MEMORANDUM OPINION & ORDER

RUBÉN CASTILLO, District Judge.

Anne Dolmage ("Plaintiff") filed this action against Combined Insurance Company of America ("Defendant") alleging breach of contract for failing to keep her personal information private. (R. 36, Am. Compl.) Presently before the Court is Defendant's motion for summary judgment. (R. 141, Mot.) For the reasons stated below, the motion is granted.

FACTS

The following facts are undisputed unless otherwise stated. Plaintiff is a citizen of Missouri. (R. 149, Pl.'s Resp. to Facts ¶ 1.) In early 2011, she applied for and was issued supplemental insurance coverage by Defendant, an insurance company headquartered in Illinois. (Id. ¶¶ 1-2.) At that time, Plaintiff was employed by the department store Dillard's and lived and worked in Iowa. (Id. ¶ 1.) From 2009 to 2011, Defendant offered a variety of insurance products to Dillard's employees, including group or individual supplemental insurance policies underwritten by Defendant, group insurance products underwritten by ACE American Insurance Company ("ACE"), and various medical, vision and dental insurance products underwritten by third parties. (Id. ¶ 8.) During this period, Defendant administered the open enrollment period for Dillard's each year, during which time Dillard's employees could enroll in the various products offered by Defendant. (Id. ¶ 9.) Defendant used a third-party vendor, Enrolltek, to provide enrollment services for Dillard's employees who enrolled in an ACE-underwritten product offered by Defendant. (Id. ¶ 22.)

On or about April 18, 2011, Plaintiff placed a telephone call to Defendant's representatives to apply for certain insurance benefits. (Id. ¶ 10.) Specifically, Plaintiff applied for and obtained a supplemental life insurance policy underwritten by Defendant. (Id. ¶ 11.) Shortly thereafter, Defendant mailed Plaintiff a package containing the policy and various other "fulfillment materials." (Id. ¶ 12.) The fulfillment materials consisted of 15 different documents, including a cover letter, a brochure with instructions for using Defendant's website to manage account information, an accelerated payment rider, Plaintiff's completed application for life insurance coverage, several blank forms, and — at issue here — a document entitled, "Our Privacy Pledge To You" ("Privacy Pledge"). (Id. ¶ 13.) The Privacy Pledge makes certain statements about the handling of insureds' personal data, including as follows:

(R. 150, Def.'s Resp. to Add'l Facts ¶ 1 (emphasis in original.) Defendant sends the Privacy Pledge to all new enrollees, although the parties dispute whether it is technically part of the insurance policy.1 (R. 149, Pl.'s Resp. to Facts ¶ 20.)

The policy mailed to Plaintiff includes the following definition: "Policy means this policy with any attached application(s), and any riders and endorsements[.]" (Id. ¶ 14.) The policy further provides: "The policy is a legal contract. It is the entire contract between you and us. Any change to it must be in writing and approved by us. Only our President or one of our Vice-Presidents can give our approval." (Id.; R. 150, Def.'s Resp. to Add'l Facts ¶ 2.) The policy also includes a table of contents, which states at the bottom, "A copy of the application and any riders and endorsements follow page 17." (R. 149, Pl.'s Resp. to Facts ¶ 15.) Following page 17 are various documents, including the Privacy Pledge. (Id. ¶ 13.) Some of the fulfillment materials Plaintiff received contain the following disclaimer: "THIS IS A PROPOSAL AND IS NOT PART OF THE INSURANCE CONTRACT." (R. 150, Def.'s Resp. to Add'l Facts ¶ 5.) The Privacy Pledge does not contain such a statement. (Id.)

In March 2012, after Plaintiff applied for and obtained her insurance policy, Defendant's third-party vendor, Enrolltek, placed two files containing the personal information of Plaintiff and other Dillard's employees and their dependents on an unsecured location on Enrolltek's website. (R. 149, Pl.'s Resp. to Facts ¶ 23.) These files were readily available online through a routine internet search from March 2012 until early July 2013. (R. 150, Def.'s Resp. to Add'l Facts ¶ 3.) The data was later taken down from Enrolltek's website, although the parties dispute whether Defendant acted quickly enough when it learned that the data was unsecured. (R. 149, Pl.'s Resp. to Facts ¶ 24.) In July 2013, Defendant notified affected individuals, including Plaintiff, that their data may have been compromised and offered them free credit monitoring services and other protections. (Id.) A fraudulent tax return was filed with the Internal Revenue Service in Plaintiff's name for tax year 2013 by unknown identity thieves. (R. 150, Def.'s Resp. to Add'l Facts ¶ 4.)

