Privacy Policy

Verity Claims™ is operated by ClaimClear, LLC, doing business as Verity Claims, based in Montana. Verity Claims™ is a consumer medical-bill audit service. You upload a medical bill and the statement from your insurance (called an Explanation of Benefits, or EOB). Verity Claims™ reads them, compares them, points out possible billing errors, and, if you choose, helps you prepare a dispute letter that you review and send.

This policy explains what information we handle, where it comes from, why we use it, who receives it, how long we keep it, and how to use your rights.

We are not a law firm, an insurer, or a healthcare provider. We are not a HIPAA covered entity or business associate on these direct-to-consumer facts. That does not mean other privacy laws do not apply.

Verity Claims™ is for adults in the United States. At launch, Verity Claims™ can only process your own bill.

Documents you upload. Medical bills, itemized statements, and EOBs. These usually show your name, address, account and member numbers, provider names, dates of service, procedure codes, charges, and balances.

Notes you type. Anything you write in the "Anything else we should know" box.

Intake answers. The type of care, your insurance type, whether you received a Good Faith Estimate, and any plan amounts you choose to type in, such as a copay or deductible.

Visit-questionnaire answers. If we ask you questions about a visit, we keep your answers with the case.

Your upload confirmation. Before you upload, you confirm that the bill is your own and that you are at least 18. We record that confirmation, the version of the text you saw, and the time.

Results. The line items read from your documents, the possible errors found, and the estimates shown to you.

Letters. Letters you generate, and the sender details you enter for them: your name, address, phone number, email address, member ID, and account number.

Mailing details. If you ask Verity Claims™ to mail a letter: the recipient's name and address, your return address, the date the letter was sent to our mail vendor, the vendor's estimated delivery date, and the authorization statement you agreed to. Verity Claims™ does not receive confirmation that a letter was delivered.

Account details. Your email address and password. Your password is handled by our identity provider.

Guest scans. If you run a scan without an account, we collect your email address, the files you upload, and the results.

Payment records. Stripe customer and payment identifiers, the amount, and the payment status. Card numbers are entered directly with Stripe and are not stored by Verity Claims™.

Limited technical data. Counters based on your IP address that limit abuse, a sign-in session, and a cookie that lets your browser reopen a report. We do not use advertising cookies.

Error reports. When something breaks, a report is created with the error, the page path, and an internal user ID. Error reports are configured to leave out document text, request bodies, and cookies.

Copilot. What you type into Copilot is used to generate guidance, as described under "How AI is used" below. Verity Claims™ does not store what you type in Copilot. We keep only a counter that limits abuse.

Insurance cards. If you add a photo of your insurance card, Verity Claims™ reads it once to find your plan's copays and other cost-sharing amounts. The image is sent to AWS to be read and is never stored by Verity Claims™; only those amounts are kept with your case.

You. Almost everything above comes directly from you: what you upload, type, answer, and approve.

Your browser or device. Your IP address and the cookies described above.

Our service providers, only as they return the result of work you asked for: line items read by the AI provider, a payment result from Stripe, an estimated delivery date from the mail vendor, and a pass-or-fail result from the bot check.

We do not buy data from data brokers. We do not collect data about you from other websites, from provider or insurer portals, or by scraping.

We use your information to:

read your documents into line items; compare your bill with your EOB and check the line items against billing rules; show you the results; analyze the notes you type for possible issues; draft a letter when you ask for one; print and mail a letter when you authorize it; run your account and keep your cases available to you; take payments; send you service emails, such as a report link, a warning before an unsent letter is deleted, or a confirmation of a deletion request; limit abuse and keep the service secure; find and fix errors; respond to privacy requests and keep a record of them; and meet legal obligations.

We collect and share health information only as needed to provide the service you ask for, or with your consent.

