Privacy Policy

Verd Health LLC ("Verd," "we," "us") makes software that estimates what health insurance plans will cost you. This policy says exactly what we collect, where it goes, how long it stays, and how to delete it. It is written to match how the product actually works; if you find a place where it does not, tell us through the contact form and we will fix the policy or the product.

Because Verd collects information about your health, we also publish a separate Consumer Health Data Privacy Policy, which applies to residents of Washington, Nevada, Connecticut, and any other state with a consumer health data law.

1. What we collect

What you type into Verd

• Account: your email address and a password (the password is stored only as a hash by our authentication provider).
• Your answers to the questionnaire: age; sex (optional, used only for the preventive-care checklist); your state and, if you choose, your county — we do not ask for your street address or ZIP code; household size and income; whether you use tobacco; height, weight, and activity level; health conditions, including allergies; medications, their drug tier, and what you pay for them; how often you see doctors, specialists, urgent care, or the emergency room; what you spent toward your deductible last year and on dental and vision care; planned procedures, pregnancy or maternity plans, and other costs you expect; your coverage situation, including whether an employer offers you a plan and what it costs, and whether you are a federal employee, in the military, covered by the VA, or enrolled in Medicare or Medicaid; your monthly premium budget and risk preference; and the email address on the last step, if you enter one.
• Your consent: a record of when you agreed to let Verd use the health information you enter, and which version of the consent wording you agreed to.
• What you track in the dashboard: the plan you chose, expenses and claims you log, benefits you mark as used, medications you watch, appointments, life events and their dates, appeals you track, and savings you record.
• What you send to the AI features (the Assistant, the Bill Checker, and the Appeal Letter Helper): chat messages, the details you enter for an appeal, and the text and file names of documents you upload (bills, Explanations of Benefits, denial letters, plan summaries). The file itself stays on your device: your browser pulls the text out of it and sends only the text. The findings and any draft appeal letter are saved to your account.
• Contact form and newsletter: your name, email, and message; for the newsletter, just your email.

What Verd calculates from your answers

Verd uses your answers to estimate your yearly healthcare spending, what each kind of plan would likely cost you, and what a bad year could cost. These estimates are saved with your account, and we treat them as health data, the same as the answers they come from.

What your browser sends automatically

• IP address, browser, and operating system, in the ordinary logs of our hosting provider and for rate limiting; not used to profile you.
• If a page breaks, an error report: the error message, the page you were on, and your browser type.
• The ?ref= code on a shared link, if you arrived through one, so we can see which kinds of sharing bring people to Verd. It is stored in your browser and attached to your profile; it never identifies who shared the link.

Verd does not use advertising trackers, analytics tools, or third-party pixels, and sets no cookies of its own. It uses your browser's local storage to keep you signed in and to hold your answers and dashboard data, as described in the next section.

2. Where your information lives

In your browser. Your questionnaire answers are saved in your browser's local storage as you go. You can answer the questions without an account, but seeing your results requires a free one; until you create it, your answers stay only in that browser. Your dashboard data is kept in local storage too, so the dashboard loads quickly. We clear it from the browser when you sign out and when you delete your account. On a shared device, sign out when you are done.

In our database. Once you have an account, your answers and everything you track on the dashboard are also stored in our database so they follow you across devices. That includes the calculated estimates, chat history, bill findings, and appeal drafts. The database is hosted by Supabase in the United States, with row-level security that lets each account read only its own rows.

3. How we use it

• To estimate what each kind of plan would cost you and to rank them.
• To run the dashboard tools you choose to use.
• To answer your questions in the Assistant and analyze documents you upload.
• To run your account, bill you if you subscribe, and answer your messages.
• To send the email you would expect from us: a welcome message, a purchase confirmation, and replies to your messages.
• The newsletter: we have not sent one yet. If you sign up, your address is kept in our support inbox. When we do send one, every issue will include an unsubscribe link and our postal address. Until then, ask us and we will remove you.
• To fix bugs: if something breaks, the error report described above is logged. We do not log your health answers with errors.

We do not sell your information, share it with insurers, brokers, employers, or advertisers, or use it to build advertising profiles. We take no commissions from anyone.

