This policy describes how MedBillCheckup handles your information. It is written to match what the software actually does. Where a statement depends on how this deployment is configured, the configured value is shown.
The short version: your bill file never leaves your device. It is read by your own browser and kept there. The only time anything about a bill reaches us is when you ask the checks to run (for the free preview or for the findings), and then only the figures read from it, never the file. Before they are sent, your browser removes the patient's name, address and account numbers wherever it recognises them. The figures are processed in memory and not stored. We run no database and hold no copy of anything about your bills. The only thing we keep is a message, if you choose to send us one.
Who is responsible for your data
Controller: Rémi Toumi Address: Calle de Alonso Castrillo 22, 28020 Madrid, Spain Registration: Individual sole trader (Spain), no company registration number Privacy contact: privacy@medbillcheckup.com General support: hello@medbillcheckup.com
We have not appointed a Data Protection Officer. Whether one is required depends on the scale of processing, and we keep that under review as the service grows.
What stays on your device
The application runs in your browser. Everything it produces about a bill is held in your browser's own
storage (an IndexedDB database named billcheck) on the device you used, and nowhere else:
The documents you open. Medical bills, Explanations of Benefits and Good Faith Estimates, as files. These contain health information. They are never uploaded. There is no server that receives them and no copy outside your device. When a bill is several photos, only the photo of its first page is kept as a file; the text read from every photo is kept.
What your browser reads from them. The full text of every page and a picture of the first page; the provider, the insurer, the dates, the line items, billing codes and amounts, the currency, the statement and claim numbers, together with the page and line each value came from and how confidently it was read, and short notes on the reading (for example that no total line was found). A PDF with a text layer is read directly; a scan or a photograph is read by text recognition that runs on your device, and so is a scanned PDF whose only text is a hidden layer its scanner added. That hidden text is used instead only where the page picture is not read (it could not be read on your device, the page shows no amount, or it comes after the first three pages with amounts of a long scan), and its figures are highlighted for you to check unless the bill's own totals confirm them. The device also keeps notes about the pages: that photos were put in page order, that two photos showed the same page, that a photo looked like a different document and was left out, that a page had no text, or that a page, or pages a PDF or photo prints, seem to be missing. The insurer's name also decides, on the device, whether the results and the PDF show a note for Medicare, Medicaid, TRICARE, VA or Indian Health insurers. When you ask for the checks, part of this reading is sent; What reaches us lists exactly which part. The page text, the picture, the notes about the pages and the names and numbers of the provider, the insurer, the statement and the claim are never sent.
Patient identifiers found in your documents. A patient name, address, account number, date of birth or insurance member ID may appear on a bill. After a document is read, those your browser recognises are kept apart from what is sent, on your device, and removed from what is sent; see What reaches us for what it recognises and its limits.
Your corrections, your answers to the money questions and the comparison tick, kept with the bill as you type them, so you can close the app, find your Explanation of Benefits and come back to them. They are cleared from the bill when you run the checks for the full list, whose results keep the figures they used. Keeping them sends nothing.
The findings, the questions, the letter and the PDF report, once you have asked for the findings.
What you record after asking, if you use "What happened when you asked" (after the free check or the full list): where things stand, when and how you asked, who you spoke to, the reference number, what they told you on a call (if you type it for the letter confirming the call), a Certified Mail tracking number, whether you kept proof of sending, the amounts due before and after, and your notes. What you record with "Record it" under the letter is kept here too. Adding a reminder, typing an account number, answering "If they say no" or adding a step also starts a record for that bill, "Not asked yet" with the amount due read from the bill. None of this is sent. The box "Tell us how it went" is not part of this record: what you type in it is not kept on your device and is sent only if you press Send (see Messages you send us).
Next steps and dates, if you add them: the steps you pick, the date you type from your own paper for each (a notice, a bill, or the day you sent a request), the date the app works out from it with the rule it cites (a collection agency's date is kept as printed), and whether you marked the step done. If you add a payment plan, the date of your next payment, as you type it, is kept the same way, as a payment plan date you add. Your answers in "If they say no" (how the bill is covered, and the ticks "My insurer denied a claim" and "A collection agency contacted me") are kept with the bill too, so it opens on the same path. None of this is sent.