PROCEDURAL HISTORY

In May 2014, Plaintiff filed this action on behalf of herself and a putative class of similarly situated individuals alleging a host of federal and state law claims. (R. 1, Compl.) After two rounds of motions to dismiss, various amendments to the pleadings, and two substantive opinions from this Court, what is left of the case is one claim for breach of contract premised on Defendant's alleged breach of the Privacy Policy. See Dolmage v. Combined Ins. Co. of Am., No. 14 C 3809, 2016 WL 754731, at *4-6 (N.D. Ill. Feb. 23, 2016).

In November 2016, Plaintiff moved for class certification. (R. 111, Pl.'s Mot. for Class Cert.) The Court denied the motion, finding that the requirements of Federal Rule of Civil Procedure 23 were not satisfied. Dolmage v. Combined Ins. Co. of Am., No. 14 C 3809, 2017 WL 1754772, at *3-10 (N.D. Ill. May 3, 2017). Plaintiff filed a petition with the U.S. Court of Appeals for the Seventh Circuit seeking leave to appeal under Rule 23(f), but the petition was denied. (R. 137, 7th Cir. Order.)

In August 2017, Defendant filed the present motion seeking summary judgment on Plaintiff's remaining claim. (R. 141, Mot.) Defendant argues that Plaintiff's breach of contract claim fails as a matter of law because it is premised on violations of the Privacy Pledge and, in Defendant's view, that document is not part of the insurance policy. (See R. 142, Def.'s Mem.; R. 143, Def.'s Facts; R. 150, Def.'s Reply.) Plaintiff opposes the entry of summary judgment, arguing that the Privacy Pledge is part of the insurance policy for all intents and purposes and that it supports a valid breach of contract claim. (R. 148, Pl.'s Opp'n; R. 149, Pl.'s Resp. to Facts.) In Plaintiff's view, the Privacy Pledge is a "rider or endorsement" that was specifically incorporated by reference into the policy. (R. 148, Pl.'s Opp'n at 7-8.)

LEGAL STANDARD

Federal Rule of Civil Procedure 56 provides that "[t]he court shall grant summary judgment if the movant shows that there is no genuine dispute as to any material fact and the movant is entitled to judgment as a matter of law." FED. R. CIV. P. 56(a). Summary judgment is proper "if the pleadings, depositions, answers to interrogatories, and admissions on file, together with the affidavits, if any, show that there is no genuine issue as to any material fact and that the moving party is entitled to a judgment as a matter of law." Celotex Corp. v. Catrett, 477 U.S. 317, 322 (1986) (citation omitted). "A genuine dispute as to any material fact exists if the evidence is such that a reasonable jury could return a verdict for the nonmoving party." Kvapil v. Chippewa Cty., 752 F.3d 708, 712 (7th Cir. 2014) (citation and internal quotation marks omitted). In deciding whether a dispute exists, the Court must "construe all facts and reasonable inferences in the light most favorable to the non-moving party." Nat'l Am. Ins. Co. v. Artisan & Truckers Cas. Co., 796 F.3d 717, 723 (7th Cir. 2015) (citation omitted).

Under Rule 56, the movant has the initial burden of establishing that a trial is not necessary. Sterk v. Redbox Automated Retail, LLC, 770 F.3d 618, 627 (7th Cir. 2014). "That burden may be discharged by showing . . . that there is an absence of evidence to support the nonmoving party's case." Id. (citation and internal quotation marks omitted). If the movant carries this burden, the nonmovant "must make a showing sufficient to establish the existence of an element essential to that party's case." Id. (citation and internal quotation marks omitted). The nonmovant "must go beyond the pleadings (e.g., produce affidavits, depositions, answers to interrogatories, or admissions on file) to demonstrate that there is evidence upon which a jury could properly proceed to find a verdict in [their] favor." Id. (alteration in original) (citation and internal quotation marks omitted). "The existence of a mere scintilla of evidence, however, is insufficient to fulfill this requirement." Wheeler v. Lawson, 539 F.3d 629, 634 (7th Cir. 2008). "[S]peculation and conjecture" also cannot defeat a motion for summary judgment. Cooney v. Casady, 735 F.3d 514, 519 (7th Cir. 2013). In addition, not all factual disputes will preclude the entry of summary judgment, only those that "could affect the outcome of the suit under governing law." Outlaw v. Newkirk, 259 F.3d 833, 837 (7th Cir. 2001) (citation omitted).

