Consumer Health Data Privacy Policy

Consumer health data is personal information that is linked, or can reasonably be linked, to you and that identifies your past, present, or future physical or mental health. A medical bill shows that you sought care, when, from whom, and for what. We treat your uploaded documents, and everything read or written from them, as consumer health data.

Verity Claims™ is not a HIPAA covered entity or business associate on these direct-to-consumer facts. That does not mean other privacy laws do not apply.

Medical billing documents. The bills, itemized statements, and insurance statements (called Explanations of Benefits, or EOBs) you upload. They show provider names, dates of service, procedure codes, charges, balances, and identifiers such as your name, address, account number, and member ID.

What you tell us about your care. Notes you type, your intake answers (type of care, insurance type, whether you received a Good Faith Estimate, any plan amounts you type in), and your answers to questions about a visit.

What Verity Claims™ produces from them. Line items read from your documents, possible billing errors, and estimates.

Letters. Dispute letters you generate, which describe the care that was billed, and the sender details you enter for them.

Mailing records. If you ask us to mail a letter: the recipient, your return address, the date sent, the mail vendor's estimated delivery date, and your authorization. The name of a healthcare provider you write to can itself be health data.

What you type into Copilot. Used to generate guidance and not stored by Verity Claims™.

Guest scans. The files, the results, and the email address you give us for a scan without an account.

Insurance-card images. If you add a photo of your insurance card, Verity Claims™ reads it once to find your plan's copays and other cost-sharing amounts. The image is sent to AWS to be read and is never stored by Verity Claims™; only those amounts are kept with your case.

We collect and use consumer health data to:

read your documents into line items; compare your bill with your EOB and check the line items against billing rules; show you the results; analyze the notes you type for possible issues; draft a letter when you ask for one; print and mail a letter when you authorize it; keep your cases available in your account; send you service emails about your case; limit abuse, keep the service secure, and fix errors; and respond to your privacy requests.

We do not use consumer health data for advertising. Verity Claims™ itself does not use it to train AI models or to build product-improvement datasets.

You. You upload the documents, type the notes and answers, and enter the letter and mailing details.

Our service providers, only as they return the result of work you asked for. For example, our AI provider returns the line items it read from your document.

We do not buy consumer health data from data brokers. We do not collect it from other websites or apps, from provider or insurer portals, or by scraping.

We share consumer health data only with service providers that process it for us so that we can provide the service you asked for, and with the recipient of a letter you choose to send.

Categories we share. Uploaded billing documents, in full. Typed notes, Copilot text, and case details, after a filter for common identifiers. Line items, findings, and letters. Mailing details. Service emails about your case. Error reports, which are configured to leave out document text, request bodies, and cookies.

Categories of recipients, and the providers in each.

Database, sign-in, and file storage: Supabase. Holds your documents, notes, answers, results, and letters.

AI processing: Amazon Web Services, through Amazon Bedrock, running Anthropic's Claude models. Receives full uploaded documents, your insurance card image if you add one, and filtered typed text and case details, to read documents, analyze notes, and generate Copilot guidance.

Hosting: Vercel. Requests to the site pass through its systems.

Printing and mailing: Lob, only if you ask us to mail a letter. Receives the full letter and both addresses.

Service email: Resend. Receives your email address and the content of the emails we send you.

Error monitoring: Sentry. Receives error reports with the error, the page path, and an internal user ID.

Payments: Stripe. Receives your payment details directly from you. It does not receive your documents or results.

Bot check: Cloudflare Turnstile, on the guest scan and sign-in forms. Receives a challenge token and your IP address. It does not receive your documents.

The recipient of your letter. A letter you send, or ask us to mail, goes to the provider, insurer, or other recipient you address it to.

We do not share consumer health data with affiliates. We may disclose information when the law requires it, such as in response to a court order.

Our service providers may keep copies in their production systems, logs, backups, and legally required records under their agreements, configuration, and retention schedules. We require providers to follow our instructions and to delete or return information when law or contract requires it, subject to permitted exceptions and ordinary backup rotation.

Uploaded documents may be transmitted to our AI-processing providers before any application-level redaction or identifier filtering occurs. Reading a bill means sending the whole document, including any name, account number, member ID, or address printed on it.

Text you type goes through a filter first. The filter looks for common identifiers and replaces them. It works by matching patterns, so it can miss some.

AWS processes the data it receives only to provide the service to us, under our agreement with it. AWS states that, for the model we use, Amazon Bedrock does not store what we send by default, does not share it with Anthropic, and does not use it to train any AI model. AI output can be wrong. You review and approve every letter before anything is sent, and Verity Claims™ does not use AI to make decisions about you.

We do not sell consumer health data, and we do not share it for advertising. We do not use location data to draw a virtual boundary (a geofence) around a healthcare facility or anywhere else.

We collect and share consumer health data only as necessary to provide the service you request, or with your consent.

Before you upload, you confirm that the bill is your own and direct Verity Claims™ to process your documents for the audit. Before we mail a letter, you authorize that mailing.

We do not currently collect or share consumer health data for any purpose beyond providing the service. If that changes, we will ask for your consent first, and we will ask for consent to share separately from consent to collect.

Signed-in content is kept while your account is open, until you ask us to delete it. Unsent letter drafts are deleted after 30 days in a row without editing, saving, or approving them. Guest scans are kept for 30 days and then deleted. The Privacy Policy lists every period.

Confirm and access. You can ask whether we collect, share, or sell your consumer health data, and ask for a copy of it. You can also ask for a list of the third parties and affiliates we have shared it with, and a way to contact them.

Withdraw consent. You can withdraw your consent to our collecting or sharing your consumer health data. Verity Claims™ cannot run an audit without processing your documents, so if you withdraw that consent we stop processing and cannot keep providing the service for that data.

Delete. You can ask us to delete your consumer health data. If you are signed in, go to Delete your account and data. We instruct the service providers that hold your data to delete it.

How to ask. Use the in-app deletion request, or email support@verityclaims.co from your account email address for any of these rights. We will not charge you, deny you service, or treat you differently for using them.

Identity check. We confirm who you are before we act. An in-app request is confirmed by your signed-in session. An email request is confirmed by showing that you control the account's email address. We may ask for more information if we need it to protect your data.

Timing. We will generally complete an authenticated deletion request within 45 days. When reasonably necessary, we may extend that period once for up to an additional 45 days and will explain the reason for the extension. The same timing applies to your other requests. Your account is locked while a deletion request is open.

Backups. If requested consumer-health data is stored in archived or backup systems, deletion may be delayed to permit restoration of those systems, but not longer than six months from authentication of the deletion request, as permitted by applicable law. Access to backups is restricted, and we do not restore data from them except for disaster recovery or when the law requires it.

What is kept after deletion. A record of your request. A payment record with your personal details removed. And, only if a letter was mailed for you, a record of that mailing with no health details in it (the recipient, the dates, and your authorization), kept for up to seven years.

If we deny or limit your request, you can appeal by emailing support@verityclaims.co with the subject line "Privacy request appeal." We will send you a written decision, with our reasons, within 45 days of receiving your appeal.

If we deny your appeal, we will tell you how to contact your state attorney general to submit a complaint. Washington residents can reach the Washington State Attorney General at atg.wa.gov. Nevada residents can reach the Nevada Attorney General at ag.nv.gov.

If we add a new category of consumer health data, a new purpose, or a new kind of recipient, we will update this policy before the change takes effect and ask for your consent where the law requires it. When we make a material change, we will change the date at the top and the version at the foot of this page, and we will tell you by email or in the product.

Questions about this policy or a consumer health data request? Email support@verityclaims.co.