Consumer Health Data Privacy Policy

When you upload a medical bill, Explanation of Benefits (EOB), insurance denial, pharmacy denial, or collection notice, that document may reveal information about your health — such as the provider you saw, the services or procedures billed, diagnosis or procedure codes, medications, dates of care, and the amounts charged. We treat this information, and any health-related detail we derive from it when generating your report, as consumer health data.

• Your uploaded documents and the health details in them — collected to read, explain, and analyze your bill or notice and prepare your report and draft letters.
• Health details we derive when our AI explains your document (for example, identifying a service or possible billing issue) — created to produce your report.
• Optional case details you enter — such as your state, insurance status, household size, and income range — used only to personalize financial-assistance and rights information in your report. These are optional.

We collect consumer health data directly from you — from the documents and details you choose to upload or enter. We do not buy health data about you, and we do not collect it from your providers, insurers, or other outside sources.

We collect and process your consumer health data only with your consent, which you give before you upload your first document, and only to provide the service you asked for. You may withdraw your consent at any time (see “Your rights” below); withdrawing consent does not affect processing that already happened.

• To read and explain your document in plain language.
• To identify possible billing or insurance issues to review.
• To prepare your report, draft letters, and next steps.
• To let you re-analyze your case when you add new documents.

We do not use your consumer health data for advertising, and we do not sell it.

We do not sell your consumer health data and we do not share it for anyone else's own purposes. We use a small number of trusted service providers (processors) that handle data only on our instructions, solely to run the service:

• OpenAI — analyzes your document contents through its business API. Under that API, your content is not used to train its models.
• Supabase — authentication, database, and private file storage.
• Stripe — payment processing (does not receive your health documents).
• Vercel — application hosting and delivery.

We may also disclose information if required by law or to protect our rights or the safety of our users. We will not sell or share your consumer health data without the separate, valid authorization the law requires — and we do not intend to sell it at all.

• Documents are stored in private storage that is not publicly accessible.
• Access is restricted to your own account through row-level security.
• Data is encrypted in transit (HTTPS) and at rest by our providers.
• Secret keys are kept server-side and never exposed to your browser.

You may, at any time:

• Access the consumer health data we hold about you and a list of the processors above with whom it is shared.
• Withdraw your consent to further collection and processing.
• Delete your consumer health data. You can delete your account and documents from Account → Privacy & data, or by emailing us. When you delete, we remove your uploaded documents and reports and instruct our processors to do the same. We may keep limited records (such as payment history) where the law allows, for legal, tax, or fraud-prevention purposes.

To exercise any right, use your account settings or email support@mareva.ai. We will not discriminate against you for exercising your rights.

We do not use geofencing to track your location around health facilities or to collect health data based on where you are.

We may update this policy from time to time. When we do, we will change the “Last updated” date above and, where appropriate, ask for your consent again.

Questions or requests about your health data? Email support@mareva.ai.