Health Data Processing Consent

This page sets out, in full, what you agree to when you tick the health-information box before your browser sends anything to us. It exists so the consent is genuinely informed rather than buried.

What happens without any consent

Opening a bill, reading it, correcting what was read, and keeping it all in your browser happen on your device, under your control, with nothing sent to us. MedBillCheckup is software running on your machine at that point, in the same way a PDF viewer is. We do not ask for consent to that, because we receive nothing.

Why consent is asked for before the checks run

A medical bill reveals information about your health: which services you received, on what dates, from which providers, and sometimes diagnostic codes. That information is in the figures your browser reads from the bill, and those figures are what your browser sends us when you ask for the findings. Under the GDPR this is special-category data and processing it requires a specific condition under Article 9. The condition MedBillCheckup relies on is Article 9(2)(a): your explicit consent.

Several United States state privacy laws similarly treat health information as sensitive data requiring opt-in consent, and the Washington My Health My Data Act requires separate consent to collect consumer health data and a further separate consent to share it. Rather than vary the experience by state, we ask everyone the same way. We share consumer health data with no one, so the second consent never arises.

What you are consenting to

I explicitly consent to MedBillCheckup receiving the figures read from my document (line items, amounts, dates, billing codes and the provider name) and processing the health information they contain, in memory and without storing it, in order to run the checks and return the findings to me.

Concretely, this means: when you ask for the free preview or choose to run the checks, your browser sends those figures, with your corrections and the country you chose, to a function we host, together with your receipt or pass for the paid checks. The function runs the consistency checks, returns the preview (how many things are worth asking about and of what kind) or the findings, and keeps nothing. The request body is not logged and is not written anywhere. That is the whole of what happens on our side.

It does not cover, because it never happens:

• sending the document itself, or any page image, to us or to anyone;
• sending the patient's name, account number, date of birth or insurance member ID. These are separated out on your device and are not part of the request;
• sending anything to an AI provider (there is none);
• storing the figures, the findings or anything derived from them on our side.

What we will not do with it

• We will not store it. It exists on our side only for the seconds the request takes.
• We will not sell it. We will not share it for advertising. We will not give it to data brokers.
• We will not use it to make decisions about you. The findings are information and questions, not verdicts.
• We will not put it into analytics, logs or error reports. There are no analytics.
• We will not use it to train models.
• We will not disclose it to your provider, your insurer, or anyone else, unless you choose to send something yourself.

How long it lasts

Your consent applies to every time you ask for the findings on a bill while it is in force. It stays in force until you withdraw it. Your bills, and everything read from them, are on your device and are deleted only when you delete them; see the Privacy Policy.

Withdrawing

You can withdraw this consent at any time from Settings, in one click. Withdrawal:

• takes effect immediately;
• stops the app from sending the figures of any bill to us for checking until you consent again;
• does not make a request that already ran unlawful, and nothing from it exists on our side to undo;
• does not delete anything on your device (use Erase everything on this device for that).

If you withdraw consent, MedBillCheckup can no longer do the thing you pay it for, but everything already on your device (bills, what was read, findings you already received) stays there and remains yours.

What we record

Nothing on our side. Your choice (granted or withdrawn), the version of this document you saw and the time are stored on your device, in the same browser storage as your bills, so the app can show you what you agreed to and can ask again if this document changes. We hold no record of it because we hold no record of you. If a request reaches our function it is because your browser, holding your consent, chose to send it; the function processes it in memory and keeps no record of that either.

Version 2.1, effective 2026-09-27