4. Who receives it

These service providers run parts of Verd for us. Each receives only what it needs to do that job, and processes it only to provide its service to us:

• Supabase — sign-in and the database that holds your account and everything in it, in the United States.
• Vercel — hosts the website. Requests to our servers, including chat messages, the text of documents you upload, and contact-form messages, pass through Vercel's servers in transit. Vercel keeps short-lived logs of those requests (such as IP address, the page requested, and error messages).
• Render — hosts our analysis server, which runs the AI features. It receives what you type or upload in those features, your plan's name, insurer, and cost-sharing figures, what you have spent toward your deductible and out-of-pocket maximum, and a pseudonymous account ID — never your email. Documents you upload may themselves contain your name, address, or member ID. The server holds each chat session in memory only, for up to about two hours after your last message, and writes nothing to disk.
• Anthropic — our AI provider. It receives what you type or upload in the AI features, the same material Render receives, in order to generate a response. Its commercial terms prohibit training its models on your data. It may retain inputs and outputs for a limited period for safety and abuse monitoring.
• Stripe — payments. You enter card details directly with Stripe; it receives your email and your Verd account ID. We see a customer ID and your subscription status, never your card number.
• Resend — sends our email (welcome messages, purchase confirmations, and contact-form acknowledgments). Contact-form messages and newsletter sign-ups pass through Resend on their way to our support inbox. It receives email addresses and the content of those emails.
• Google Workspace — hosts our support@verdhealth.com inbox, where contact-form messages, newsletter sign-ups, and your email replies to us arrive.

Your browser also contacts two services directly when it loads certain pages:

• Google Fonts — serves the typefaces on the site; your browser sends Google your IP address when the fonts load.
• Mixkit (Envato) — serves the short video clips on the home, Features, and About pages; your browser sends its IP address when the video loads.

We may also disclose information if the law requires it, or as part of a sale or merger of the company, in which case this policy continues to apply to it.

5. How long we keep it

• Your account and everything in it: until you delete your account. The Delete my account card on the dashboard's Plan Details tab deletes your account and everything stored in it from our database immediately, cancels any subscription, and deletes your login. You can also ask us to do it by emailing support@verdhealth.com from the address on your account. Copies in our database provider's backups roll off within 30 days. Copies held by the service providers in section 4 follow their own retention, described there.
• Your browser: answers and dashboard data stay in local storage until you sign out or delete your account. If you answered the questionnaire without creating an account, they stay in that browser until you clear its site data.
• Assistant sessions on the analysis server: held in memory only, for up to about two hours after your last message. Your saved chat history lives in your account, not there.
• Uploaded documents: the file stays on your device. Its text is used in memory to produce the analysis and is not kept, on the analysis server or in our database. The AI's summary stays with your Assistant session on the analysis server, as above, and the findings are saved to your account.
• Contact-form messages and newsletter sign-ups: in our support inbox, deleted on a rolling basis (target: two years).
• Payment records: as long as tax and accounting law requires.
• Error logs: deleted on a rolling basis (target: 90 days).
• Rate-limit records: a counter tied to your IP address and the feature you used, holding only the count and when the current window began (10 minutes to an hour). Old counters are deleted on a rolling basis (target: one day).

6. Your choices and rights

Wherever you live, you can see what we hold about you, correct it, ask for a copy of it (we will send it within 45 days), or delete it. Most of it is on the dashboard already; your answers can be edited from "My answers"; deletion is the Delete my account card on the dashboard's Plan Details tab. For anything else, use the contact form and choose "Privacy & Data Request," or email support@verdhealth.com. We respond within 45 days, we will never charge you or treat you differently for asking, and you may appeal our decision by replying to it.

California residents: the California Consumer Privacy Act gives you the right to know, delete, correct, and to limit the use of sensitive personal information such as health data. We do not sell or share personal information for advertising, and we use sensitive information only to provide the service you asked for.

Washington, Nevada, and Connecticut residents: your consumer health data rights, including consent and withdrawal of consent, are described in the Consumer Health Data Privacy Policy.

Nevada residents: we do not sell covered information; you may still send a request not to sell through the contact form.

7. Security

Data is encrypted in transit, stored encrypted at rest by our database provider, and protected by row-level security so that no account can read another's. Payment card data never touches our servers. The service that runs the AI features accepts requests only from our own website, authenticated with a shared secret. No system is perfectly secure; if a breach ever affects your information, we will notify you and, where required, the Federal Trade Commission under the Health Breach Notification Rule, without unreasonable delay and within the time the rule allows.

8. Children

Verd is for adults. We do not knowingly collect information from anyone under 18; if you believe we have, contact us and we will delete it.

9. HIPAA

Verd is not a healthcare provider, health plan, or clearinghouse, so it is not a covered entity under HIPAA, and the information you give us is not protected health information under that law. It is protected by this policy, by the Consumer Health Data Privacy Policy, and by the FTC's Health Breach Notification Rule, which does apply to health apps like Verd.

10. Changes

If we change this policy in a way that matters — new categories of data, new recipients, new uses — we will email account holders before the change takes effect and post the new effective date here. Minor clarifications are posted here without notice.

11. Contact

Verd Health LLC, a Nevada limited liability company
801 Pennsylvania Avenue NW, Washington, DC 20004
support@verdhealth.com · verdhealth.com/contact (choose "Privacy & Data Request")