Last updated: May 27, 2026
MedBill ("we," "our," "us") operates the MedBill platform at medbill-auditor.pages.dev. We provide automated medical bill auditing services to consumers and healthcare practices.
Data Controller: MedBill Inc. For privacy inquiries, contact privacy@medbill.ai.
We collect only the information necessary to provide our audit service:
| Purpose | Legal Basis | Data Used |
|---|---|---|
| Medical bill audit (core service) | Performance of contract / Consent | Full medical bill data (PHI) |
| Report delivery (email) | Performance of contract | Email address |
| Payment processing | Performance of contract | Payment data (via Stripe) |
| Service improvement & analytics | Legitimate interest | Aggregated, de-identified usage data |
| Legal compliance | Legal obligation | As required by law |
Medical bills and EOBs contain Protected Health Information (PHI) as defined by HIPAA (Health Insurance Portability and Accountability Act). We handle PHI with the following safeguards:
When serving healthcare providers and medical practices (B2B), MedBill acts as a HIPAA Business Associate. We enter into Business Associate Agreements (BAAs) with covered entities upon request.
For direct-to-consumer services, MedBill is not a HIPAA-covered entity. We process PHI solely to perform the billing audit service you request. We comply with applicable state privacy laws and industry best practices for PHI protection.
| Data Type | Retention Period | Reason |
|---|---|---|
| Source bill files (uploaded PDFs/images) | Deleted within 24 hours of audit completion | Minimize PHI exposure |
| Audit report (findings, dispute letter) | 30 days available via shareable link | Allow user access + dispute processing |
| Email address + job metadata | 7 years (pseudonymized) | Legal compliance + service records |
| Payment records | As required by tax law (typically 7 years) | Tax and financial compliance |
| Analytics data | 26 months (aggregated, de-identified) | Service improvement |
You may request earlier deletion of your data at any time by emailing privacy@medbill.ai. We will delete all identifiable data within 14 days of verified request.
We never sell your personal information or PHI. We share data only in these limited circumstances:
Depending on your jurisdiction, you have the following rights regarding your data:
| Right | Description |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Rectification | Correct inaccurate or incomplete data |
| Deletion (Right to be Forgotten) | Request deletion of your data (we will delete within 14 days) |
| Restriction | Limit how we process your data |
| Portability | Receive your data in a machine-readable format |
| Objection | Object to processing based on legitimate interests |
| Withdraw Consent | Withdraw consent at any time (does not affect prior processing) |
To exercise any right, email privacy@medbill.ai. We will respond within 30 days (or as required by applicable law).
We use essential cookies for site operation and optional analytics cookies. You can manage preferences at any time. See our full Cookie Policy.
MedBill implements industry-standard security measures:
MedBill is not directed at individuals under 18. We do not knowingly collect information from children. If we discover a child has provided us with personal data, we will delete it immediately.
MedBill is based in the United States and processes data in US-based and EU-based cloud infrastructure. If you are accessing our service from the European Economic Area (EEA), United Kingdom, or other regions with data protection laws, your data may be transferred to and processed in the United States. We rely on Standard Contractual Clauses (SCCs) and Data Processing Addenda (DPAs) as appropriate transfer mechanisms.
Our website may contain links to third-party sites (e.g., Stripe, CMS.gov). We are not responsible for their privacy practices. We encourage you to review their privacy policies.
We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be notified via email (if you provided one) or a notice on our website. The "Last updated" date at the top of this page indicates when the policy was last revised.
For privacy-related inquiries, data subject requests, or to report a concern:
This Privacy Policy is governed by the laws of the State of Delaware, United States, without regard to its conflict of laws principles. By using MedBill, you consent to the data practices described in this policy.