Consumer Health Data Privacy Policy

This Consumer Health Data Privacy Policy describes how Westenders LLC, doing business as TestMyBill ("TestMyBill," "we," "our," or "us"), collects, uses, and protects consumer health data submitted by patients and their authorized representatives, including as required by the Washington My Health My Data Act and similar state consumer health data laws. It supplements our general Privacy Policy; where this policy addresses consumer health data, this policy controls.

We collect the following categories of consumer health data, only when you choose to provide them:

Medical billing documents. Bills, statements, and related billing documents you upload (as PDFs or photos), which may include provider names, dates of service, billed services and procedure codes, charges, insurance payments and adjustments, account numbers, and patient names.

Billing information you enter. The same categories of information when you type them in manually, and your answers to our questionnaire (for example, a description of a suspected billing error, a financial hardship description, or an insurance denial reason).

Information extracted from your documents. Structured billing data our software extracts from what you upload, used solely to prepare your documents.

We do not collect biometric data or precise location data, and we do not infer health data from your browsing or from non-health information.

We collect and process consumer health data for exactly one purpose: to provide the service you request — reviewing your bill, flagging possible issues for your review, and generating your requested letter and phone script. Collection and processing are limited to what is necessary to provide that service.

We do not use consumer health data for advertising, marketing, profiling, model training, or any secondary purpose. Our anonymized billing-trends research is separate, strictly opt-in, and described in Section 5a of our Privacy Policy.

We collect consumer health data from one source: you. Either directly from the documents you upload or from the information you type into our forms. We do not purchase, license, or otherwise acquire consumer health data from any third party.

We do not sell consumer health data. We have never sold consumer health data and will not do so.

We do not share consumer health data with third parties for their own purposes. Your data is handled only by service providers acting on our behalf, under contract, to deliver the service you requested:

— Microsoft Azure OpenAI Service (document analysis and letter generation, under a Business Associate Agreement, with no data retention for model training);
— Supabase (temporary encrypted storage, under a Business Associate Agreement);
— Vercel (application hosting).

Stripe (payments), Resend (email delivery), and Sentry (error monitoring) support the service but are deliberately kept outside the consumer health data flow: Stripe receives only payment information, delivery emails contain secure download links rather than your documents, and error reports are scrubbed of document contents before transmission.

Your uploaded documents, extracted billing data, and generated letters are automatically and permanently deleted within 24 hours of service. An automated deletion process runs continuously and is monitored. Payment transaction records (which contain no health data) are retained as required for tax and accounting purposes.

You have the right to:

— Access the consumer health data we hold about you;
— Withdraw consent for our collection or processing of your consumer health data;
— Delete your consumer health data (note that our standard process deletes it automatically within 24 hours regardless).

To exercise any of these rights, email hello@testmybill.com. Because we use anonymous sessions rather than accounts, please include the approximate date and time of your session so we can locate any data that has not yet been automatically deleted. We will respond within the time required by applicable law.

Appeals. If we decline a request, you may appeal by replying to our response with the word "Appeal" in the subject line. If your appeal is unsuccessful and you are a Washington resident, you may contact the Washington State Attorney General at atg.wa.gov/file-complaint.

Westenders LLC (doing business as TestMyBill)

Email: hello@testmybill.com