How your data is protected.

Encryption

• All traffic is encrypted in transit with TLS.
• Uploaded documents, drafts, and exports are stored in object storage that encrypts everything at rest.

Where your data lives

• Your documents and the health information extracted from them never enter our database. The database holds public coverage policies (CMS guidelines, payer policies, clinical guidelines) plus operational records like consent receipts — not your medical data.
• Uploads, drafts, and session transcripts live in access-controlled object storage under a key only your session can reach, and are removed by the retention sweep below.
• Session transcripts are scrubbed before they are written: Social Security and labeled member/record numbers, dates of birth, phone numbers, and email addresses are redacted.

Retention — the actual windows

• Everything tied to your session — uploads, extracted data, the drafted appeal, and the transcript — is deleted automatically within 24 hours, on a fixed schedule.
• Paid-appeal download links expire 24 hours after the delivery email is sent.
• What persists longer: your legal-consent receipt, anonymized outcome feedback (no documents, no identifying details), and the email you gave at checkout for delivering your purchase.

Accounts and payments

• No accounts, no passwords — by design. Your session exists in your browser tab; there is no stored profile to breach.
• Payments are processed by Stripe. Your card number never touches our servers.

AI providers

• The AI services we use to read and draft are contractually barred from training on, retaining, or reusing your content.
• We don't train on your documents either. The only thing we learn from is anonymized outcome data — whether an appeal succeeded — which contains no documents and no identifying details.

What we don't claim

We're a small team and haven't completed a formal certification such as SOC 2 yet. Rather than display badges we haven't earned, this page states exactly what the system does. If a security incident ever affected your data, we would notify affected users without undue delay, as required by law. Questions or something to report? Contact us through the help center.