This page is our consumer health data privacy policy under Washington's My Health My Data Act (RCW 19.373) and Nevada's consumer health data law (NRS 603A.400 to 603A.550). It is shown to everyone, wherever you live. Our full Privacy Policy gives more detail.
MedBillCheckup is operated by Rémi Toumi, Calle de Alonso Castrillo 22, 28020 Madrid, Spain. Privacy contact: privacy@medbillcheckup.com.
The consumer health data we collect, and why
Your bill is read by your own browser and kept on your device. We never receive the file or a picture of it. We receive consumer health data only in these cases:
- When you ask for the checks (the free preview or the full list), your browser sends us the figures read from your bill: the charges with their descriptions, billing codes, dates and amounts, the totals and dates of the bill, the name of who billed a charge when it is printed as an organisation, your corrections, and your answers to the optional money questions (what you paid, what your insurer's EOB says you owe for this visit, your plan's yearly out-of-pocket maximum, how much had counted toward it before this visit, and whether the care was an emergency or out of network). We use them only to run the checks and return the preview or the findings to you. They are processed in memory for the seconds the request takes, then gone: not stored and not logged. Before anything is sent, your browser removes your name, address and account numbers wherever it recognises them.
- When you write to us from the Support page, with "Tell us how it went" on a bill, or by email, we receive what you write. We ask you not to include anything from your bill, but a message may still say something about your health. We use it to deal with what you raised (with Tell us how it went, to learn how asking the billing office went) and, when it describes a problem with reading a bill or with a finding, to improve the reader and the checks in a later update.
- When your browser reaches our site, our host, Cloudflare, records each request as any web server does, for up to about 7 days: the network address it came from, an approximate location and the address of the page or function, which can show that the checks ran on a bill, but never what was sent. These records are used only to run and protect the service. Our own functions' log line also names the step of a successful free check, full list, checkout started or payment confirmed, so we can count each step in a week; it holds nothing from the bill. When an organization's link is opened, the line also holds the link's neutral number or the organization's label, never anything from a bill.
Where it comes from
From you only: the bill you choose to open on your device, the corrections and answers you type, and the messages you send us. We collect nothing about you from anyone else.
The consumer health data we share
None. We do not share or sell consumer health data, and we do not use it for advertising. We never quote a message that mentions anyone's health, so a quote you allow us to show is never consumer health data.
Who receives it
No third party and no affiliate receives consumer health data from us; we have no affiliates. Two providers handle it for us, only on our instructions:
- Cloudflare, our host, carries the request that runs the checks to our function and delivers the messages you send from the Support page or with Tell us how it went to our mailbox.
- Proton, our email provider, holds our support mailbox, where your messages are kept.
Our payment provider, Stripe, through its Link service, receives your email address, your name and billing address and your payment details when you pay, and for a single bill a fingerprint of the figures (a code that cannot be turned back into them). It never receives the figures or the bill.
Your rights, and how to use them
You have the right to confirm whether we collect or share your consumer health data and to see it, together with the list of everyone who received it; to withdraw your consent; and to have it deleted.
- What your browser read from your bills exists only on your device. In Settings you can see and download all of it (Download my data), withdraw your consent (Your permission) and delete it (Erase everything on this device). We hold no copy, so there is nothing of it for us to show or delete.
- Messages you sent us: write to privacy@medbillcheckup.com and say what you want; no account is needed. If you wrote by email, or gave your email address in the Support box, write from that address. A message sent from the Support box without an email address, or with Tell us how it went, carries nothing that shows it was yours: give us the reference shown after you sent it (Tell us how it went shows one), or its topic and roughly when you sent it, and we delete it, but we cannot send you a copy.
We answer within one month of receiving your request. If we need more time, we tell you why within that month and answer within 45 more days. Answers are free, up to twice a year.
Appeals
If we refuse to act on your request, you can appeal: reply to our answer, or write to privacy@medbillcheckup.com with "Appeal" in the subject. We give you a written decision, with our reasons, within 45 days of receiving the appeal. If we deny it, you can complain to the Washington State Attorney General at https://www.atg.wa.gov/file-complaint.
Reviewing and correcting
You can review and correct what your browser read from a bill on the review screen, on your device. To correct a message you sent us, write to privacy@medbillcheckup.com.
Tracking by others
No third party collects consumer health data about you over time or across websites or online services when you use our site or app.
Changes to this policy
When this policy changes, we publish the new version here with a new version number and effective date. Before we collect, use or share consumer health data in a way this policy does not describe, we tell you and ask for your consent first.
Version 1.5, effective 2026-10-30