Verity Claims™ uses Anthropic's Claude AI models, which we run on Amazon Bedrock, a service of Amazon Web Services (AWS). Your information is sent to AWS, not to Anthropic. AI is used for three things: reading your documents into line items (and, if you add one, your insurance card into your plan's cost-sharing amounts), analyzing the notes you type for possible issues, and generating Copilot guidance. Dispute letters are put together from fixed wording based on your audit results.

Uploaded documents are sent in full. Uploaded documents may be transmitted to our AI-processing providers before any application-level redaction or identifier filtering occurs. Reading a bill means sending the whole document, including any name, account number, member ID, or address printed on it. We instruct the AI not to copy your name, member ID, or address into the results we store.

Typed text is filtered first. The notes you type and what you type into Copilot go through a filter before they are sent. The filter looks for common identifiers, such as email addresses, phone numbers, Social Security numbers, account and member numbers, street addresses, and your name if we already have it, and replaces them. It works by matching patterns, so it can miss some.

Copilot. What you type is filtered as described above and sent to the AI provider, together with details of your case, to generate guidance.

What is not AI. Billing-rule checks are performed by Verity Claims™ software, not the AI model. These include code-pair (bundling) edits, unit limits, fee-schedule comparisons, and the comparison of your bill with your EOB.

AI output can be wrong. It can misread a document, miss an error, or flag something that is correct. You review and approve every letter before anything is sent. Verity Claims™ does not use AI to make decisions about you. It does not decide what you owe, what your plan covers, or what your rights are.

Training and other uses. Verity Claims™ itself does not use your documents, notes, or prompts to train AI models, for advertising, or to build product-improvement datasets. AWS processes the data it receives only to provide the service to us, under our agreement with it. AWS states that, for the model we use, Amazon Bedrock does not store what we send by default, does not share it with Anthropic, and does not use it to train any AI model.

We share information with the service providers below so they can do their part of the service. Each receives what its job needs.

Supabase. Database, sign-in, and file storage. Holds your account, documents, results, and letters.

Amazon Web Services (Amazon Bedrock). AI processing, as described above: full uploaded documents, your insurance card image if you add one, and filtered typed text and case details.

Stripe. Payments. Receives your payment details directly from you.

Vercel. Hosting. Requests to the site pass through its systems.

Lob. Printing and mailing a letter, only if you ask us to mail it. Receives the full letter and both addresses.

Resend. Service email. Receives your email address and the content of the emails we send you.

Sentry. Error monitoring, configured as described under "What we collect."

Cloudflare Turnstile. A bot check on the guest scan and sign-in forms. Receives a challenge token and your IP address. It does not receive your documents.

People you choose. A letter you send, or ask us to mail, goes to the provider, insurer, or other recipient you address it to.

Legal requirements. We may disclose information when the law requires it, such as in response to a court order or subpoena.

Our service providers may host, analyze, transmit, monitor, secure, or otherwise process information on our behalf. They may keep copies in their production systems, logs, backups, and legally required records under their agreements, configuration, and retention schedules. We require providers to follow our instructions and to delete or return information when law or contract requires it, subject to permitted exceptions and ordinary backup rotation. Deletion by a provider may not happen at the same moment as deletion from our own systems.

We do not sell your personal information or your health information.

We do not share your information for advertising, and we do not use your medical documents to advertise to you.

We do not use advertising trackers. We use Vercel Web Analytics to count visits to our public pages. It does not use cookies, and it does not receive pages from inside your account.

We do not use location data to draw a virtual boundary (a geofence) around a healthcare facility or anywhere else.

We do not buy information about you, and we do not collect it from other websites or from provider portals.

Signed-in content. Your documents, notes, answers, results, and mailed letters are kept while your account is open, until you ask us to delete them. There is currently no button to delete a single case or document. To have your data deleted, use the account deletion request described below, or email us.

Unsent letter drafts. A letter that has not been mailed is deleted after 30 days in a row without editing, saving, or approving it. We email you 7 days before and again 24 hours before. Opening the letter without changing it does not reset the 30 days.

