Legal & trust
Policies
Each one is its own document with its own effective date, so a clause can be cited and a change can be dated. None is boilerplate — every statement about the platform is true of the system as built.
Public commitments
What we tell you, in writing
Privacy Policy
What this site collects — nothing automatically — and separately how customer and
patient data inside the platform is handled.
Terms of Use
The terms for this website, including the plain statement that no recovery is
guaranteed.
Acceptable Use Policy
What the platform may and may not be used for. Has teeth, because misuse of a
recovery tool has victims.
Cookie Policy
Short. This site sets no cookies, and the platform uses browser storage for four
named things.
Subprocessors
Every third party that can touch customer data, and — as importantly — the ones
deliberately absent.
Data Retention & Deletion
What is kept and why, deletion on request, and exactly what happens when a customer
leaves.
AI Governance
What the AI may do, what it is structurally prevented from doing, and how a customer
verifies it.
Accessibility Statement
The controls that protect claims data, stated so a security review can check each one.
Responsible Disclosure
What we promise a security researcher, and what we ask in return.
Security & Trust
Controls in place today, and the certifications we do not hold.
Contractual
Not on this page
Some documents are negotiated rather than published. A customer receives these during procurement:
Master Services Agreement
Governs use of the platform. Takes precedence over anything on this website.
Business Associate Agreement
Executed before any protected health information moves. Not optional and not negotiable in substance.
Data Processing Addendum
Processing instructions, subprocessor notice and objection rights, and the security schedule.