Privacy Policy

Privacy Policy

Effective date: October 2, 2026 · Version 1.8

VUGA Enterprises LLC ("IsMyBillWrong," "we," "us," or "our") operates IsMyBillWrong.com. IsMyBillWrong is an AI service that audits medical bills for errors and generates dispute letters for a flat fee. Your medical bills are sensitive, and this policy explains — in plain English — exactly what we collect, how we use it, who we share it with, how long we keep it, and the choices and rights you have.

A note on HIPAA: We are generally not a HIPAA "covered entity" or "business associate," so we do not claim to be "HIPAA compliant." Instead, this policy describes the concrete protections we actually apply — encryption, data minimization, no use of your data to train AI, and a fixed purge schedule.

1. Information we collect

We collect only what we need to run the Service:

• Documents you upload. Itemized hospital bills, insurance Explanations of

Benefits (EOBs), collections letters, provider or insurer responses, and similar documents. These often contain health information — dates of service, procedure and diagnosis codes, provider names, and amounts. This is the core of what we process to audit your bill and prepare your letters.

• Information extracted from those documents. Structured data our extraction

step pulls out of your uploads (line items, codes, amounts, dates), stored so the audit can run.

• Account information. Your email address, an Argon2id one-way password hash,

and account/session records used for sign-in, email verification, password reset, case ownership, and transactional messages. A verified account is required to save an anonymous case beyond 24 hours or buy an offer. We never store your plaintext password.

• Consent and lifecycle records. The current consent version, exact terms,

affirmative acceptance time, withdrawal or closure time, and deletion status.

• Payment metadata from Stripe. When you pay, our payment processor Stripe

handles your card. We receive and store payment metadata only — for example a charge ID, the amount, the last four digits and card brand, and success/failure status. We never receive or store your full card number.

• Basic technical and usage data. Limited security and reliability data such as

your IP address (used for sign-in security, rate limiting, and abuse prevention) and analytics data (see Section 4).

We do not ask for information we don't need, and we instruct you not to upload documents that are not yours.

Optional Google sign-in. If you choose Google to create or access a customer account, we redirect you to Google and request the openid, email, and profile scopes. Google returns a signed identity token. We verify it on our server and use Google's stable account identifier (sub), your verified email address, and, when supplied, your display name to create or link your IsMyBillWrong account. We retain the sub with your account until account deletion. A matching verified email can link to an existing account, preserving its cases and purchases. Password sign-in remains available for accounts that have a password. Google-only accounts do not have a password hash. We do not receive your Google password or request access to your Gmail, Drive, medical documents, cases, or payments. Google receives the authentication request and processes it under its own privacy policy. We do not send bill or case contents to Google for sign-in.

2. How your documents are analyzed by AI

We plan to use OpenAI's US-routed API to extract text and line items from uploaded documents and to support audit reasoning. Findings are reviewed against the bill evidence; dispute letters use locked templates. We send only the content needed to process your case.

By default, OpenAI does not use API data to train or improve its models unless the customer opts in. We do not opt in. OpenAI may retain prompts, responses, and related metadata in abuse-monitoring logs for up to 30 days, or longer where law or safety requires. We do not claim zero retention. We will not send real customer health documents to OpenAI until our required contractual and US-routing review is complete. Uploaded text is treated as untrusted data, and health information is kept out of our application logs, error reports, and analytics.

3. How we use your information

We use your information only to:

• run the preliminary scan and purchased audit, and generate letters included

in the package or add-on you purchase;

• process your payment (via Stripe);
• send you transactional email about your case and deadlines (via Resend);
• secure the Service, prevent abuse, and enforce our Terms; and
• comply with law.

We do not use your documents, extractions, account data, case data, or any health information for advertising, profiling, or automated decision-making about you, and we do not make automated decisions that produce legal effects about you without your involvement — you review and send every letter yourself. Site-level advertising measurement on public marketing pages is described in Section 4.

