Health data privacy notice

What we collect

• The denial letter, and any other insurance document, you choose to upload (a photo or PDF).
• The details we read from it or you type in: insurer name, denial reason, service or treatment described, dates, dollar amounts, member and claim numbers, and your plan type.
• What you tell us in the guided interview, such as treatment history and prior authorization details, and the appeal letters drafted from it.
• Your email address, if you choose to save your report or buy a product.
• For Chronic Plan subscribers, the patient's name and date of birth for each appeal, used only to count how many patients and policies the plan is covering. We store a keyed one-way hash for that count, so the count can be made without reading the underlying details.
• Product usage events (for example “report viewed” or “packet downloaded”) with no document content in them.

Why we collect it

Only to do what you asked: read your denial letter, show you the published rules and deadlines that apply, draft documents you review and approve, and remind you of dates. We do not use your health information for advertising, and we never sell it or share it for marketing.

Who processes it on our behalf

These service providers handle data under contract to us, to run the product:

• Anthropic (AI provider): receives your uploaded document and the facts you enter, to read the letter and draft text. We send only what is needed for the request.
• Supabase (database, authentication, and file storage): stores your documents in a private bucket and your case details in a database. Member and claim numbers are encrypted by us before storage.
• Stripe (payments): receives your email and payment details if you buy a product. Stripe does not receive your documents or case details.
• Resend (email): sends reminder emails. Reminder emails may include your insurer's name, dates, and, in a call script, your member and claim numbers.
• Fax provider (only if one-click fax filing is turned on, which it is not today): would transmit a document you approved to the fax number you entered.

What we never do

• Sell your health information, or share it for advertising or marketing.
• Run third-party analytics, advertising pixels, or tracking scripts in the app.
• Send anything to your insurer, provider, or anyone else without your explicit action.
• Put document contents or the details we read from them into application logs.

How long we keep it

Until you delete it, with one exception: a free report started without saving an email is deleted automatically, together with the uploaded document, 30 days after it was created. Otherwise, your account settings page lets you download everything tied to your account and permanently delete it, which removes your documents and case details; only anonymized usage events, no longer linked to you, remain. If you used the free analyzer without saving an email, you can still delete that data by saving an email first and then using the delete option.

Your rights

You can withdraw consent, get a copy of your data, or delete it at any time from your account settings page. Depending on your state, you may have additional rights, and you may appeal a decision we make about a request. To reach us about privacy: [contact address to be set before launch].

If something goes wrong

Tarian is not a health-care provider or insurer, so HIPAA does not apply to us directly. The FTC Health Breach Notification Rule does. If your health information is ever accessed or disclosed without authorization, we will notify you and, where required, the FTC, on the schedule that rule sets.