Reminders and dates for your calendar. A reminder or the dates you add to your calendar are files made on your device. A reminder says "Follow up on your medical bill". One file of dates holds an entry for each date still to come and not marked done, each saying "A date for your medical bill". Each links to your list of bills in MedBillCheckup, at https://medbillcheckup.com/app; the link carries nothing about the bill. The entry's own identifier carries a random number that means something only on your device, and the entry's date. They name no step, provider, amount or person. Calendars are often synced to other services, which is why they say so little.
Dates from the health money dates page. The calendar file on that page is made on your device. Dates that are the same for everyone, such as the end of open enrollment, name what they are. A date you count from your own paper says only "A date for your medical bill" and links to the page. It does not say what happened or what you typed. Your answers and the date you type are not sent to us or stored.
An account number you type, if you type one in "Before you call", under the letter or with the letters in "What happened when you asked". It is kept with that bill, fills in what you say when you call and the letters you copy or download, and is printed on the letter you download to print. It is never sent and never printed in the PDF report.
The addresses you type for a letter, if you use "Print it" under the letter on the full list: your name and address, the billing office's address, and whether to add a Certified Mail line and an enclosures line. They are kept with that bill and printed on the letter you download to print, a file made on your device; the first line, your name, also signs the letters in "What happened when you asked". None of this is sent, and we never send, mail or fax anything for you.
The letters in "What happened when you asked", "Confirming our call" and "Second request", are made on your device from what you recorded there, the account number and the name you typed, and the provider and statement date read from your bill. You copy or download them yourself. None of it is sent, and we never send anything for you.
Proof of payment. If you pay for a bill, a signed receipt for that bill, with the time you ticked the EU 14-day acknowledgement if you were asked; if you subscribe, a signed pass. These are what let you open your findings again without paying twice.
The date you last downloaded your data. The day you last used Download my data or Download a backup, so the app can tell you when a new copy is worth making. It is kept on your device only. It is not in the file you download, and it is erased with everything else.
Your choices. The country you told us the bill is from, whether you turned off Ask about your bill, and your consent choices: the time of each tick and the versions of the Health Data Processing Consent, the Terms of Service and this policy you agreed to.
What you type in the free tools. The itemized bill letter, the medical bill dispute letter, the refund request letter, the financial assistance letter, the letter to a collection agency, the letter asking a health plan for its claim file and the medical bill code lookup run in your browser. What you type, tick or choose in them is not sent to us or stored. The itemized bill letter, the medical bill dispute letter, the letter asking a health plan for its claim file and the letter to a collection agency can also make a reminder for your calendar, a file made on your device for a day you pick (on the letter to a collection agency, the end date printed on your notice). It says "A date for your medical bill" and links to MedBillCheckup. It names no provider, plan, amount or person, and the day you pick is not sent to us or stored. The code lookup, and the review screen for a US bill, download Medicare's public code list as one file, the same file for every visitor, so the request says nothing about which codes you look up or which codes your bill holds. The tools on our public pages run in your browser. What you type in them is not sent to us or stored. The year count on the out-of-pocket maximum guide also adds the share of bills with a full list in this browser.
Your health plan, if you save it (Pro). Your plan's yearly out-of-pocket maximum, how much had counted toward it before a given date, and the month your plan year starts. It is used on your device to fill in the optional money questions on each new bill; it is sent only as part of those answers when you run the checks.
Ask about your bill (Pro), if you use it. You can type a question about a bill on its full list. A small language model, downloaded from our site to your device the first time you ask (about 24 MB, and about 4 MB more for the engine that runs it unless your device already keeps that engine from reading a photo or a scan; both kept by your browser with the app's other files), turns your question into numbers on your device and compares them with questions we prepared, to pick one of the answers we wrote. Some questions, such as what a charge or a billing word means, are answered by fixed rules on your device without the model, and nothing is downloaded for them. The answer is built on your device from your full list, what you recorded about the bill and the official sources it names. Your question is not sent to us or to anyone else, and it is not kept: it is gone when you leave the page. Only your choice to turn the panel off is kept, with your other settings. Turning it off also deletes the downloaded model from your device; the engine stays, as the reader uses it. Without Pro, Settings still lets you delete a model your device keeps.
When you save a bill, restore a backup, confirm a payment or open the app from your Home Screen, the app asks your browser to keep this storage; your browser decides, and a refusal changes nothing else.