In deciding the motion, the Court cannot weigh conflicting evidence, assess the credibility of the witnesses, or determine the ultimate truth of the matter, as these are functions of the jury. Anderson v. Liberty Lobby, Inc., 477 U.S. 242, 255 (1986); Omnicare, Inc. v. UnitedHealth Grp., Inc., 629 F.3d 697, 704-05 (7th Cir. 2011). Instead, the Court's sole function is "to determine whether there is a genuine issue for trial." Tolan v. Cotton, 134 S.Ct. 1861, 1866 (2014) (quoting Anderson, 477 U.S. at 249).

ANALYSIS

Defendant argues that Plaintiff's breach of contract claim fails as a matter of law because she has not established that the Privacy Pledge was part of the parties' insurance contract. (R. 142, Def.'s Mem. at 5-6.) Plaintiff disagrees. (R. 148, Pl.'s Opp'n at 7-8.) The Court addresses each of their respective arguments below.

I. Applicable Law

As a preliminary matter, the parties disagree over which state's law should be applied to resolve Plaintiff's claim. Defendant argues that the Court should apply Iowa law, whereas Plaintiff believes the Court should apply the law of Illinois as the forum state. (See R. 142, Def.'s Mem. at 9; R. 148, Pl.'s Opp'n at 6-7.) "Federal courts hearing state law claims under diversity or supplemental jurisdiction apply the forum state's choice of law rules to select the applicable state substantive law." McCoy v. Iberdrola Renewables, Inc., 760 F.3d 674, 684 (7th Cir. 2014). Under Illinois law, in the absence of an express choice-of-law provision in an insurance policy, courts apply a "most significant contacts" test, which considers various factors, including the "location of the subject matter, the place of delivery of the contract, the domicile of the insured or of the insurer, . . . or other place bearing a rational relationship to the general contract." Jupiter Aluminum Corp. v. Home Ins. Co., 225 F.3d 868, 873 (7th Cir. 2000) (quoting Lapham-Hickey Steel Corp. v. Protection Mut. Ins. Co., 655 N.E.2d 842, 845 (Ill. 1995)). Although the Court should consider all of these factors, the "location of the insured risk is given special emphasis." Id. (quoting Society of Mount Carmel v. National Ben Franklin Ins. Co. of Ill., 643 N.E.2d 1280, 1287 (Ill. 1994)).

Neither party points to a choice-of-law provision contained in the insurance policy. Applying the "most significant contacts" test, the record reflects that Plaintiff was domiciled in Iowa at the time the policy was issued, the policy was delivered to her in Iowa, and given that the policy insured Plaintiff's life, the "location of the insured risk" was also located in Iowa. (See R. 149, Pl.'s Resp. to Facts ¶¶ 1, 13.) Although Defendant is located in Illinois, all other factors weigh in favor of applying Iowa law. See Hampton v. Hartford Life Ins. Co., No. 04 C 4619, 2008 WL 244169, at *3 (N.D. Ill. Jan. 28, 2008) (conducting choice-of-law analysis and applying law of plaintiff's domicile at the time she applied for life insurance policy); Gann v. Oltesvig, 508 F.Supp.2d 654, 656-57 (N.D. Ill. 2007) (conducting choice-of-law analysis and applying Wisconsin law to insurance dispute because insurance policy was delivered to Wisconsin and insured was located there).

