What we collect
When you start a medical bill review, we collect information you provide directly: your name, contact information, details about the bill and provider, and any documents you upload (bills, Explanations of Benefits, itemized statements, denial letters, and related correspondence). These documents may contain protected health information (PHI) and other sensitive personal information.
How we use it
We use this information only to perform the assessment you requested: reviewing your documents, producing a written report, and communicating with you about your case. We do not use your information for advertising, and we do not sell it.
Where it's stored
Case information and documents are stored in an access-controlled database and private file storage, encrypted in transit and at rest. Only RomiCare personnel working on your case, and the limited service providers described below, can access it.
Who else sees it
- Payment processing: handled by Stripe. Stripe receives payment details, not your medical documents or bill details.
- AI-assisted review: portions of your documents may be processed by a third-party AI provider (Anthropic) as part of producing a first-pass assessment for our team to review. This processing happens under that provider's commercial API terms.
- Email delivery: we use a transactional email provider (Resend) to send you status notifications. We do not include sensitive bill or medical details in these emails.
- Analytics: we use product analytics (PostHog) on our public marketing pages only. Pages that collect or display your case information are excluded from analytics and session recording entirely.
We do not currently claim HIPAA-covered-entity or business-associate status; see our Terms for how RomiCare is described. [DRAFT — legal counsel to confirm accurate framing.]
How long we keep it
We retain case information and documents for [DRAFT — retention period to be finalized, e.g. a fixed period after case closure] to allow you to access your report and for our own recordkeeping and legal-compliance needs, after which documents are deleted. You can request earlier deletion by contacting us, subject to any legal retention requirements.
Your choices
You can request a copy of your case information, ask us to correct it, or ask us to delete it (subject to legal retention requirements) by contacting us.
Changes to this policy
We'll update this page if our practices change and note the date of the most recent revision.