You can download all of this as a single file, import it on another device, or erase it, from Settings. Your consent choices are in the file as a record, but importing the file does not give your permission on the new device: the app asks for it there before anything is sent.
What reaches us, and when
We operate no database and store nothing about your bills. Four things can reach our servers, each transient (a message you choose to send us is the one thing that is kept; see Messages you send us):
1. The request that runs the checks. When you ask for the free preview or for the findings on a bill, your browser sends a request to a function we host. It contains exactly:
- what your browser read from the bill, as it was read, with the corrections you made: the line items (description, date, billing code, amounts, and who billed it when that is printed as an organisation), the totals, the bill, due and service dates, the currency, the document type, the number of pages, the page and line each value came from and how confidently it was read, and short notes on the reading (for example that no total line was found, or that the charges on a page may have been missed). For the provider's name, the insurer and the statement and claim numbers only the word "present" is sent when the bill shows them: the checks need to know they are there, not what they say. A charge you marked as not on your bill is still sent as it was read, marked as removed, and the checks leave it out; the reading has to be sent unchanged because a single-bill purchase is tied to it. You can take the service dates and each billing organisation out on the review screen before anything is sent;
- the answers you chose to give to the optional money questions, if any: what you have already paid on the bill, what your insurer's Explanation of Benefits (EOB) says you owe for this visit (the amount you type, never the EOB itself), your plan's yearly out-of-pocket maximum and how much had counted toward it before this visit, and two yes or no answers about emergency or out-of-network care. Only amounts and yes, no or not sure;
- the country you chose;
- a measure of how legible the document was;
- for the findings, your receipt or pass, so the function can confirm the bill has been paid for. A receipt holds the payment's reference, the amount and the fingerprint of the bill it unlocks. A subscriber's pass holds the email address used at checkout, the Stripe customer number, the plan and its end date. A pass from an organization's free-access link or client link holds no email address and no customer number; Payment steps below says what it holds. Receipts and passes are signed by us so they cannot be altered; the function checks them and keeps nothing. The free preview needs none: it answers only how many things are worth asking about and of what kind, how many of them are important, how many notes there are, whether the amounts add up, when a money check finds something, the largest amount worth asking about, and the first thing on the list: what it is, what was found, why it may be worth asking and which lines it is on. Your browser then writes the start of your letter from that, on your device.
It does not contain the file, any page image, any other text from the page (only the value read from a line is sent, not the rest of that line), your email address (other than inside a subscriber's pass), or anything identifying your device beyond what any web request carries.
Before anything is sent, your browser removes the patient's name, address and account numbers wherever it recognises them, and replaces them with "[redacted]" wherever they appear in what is sent. It recognises: names, account, member, policy, record, visit and encounter numbers and birth dates printed next to a patient, guarantor, subscriber, insured, parent or guardian label anywhere on the bill, including a name on the line after its label and every row of a patient column; greetings and first and last name labels; the same name printed again with or without middle names or initials, accents, apostrophes, hyphens or "Jr."; a surname on its own in a charge, and a first name after "for" or "baby"; Social Security and Medicare numbers anywhere; Medicare, Medicaid and insurance numbers after their labels; birth dates; street addresses, including a house number and a street name in a charge with no city after it (with a short street word that bills also use for care, such as "Dr", "Ct" or "Ln", only right after a word such as "visit", "pickup", "from" or "to"), PO boxes and a city, state and ZIP code; a ZIP code after "from" or "to" on an ambulance mileage line; phone numbers, including ten digits after "call" or "phone"; and email addresses.
It cannot recognise everything. Among what it may miss: a name printed with no label anywhere on the bill, for example a child's name in a heading that also names a department or a practice; a first name on its own in a charge, except after "for" or "baby"; a surname on its own that is also an ordinary word or has fewer than four letters; a middle name the label did not print, when the surname comes first and more words of the charge follow the name; labels it does not know; a city, state and ZIP code printed without a street, for state codes that bills also use as abbreviations (for example MD or PA); a ZIP code on its own anywhere else; and a street with no city after it that has no house number or street word, a one-digit house number, a five-digit house number and a one-word street name, more than three words in its street name, a street name with a word that also describes care (for example "12 High St" or "40 Bay View St"), or a short street word such as "Dr" or "Ct" with no word such as "visit", "pickup", "from" or "to" just before the house number. You see every charge and figure before anything is sent.
