Security and data

What we do with what you send.

The free review takes no patient data. A customer account runs under a Business Associate Agreement.

The free review

We ask for

4 aggregate columns

Patient data

None

BAA needed

No

Stored in

United States

Payer, CARC code, count, billed amount. Summaries are kept for 12 months, or less if you ask.

If you become a customer

A BAA with every vendor in the path

No tool touches PHI without one on file.

Patient data stays in the United States

One US region for every system that touches it.

No consumer AI tools

Zero data retention on every model API that sees patient data.

A complete audit log

Every record read and every human action. It cannot be edited or deleted.

Nothing submits itself

No appeal reaches a payer without one of your people approving it.

SOC 2 Type II

Planned within 12 months of the first paying customer. Not yet held.

What ships today, and what does not

If it says live, it runs now. If it says not built, we will not imply otherwise on a call.

Live today

  • Denial triageReads the 835 and ranks each denial by dollars, odds and deadline.
  • Cited appeal draftsEvery citation links to the CMS policy. Anything else is rejected.
  • Audit logCannot be edited or deleted. Exports as a CSV.
  • Recovery reportsRecovered, in flight and written off, by payer and category.

Not built yet

  • Sending the appealYour person sends it on your rail and records the proof.
  • Payer status checksYour person asks the payer and records the answer.
  • Local coverage policyNational policy is indexed. Local needs a licence we do not hold.
  • Voice follow-upWe will buy this, not build it.

Questions people ask

What if my file contains patient data anyway?

The upload is refused, and we name the column. We do not strip it quietly, because that would mean we held your patient data and told nobody. If PHI reaches us another way, we delete it and confirm that in writing.

Which AI models see patient data?

Only model APIs with zero data retention, under a BAA. Policy search and the citation check use a separate model. It only sees your search words, public CMS text and the draft letter before any patient detail is merged in.

Do you hold SOC 2 or HITRUST?

Not yet. SOC 2 Type II is planned within 12 months of the first paying customer.

Where does your email live?

Our business mailbox is on Google, stored in the European Union today. We do not accept patient data by email. We move it to a US region before we take on a customer. If that matters to you now, say so and we send your review another way.

Ask a security question One person reads that inbox.