Consumer Health Data Consent

Consumer Health Data Consent

Effective date: July 15, 2026 · Version 1.0

This is a first draft pending attorney review.

This is the affirmative, unbundled consent presented to the user at upload. It is shown as a separate, unchecked checkbox — not bundled with the Terms of Service or any other agreement — and the user's affirmative action is stored with a timestamp against their account.

Checkbox text (shown at upload)

☐ I authorize IsMyBillWrong to process the health information in my uploaded documents to audit my bill and prepare dispute letters. Processing uses Google Vertex AI under terms that prohibit training on my data.

One-paragraph explanation (shown next to the checkbox)

The bills, Explanations of Benefits, and letters you upload contain health information — such as dates of service, procedure and diagnosis codes, provider names, and amounts. By checking this box you give us your separate, specific consent to process that health information for one purpose only: to audit your bill for billing errors and to prepare dispute letters that you send in your own name. Your documents are analyzed by Google's Document AI and Gemini (via Vertex AI) under enterprise terms that prohibit using your data to train AI models. We do not sell your health data, we do not use it for advertising, and we permanently purge your documents on the schedule in our [Privacy Policy](./privacy-policy.md) (90 days after your case is resolved or abandoned). This consent is voluntary and you can withdraw it at any time by emailing [[CONTACT_EMAIL]] or deleting your account; withdrawing consent stops further processing of that case. For full details, see our [Privacy Policy](./privacy-policy.md).

Storage requirements (implementation note)

When the user checks the box and proceeds, the system stores, per user and per consent event:

• the consent version and effective date shown (this document's front

matter);

• the exact checkbox text presented;
• a UTC timestamp of the affirmative action; and
• the account identifier.

Consent must be a fresh affirmative action (no pre-checked box, no bundling with the Terms of Service). A withdrawal is likewise recorded with a timestamp.

---

[[ENTITYLEGALNAME]] · [[ENTITYADDRESS]] · [[CONTACTEMAIL]]