Plaintiff argues, however, that Defendant waived its choice-of-law argument by failing to raise it earlier in the proceedings; in Plaintiff's view, the Court should simply apply the law of Illinois as the forum state. (R. 148, Pl.'s Opp'n at 6-7.) Plaintiff is correct that choice-of-law arguments are subject to waiver. See Vukadinovich v. McCarthy, 59 F.3d 58, 62 (7th Cir. 1995) (observing that "choice of law, not being jurisdictional, is normally . . . waivable"); Woodard v. Victory Records, Inc., No. 14 CV 1887, 2014 WL 2118799, at *5 (N.D. Ill. May 21, 2014) (finding that plaintiffs waived their argument that California law applied to parties' dispute by citing solely to Illinois law in their briefs and remaining silent when the court applied Illinois law and explicitly noted that the choice of law was "not in dispute"). But the Court does not believe that Defendant waived its choice-of-law argument in this case.

Notably, Plaintiff did not allege which state's laws applied to her breach of contract claim in either her original or her amended complaint, and instead she pleaded the elements of breach of contract generally. (See R. 1, Compl. ¶¶ 87-92; R. 36, Am. Compl. ¶¶ 47-56.) Plaintiff also alleged in both pleadings that she was "a Missouri citizen." (R. 1, Compl. ¶ 9; R. 36, Am. Compl. ¶ 10.) When Defendant moved to dismiss the complaint (at a point when the record was still undeveloped), it stated, "For purposes of this Motion only, [Defendant] assumes, but does not otherwise contend, that Illinois law applies." (R. 42, Def.'s Mem. at 6 n.3.) In ruling on the motion to dismiss, the Court noted that the parties agreed that Illinois law applied "for purposes of the present motion[.]" Dolmage, 2016 WL 754731, at *4 n.2. But it was clear from the briefing that Defendant was not generally acquiescing to the application of Illinois law.

Some months later, in connection with briefing on the motion for class certification, Defendant argued that Iowa law rather than Illinois law governed Plaintiff's claim, and that in turn, other class members' claims would be governed by the law of their states of residence. (See R. 119, Def.'s Opp'n to Class Cert. at 11 n.7.) At that point, fact discovery had been completed and Plaintiff's deposition had been taken, such that it had become clear that Plaintiff was living in Iowa at the time the insurance policy was issued. (See generally R. 106, Min. Entry; R. 143-1, Pl.'s Dep. Tr. at 8-9, 12.) In the opinion ruling on the motion for class certification, the Court agreed with Defendant's analysis about the law governing class members' claims. See Dolmage, 2017 WL 1754772, at *5. In fact, this was one of the reasons the Court denied class certification; the class members lived in as many as 30 different states, and the need to apply the law of so many different states made class treatment of the case inappropriate. Id. at *5-6.

Defendant has now raised the issue again in connection with its motion for summary judgment, arguing that Plaintiff's claim is governed by Iowa law. (R. 142, Def.'s Mem. at 10-11.) This is not a situation, then, where a party has "explicitly submitted" to the law of the forum state, Lott v. Levitt, 556 F.3d 564, 568 (7th Cir. 2009), or where a party has so unduly delayed in raising a choice-of-law argument that waiver should be found, see Whirlpool Fin. Corp. v. Sevaux, 96 F.3d 216, 221 (7th Cir. 1996) (holding that party waived choice-of-law argument by failing to raise it "until after summary judgment had been rendered against him"). Under the circumstances, the Court declines to find that Defendant waived its choice-of-law argument. Other than arguing waiver, Plaintiff has not offered any reason why Iowa law should not be applied, and the Court finds Defendant's analysis compelling. Therefore, the Court will apply Iowa law to resolve the motion for summary judgment.2

II. Breach of Contract

To establish breach of contract under Iowa law, Plaintiff must prove: "(1) the existence of a contract; (2) the terms and conditions of the contract; (3) that it has performed all the terms and conditions required under the contract; (4) the defendant's breach of the contract in some particular way; and (5) that plaintiff has suffered damages as a result of the breach." Molo Oil Co. v. River City Ford Truck Sales, Inc., 578 N.W.2d 222, 224 (Iowa 1998). "The construction and legal effect of a written contract are questions of law" for the Court to decide. Rapid Leasing, Inc. v. Nat'l Am. Ins. Co., 263 F.3d 820, 825 (8th Cir. 2001). "The cardinal rule of contract interpretation is to determine what the intent of the parties was at the time they entered into the contract." Pillsbury Co. v. Wells Dairy, Inc., 752 N.W.2d 430, 436 (Iowa 2008). The language of the contract itself is "the most important evidence" in making this determination. Id.

