Is my information private

Short version: your intake data, the AI draft, and the PDF stay yours. We never sell any of it. This article walks through what we store, what we do not, and who can see it.

What we store

• The intake form fields (member ID, denial code, insurer, plan year, your narrative)
• The generated appeal letter text
• The PDF of your appeal packet
• The Stripe payment record (a session ID and a status flag, not your card number)
• A cost log used to price and improve the product (input and output token counts, no PHI)

Where it lives

• Structured data lives in an encrypted Cloudflare D1 database in Cloudflare's US region
• PDF files live in Cloudflare R2 object storage, also US region, encrypted at rest
• Payment records live at Stripe, subject to Stripe's own compliance program

What we do not store

• Your credit card number (Stripe handles that; we never see it)
• Your Social Security number (the intake form does not ask for it)
• Your medical records beyond what you paste in the narrative
• Any account password (we do not use accounts)

HIPAA

Basis Appeals is a document assistant that you, the patient or authorized representative, use to draft a letter. In most consumer use, we are not a "covered entity" or "business associate" under HIPAA because you are handing us your own information to help you write a letter about your own care. That said:

• If you are an HR admin or provider using this for someone else, and your context is HIPAA-covered, treat the intake data accordingly
• We do not disclose intake data outside our own systems, aside from the LLM inference call needed to draft the letter
• The LLM provider we use processes intake data for the sole purpose of returning the draft, does not train on it, and does not retain it beyond the API call retention window

Who can see it

• You, through the download link
• Our operations, when a customer emails support asking about their order (we look up the appeal ID)
• Nobody else

We do not share intake data with insurance companies, employers, marketing partners, data brokers, or law firms.

What you can ask us to do

• Send you a copy of everything we hold about your appeal (email support with your appeal ID)
• Delete everything we hold about your appeal (email support with your appeal ID and the word "delete"; we confirm within two business days)
• Correct anything that is wrong (see My letter has a typo)

Payment privacy

Stripe handles payment. We receive:

• A session ID
• The last four digits of your card (for reconciliation only)
• Your email if you provided one
• A country and postal code (Stripe uses these for fraud detection)

We never see the full card number or CVC. We do not use your email for marketing unless you check a specific "Send me tips" box.

No tracking pixels

• No Facebook pixel
• No Google Analytics on the checkout or download pages
• The public marketing pages use a first-party analytics setup that does not attach cookies

Questions

Email support with any question, including "please delete everything." We answer within two business days.