Services Data Protection Addendum (DPA). The Milliman entities listed above provide technical support in connection with the processing activities described in the “Purposes of Processing” section.
VIII. International Data Transfers
Personal Data processed through Integrate’s chatbot is currently hosted and stored in Microsoft Azure regions in the United States, primarily West US 3, with certain knowledge retrieval, search and disaster recovery resources located in East US.
Relevant authorised personnel are based in the United States, the United Kingdom and India. Accordingly, chatbot Personal Data may be stored or accessed from these countries.
Where required by Applicable Data Protection Laws, Milliman will rely on an applicable adequacy determination or another valid transfer mechanism, such as the relevant Standard Contractual Clauses or other legally recognised safeguards, together with supplementary measures and transfer assessments where required. For more information about the applicable safeguards or how to obtain a copy, contact Milliman’s privacy team using the contact details in Section VII.
IX. Your Rights
Depending on Applicable Data Protection Laws, you may have the right to access, rectify, erase, restrict, or object to the processing of your Personal Data, as well as the right to data portability. In addition, where we rely on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before its withdrawal.
To exercise your rights, complete the applicable form on How to Submit a Data Privacy Request page and explain that your request concerns the “Integrate chatbot”.
If Milliman denies your request, an explanation for the refusal will be provided. You also have the right to lodge a complaint with your country’s data protection authority or refer the matter to a court of competent jurisdiction.