Consumer Health Data Privacy Notice
Applies to Washington, Nevada, and Connecticut residents under state consumer health data laws. Last updated: July 1, 2026
Scope
This notice explains how BillSurgeon collects, uses, shares, and deletes consumer health data under Washington's My Health My Data Act, Nevada's consumer health data law, and Connecticut's data privacy act. Read it together with our Privacy Policy.
What counts as consumer health data here
- The bill documents you upload
- Your insurance status and state of residence, when combined with your bill
- The patient, provider, and account details you confirm if you generate a dispute letter
Why we collect it
Solely to run your audit: identify potential billing errors, generate your findings, and, if you choose, prepare your dispute letter. We also produce anonymous, aggregate statistics from completed audits that cannot be traced back to you.
Consent
We collect your consumer health data only with your consent, given when you upload a bill and continue through the audit flow after seeing this notice. We never bundle this consent into a general terms acceptance, and we never use dark patterns to get it. You can withdraw consent at any time, see below.
We do not sell your data
We do not sell consumer health data, ever, and we do not share it for advertising.
Who we share it with
- Stripe: payment processing only, never sees your bill content
- Anthropic: AI assisted document analysis, zero data retention
- Supabase: application infrastructure, during the audit only
- Inngest: background job processing, during the audit only
- Cloudflare: hosting and content delivery
We never share your data with data brokers or advertisers.
How long we keep it
Once your audit is complete and your report is generated, we delete the uploaded bill files and your identifiable job record, including findings and letter details. After that, only anonymous, aggregate statistics remain, and they cannot be linked back to you. Download your report and letter promptly, since we cannot retrieve an identifiable copy for you later.
Your rights
- Confirm whether we are collecting, sharing, or selling your consumer health data
- Access your data and see which third parties received it
- Withdraw consent
- Request deletion, including from backups
- Appeal if we deny a request
How to exercise your rights
Email privacy@billsurgeon.com with the email you used at checkout, or your order confirmation, and tell us which right you want to exercise. We will respond within the time the law requires.
Geofencing
We do not use geofencing near medical facilities.
Changes to this notice
If we make a material change, we will update the date above before it applies to data we already collected.