A bill read with earlier rules is cleaned again with today's rules when you open it, unless a single-bill purchase is tied to it, because the purchase is tied to what was read. Even then, a copy of a printed line or a patient field is never sent.
The function runs the checks in memory, returns the preview or the findings to your browser, and keeps nothing. The request body is not logged and is not written anywhere. This is the only processing of health information that happens on our side, and it lasts for the seconds the request takes.
2. A sign-in request, subscribers only. If you subscribe and want to use another device, you enter the email address you used at checkout. We look it up with our payment provider and, if it belongs to a subscriber, email you a link. The request is processed in memory and not stored; the email is delivered by the provider named below. The link carries its sign-in code after "#", so the code never appears in an address that a server or request log records; the sign-in page then sends it once to our server, inside the request that installs your pass, which is not logged.
3. Payment steps. When you start a payment, your browser sends what you chose to buy, the ticks you gave (the renewal tick and, where asked, the EU 14-day acknowledgement) and, for a single bill, the fingerprint of its figures. When you come back from the payment page, your browser sends the payment's session number, which the payment provider puts in the address after "?", to receive your receipt or pass. A subscriber's browser also renews the pass on its own shortly before it expires, and opening Manage subscription sends the pass too; the pass holds the email address used at checkout and the Stripe customer number. A free-access link we gave an organization that helps patients (see the Terms, section 4) carries a code after "#"; opening it sends that code once to our server, inside the request that installs a pass, which is not logged. That pass holds no email address and no customer number: it holds a fingerprint of the code that cannot be turned back into it, the plan, its dates and, only if the organization agreed, the organization's name. Your browser renews it on its own about once a month, until the end date agreed with the organization. A client link that an organization gives the people it serves (see the Terms, section 4) works the same way: its code comes after "#" and reaches our server only inside the request that installs a pass, whose content is not logged. The code and the pass hold a neutral number for the organization's access, the link's version, the end of its free pilot, whether the access was paid for and the pass's dates; never the organization's name, an email address or a customer number. To learn whether that access was paid for, our server asks our payment provider for the completed payments made through our organization checkout links and picks out those that carry the same number; it sends the provider nothing about you or your device. The provider's answer also contains what each organization's buyer entered at checkout; we use only each payment's number, date, checkout link and whether it was refunded or disputed (for a plan that renews, the status of its subscription and the day it is paid through), and keep that in memory for at most half an hour. We log none of it, except that a payment that reached one of those links without a number, or that was disputed, is logged once by the provider's reference for it, so we can match it by hand. The organization receives from us only how many times its link was opened in a quarter; we cannot tell it who opened it.
When an organization buys a plan on our Organizations page, the buyer's browser sends our function the plan chosen, the three ticks and the version of the Terms for organizations shown beside the first one. Our function asks our payment provider to start a checkout that carries a neutral number for the new link, the plan, that version, the time of the tick, the statement that the organization is not a health care provider, health plan or health care clearinghouse and the confirmation that the plan renews automatically; the provider keeps these with the payment. When the buyer comes back, the address of the confirmation page carries the payment's session number, which the provider puts after "?". The page sends it to our function, which asks the provider for that one checkout, checks that it is ours and paid, and works out the link from it. Nothing is stored, so the same address shows the same link for 14 days. Anyone who has that address can see the link: the page is not in our sitemap, and it asks browsers to keep it out of search results, not to pass the address on and not to store the page. The provider's answer also contains the email address and the business name entered at checkout. We do not use the email address or the name on that page. The email address is used only for the "Lost your link?" page: to match it with the address typed there, and to send the link to it. If the buyer loses the link, the "Lost your link?" page takes an email address, asks the provider for the organization plans paid with that address in the last 37 months and emails the link of each plan that still runs to that address and to no other, through Cloudflare Email Service. The page gives the same answer whether or not it found a plan. When a device opens or renews a link from such a plan, or the confirmation page or the lost-link email is made, our function asks the provider for the completed checkouts of the one day on which the plan was paid. That answer also lists other buyers' purchases of that day; we ignore them, use only each plan payment's number, date, plan and whether it was refunded or disputed (for a plan that renews, the status of its subscription and the day it is paid through), and keep that in memory for at most half an hour. We log none of it, except that a payment that was disputed is logged once by the plan's neutral number, so we can match it by hand. We keep no email address or business name: they stay with the provider.
