Draft. This document is under legal review and is not yet in effect. Bracketed items will be completed before launch.
MedsClaim Privacy Policy
Effective date: October 25, 2026
This policy explains how MedsClaim, the operator of medsclaim.com ("MedsClaim," "we," "us") collects, uses, shares, and protects personal information when you use our website, apps, and services (the "Services"). It applies to everyone in the United States who uses the Services, including through a healthcare provider, telehealth company, employer, or other partner.
If you live in Washington, Nevada, or Connecticut, or want detail on how we handle health information specifically, also read our Consumer Health Data Privacy Policy.
The short version
- We collect health and financial information so we can find eligible expenses and get you reimbursed. We use it for that, and to keep the Services secure and working.
- We never sell your personal information. We never use your health information for advertising or share it with advertisers or data brokers.
- We don't run third-party ad trackers. Our analytics are cookieless and never run on pages that show your health information.
- You stay in control. You can disconnect accounts, download your data, or delete it at any time, wherever you live.
- We don't train AI models on your health information, and we don't let our vendors do so.
1. Who handles your information
When you use MedsClaim directly, MedsClaim decides how your information is used, and this policy applies.
When a healthcare provider or health plan offers MedsClaim to you, some information may come to us from that organization. If that organization is covered by HIPAA and we receive your protected health information (PHI) to perform services for it, we act as its business associate. We handle that PHI only as our business associate agreement with that organization and HIPAA allow. That organization's Notice of Privacy Practices also applies.
Information you give us directly, such as records from your email or uploads, is generally not protected by HIPAA. We protect it as described in this policy.
2. What we collect
Information you give us
| Category | Examples |
|---|---|
| Account information | Name, email, phone number, password, date of birth |
| Benefit Account information | Plan administrator, account type (FSA, HSA, HRA), member or employee ID |
| Expense and health information | Receipts, invoices, explanations of benefits, prescription details, provider names, service dates and descriptions, Letters of Medical Necessity (LMNs) |
| Dependent information | Names, relationship, and dates of birth of a spouse or dependents whose expenses you submit |
| Savings estimate inputs | Filing status, income range, or tax bracket, if you choose to get a savings estimate |
| Uploads and photos | Receipt photos and documents you upload, including through your device's camera |
| Communications | Messages to support, survey responses |
| Payment information | Billing details, processed by [PAYMENT PROCESSOR]. We don't store full card numbers. |
We do not ask for your full Social Security number. [IF AN ADMINISTRATOR'S CLAIM FORM REQUIRES ONE: We ask for it only at the moment of submission, use it only for that claim, and do not store it.]
Information from accounts you connect
| Source | What we access |
|---|---|
| Email inbox (Gmail, Outlook, or others) | We search for messages that look like health-related receipts, invoices, or order confirmations, and read only those messages. We store only the details needed for a claim and a copy of the receipt. |
| Pharmacies, retailers, health plans, benefit administrators | Purchase and claim history, receipts, and claim status |
Information from partners. If a partner offers MedsClaim to you, it may send us your name and contact details, eligibility information, and records of care or purchases you made with it.
Information collected automatically
- Device and log information, such as IP address, browser and device type, pages viewed, and error reports. We use this for security, troubleshooting, and performance.
- Aggregated website performance and usage analytics through [Vercel Speed Insights and, if enabled, Vercel Web Analytics], which do not use cookies. [UPDATE THIS LIST AS TOOLS ARE ADDED.]
We do not collect precise geolocation, and we do not use third-party advertising pixels or cookies.
3. How we use it
We use your information to:
- provide the Services, including finding eligible expenses, preparing and submitting claims you authorize, tracking claim status, and arranging LMNs;
- send you service messages, such as eligibility alerts and claim updates;
- give you savings estimates you ask for;
- create, secure, and support your account;
- detect and prevent fraud, abuse, and security incidents;
- improve the Services, using de-identified or aggregated information wherever possible; and
- comply with the law and enforce our Terms.
We send marketing emails only with your consent, and you can unsubscribe at any time. We never use health information to market to you or to anyone else.
Automated processing and AI. We use automated tools, including AI models run by our service providers, to read receipts and identify potentially eligible expenses. Those providers are contractually barred from using your information to train their models or for any other purpose. You can always review an expense before submitting it [UNLESS YOU TURN ON AUTO-SUBMIT]. A human at MedsClaim will review an eligibility result if you ask.
4. Google user data
If you connect a Google account, our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements. Specifically:
- we use Gmail data only to find and process health-expense receipts for you;
- we do not use it for advertising, and we do not sell it;
- we do not let people read it, except with your permission, for security purposes, or as required by law; and
- we do not use it to train general-purpose AI models.
5. How we share it
We share personal information only:
- with your Benefit Account administrator, when you authorize a claim submission;
- with clinicians who review LMN requests, when you ask for one;
- with the partner that offered MedsClaim to you, limited to what our agreement with you and that partner allows (for example, whether you enrolled and whether claims were submitted). [CONFIRM WHAT PARTNERS RECEIVE. DEFAULT TO AGGREGATED, DE-IDENTIFIED REPORTING.]