Guest scans. The files, the results, and your email address are kept for 30 days and then deleted.

Upload confirmation records. Kept for 30 days after they are used. The confirmation itself is also saved with the case or guest report it belongs to, and is kept for as long as that case or report.

Abuse-prevention counters. Deleted within about 30 days after they are created.

Email opt-out list. If you opt out of email, we keep your address on a list with as few fields as possible, solely so that we keep honoring your choice. We keep this list indefinitely for that one purpose.

Payment records. Kept for the period required by applicable tax, accounting, payment-processing, chargeback, legal, and compliance requirements, generally up to seven years.

Copies held by service providers. Kept under their agreements and retention schedules, as described under "Who receives it."

How to ask. If you are signed in, go to Delete your account and data. You can also email support@verityclaims.co from your account email address. If you ran a guest scan without an account, email us from the address you used for the scan. We may need more information to confirm the scan is yours.

How long it takes. We will generally complete an authenticated deletion request within 45 days. When reasonably necessary, we may extend that period once for up to an additional 45 days and will explain the reason for the extension.

What happens. Your account is locked while the request is open, so nothing new can be added. We send a confirmation to your account email. If you change your mind, tell us before deletion starts and we will withdraw the request. Once deletion starts, it cannot be undone.

What is deleted. Your uploaded documents, notes, answers, results, letters, and your account.

What is kept. A record of your request. A payment record with your personal details removed. And, only if a letter was mailed for you, a record of that mailing with no health details in it (the recipient, the dates, and your authorization), kept for up to seven years.

Service providers. We instruct the service providers that hold your data to delete it.

Wherever you live in the United States, you can ask us to:

confirm whether we hold information about you; give you access to it; correct it; give you a copy you can take elsewhere; delete it; give you a list of the recipients we have shared it with; and withdraw a consent you gave us.

Some state laws, such as the California Consumer Privacy Act, give residents these rights by law. We will not charge you, deny you service, or treat you differently for using them.

How to ask. For deletion, use the in-app request above. For everything else, email support@verityclaims.co.

Identity check. We confirm who you are before we act. An in-app request is confirmed by your signed-in session. An email request is confirmed by showing that you control the account's email address. We may ask for more information if we need it to protect your data.

Timing. We respond within 45 days. When reasonably necessary, we may extend that once by up to 45 days, and we will tell you why.

Appeals. If we deny or limit your request, you can appeal by emailing support@verityclaims.co with the subject line "Privacy request appeal." We will send you a written decision, with our reasons, within 45 days of receiving your appeal. If we deny your appeal, we will tell you how to contact your state attorney general to submit a complaint.

Deleted data may remain in backup copies until those backups are rotated out or securely overwritten in the ordinary course. Access to backups is restricted. We do not restore data from backups except for disaster recovery or when the law requires it.

If requested consumer-health data is stored in archived or backup systems, deletion may be delayed to permit restoration of those systems, but not longer than six months from authentication of the deletion request, as permitted by applicable law.

Verity Claims™ is for adults. You must be at least 18 to use it, and we ask you to confirm that before you upload. We do not knowingly collect information from anyone under 18. At launch, Verity Claims™ does not process bills for a child or for another person. If you believe a minor has given us information, email support@verityclaims.co and we will delete it.

Every connection to Verity Claims™ runs over HTTPS (TLS). Files and records are stored on infrastructure whose provider encrypts data at rest. Database row-level security limits a signed-in user to their own cases, documents, and results.

As described under "How AI is used," uploaded documents are sent to our AI provider in full. No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. More detail is on our Security page.

If we add a new category of information, a new purpose, or a new kind of recipient, we will update this policy before the change takes effect and ask for your consent where the law requires it. When we make a material change, we will change the date at the top and the version at the foot of this page, and we will tell you by email or in the product.

Questions about your privacy, this policy, or a request? Email support@verityclaims.co. We use one mailbox for support, privacy requests, and appeals.