4. Analytics and advertising measurement

Your bill and case contents are never in analytics. No third-party analytics or advertising tag loads on bill, account, case, upload, consent, search, guide, glossary, or waitlist pages. GA4 and Meta Pixel tags load only on selected public marketing pages. For conversion measurement on other pages, our site sends limited event data to our own server, which forwards approved events to Google Analytics 4 (GA4). These events contain only fixed names and approved values such as a state, broad count or bill-size bucket, our product price, and product type. We do not send exact bill amounts, provider names, medical or procedure codes, filenames, document text, email addresses, form entries, case identifiers, query strings, URL fragments, or full landing URLs to GA4. We may attach first-touch campaign tags and a partner referral code from the landing URL to sign-up, purchase, and waitlist events. We store those attribution fields with the account and order, where available. GA4 uses a browser client ID captured at checkout to connect a confirmed purchase with the browser session; the purchase is sent from our server after payment confirmation and includes our internal order ID. Google may also receive basic browser, device, and network information, including your IP address, when its tag runs on public marketing pages. Meta Pixel is not used for service events. Search queries and Consumer Health Data Consent pages are excluded from GA4 events.

• Self-hosted Plausible (no third party). We run our own Plausible instance

on public informational pages. It receives sanitized page and funnel-event names, never case identifiers, account identifiers, document data, or health information. Because it is self-hosted, this data is not disclosed to any outside analytics company.

• Google Analytics (with your consent, measurement only). If you accept

analytics measurement in our consent banner, we use the GA4 tag for public marketing traffic and send limited conversion events from our server. Advertising features are disabled at the tag level (ad storage, ad user data, and ad personalization signals are denied). Declining or withdrawing analytics consent prevents new GA4 events, including server-relayed events and purchases from payment confirmation.

• Meta Pixel (when configured, marketing pages only). If an IsMyBillWrong

Meta (Facebook) Pixel is configured, we use it on public marketing pages to measure whether our advertisements lead people to the site. Meta receives a sanitized page address, basic browser and device information, and your IP address. The pixel is not placed on any page where you enter account, bill, or case information, and we never send it your email, name, or document data. We honor Global Privacy Control and the persistent Do Not Sell or Share My Personal Information control in our footer by not loading (or by removing) the pixel in that browser. You can also opt out at https://www.facebook.com/settings?tab=facebook_pixel, or by blocking third-party scripts.

• Your analytics choice. Google Analytics and Meta Pixel load only after

you accept analytics and advertising measurement in our consent banner. You can change that choice later in the privacy controls. Declining does not prevent you from using the Service. This choice is separate from consent to process your uploaded health documents or join the waitlist.

No advertising use of your case information. Nothing you upload, submit, or view inside the Service (bills, extractions, cases, accounts) is used for advertising or shared with advertisers or data brokers.

5. Who we share information with

We share information only with the service providers that make the Service work, and only as needed:

| Provider | Purpose | What it receives | |---|---|---| | OpenAI API (US-routed) | Document extraction and audit reasoning | Uploaded documents and extracted content needed for the case; default no model training, possible abuse-monitoring retention | | Google sign-in (optional) | Customer account creation, sign-in, and reauthentication | Authentication request to Google; we receive a signed identity token with stable sub, verified email, and optional display name; no bill, case, medical document, or payment contents | | Google Analytics 4 | Public marketing traffic and limited server-sent conversion measurement | Sanitized page and event data, approved buckets and product metadata, first-touch campaign/partner attribution on selected events, checkout client ID and internal order ID for confirmed purchases, and basic browser/device/network information on tagged pages; no bill or document contents, email, or free-text form data | | Meta Platforms (Meta Pixel) | Advertising measurement on public marketing pages | Page address, referrer, basic browser/device information, and IP address; no bill, account, case, or contact data | | Stripe | Payment processing | Payment details you enter at checkout; we receive only payment metadata back | | Resend | Transactional email delivery | Your email address and transactional message contents (case/deadline notices) |

These are the external service providers that may receive information to operate the Service. Plausible analytics is self-hosted and is not sent to a third-party analytics provider.