When the parties adopt a writing as the final and complete expression of their agreement, that agreement is considered to be "fully integrated." Whalen v. Connelly, 545 N.W.2d 284, 290 (Iowa 1996). "When an agreement is deemed fully integrated, the parol evidence rule prevents the receipt of any extrinsic evidence to contradict (or even supplement) the terms of the written agreement." Id.; see also C & J Vantage Leasing Co. v. Wolfe, 795 N.W.2d 65, 85 (Iowa 2011) (observing that if an agreement is fully integrated, the parol evidence rule "forbids the use of extrinsic evidence introduced solely to vary, add to, or subtract from the agreement"). Nevertheless, the rule does not prohibit the consideration of extrinsic evidence for certain limited purposes, such as "to show the situation of the parties, attendant circumstances, and the objects they were striving to attain." C & J Vantage Leasing Co., 795 N.W.2d at 85 (citation, internal quotation marks and alteration omitted).

"In general, an insurance contract includes the policy form along with the declarations and endorsements." Essex Ins. Co. v. Fieldhouse, Inc., 506 N.W.2d 772, 776 (Iowa 1993). "A rider or endorsement is a writing added or attached to a policy or certificate of insurance which expands or restricts its benefits or excludes certain conditions from coverage." Steven Plitt, et al., 2 COUCH ON INS. § 18:19 (3d ed. 1995 & Supp. 2017); see also BLACK'S LAW DICTIONARY (10th ed. 2014) (defining "rider" as "[a]n attachment to some document, such as . . . an insurance policy, that amends or supplements the document"). "To be effective, an endorsement must be made a part of the policy and incorporated by reference." Essex, 506 N.W.2d at 776. In plain terms, "[i]f an endorsement is physically attached to an insurance policy contemporaneous with its execution, and is delivered to the insured as attached, and sufficient reference is made in either the policy or the attached matter to identify the papers as related," it will be considered part of the policy. Id. at 777 (citation omitted).

There is no dispute that the insurance policy issued by Defendant constitutes a valid contract.3 But Plaintiff's breach of contract claim is not premised on the language of the policy itself; instead, it is premised on alleged violations of the Privacy Pledge, which is a separate document. (See, e.g., R. 36, Am. Compl. ¶ 54 ("[Defendant] breached its contractual obligations in its Privacy Pledge when it allowed Plaintiff's . . . [personal identifying information] to be used without proper and regulatory-compliant security precautions, restrictions, and controls."). The question, then, is whether the Privacy Pledge forms part of the parties' agreement.4

Although the parties do not directly address this issue in their briefs, they appear to be in agreement that the policy generally precludes consideration of extraneous documents to supplement its terms when it states: "The policy is a legal contract. It is the entire contract between you and us." (R. 149, Pl.'s Resp. to Facts ¶ 14.) Indeed, Iowa courts have found similar language to evidence a fully integrated contract. See Nationwide Agribusiness Ins. Co. v. PGI Int'l, 882 N.W.2d 512, 518 n.3 (Iowa Ct. App. 2016) (finding contract fully integrated where it stated that it was "the entire agreement between the parties hereto"); Urbandale Best, LLC v. R & R Realty Grp., No. 13-1879, 2015 WL 799544, at *3 (Iowa Ct. App. 2015) (finding contract fully integrated where it stated, "This Agreement and the exhibits hereto contain the entire understanding and agreement between the Members[.]"); Fritz v. Fritz, No. 08-1088, 2009 WL 779544, at *3 (Iowa Ct. App. 2009) ("A completely integrated agreement is an integrated agreement adopted by the parties as a compete and exclusive statement of the terms of the agreement." (citation omitted)).

