Privacy Policy

AppealWin is operated by Autonomous Labs (the "Service", "we", "us"). We provide a software tool that helps behavioral-health therapists generate insurance-appeal letters. Contact: support@appealwin.app.

• Your appeal-letter inputs never leave our private infrastructure. AI inference runs locally on a Mac in our office. We do not send your data to OpenAI, Anthropic, Google, or any other third-party LLM.
• We collect the minimum needed to provide the service: your email (via Clerk), your subscription state (via Stripe), and the structured denial details you type into the form.
• We strongly encourage you to use the placeholder fields ([PATIENT NAME],[MEMBER ID]) we generate, and to fill in patient-identifying information in your billing system rather than in AppealWin. The product is designed to produce a great letter from fully scrubbed inputs.
• We do not currently have a HIPAA Business Associate Agreement (BAA) in place. Until we do, please use professional judgment about what details you paste into the form.

From you, directly

• Account email and (optionally) name (via Clerk authentication)
• Practice information you save in /app/settings: provider name, credentials, NPI, practice name, address, phone
• Per-appeal inputs you submit to the generator: payer, denial code, CPT code, state, diagnosis, clinical context, prior-treatment notes
• Optional ERA/EOB files you upload (parsed in your browser)
• Outcomes you record after sending an appeal (overturned, partial, upheld, no response)
• Support-chat messages and thumbs ratings, if you use the in-product chat

Automatically

• Sign-in events and session cookies (via Clerk)
• Subscription / billing state (via Stripe — we never see your card number)
• Page views, clicks, and other product-analytics events via PostHog and Vercel Analytics — see "Analytics and session replay" below for what that includes and the choices you have.
• Server logs containing request timing, status codes, and error stacks (no message bodies)

We use PostHog, a US-based product-analytics processor, to understand how the product is used and to find and fix problems. PostHog is a third-party service provider; we do not currently have a HIPAA Business Associate Agreement (BAA) with PostHog (see Section 7, PHI and HIPAA).

What runs, and where

• On marketing, guide, glossary, pricing, and other public pages: page views, clicks, heatmaps, and error monitoring, plus session replay — a visual playback of on-screen activity during a visit. Replay on these pages masks every form field.
• On the signed-in product (/app), the admin dashboard, and the sign-in / sign-up pages: page views and error monitoring run (click-level and heatmap capture are off here); session replay is off entirely.
• For patient-audience visitors (anyone who arrives through a patient-oriented link, or who identifies as a patient or caregiver in the product), we do not run analytics capture of any kind — no page views, clicks, or replay — until we add a dedicated consent flow for that audience. See the Washington note below. We keep an anonymous running count of patient appeal purchases; it is not linked to any individual account, device, or location.

What we don't send

• Appeal-letter content, diagnosis and clinical notes, member/claim/patient identifiers, and any free-text field you type into the product are excluded from analytics events by category — not just visually masked. Where session replay does run (public pages only), it additionally masks every form input and any element we've tagged as containing health-related information.
• Error reports keep the error type and the file/line where it happened, and drop the free-text error message before it's sent — error messages can sometimes echo back content you typed.

Cookies, local storage, and your choices

Analytics uses cookies and browser localStorage to recognize repeat visits within a session. Requests are routed through /relay, a path on our own domain, rather than sent directly to PostHog's servers.

We honor the Global Privacy Control browser signal: if your browser sends it, we turn off analytics capture automatically. You can also turn analytics off yourself at any time — see Your Privacy Choices below. Neither choice affects your ability to sign in or use AppealWin.

Washington residents: Washington's My Health My Data Act treats the fact that someone is using a mental-health appeal service as consumer health data. Consistent with that, we do not run analytics capture at all for patient-audience visitors, as described above, unless and until we add an affirmative consent flow for that surface.

We do not sell analytics data.

AppealWin uses a small number of narrowly-scoped third-party services. Each handles a specific category of data:

A small amount of operational state lives in your browser's localStorage so the product works fast and offline-tolerant: form drafts, history, outcome records, support-chat history. You can clear this at any time via Settings → Clear local data.

• We don't train AI models on your data. The local Qwen model is a fixed open-source checkpoint; nothing you submit changes its weights.
• We don't sell, rent, or share your data with advertisers or data brokers.
• We don't use cookies for advertising or retargeting. We use Clerk auth, Vercel Analytics, and PostHog (see Section 4) for page views and basic product events like CTA clicks, generation-success status, output-button actions, quota-upgrade clicks, and checkout-session status. Those events use operational metadata only (route/source/action, counts, and buckets), not appeal-letter content, patient/member identifiers, claim numbers, emails, or free-text clinical details.
• We don't scan, mine, or otherwise look at your appeal contents for any purpose other than generating the letter you asked for.

AppealWin is a tool used by therapists. The therapist is the HIPAA-covered entity, not us. We do not currently sign Business Associate Agreements (BAAs).

The product is designed so that you can produce excellent appeal letters without ever entering Protected Health Information (PHI). The generator emits ALL-CAPS placeholders for patient name, member ID, claim number, and date of birth. Fill those in inside your billing system after copy-paste.

The in-product support chat enforces a stronger rule: it will refuse to discuss any PHI you paste into it, and we run server-side redaction on SSN-shaped and 12+ digit identifier strings as a backstop. Use professional judgment.

• Account data: for the life of your account; deleted ~30 days after you cancel
• Subscription billing records: 7 years (US tax law)
• Server logs: 30 days
• Local-machine inference: in-memory only, never written to disk
• Support-chat conversations: 7 days in your browser, up to 12 most recent messages mirrored to Clerk metadata for cross-device continuity
• Outcome records: in your browser indefinitely, last ~30 records mirrored to Clerk metadata for the weekly digest

You can request access to, correction of, or deletion of your data at any time by emailing support@appealwin.app. If you're an EU/UK resident, GDPR rights apply. If you're a California resident, CCPA rights apply. We respond within 30 days.

• HTTPS everywhere (Vercel + Cloudflare TLS)
• Authentication via Clerk (industry-standard session cookies + 2FA available)
• API access to our backend is gated by a Bearer token
• Email transactional sender is DKIM- and SPF-signed for the appealwin.app domain
• The local inference machine is in a residential office, single-user, full-disk encryption

No system is perfect. If you discover a security issue, please email support@appealwin.app. We'll respond within 24 hours.

AppealWin is a B2B tool for licensed therapists. We do not knowingly collect data from anyone under 18, and the product is not directed at minors.

When we make material changes, we'll notify you via the in-product banner and the email address on your account at least 14 days before the change takes effect.

Questions? Email support@appealwin.app. We respond personally — there's no help-desk script behind this address.