We may also disclose information if required by law, to respond to lawful requests, to protect our rights or the safety of others, or in connection with a merger or acquisition (in which case this policy continues to apply to the transferred data). We do not share your case, health, or account data with data brokers or advertisers; the only advertising-related disclosure is the marketing-page pixel data described in Section 4.

6. How we protect your information

• Encryption at rest. Uploaded documents are encrypted at rest

(application-layer AES-256-GCM). Encrypted database backups are copied to a private Cloudflare R2 bucket with public-access prevention. Traffic is encrypted in transit with TLS.

• Data minimization. We collect only what we need and keep health information

out of logs, error monitoring, and analytics by design.

• Access limits. Access to case data is restricted; our administrative tools

are not publicly exposed.

• Model training. We do not opt in to OpenAI training on API data. OpenAI may retain abuse-monitoring logs as described in Section 2.
• Malware scanning and upload validation protect the Service and other users.

No system is perfectly secure, but these are the concrete measures we apply.

The public example uses fixed synthetic data, not customer records, and does not run an AI audit or create a customer case.

7. How long we keep your information (retention schedule)

You can upload a bill and view preliminary findings without an account. One active anonymous case per browser can be resumed or deleted. Browser access expires 24 hours after case creation; unclaimed documents, extracted data, and findings are then queued for durable erasure. Saving results or buying an offer requires a verified account and an explicit case claim before expiry.

You may upload a bill and view preliminary findings without an account. One active anonymous case per browser can be resumed or deleted. Its browser access expires 24 hours after creation. If unclaimed, we queue its documents, extractions, and findings for durable erasure on the next lifecycle sweep. Signing in after expiry does not recover it. Claiming it within 24 hours requires a verified account and the same browser; paid steps also require an account.

Eligible cases close after 90 days without meaningful user activity. We send an inactivity notice at day 76 and allow at least 14 days after delivery of that notice before closure. Opening a background polling connection does not renew activity. Use the Keep case open control if you still need the case.

Automatic closure excludes unresolved payments or refunds, active processing or review, and future deadlines. Stalled excluded work requires operational follow-up; it must not be kept open indefinitely without attention. Legacy anonymous cases remain restricted and are excluded from automatic destructive migration pending verified support-assisted recovery.

| Data | Retention | |---|---| | Uploaded documents (bills, EOBs, letters, responses) | Purged 90 days after case closure, including resolved, abandoned, and terminally failed cases | | Extractions (data pulled from your documents) | Purged 90 days after case closure | | Rendered dispute-package PDFs | Purged 90 days after case closure | | Account records | Kept until you delete your account; an account inactive for 730 days becomes eligible for deletion after notice | | State-expansion waitlist entries | Email, state, consent version, and consent time are deleted 365 days after consent unless you ask us to remove them sooner |

A user-requested deletion begins immediately instead of waiting for the ordinary retention window. Access is revoked when the request is accepted. Deletion continues in the background, with retries if a file cannot be removed immediately. Case erasure removes associated health information, extractions, findings, letters, and files. It may retain a minimal case and deletion record, never the contents of your bill. Necessary accounting and sanitized operational records may remain under the applicable retention policy and legal obligations. Limited operational records may include case identifiers, processing counts, and cryptographic fingerprints. These records remain restricted and linked to the case; they are not anonymous. Historical event records containing bill details are redacted as part of case erasure.

Encrypted backups follow their controlled retention schedule. Before restored data can become available, we apply deletion records again so a restore does not republish erased health information.

8. Your choices and deletion rights

You can:

• Access your cases from your account and change your password through the

password-reset process.