4. Ordinary web-server records. Our hosting provider records requests as any web server does, for up to about 7 days; its records can include the network address a request came from and an approximate location. Our own functions log, for each request, a random request number, the method, the path, the status and the duration, and, for a request that fails, the error code and a short technical description of the fault; never what was sent. For a successful free check, full list, checkout started or payment confirmed, the line also names that step, so we can count how many of each happen in a week; the step's name says nothing about the bill or the person. When a free-access link we gave an organization is used, our function also logs that organization's name as we labelled its link, and whether the link was used or had ended; never the code. Because the code comes after "#", a part of an address your browser does not send, no address a request log records contains it. When a client link is opened, our function logs one line with that link's neutral number, its version and the outcome (opened, replaced, ended or could not be checked); when we check a link's end date ourselves, the line says so and is not counted. If our payment provider cannot be read when a client link is opened or its pass renewed, or a renewal brings the end date forward, our function logs the neutral number and the reason. Never the code, never the organization's name (our server keeps no record of it) and nothing about a bill. When the confirmation page shows a plan's link, our function logs one line with that link's neutral number and its version; when it emails links, one line with how many it sent. Never the address or the code. We also add one count line with the link's neutral number, the outcome and the day (our host also stamps the time it was written), kept about 3 months, so that the quarterly count does not depend on records kept for 7 days; we count these lines to tell the organization how many times its link was opened each quarter. We derive rate-limit counters from a one-way fingerprint of the network address a request arrives from: some live in memory and end with the function instance, the others are kept by our host across its servers for about a minute. Our own code never stores a network address. We also run an automated check every three hours that the live site answers, which sends nothing about any person. If a page from our site fails to load, your browser may also send our host a short network error report; the Cookie and Storage Policy says what it holds.
Payment. If you pay, our payment provider collects your email address, your name and billing address (to work out the tax) and your payment details on its own pages, and keeps the record of what you bought, with the ticks you gave before paying. For a single-bill purchase it also holds a fingerprint (a cryptographic hash) of the figures you paid to have checked, so that your receipt can be tied to that bill. The fingerprint cannot be turned back into the figures. We never see or store card numbers.
We do not collect precise location, we set no cookies, we do not use tracking of any kind, and we do not build advertising profiles. We use no analytics scripts. To see how the site is used, we count requests per page in our host's own figures, for example how many times the checks ran (requests to POST /api/v1/analyze, with ?preview=1 for the free preview). We also count the pages that web browsers open, on our server. Each time a browser opens a page of the site, our function adds one line to our host's analytics store: the page's address without anything after a "?" (for the app's own pages, the part of the address that names one of your bills is left out), whether the page is public or part of the app, the country our host works out for the request, the host name of the website you came from (such as google.com, never the full address) and the day; our host also stamps each line with the time it was written. The line holds no network address, no browser or device details, no cookie, no number that identifies you and nothing about a bill. Our host keeps it for about 3 months. Robots, tools that fetch pages and browsers that only load a page in advance are not counted. Those counts say nothing about any person.
Messages you send us
The Support page has a message box for problems, payment questions, complaints, ideas and withdrawals from a contract. If you use it, we receive the topic you chose, what you wrote, and the version of the app you were using. For a payment question or a complaint you may also give the email address you paid with; it is optional, and we use it to find your payment with our payment provider and, if we put a payment right, to write to you. A withdrawal from a contract needs the email address you paid with: we use it to find your payment and to confirm by email that we received your withdrawal.
The message is delivered by our host to our support mailbox, hosted by Proton AG in Switzerland, which only the operator can read. Our host keeps a delivery record of each email (sender, recipient, the topic as subject, and the time) for up to about 30 days. You get an automatic reply on screen. The only emails we send are the sign-in links a subscriber asks for, a reply when you wrote to us first (to confirm a withdrawal, to put a payment right, or to answer a request about your rights), to an organization with a client link, the messages the Terms for organizations describe, and, to a buyer who asks for it on the "Lost your link?" page, the email that returns the link of a plan paid with the address typed there. Our payment provider emails you about a payment you made, such as receipts, invoices, refunds and renewal reminders. Please do not include anything from your bill: no names, account numbers or medical details. We keep a message for up to 12 months after the matter it raised is closed, then delete it. You can ask us to delete yours sooner at any time by writing to privacy@medbillcheckup.com.
