Consumer Health Data Privacy Policy

This policy supplements our Privacy Policy and applies to "consumer health data" as defined by Washington's My Health My Data Act, Nevada's consumer health data law, Connecticut's privacy law, and similar laws. Where this policy and the Privacy Policy differ, this one controls for health data.

1. The health data we collect

• Health conditions you select or type, including allergies.
• Medications you list, what you pay for them, and their formulary tier.
• Planned procedures and how often you see doctors, specialists, urgent care, or the emergency room.
• What you spent toward your deductible last year and on dental and vision care.
• Height, weight, activity level, and tobacco use.
• Whether you are planning a pregnancy, and the maternity costs you expect, if you tell us.
• Whether you are covered by the VA or enrolled in Medicare or Medicaid.
• Information in documents you upload for analysis (medical bills, Explanations of Benefits, denial letters, plan documents) and the findings extracted from them, such as procedures, provider names, and amounts.
• What you enter in the AI features: questions you ask the Verd Assistant and details you give the Appeal Letter Helper, which may include health information you choose to share.
• Preventive services you mark as used, and expenses, appointments, appeals, and life events you track.

Verd also calculates estimates from your answers, such as your projected yearly healthcare spending and what each kind of plan would likely cost you. We treat these calculated estimates as consumer health data too, and store them with your account. We do not collect precise geolocation, and we do not use geofencing.

2. Why we collect it

Only to provide what you asked for: estimating your year of healthcare costs so each plan can be priced against it, running the dashboard tools you use, and answering your questions. We do not use health data for advertising, and we do not sell or rent it to anyone.

3. Who it is shared with

We never share health data with insurers, brokers, employers, advertisers, or data brokers. The only companies that receive it are the service providers that run Verd, each under contract to use it only to provide its service to us:

• Supabase — our database and sign-in provider, in the United States. It stores the health data in your account.
• Vercel — hosts the website. Chat messages, the text of documents you upload, and contact-form messages pass through its servers in transit, and it keeps short-lived logs of those requests.
• Render — hosts our analysis server. When you use the Assistant, the Bill Checker, or the Appeal Letter Helper, it receives what you type or upload, your plan's cost-sharing figures and what you have spent this year, and a pseudonymous account ID. It holds each session in memory only, for up to about two hours after your last message.
• Anthropic — our AI provider. It receives the same material as Render to generate a response. Its commercial terms prohibit training its models on your data; it may retain inputs and outputs for a limited period for safety and abuse monitoring.
• Resend and Google Workspace — only for health information you choose to write to us. Contact-form messages pass through Resend, our email service, and arrive in our support inbox, which Google Workspace hosts.

The other providers listed in our Privacy Policy do not receive health data.

4. Your consent, and how to withdraw it

We ask for your consent to collect health data at the start of the questionnaire, and you can answer as few of the health questions as you like — age and income are the only required fields. You can withdraw consent at any time by deleting your account: the Delete my account card on the dashboard's Plan Details tab deletes everything listed above from our database. If you would rather keep your account, email support@verdhealth.com or use the contact form and we will remove the health data we hold for you and record that you withdrew consent. Without health information, the cost estimates become less specific to you; the rest of Verd keeps working.

5. Your rights

• To confirm whether we collect, share, or sell your health data (we never sell it) and to see it — almost all of it is visible on your dashboard and under "My answers."
• To receive a list of the third parties it has been shared with (section 3 is that list).
• To withdraw consent (section 4).
• To have it deleted. Deleting your account removes it from our database immediately, and copies in our database backups roll off within 30 days. What the providers in section 3 held while running a request follows their own limited retention, described there. If you wrote to us, ask and we will delete those messages from our support inbox.
• To appeal a decision we make about a request, by replying to our response; we will answer the appeal in writing within 45 days and tell you how to contact your state attorney general if you disagree.

To make a request that the dashboard does not already handle, use the contact form and choose "Privacy & Data Request," or email support@verdhealth.com. We respond within 45 days, free of charge, and we will not treat you differently for asking. We may ask you to confirm the request from the email address on your account.

6. Contact

Verd Health LLC, a Nevada limited liability company
801 Pennsylvania Avenue NW, Washington, DC 20004
support@verdhealth.com · verdhealth.com/contact