Terms & Privacy Changelog

We now accept de-identified claim-line data. Customers may choose to send service-line billing data with all HIPAA Safe Harbor identifiers removed and dates reduced to the year, so we can compare their actual volumes, allowed amounts and denials with market rates (Terms §§1, 2, 4, 6, 11; Privacy §9). We still do not accept PHI or identifiable claims and do not act as a HIPAA business associate.

Claim-line data is covered by the same aggregate-data protections as other uploads (Terms §8): the k=5 minimum-cohort floor, identity stripping, and your right to opt out of third-party-licensed aggregates. We will never attempt to re-identify anyone from it, and we delete it within 30 days after your account is closed (Terms §12).

Added the in-product opt-out control the aggregate-data clause has promised since the initial release: portal users can now manage aggregate inclusion under Data preferences (in addition to the existing email path). Both documents now reference it.

Clarified the categories of customer content covered by the aggregate clause (Privacy §3.1) to name facts a customer confirms in the portal — volumes entered in the workbench, facility ownership and affiliation declarations, organizational relationships and payer contract-authority designations, and billing-code confirmations — alongside the previously listed uploads. The protections are unchanged: the k=5 minimum-cohort floor, identity stripping, group-statistics-only reporting, state/ CBSA geography, the GDPR opt-in requirement, and the commitment never to license customer-derived aggregates to payers.

Added the billing terms that govern paid plans (Terms §7). We spelled out how each plan is charged: one-time Reports are fully refundable within 30 days of purchase, no reason required; Memberships bill in advance and automatically renew, and you can cancel anytime to stop future renewals (access runs through the period already paid for); Strategy engagements are non-refundable once the work has begun. We also described taxes, failed-payment retries, and a 30-day notice before any recurring price change.

Added an Antitrust and independent-use section (Terms §5) making explicit that the Service informs your own independent decisions and may not be used to coordinate prices or terms with competitors. Added a customer-data representations section (Terms §6) listing the data you must not submit (PHI, claims, executed contracts, card data) and our right to remove it, and an Indemnification section (Terms §11).

Clarified the Privacy Policy: a sourced sub-processor table, explicit US storage locations, the GDPR Standard Contractual Clauses for EEA/UK customers, and the same k=5 minimum-cohort floor and opt-out for aggregated market statistics. No new categories of data are collected; the changes describe existing practice more precisely.

Initial release. Added an aggregate-data-licensing clause covering customer file uploads: cohorts of fewer than five contributing organizations are never released (the “ k=5 floor”), and customers can opt out of aggregate inclusion at any time through their account settings.

This release establishes the baseline for everything that follows. Future entries describe what changed relative to the version directly above.