Tell us how it went. After you record "They changed the bill" in "What happened when you asked", you can send us a short message about how it went. We receive only what you wrote, whether you ticked "You may quote this, without my name", and the version of the app. Nothing from your bill or from what you recorded is added, unless you type it yourself. Nothing is sent until you press Send, and what you type there is not kept on your device. Please leave out names, account numbers and medical details. Your message is delivered to our support mailbox and kept there, like any message you send us. When it is sent, you are shown a reference made at random for it, which is also in the email we receive. It is the only way to point us to that message later, because nothing in it shows it was yours.
Quotes. We quote a message only if you ticked "You may quote this, without my name". We may then show it on our website and in our listings on app directories, word for word and in full, or not at all, and never with your name. We never quote a message that mentions anyone's health. A quote is shown as one person's words, never as what most people find. We give nothing in return for a message or a quote. You can withdraw your permission at any time, as easily as you gave it: on the Support page, choose "Withdraw permission to quote" and give the reference shown after you sent your message, or roughly when you sent it and what it said. No email is needed. We then stop showing the quote.
Why we process it, and on what legal basis
Reading a bill in your browser is done by software running on your device under your control; no data is disclosed to us by it. The table covers what is processed on our side.
| What | Why | Legal basis (GDPR) |
|---|---|---|
| Running the checks on the figures you send | To produce the free preview you ask for, or the findings you paid for | Article 6(1)(b), performance of a contract |
| The health information inside those figures | Same | Article 9(2)(a), your explicit consent |
| Subscriber sign-in by email link | To let a subscriber use another device | Article 6(1)(b) |
| Payments and subscription state (held by the payment provider) | To take and manage a purchase | Article 6(1)(b) |
| Reading an organization's purchase from the payment provider, to show its link, to email it again when the buyer asks and to check that the purchase stands | To deliver the plan an organization bought | Article 6(1)(b), performance of a contract; Article 6(1)(f), legitimate interests, for the check that the purchase stands |
| Rate limiting and abuse prevention | To keep the service working and safe | Article 6(1)(f), legitimate interests |
| Request records (ours, and our host's, which can include the network address) and the counts of pages opened and of each step (free check, full list, checkout started, payment confirmed) | To run and secure the service and to see how it is used | Article 6(1)(f), legitimate interests in running, securing and improving the service |
| A message you send from the Support page or with Tell us how it went | To deal with the problem, payment question, complaint, idea or withdrawal it describes, or to learn how asking the billing office went | Article 6(1)(b) where it concerns your purchase; Article 6(1)(c), a legal obligation, to confirm a withdrawal; otherwise Article 6(1)(f), legitimate interests in running and improving the service |
| Anything about your health you choose to write in a message from the Support page or with Tell us how it went | To deal with that message and, if it describes a problem reading a bill or with a finding, to improve the app | Article 9(2)(a), your explicit consent, given by the statement shown before you send it; you can withdraw it and ask us to delete the message at any time |
| Showing a message you allowed us to quote | To show what people say about the service, in their own words | Article 6(1)(a), your consent, which you can withdraw at any time |
No law requires you to give us personal data. You do not have to give us anything to read a bill on your device. To get the free preview or the findings, your browser must send the figures of the bill, so the checks cannot run without your consent to that. To buy, you give our payment provider your email address and payment details; without them it cannot take the payment.
Health information is special-category data. We rely on your explicit consent under Article 9(2)(a) for the requests that carry it. That consent is asked for separately, is never pre-ticked, is never bundled with anything else, and can be withdrawn at any time in Settings. Withdrawing it means the app will not send the figures of a bill to us for checking; it does not affect a request that already ran, and it does not affect anything on your device.
If you are in the United States, several state laws, including Washington's My Health My Data Act, set rules for consumer health data. We ask everyone for the same explicit consent before the figures of a bill are sent, and we share consumer health data with no one. Our Consumer Health Data Privacy Policy sets out what we collect, why, and how to use your rights.
Automated processing
The checks that produce your findings are ordinary arithmetic and comparison rules written in code. They compare amounts, dates and descriptions in the figures your browser sent.