The parties disagree, however, over the language in the policy incorporating by reference "any [attached] riders and endorsements." (R. 149, Pl.'s Resp. to Facts ¶ 14.) The crux of their dispute is whether the Privacy Pledge constitutes a "rider or endorsement" within the meaning of that provision. (R. 142, Def.'s Mem. at 12-18; R. 148, Pl.'s Opp'n at 7-9.) Defendant argues that the Privacy Pledge does not constitute a rider or endorsement. (R. 142, Def.'s Mem. at 12-18.) In support, Defendant relies on the expert report of Charles Morgan, an attorney with extensive experience in the insurance industry. (See R. 143-6, Morgan Report.) Plaintiff responds that this Court already rejected Morgan's report in ruling on the motion for class certification and therefore should not consider it in connection with the present motion. (R. 148, Pl.'s Opp'n at 9.) Plaintiff further argues that the Privacy Pledge should be construed as a rider to the policy. (Id. at 9-13.) The Court turns first to the matter of Morgan's report.

A. Admissibility of Morgan's Report

In the opinion resolving the motion for class certification, the Court fully considered Morgan's credentials as an expert in accordance with Federal Rule of Evidence 702 and Daubert v. Merrell Dow Pharmaceuticals, Inc., 509 U.S. 579 (1993). Dolmage, 2017 WL 1754772, at *4-5. The Court concluded that Morgan was qualified as an expert. Id. at *4. However, the Court determined that certain of his "opinions" constituted improper legal conclusions, specifically, his opinions that the Privacy Pledge was "not enforceable." Id. at *5. These opinions were not a proper subject for an expert's report (nor were they helpful to the Court as the trier of fact), as it is the Court's task to decide whether the Privacy Pledge is legally enforceable. Id. Therefore, these specific opinions were not considered by the Court in ruling on the motion for class certification. Id.

Nevertheless, the Court found the bulk of Morgan's report admissible, including the background information he provided about "insurance compliance and drafting practices," as well as his review of "whether the Privacy Pledge was filed with the relevant state authorities as part of the insurance compliance process." Id. This is the same information Defendant relies on in connection with the present motion. (See R. 142, Def.'s Mem. at 12-16 & n.3.) As the Court previously concluded, Morgan's report on these issues provides "concrete information against which to measure abstract legal concepts," which is a proper use of expert testimony. Dolmage, 2017 WL 1754772, at *5 (quoting United States v. Blount, 502 F.3d 674, 680 (7th Cir. 2007)). This information will be considered by the Court in deciding the motion for summary judgment.

B. Whether the Privacy Pledge is a Rider or Endorsement

Morgan's opinion is that the Privacy Pledge is not a rider or endorsement.5 (R. 143-6, Morgan Report at 25.) He opines that the Privacy Pledge cannot be considered a rider or endorsement within the ordinary meaning of those terms because it was not filed with and approved by state insurance officials as required by state law. (Id. at 23.) In support, he cites to Iowa Code § 508.25, which provides: "It shall be unlawful for any insurance company transacting business within this state . . . to write or use any form of policy or contract of insurance, on the life of any individual in this state, until a copy of such form of policy or contract has been filed with and approved by the commissioner of insurance."6

The Court is unpersuaded by Morgan's reasoning. As Plaintiff argues, accepting this argument would effectively reward a company for failing to comply with state insurance requirements. (See R. 148, Pl.'s Opp'n at 10.) It would be "akin to finding that a driver could not possibly have caused a car accident because the light was red . . . and the motor vehicle code requires drivers to stop at red lights[.]" (Id.) For precisely that reason, courts in Iowa have long held that insurance policies are enforceable notwithstanding an insurance company's failure to have the policy preapproved by the state department of insurance. See Graf v. Employees' Liab. Assur. Corp., 180 N.W. 297, 298-99 (Iowa 1920) ("[N]otwithstanding the failure of the defendant to obey the statute [requiring approval of forms by state insurance commissioner], it is not relieved thereby from complying with its contract[.]"); see also Baldwin v. Equitable Life Assur. Soc. of U.S., 108 N.W.2d 66, 73 (Iowa 1961) (observing that the Iowa Supreme Court had considered the argument several times and had never held that an insurance contract was void for failure to obtain approval of policy forms, "although the insurance companies may have acted in violation of both the letter and spirit of the law and subjected themselves to penalties by the state"); Clausen v. N.Y. Life Ins. Co., 276 N.W. 427, 430 (Iowa 1937) ("Graf . . . lays down the rule that a life insurance policy is valid and enforcible [sic], even though issued without filing a form as required by statute."). A company's failure to comply with state regulations might subject it to fines or penalties, but that is a matter between the company and state regulators; it does not impact the enforceability of the policy issued to the insured.7 See Graf, 180 N.W. at 298-99.

