Privacy Policy

Information We Collect

When you join our waitlist, create an account, contact us, or submit a bill for negotiation, we collect the information you provide, such as your name, email, phone, and the bill details needed to work your case. When you connect an insurer, we receive the claims and benefit records (FHIR data) that you authorize us to access. When you purchase a service, payment details are processed directly by Stripe; we never see or store your card number.

How We Use Your Information

We use your information to provide the service (organizing your bills, flagging potential errors, and working your negotiation case) and to send you service and product updates. We do not sell or rent your personal information, and we never share your health data with third parties for marketing purposes.

Cookies and Analytics

We use strictly necessary cookies to keep you signed in and remember your preferences. With your consent, we use Google Analytics on our public marketing pages to measure traffic. These cookies do not load until you accept them, and they are never used on the signed-in portal where medical bills are handled. Full details are in our Cookie Policy.

Service Providers We Share Data With

We rely on a small set of vetted processors to operate the service, each handling only the data they need:

• Supabase: database, authentication and storage.
• Stripe: payment processing (card data goes directly to Stripe).
• Resend: transactional and update emails.
• Anthropic: AI reading of bills you upload.
• Vercel: application hosting.
• Google Analytics: marketing site analytics (only with your consent).

Data Security

Data is encrypted in transit (TLS) and at rest. Access to stored data is restricted and logged. We follow HIPAA-focused security practices in preparation for handling protected health information at launch.

Data Retention

We keep your information for as long as your account is active or as needed to provide the service and meet legal obligations. When you ask us to delete your data, we remove it from our active systems, except where we must retain certain records (for example, transaction records for tax and accounting).

Children's Privacy

MedPay Hub is intended for adults (18+) managing their own or their family's medical bills. It is not directed to children, and we do not knowingly collect personal information directly from anyone under 13. A parent or guardian may submit a dependent's bill as part of their own account. If you believe a child has provided us information directly, contact us and we will delete it.

Your Rights

Depending on where you live, you may have the right to access, correct, delete or port your personal data, and to opt out of the sale or sharing of personal information (we do not sell it). Residents of California (CCPA/CPRA) and the EU/UK (GDPR) have these rights. To exercise any of them, including a data deletion request, email partner.relations@medpayhub.com. We will not discriminate against you for exercising your rights.

Contact

Questions about this policy? Contact us at partner.relations@medpayhub.com.