With Pro, Ask about your bill uses a small language model on your device. It does not write answers and it does not judge your bill: it only measures how close your question is to questions we prepared, and shows the answer we wrote for the closest one, filled with your bill's own figures. When no prepared question is close enough, it says it has no verified answer. Nothing it does is sent to us.
MedBillCheckup does not make automated decisions that produce legal or similarly significant effects about you. It does not decide what you owe, what your insurance covers, whether a charge is correct, or whether you have a legal claim. It produces information and questions; every decision remains yours.
Who else processes your data
| Recipient | What they receive | Why |
|---|---|---|
| Hosting | Cloudflare carries every request to our functions, including the one that runs the checks, and serves the application | To run the service |
| Payments | Stripe, through Link (Sold through Link, LLC, a Stripe company), the merchant of record that handles the sale for us: it hosts checkout, takes the payment, calculates and pays sales tax or VAT in the countries it covers and keeps the payment record; we never see or store card numbers | To take a purchase or a subscription |
| Cloudflare, our host, which receives a subscriber’s email address in order to deliver a sign-in link; it also delivers the messages you send from the Support page or with Tell us how it went to our support mailbox, and forwards the emails you write to us there; it also receives the address a buyer types to get an organization's plan link again, and the link sent to it | To send sign-in links to subscribers, return an organization's plan link and deliver your messages | |
| Error tracking | no third-party error tracker; errors go to the server log only, without request bodies | To find and fix faults |
| Support mailbox (Proton AG, Switzerland) | Each message you send from the Support page or with Tell us how it went, and any email you write to us. Our host forwards them to the mailbox, where they are kept | To read your message |
| Visitors to our website and listings | A message you allowed us to quote, word for word and without your name, if we show it | To show what people say about the service |
No recipient ever receives your bill file or a page of it. No document is sent to an AI provider; there is none. The model that Ask about your bill uses runs on your device, and its files come from our own site.
The current list, with locations and transfer mechanisms, is published at https://medbillcheckup.com/subprocessors.
We do not sell your personal information. We do not share it for cross-context behavioural advertising. We do not disclose it to data brokers. We do not collect, use or sell personal data to train large language models or any other model.
International transfers
The operator is established in Spain. Hosting and payments may involve processing outside the European Economic Area, principally in the United States. Where that is the case we rely on the European Commission's Standard Contractual Clauses together with the provider's own safeguards. You can ask us for a copy of these safeguards at privacy@medbillcheckup.com. Our support mailbox is kept by Proton AG in Switzerland, for which the European Commission has adopted an adequacy decision.
Because the bill file never leaves your device, the only health-related data that can cross a border is the figures read from a bill, in transit, for the seconds it takes to run the checks, and any message you send us. The subprocessor page states, for each provider, where processing takes place and on what transfer mechanism we rely.
How long we keep it
| Data | Kept for |
|---|---|
| Your bills, what was read from them, your results, letters, receipts, what you recorded after asking (with its steps and dates), the addresses you typed for a letter, pass and choices | On your device only, until you erase them. We hold no copy |
| The figures sent when you run the checks | In memory for the duration of the request, then gone. Not stored, not logged |
| A subscriber's sign-in request | In memory for the duration of the request; the link expires after 15 minutes |
| Request records (our functions: request number, method, path, status, duration, the name of the step for a successful free check, full list, checkout started or payment confirmed, for a failed request the error code and a short description, and, when an organization's free-access link for its staff is used, that organization's name, and, for a client link, the link's neutral number, its version and the outcome; our host's records can include the network address) | Up to about 7 days, per the hosting provider's log retention; they contain no bill contents |
| An organization's purchase, as read from the payment provider (the checkout email address and business name, the plan, the dates, whether it was refunded or disputed, and for a plan that renews the status of its subscription) | We keep none of it. Our function holds the number, date, plan and refund state in memory and uses an answer for at most half an hour; the rest stays with the payment provider |
| Client link opening counts (the link's neutral number, the outcome, the day, and the time our host stamps on the line) | About 3 months, per the hosting provider's retention |
| Page-visit count lines (the page, public or app, the country, the referring site's host name, the day, and the time our host stamps on the line) | About 3 months, per the hosting provider's retention |
| Email delivery records (sender, recipient, subject, time) | Up to about 30 days, per the hosting provider's retention |
| Payment records | Held by the payment provider under its own retention policy, as required for accounting |
| A message you send from the Support page, with Tell us how it went, or by email (kept in our support mailbox) | Up to 12 months after the matter it raised is closed; deleted sooner if you ask |
| A message you allowed us to quote | While we show the quote, and up to 12 months after we last show it, as the record of your permission; if you withdraw it, we stop showing the quote and delete the message when you ask |
Apart from a message you chose to send us, there is nothing to delete on our side because nothing is written. Erasing your bills is something you do on your device.
