Privacy Policy

1. Information we collect

• Documents you upload: medical bills, statements, collection notices relating to medical services, and insurance explanations of benefits (EOBs). They may include patient names, addresses, dates of birth, account or insurance numbers, providers, service dates, diagnoses or procedure codes, charges, balances, and payment details.
• Review request details: your first and last name, state, email address, phone number, contact consent, and links to your uploaded files.
• Review records: submission dates, document verification results, review status, and staff notes.
• Website and technical information: referral and campaign parameters, including UTM tags and Google or Meta click identifiers when present in the page address. Hosting and security providers may also process IP addresses, device or browser information, request times, and error records to deliver and protect the site.

Upload only documents you own or have permission to share. Do not send passwords, full payment-card details, or unrelated medical records. You may cover information not needed for billing review, but leave enough billing details visible for the document to be checked.

2. How we use your information

We use information to receive and check uploads, review billing details for possible errors or savings, respond to your request, contact you about your bill, manage your review, maintain records, prevent misuse, troubleshoot the service, and meet applicable legal obligations. Referral information helps us understand how people reach the service.

Submitting a review request does not authorize us to contact a hospital, insurer, or collector on your behalf. We seek any additional permission needed before taking that step. We do not use your uploaded bills as advertising content or sell your uploaded bills.

3. How uploaded bills are stored

Uploaded bills are kept in a private file-storage area on Lovable Cloud. They are not published on the website or available in a public file directory. Your contact details, review status, and verification records are stored separately in the service's database and linked to the uploaded files.

Uploads use temporary authorized upload links. Authorized administrators can generate viewing links that expire after five minutes. Anyone who receives a valid viewing link may be able to open it until it expires, so those links should not be forwarded.

Access controls and temporary links reduce exposure, but no website, transmission, or storage system can be guaranteed completely secure. "Private storage" is not a claim of HIPAA certification or a guarantee that unauthorized access is impossible.

4. Who can see your information

• Authorized Discharge Bills administrators and reviewers: people with administrator access can view submitted contact details, review notes, and bills to handle your request. Merely creating or signing into an account does not give someone access to the review list.
• Service providers: Lovable Cloud and its infrastructure providers process information to host, store, secure, and operate the service. Lovable AI Gateway and the OpenAI model provider process uploaded document contents for the screening described below. These systems need to process data even though bills are not public.
• Providers, insurers, or other billing parties: relevant information may be shared to pursue your review only with appropriate authorization.
• Legal or safety recipients: information may be disclosed when required by law or a valid legal process, or when reasonably necessary to address fraud, security incidents, or protect legal rights. A business transfer may involve records, subject to applicable law and privacy obligations.

5. Automated document screening

Before a file reaches the review list, the service sends its contents through Lovable AI Gateway to an OpenAI model to check whether it contains readable medical billing information. This happens at upload, before you submit the contact form. The check looks for billing evidence and attempts to reject unrelated, unreadable, or suspicious documents.

The screening instructions ask for a classification, not a transcription of personal details. The application stores the document category, verification status, and a digital fingerprint used to detect changes. The AI request is configured not to store the response. That setting is not a promise that every infrastructure log, backup, or provider record is immediately erased.

Automated screening can make mistakes. Acceptance does not establish authenticity, confirm that a charge is wrong, or determine eligibility for savings. Screening is not medical advice or a final decision about your bill.

6. Retention and deletion

There is currently no fixed automatic deletion schedule for submitted bills, contact details, review notes, or verification records. These records may remain stored until they are removed. Uploaded files may remain even if you leave before completing a review request.

The service attempts to remove files rejected by document screening, but cleanup can fail. The expiry of an upload permission or verification window does not itself delete a file. Do not rely on closing the page or an upload error as confirmation of deletion.

You can request deletion using the contact process below. Requests are subject to identity or authority verification and applicable legal requirements. Some records may need to be retained for legal, security, or dispute purposes, and backup copies or third-party records may follow separate retention processes. We do not promise a particular deletion deadline in this policy.

7. Cookies, advertising, and external services

Google Ads and Meta Pixel tracking are currently disabled on this website. Campaign and click identifiers can still be recorded from the page address when you submit a request. We do not send the contents of uploaded bills through advertising conversion events.

The site loads fonts from Google Fonts, which receives the network information needed to serve them. Staff sign-in uses browser storage or cookies for authentication. Hosting providers may use essential technologies to operate and secure the site. If advertising tracking or materially different data uses are introduced, this policy should be updated and any legally required consent obtained first.

8. Your choices and privacy requests

You can choose not to upload, limit the information you share, ask to correct your details, request a copy of your information, or request deletion. Depending on where you live and whether applicable privacy laws cover our business, you may have additional rights to access, correct, delete, restrict certain uses, or appeal a privacy decision. These rights can have exceptions.

The review form asks for permission to contact you by phone, text, and email about your bill, including automated means. You can ask us to stop future contact by replying to a communication you receive. Message and data rates may apply. Withdrawing contact permission does not undo processing that already occurred.

We may need to verify your identity or permission to act for the patient before providing records or carrying out a request. Please do not attach a full bill or sensitive identity document to an initial privacy inquiry.

9. Children and processing location

This service is intended for adults, not for children to submit information themselves. A parent, guardian, or other authorized adult may submit a dependent's bill. Service providers may process information in locations other than your state or country; we do not promise storage in a particular location.

10. Contact and policy updates

Brentwood Health Group, LLC is responsible for this service. Email Info@brentwoodhg.com for privacy questions or access, correction, or deletion requests. Please identify the type of request without attaching a full bill or sensitive identity document to your initial email. You may also reply to a communication from Discharge Bills.

We may update this policy when our practices or legal requirements change. The effective date above identifies this version. Material changes should be communicated as required by law; a policy update does not by itself authorize a new use of information that requires your consent.

For the rules governing use of the service, read our Terms of Service.