Privacy Policy

AppealWin is operated by Autonomous Labs (the "Service", "we", "us"). We provide a software tool that helps behavioral-health therapists generate insurance-appeal letters for their patients, and helps individual patients or health plan members generate an appeal of their own denial. Contact: support@appealwin.app.

• AI inference runs on our own hardware — we never send your inputs to OpenAI, Anthropic, Google, or any other third-party LLM. Your appeal inputs and generated letters are stored in our hosted database (Neon) so you can return to them (see Section 5 for what each provider sees and Section 8 for how long we keep it). We do not yet have a HIPAA BAA with that provider.
• We collect the minimum needed to provide the service: your email (via Clerk), your subscription state (via Stripe), and the structured denial details you type into the form.
• We strongly encourage you to use the placeholder fields ([PATIENT NAME],[MEMBER ID]) we generate, and to fill in patient-identifying information in your billing system rather than in AppealWin. The product is designed to produce a great letter from fully scrubbed inputs.
• We do not currently have a HIPAA Business Associate Agreement (BAA) in place. Until we do, please use professional judgment about what details you paste into the form.

From you, directly

• Account email and (optionally) name (via Clerk authentication)
• Practice information you save in /app/settings: provider name, credentials, NPI, practice name, address, phone
• Per-appeal inputs you submit to the generator: payer, denial code, CPT code, state, diagnosis, clinical context, prior-treatment notes
• Optional ERA/EOB files you upload — sent to our backend for parsing (not processed in your browser); patient-name fields are stripped out server-side before the extracted result is shown to you, other identifiers in the file (e.g. member ID, claim number) are not
• Outcomes you record after sending an appeal (overturned, partial, upheld, no response)
• Support-chat messages and thumbs ratings, if you use the in-product chat

Automatically

• Sign-in events and session cookies (via Clerk)
• Subscription / billing state (via Stripe — we never see your card number)
• Page views, clicks, and other product-analytics events via PostHog and Vercel Analytics — see "Analytics and session replay" below for what that includes and the choices you have.
• Server logs containing request timing, status codes, and error stacks (no message bodies)

We use PostHog, a US-based product-analytics processor, to understand how the product is used and to find and fix problems. PostHog is a third-party service provider; we do not currently have a HIPAA Business Associate Agreement (BAA) with PostHog (see Section 7, PHI and HIPAA).

What runs, and where

• On marketing, guide, glossary, pricing, and other public pages: page views, clicks, heatmaps, and error monitoring, plus session replay — a visual playback of on-screen activity during a visit. Replay on these pages masks every form field.
• On the signed-in product (/app), the admin dashboard, and the sign-in / sign-up pages: page views and error monitoring run (click-level and heatmap capture are off here); session replay is off entirely.
• For patient-audience visitors (anyone who arrives through a patient-oriented link, or who identifies as a patient or caregiver in the product), we do not run analytics capture of any kind — no page views, clicks, or replay — until we add a dedicated consent flow for that audience. See the Washington note below. We keep an anonymous running count of patient appeal purchases; it is not linked to any individual account, device, or location.

What we don't send

• Appeal-letter content, diagnosis and clinical notes, member/claim/patient identifiers, and any free-text field you type into the product are excluded from analytics events by category — not just visually masked. Where session replay does run (public pages only), it additionally masks every form input and any element we've tagged as containing health-related information.
• Error reports keep the error type and the file/line where it happened, and drop the free-text error message before it's sent — error messages can sometimes echo back content you typed.

Cookies, local storage, and your choices

Analytics uses cookies and browser localStorage to recognize repeat visits within a session. Requests are routed through /relay, a path on our own domain, rather than sent directly to PostHog's servers.

We also set a first-party cookie, aw_audience, when you answer the patient/therapist question on our homepage, or when you arrive through a link that already specifies your audience (for example, a link containing?audience=patient). It stores only the word “patient” or “therapist” for up to 12 months, is read by our own servers to route you correctly on return visits, and is what triggers the zero-analytics-capture rule for patient-audience visitors described above. We never send its value to PostHog, Vercel Analytics, or any other third party.

We honor the Global Privacy Control browser signal: if your browser sends it, we turn off analytics capture automatically. You can also turn analytics off yourself at any time — see Your Privacy Choices below. Neither choice affects your ability to sign in or use AppealWin.