Erasing your data
In the app: Settings → Erase everything on this device deletes everything the app holds in that browser: every bill, result, letter, receipt, pass and consent choice, the corrections and answers kept with each bill, what you recorded after asking (with what they told you on a call, the steps and dates you added, your answers in If they say no and an account number you typed for a call or a letter), the addresses you typed for a letter, and the app pages saved for offline use. Reminders and dates you added to your calendar stay in your calendar; delete them there. Do this before lending or disposing of a device. Settings → Download my data first if you want to keep a copy.
In the browser: clearing site data for https://medbillcheckup.com in your browser's settings has the same effect. Uninstalling an installed app may not be enough: some browsers, Chrome among them, keep a site's data until you also choose to clear it.
Erasing your device data does not cancel a subscription; manage that from the billing page, which opens the payment provider's portal. It also does not remove the payment provider's records; see Your rights.
Security
The strongest protection is that the bill file never leaves your device: there is no server-side store of bills to breach. Requests travel over an encrypted connection. The paid checks need a signed receipt or pass. Every request that runs the checks is rate-limited and processed in memory, and what it carries is never logged. Full detail is on the security page.
Keeping the bill on your device also means its safety depends on your device. Anyone who can open your browser profile can open your bills. On a shared computer, use the erase control when you are done.
Your rights
Because we are established in Spain, the GDPR applies to what we process about you wherever you live. You have the rights to access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time. You may lodge a complaint with the Agencia Española de Protección de Datos (https://www.aepd.es/) or, if you live or work in the EU or EEA, with the data protection authority there.
Your right to object. Where we rely on our legitimate interests (rate limiting, request records, the counts of pages and steps, and messages that do not concern a purchase), you can object at any time, on grounds relating to your situation, by writing to privacy@medbillcheckup.com.
If you are in the United States, depending on your state you may also have rights to access, correct, delete and obtain a copy of your data, to opt out of sale or sharing, and to appeal a refused request. We do not sell or share your data, so there is nothing to opt out of. To appeal a refusal, reply to our answer or write to privacy@medbillcheckup.com with "Appeal" in the subject. We give you a written decision with our reasons within 45 days. If we deny it, you can complain to your state's Attorney General, for example in Connecticut at https://portal.ct.gov/ag/common/complaint-form-landing-page or in Washington at https://www.atg.wa.gov/file-complaint.
For everything about your bills, you exercise these rights yourself, immediately, in Settings, because the data exists only on your device: download everything (access and portability), correct what was read (rectification), withdraw consent, or erase everything (erasure). There is no account to delete, and we could not act on a request about a bill even if asked, because we do not have it and cannot identify you from it.
For a message you sent us, write to privacy@medbillcheckup.com and we will give you a copy or delete it. We answer requests about your rights by email.
For payment records, write to privacy@medbillcheckup.com from the email address you used at checkout. We can ask the payment provider to give you a copy of, correct, or delete what it holds, subject to the retention it is required to keep for accounting.
We answer within one month of receiving your request. If we need more time, we tell you why within that month and answer within 45 more days.
Children
MedBillCheckup is for adults. You must be at least 18 to use it, and we ask you to confirm this before the figures of any bill are sent for the checks. We do not knowingly process information from children. If you believe a child has used the service, erase the data on that device; if a payment was made, write to privacy@medbillcheckup.com and we will ask the payment provider to delete the payment record, subject to the records it must keep.
Changes
If we change this policy materially we will publish the new version with a new version number and effective date, and the app will show you that it changed and ask for your permissions again before it next sends the figures of a bill for the checks. Your choices are stored on your device together with the versions you accepted, so you can always see what you agreed to.
Version 2.27, effective 2026-11-06