What we collect, and what we do not

What we collect

Documents you give us. Medical bills, Explanations of Benefits, and where you supply one, a Good Faith Estimate. These contain health information: provider names, dates of service, procedure codes and amounts.

What we extract from them. Provider, dates, line items with codes and amounts, adjudication figures, and the findings we produce.

Your account. An email address. There is no API key — we do not issue one, and nothing in the service asks you for one. A case is reached by its own web address, which is the only thing you hold.

Payment. Handled entirely by Stripe. We receive a confirmation that a payment succeeded and what it was for. We never see or store your card number.

How you reached us. Whether a check came through our website, Claude, Grok, another AI app or our API, and for our website the kind of site that sent you there, as one word such as “google” — never the page you came from or what you searched for. For an AI app installed from a directory of AI tools, the directory, as one word such as “mcpservers”. Kept with the check for 30 days, and counted in daily totals that identify no one. When an AI app connects to us, we also count which kind of app it is, as one word such as “cursor”, in daily totals only — never with a check.

What we deliberately do not collect

• There is no field for a Social Security number, a date of birth, or an insurance member ID. Not a policy — the data model has no such field, the reader is instructed to leave them on the page, and a test fails if one is ever added.
• Nothing you send trains an AI model. Not ours, not anyone's.
• No health information reaches our logs. Transcribed values are stripped out before anything is written, and a test fails the build if any code path starts reading them.
• The comparison itself is not done by AI. A reader transcribes what is printed on your documents; fixed rules decide what it means.

How long we keep it

Your documents are not kept at all, so there is nothing about them to delete: they are read once, in the request that uploads them, and never written to disk or to a database. The same is true of the text read off them. What exists after the request is the result — the figures and the findings — and that is deleted 30 days after the case is created. You can delete any case immediately, using the delete code shown once when the check is run, and deletion is a hard delete — the record is removed, not flagged.

The code is shown once and we store only a one-way digest of it, so we cannot look it up or send it again. If you no longer have it we will not delete the case on request, because we would have no way to tell you from anyone else who came by the link — which is exactly what protects your records from them. The case deletes itself after 30 days regardless.

Account records and payment confirmations are kept while your account is open and for as long afterwards as tax and accounting rules require.

Processors

Who we share it with

Six processors, each for one purpose:

Google Signals and advertising personalization are switched off in Google Analytics, so it is not used to build an advertising profile of you and is not shared for that purpose. Vercel Web Analytics sets no cookies; it tells one visit from another with a hash of the request that Vercel discards after 24 hours. Both analytics tools are on our marketing pages only. Neither is ever on a page whose address can carry a case id — not the app, and not the 404 page — because a page path would otherwise record which bill you were looking at.

We do not sell personal information. We do not share it for cross-context behavioral advertising. We do not disclose it to your insurer, your provider, your employer, or a debt collector. We will disclose information if legally compelled, and where we are permitted to tell you, we will.

AI and your documents

We use Anthropic's API to read your documents.

Your documents are never used to train any AI model — not ours, not anyone's. We do not train models, and Anthropic's commercial terms do not permit training on what we send through the API. We have also never sent a document anywhere else: there is no second AI provider, no analytics vendor that sees document contents, and no human review queue.

How long Anthropic keeps it. Anthropic may keep what we send for a limited period under its standard commercial terms — for example, to detect misuse — and does not use it to train models. Businesses can sign a separate agreement with Anthropic that removes that period. We have not signed one yet, so we are not claiming it; if we do, this paragraph will say so.

What we send. The document itself, and nothing attached to it. The request carries no name, no account number, no identifier of any kind that we add — there is no field in our data model that could hold one. The page itself, of course, shows whatever is printed on it, which usually includes your name and account number. We also do not ask the model to read a Social Security number, a full date of birth or an insurance member ID off your document, and there is nowhere for it to put them if it did.

What the AI does and does not decide. It transcribes. It reads the numbers printed on the page and copies them out; it does not judge whether anything is wrong. Once your documents are read, the comparison is performed by deterministic code with fixed rules, which is why the same documents always produce the same findings, and why we can tell you exactly which rule produced each one.

Security

Encrypted in transit and at rest, with document text and findings additionally encrypted at the field level. No health information is written to application logs, analytics or error reports, and that scrubbing is tested rather than assumed. Access is limited to the operator, with multi-factor authentication and no shared credentials.

No system is perfectly secure, and we are not going to claim otherwise.

If there is a breach

We are subject to the FTC's Health Breach Notification Rule. If your health information is acquired or accessed without authorisation, we will notify you, the Federal Trade Commission, and where the rule requires it the media, within the timeframes the rule sets. That obligation covers unauthorised access, not only a hack, and it includes disclosing your information in ways this policy does not describe.

Your rights

Access what we hold, correct it, delete it, or receive a copy in a portable format — email support@medbillanalyzer.com and we will respond within 30 days. Deleting your data does not require you to close your account, and we will not degrade the service because you exercised a right.

California residents. You additionally have the rights described in the CCPA as amended by the CPRA, and your medical information is protected by the Confidentiality of Medical Information Act. We do not sell or share personal information as those terms are defined, so there is nothing to opt out of.

Children

MedBillAnalyzer is for adults. We do not knowingly collect information from anyone under 18. An adult may submit a bill for a dependent; the adult is the account holder and the rights above are theirs to exercise.

Changes

If we change this policy materially, we will email account holders before the change takes effect. The date at the top always reflects the current version.

Contact

support@medbillanalyzer.com · RMK Capital, Inc

Last updated 7 November 2026. See also our Consumer Health Data Privacy Policy and our Terms of Service, of which this policy is a part.