- with service providers that help us run the Services, such as cloud hosting, data storage, document processing and AI, email and text delivery, customer support, and payment processing. They may use your information only to perform services for us, under written contracts;
- for legal reasons, when required by law, subpoena, or court order, or to protect the rights, safety, or security of our users or others. We'll tell you about a legal demand unless the law prohibits it;
- in a business transfer, such as a merger or acquisition. The new owner must honor this policy, and we'll notify you before your information becomes subject to a different policy; and
- with your consent, for anything else.
We do not sell personal information or share it for cross-context behavioral advertising, and we haven't done so in the past 12 months.
6. How long we keep it
| Information | How long |
|---|---|
| Account information | While your account is open, then deleted within [30] days of closing |
| Claim records and receipts | While your account is open, unless you delete them sooner. You can download them first. |
| Logins and tokens for Connected Accounts | Deleted immediately when you disconnect the account or close your account |
| Email messages that aren't receipts | Not stored |
| Support communications | [2] years |
| Backups | Overwritten on a rolling [35]-day cycle |
| Records we must keep by law | As long as the law requires (for example, payment and tax records) |
IRS rules may require you to keep FSA and HSA records for several years. We recommend downloading your claim records before you close your account.
7. How we protect it
- All data is encrypted in transit (TLS) and at rest.
- Connected Account logins and tokens are stored in a separate encrypted vault and used only to retrieve your records.
- Access to personal information is limited to staff who need it, protected by multi-factor authentication, and logged.
- Our vendors are reviewed for security before we share information with them.
- [SECURITY PROGRAM: e.g., annual third-party penetration test, SOC 2 Type II target date.]
No system is perfectly secure. If a breach affects your information, we'll notify you and the appropriate authorities as required by law, including the FTC Health Breach Notification Rule and HIPAA where they apply.
8. Your rights and choices
Wherever you live in the U.S., you can:
- access and download your information;
- correct inaccurate information;
- delete your information or your account;
- disconnect any Connected Account;
- withdraw consent you've given, such as for email access or text messages; and
- limit our use of sensitive information to what's necessary to provide the Services. This is already our practice.
How to make a request: use the privacy settings in your account, or email support@medsclaim.com. We'll verify your identity by confirming access to your account email. You can use an authorized agent if you give them signed permission. We'll respond within 45 days, and we'll tell you if we need up to 45 more.
Appeals. If we deny your request, you can appeal by replying to our decision or emailing support@medsclaim.com with "Appeal" in the subject line. We'll respond within 60 days. If you disagree with the outcome, you can contact your state attorney general.
We won't treat you differently or charge you more for using your privacy rights.
Global Privacy Control. We honor Global Privacy Control (GPC) signals as a request to opt out of sale and sharing. We don't sell or share personal information anyway, so nothing changes.
9. State-specific information
California. In the past 12 months, we have collected the following categories of personal information, as defined in the California Consumer Privacy Act:
| CCPA category | Collected? | Examples | Disclosed for a business purpose to |
|---|---|---|---|
| Identifiers | Yes | Name, email, phone, IP address, account ID | Service providers, benefit administrators |
| Customer records | Yes | Benefit Account details, billing information | Service providers, benefit administrators |
| Protected characteristics | Yes | Date of birth | Service providers, benefit administrators |
| Commercial information | Yes | Purchase records, receipts, claim history | Service providers, benefit administrators |
| Internet activity | Yes | Pages viewed, interactions with the Services | Service providers |
| Geolocation | Approximate only | Region inferred from IP address | Service providers |
| Audio, visual, or similar | Yes | Receipt photos you upload | Service providers, benefit administrators |
| Professional information | Limited | Employer, if needed for your Benefit Account | Benefit administrators |
| Inferences | Yes | Whether an expense is likely eligible | Not disclosed |
| Sensitive personal information | Yes | Account logins, health information, contents of receipt emails, financial account details | Service providers, benefit administrators, LMN clinicians |
| Biometric, education | No |
We collect this information from the sources and for the purposes described in Sections 2 and 3. We keep it as described in Section 6. We do not sell or share it, and we use sensitive personal information only as needed to provide the Services.
Under California's "Shine the Light" law, we don't disclose personal information to third parties for their direct marketing.
Washington, Nevada, and Connecticut. See our Consumer Health Data Privacy Policy.
Other states. If your state's privacy law gives you additional rights, make your request as described in Section 8 and we'll honor it.
10. Children and dependents
You must be 18 or older to have a MedsClaim account. We don't knowingly collect information directly from children under 13. If you submit expenses for a dependent child, you confirm that you are their parent or legal guardian, and we use the child's information only to process those claims. If you believe a child has created an account, contact support@medsclaim.com and we'll delete it.
11. Changes to this policy
If we make material changes, we'll email you and post a notice in the Services at least 30 days before they take effect. We won't use health information collected under this policy for a new purpose without your consent.
12. Contact us
MedsClaim (medsclaim.com) Attn: Privacy [MAILING ADDRESS] support@medsclaim.com