• Close a case from its case controls.
• Withdraw consent from the case controls at any time. This immediately blocks

further processing and new checkout; it does not automatically erase existing records. Use deletion if you also want those records erased.

• Delete a case or your account from the relevant controls after confirming

your current password. For a Google-only account, complete fresh Google reauthentication instead. An accepted request immediately revokes access and queues erasure, subject to the necessary accounting and deletion records described above.

For assistance or another privacy request, email [email protected] from your account address. Do not attach medical documents or send passwords. We verify requests before acting. A case reference or an email supplied by a requester does not prove ownership. Legacy anonymous-case recovery requires independent ownership verification by authorized support staff; there is no public claim link. We respond within applicable legal timeframes and do not discriminate against you for exercising privacy rights.

9. Washington My Health My Data Act — consumer health data

Because we process health information, we apply the standards of the Washington My Health My Data Act (MHMDA) to all users, regardless of where you live:

• Consent. We collect and process the consumer health data in your uploaded

documents only with your separate, affirmative, unbundled consent, obtained at upload (see our Consumer Health Data Consent), and we use it only for the purposes you consented to.

• No sale. We do not sell your consumer health data, and we will not,

without the separate valid authorization the Act requires (which we do not seek).

• Your rights. You have the right to confirm whether we are processing your

consumer health data, to access it, to withdraw consent, and to have it deleted. Use the account controls described above or email [email protected] for verified assistance.

• Authorized agents. You may designate an authorized agent to make a

consumer-health-data request on your behalf; we will require proof of your authorization before acting.

• Access controls. We restrict access to consumer health data to the people and

processes that need it to provide the Service.

10. California (CCPA/CPRA) rights

If you are a California resident, you have the right to: know/access the personal information we collect and how we use and disclose it; delete your personal information; correct inaccurate personal information; and opt out of sale/sharing and of targeted advertising. We do not sell your personal information. The Meta Pixel on our public marketing pages involves "sharing" under California law (cross-context behavioral advertising): if you opt out, we will stop loading the pixel in your browser; you can also opt out directly via https://www.facebook.com/settings?tab=facebook_pixel or your browser's Global Privacy Control setting. We do not use or disclose sensitive personal information (including health information) for advertising purposes beyond the purposes permitted without a right to limit, and no sensitive or health information is ever sent to advertising pixels. We will not discriminate against you for exercising these rights. To exercise them, email [email protected]; you may use an authorized agent, and you may appeal a denial by replying to our response.

11. Florida Digital Bill of Rights

If you are a Florida resident covered by the Florida Digital Bill of Rights, you have the right to confirm and access your personal data, correct it, delete it, obtain a portable copy, and opt out of the sale of personal data and of targeted advertising and profiling. We do not sell your personal data. As described in Sections 4 and 10, the Meta Pixel on our public marketing pages involves advertising-related sharing; you may opt out by email or through the choices listed in Section 10, and no health or case information is ever sent to advertising pixels. To exercise these rights, email [email protected].

12. Breach notification

We maintain safeguards to protect your information, but if a breach of unsecured, individually identifiable health information does occur, we commit to notifying affected users (and, where applicable, the U.S. Federal Trade Commission and the media) consistent with the FTC Health Breach Notification Rule — including notifying affected individuals without unreasonable delay and no later than 60 calendar days after discovery of the breach. Our internal breach-response process follows those timelines.

13. Children

The Service is for adults (18+) and is not directed to children. We do not knowingly collect personal information from children under 13. If you believe a child provided us information, email [email protected] and we will delete it.

14. Changes to this policy

We may update this policy prospectively. Material changes will be reflected in the version and effective date above and, where appropriate, communicated to you.

15. Contact us

VUGA Enterprises LLC 18117 Biscayne Blvd unit 1039, Aventura, FL 33160 Email: [email protected]

Related documents: Terms of Service · Refund Policy · UPL Disclaimer · Consumer Health Data Consent