Washington residents: Washington's My Health My Data Act treats the fact that someone is using a mental-health appeal service as consumer health data. Consistent with that, we do not run analytics capture at all for patient-audience visitors, as described above, unless and until we add an affirmative consent flow for that surface.

We do not sell analytics data.

AppealWin uses a small number of narrowly-scoped third-party services. Each handles a specific category of data:

Operational state lives in your browser's localStorage so the product works fast and offline-tolerant: form drafts, your appeal history, outcome records, practice-profile fields, and support-chat history. When you generate a letter it is saved to your browser in full, together with the form details you entered. History restored from your account after signing in holds only the summary fields (payer, denial and procedure codes, state, and generation date) — the letter itself is fetched from the server one at a time when you open it. Signing out erases all of this from the device; it is restored from your account when you sign back in. There is currently no on-demand control to clear the local cache without signing out. To delete your account data, email support@appealwin.app (see Section 9).

• We don't use your letter text to train AI models. The local Qwen model is a fixed open-source checkpoint; nothing you submit changes its weights.
• We don't sell, rent, or share your data with advertisers or data brokers.
• We don't use cookies for advertising or retargeting. We use Clerk auth, Vercel Analytics, and PostHog (see Section 4) for page views and basic product events like CTA clicks, generation-success status, output-button actions, quota-upgrade clicks, and checkout-session status. Those events use operational metadata only (route/source/action, counts, and buckets), not appeal-letter content, patient/member identifiers, claim numbers, emails, or free-text clinical details.
• We don't scan, mine, or otherwise look at your appeal contents for any purpose other than generating the letter you asked for.

AppealWin is a tool used by therapists. The therapist is the HIPAA-covered entity, not us. We do not currently sign Business Associate Agreements (BAAs).

When you sign up and use AppealWin as a patient appealing your own denial — not through a therapist's account — there is no HIPAA-covered entity in that relationship, so HIPAA's BAA framework does not apply to that data at all. Our handling of it instead falls under the FTC Health Breach Notification Rule and, for Washington residents, the state My Health My Data Act (RCW 19.373). See Section 4 for what that means for you today: we do not run analytics capture of any kind on patient-audience traffic.

The product is designed so that you can produce excellent appeal letters without ever entering Protected Health Information (PHI). The generator emits ALL-CAPS placeholders for patient name, member ID, claim number, and date of birth. Fill those in inside your billing system after copy-paste.

The in-product support chat enforces a stronger rule: it will refuse to discuss any PHI you paste into it, and we run server-side redaction on SSN-shaped and 12+ digit identifier strings as a backstop. Use professional judgment.

• Account data: for the life of your account; deleted ~30 days after you cancel
• Subscription billing records: 7 years (US tax law)
• Server logs: 30 days
• Local-machine generation records: letter text and clinical free-text are not written to disk. A per-generation quality record (codes, payer, state, lengths, timestamps, account ID) is retained for up to 12 months.
• Generated appeal letters and their form inputs: stored in your account so your history survives signing out. Retained for the life of your account and deleted approximately 30 days after you cancel, or sooner on request via support@appealwin.app.
• Email delivery log: recipient address, send status, and a generic subject line, retained 12 months. Subjects never contain payer names, claim numbers, or letter content.
• Support-chat conversations: 7 days in your browser, up to 12 most recent messages mirrored to Clerk metadata for cross-device continuity
• Outcome records: in your browser indefinitely, last ~30 records mirrored to Clerk metadata for the weekly digest

You can request access to, correction of, or deletion of your data at any time by emailing support@appealwin.app. If you're an EU/UK resident, GDPR rights apply. If you're a California resident, CCPA rights apply. We respond within 30 days.

• HTTPS everywhere (Vercel + Cloudflare TLS)
• Authentication via Clerk (industry-standard session cookies + 2FA available)
• API access to our backend is gated by a Bearer token
• Email transactional sender is DKIM- and SPF-signed for the appealwin.app domain
• The local inference machine is in a residential office, single-user, full-disk encryption

No system is perfect. If you discover a security issue, please email support@appealwin.app. We'll respond within 24 hours.

AppealWin is for licensed therapists appealing on behalf of their patients, and for individual patients or health plan members appealing a denial of their own claim. We do not knowingly collect data from anyone under 18, and the product is not directed at minors.

When we make material changes, we'll notify you via the in-product banner and the email address on your account at least 14 days before the change takes effect.

Questions? Email support@appealwin.app. We respond personally — there's no help-desk script behind this address.