But, by the same token, the Court does not find it entirely irrelevant that the Privacy Pledge was not filed with state insurance regulators. Morgan opines that, based on his extensive experience in the insurance industry, the "usual and customary practice" of insurance companies is to comply with insurance regulations and to have endorsements and riders formally approved by the state before appending them to insurance policies. (R. 143-6, Morgan Report at 11-12.) He explains that insurance companies are tightly regulated and are subject to "periodic examination of the conduct of their affairs for compliance with State insurance laws." (Id. at 12.) They are also subject to "fines and loss of licenses to do business in the state" if they fail to comply with applicable regulations. (Id.) His opinion suggests that the Privacy Pledge is not a formal rider or endorsement, because, if it were, it would have been submitted to state regulators for approval in the ordinary course of business. This lends support to Defendant's argument that the Privacy Pledge was not a formal rider or endorsement but simply a loose document, like the blank forms and brochures, that was included in the fulfillment materials sent to Plaintiff. Plaintiff has not offered any evidence to counter Morgan's opinion on this point.

But the Court need not rely solely on the lack of regulatory approval, because Morgan offers additional reasons why, in his view, the Privacy Pledge does not constitute a rider or endorsement. (R. 143-6, Morgan Report at 17-18, 25-26.) He opines that, based on his experience, riders and endorsements bear several hallmarks, including being "clearly marked in the header as a Rider or Endorsement." (Id. at 17.) He asserts that riders and endorsements are ordinarily signed by an official of the insurance company and expressly reference the policy. (Id. at 25.) The Privacy Pledge does not bear any of these hallmarks. It is not labelled at the top as an endorsement or rider, is not signed by anyone, and does not expressly reference the insurance policy. (See R. 146, Fulfillment Materials at 39.) This is in sharp contrast to the accelerated payment rider, which was also part of the fulfillment materials. The accelerated payment rider is clearly labeled at the top as a rider, is signed by Defendant's Chairman and Chief Executive Officer, includes an effective date, and expressly states, "This rider is part of the policy and is subject to all policy provisions." (Id. at 23.)

Plaintiff has not countered any of this evidence. Instead her argument appears to be simply that, because she received the Privacy Pledge in the same packet as the policy and it follows page 17, it constitutes a rider or endorsement.8 (See R. 148, Pl.'s Opp'n at 7-8.) By this logic, all of the documents included in the packet following page 17 would constitute riders and endorsements. This would include various blank forms, a pamphlet entitled, "Life Insurance Buyers' Guide," and other documents that clearly do not bear the formal hallmarks of a rider or endorsement. (See R. 146, Fulfillment Materials at 34-37, 40.) Although Plaintiff points out that the Privacy Pledge did not include a specific disclaimer stating that it was not part of the policy, none of these generic documents carried such a disclaimer. (See id.) Plaintiff has not cited any legal authority to support her unusual argument that any loose document submitted with an insurance policy constitutes a rider or endorsement, and such an argument is not in accord with insurance industry standards (as evidence by Morgan's report), or with Iowa law. See, e.g., Essex, 506 N.W.2d at 777 (concluding that document constituted an endorsement where it was clearly labeled "Special Provisions Endorsement" and was specifically referenced on the declarations page of the policy); Rapid Leasing, Inc., 263 F.3d at 826 (concluding that district court did not err in finding document to be an endorsement, where document was physically attached to the policy and expressly referenced within it).

Based on the undisputed record, the Court concludes that the Privacy Pledge is not a rider or endorsement that was incorporated by reference into the policy, and thus the Privacy Pledge did not create a legally enforceable promise. Plaintiff has failed to establish the existence of a contract requiring Defendant to keep her personal information private, which is an essential element of her breach of contract claim. See Molo Oil Co., 578 N.W.2d at 224. Therefore, Defendant is entitled to summary judgment.

CONCLUSION

For the foregoing reasons, Defendant's motion for summary judgment (R. 141) is GRANTED. The clerk of court is DIRECTED to enter final judgment in favor of Defendant and against Plaintiff.