Privacy Policy

The short version: your denial is your business. This site is built to minimize collection, keep the appeal builder local-first, and make the optional workspace’s encryption choices explicit.

Anonymous and local-first by default. The public research tools, denial explainer, appeal builder, and local workspace can be used without an account. Wizard answers are saved in your browser (localStorage), not in a Coverage Rights database. You can clear them from the product or by clearing this site’s browser storage.

What rides with your payment. When you check out, only your structured routing selections — plan/program, insurer, regulating state, denial category, employer and funding type, drug benefit channel, regulator marker and source, appeal stage, current care status, expedited flag, and any filing deadline you enter — are included in the secure Stripe checkout session, so we can recover your purchase if your browser loses its data. Medical narrative, records, and the generated letter are not attached to the payment.

The sensitive details you type stay with you. The specific service that was denied, your prior treatment history, whether your doctor supports the treatment, and your personal impact statement stay in your browser and are sent only to generate your letter. They are never attached to your payment. Coverage Rights processes the generation request in memory and does not persist the generated letter on its servers.

Denial text, letter generation, and AI processing. If you paste denial-letter text for automatic reading, that text is sent to our AI provider, Anthropic, for the request. If you buy and generate an appeal, the private narrative you enter and the sourced route context are also sent to Anthropic to draft the letter. Coverage Rights processes the responses in memory and does not persist the pasted text or generated letter on its servers. If automatic reading is unavailable, pasted text does not leave the page. Review Anthropic’s service terms for its role as the processing provider.

Optional workspace sync. An anonymous workspace stays in the local browser. If you sign in and turn on sync, the matter is copied to Coverage Rights in encrypted form so it can be opened on another device. In Standard mode, Coverage Rights holds the key needed to reopen the matter and can technically decrypt it to operate the service. In Extra-private mode, the key comes from a passphrase that Coverage Rights does not receive or retain; we cannot read or recover that matter if the passphrase is lost.

Appeal workspace attachments stay on this device. Document attachment is live today. File bytes are encrypted in the browser and stored in that browser’s IndexedDB; filenames and related metadata are also encrypted locally. Attached files are not uploaded or included in workspace sync. Clearing browser storage or losing the device can remove the only copy, so keep the originals elsewhere.

What we do keep. We use Google Analytics on our public content pages for aggregate traffic (which denial reasons and plan types people look up) so we know what to build next. Google sets a cookie and processes your IP address and the public page URL, so this is pseudonymous rather than fully anonymous. We deliberately do not load Google Analytics on the appeal builder, letter page, or private workspace, and we switch Google Analytics collection off for as long as you are on those pages, so the details you enter there are not exposed to that script. We do not send names, diagnoses, document contents, or generated letter text to analytics. If your browser sends Global Privacy Control or Do Not Track, we do not load Google Analytics at all.

First-party step counts. We record generic steps such as opening a route result, downloading a package, or saving workspace progress in our operational logs. These events contain no form values, medical details, page URLs, account identifiers, email, or purchase tokens. The browser sends them without cookies or a referrer and honors Do Not Track and Global Privacy Control. They are counts of actions, not a record of an individual’s journey. Our hosting provider, Vercel, processes ordinary network metadata, such as IP addresses, and sends its request logs to our log-monitoring provider, Axiom, where they are kept for up to 30 days.

Limited error reports. We use error reports to find and fix failures, including on private pages. Reports contain the error type, page category, and app version, but no account identifiers, entered facts, filenames, or file contents. They do not include error messages or full page addresses. Hosting providers may separately process ordinary request metadata, such as IP addresses.

AI assistant connector. Coverage Rights offers free, read-only tools that AI assistants such as Claude can use at https://www.coverage-rights.com/api/mcp (setup on the MCP page). No account is needed, and the tools cannot reach your appeal workspace, attachments, or purchases. When an assistant uses a tool, we receive the tool name and the details it sends, such as an insurer, treatment, condition, coverage program, denial category, or state, and, for the knee-injection checklist, which kinds of records are available. The tools don’t need your name, member ID, denial-letter text, or medical records, so please keep questions general. We use these details only to answer that request from our published datasets. We do not store them or send them to anyone else. We keep daily counts of how often each tool is called and whether the call worked, with no request details, IP addresses, or identifiers, and delete counts older than 90 days. Vercel’s request logs, described above, cover these requests too; they do not contain the details a tool request carries. We do not sell connector requests or use them for advertising. Your AI assistant’s provider handles your conversation under its own privacy policy.

Follow-up and submission notes. These are part of your encrypted workspace matter and follow its existing local-storage and optional-sync choices. A calendar download contains a generic reminder title and the date you chose or confirmed, without medical details. Importing it shares that reminder with your chosen calendar provider. A readable progress download can contain your private notes; store it safely. Coverage Rights does not send automatic reminders from these dates.

Payments. Stripe processes payments; we never see your card number. Payment records are kept as required for accounting and refunds.

Sign-in, accounts, and where account data lives. Our database provider is Supabase. If you request an email sign-in link, your email address is stored there with a single-use, short-lived sign-in token (the token itself only as a hash), and your signed-in session cookie contains your email address. Synced workspace matters and their key records are stored in Supabase in the encrypted form described above, under an account identifier rather than your email address. When you buy a package, Supabase also holds the purchase record: the Stripe checkout and payment references, the package purchased, the routing selections that ride with your payment, the email address you gave at checkout, and whether the delivery email was sent. The daily AI-connector tool counts described above are kept there too.

Email delivery. We send email through Resend: sign-in links, route summaries you request, and the purchase email that links to your package. Resend receives your address and the message content to deliver it.

Email. If you request a route summary, its email contains the coverage program and route, denial category, insurer if selected, deadline, filing recipient, appeal grounds, and public source links. It does not include your medical narrative, diagnosis, denied-service description, records, or generated letter. We use your address for the requested message and any reminders you explicitly choose. Unsubscribe anytime.

Questions or deletion requests: privacy@coverage-rights.com

EFFECTIVE JULY 2026 · LAST UPDATED NOVEMBER 14, 2026