Privacy Policy

Verd Health LLC ("Verd," "we," "us") makes software that estimates what health insurance plans will cost you. This policy says exactly what we collect, where it goes, how long it stays, and how to delete it. It is written to match how the product actually works; if you find a place where it does not, tell us through the contact form and we will fix the policy or the product.

Because Verd collects information about your health, we also publish a separate Consumer Health Data Privacy Policy, which applies to residents of Washington, Nevada, Connecticut, and any other state with a consumer health data law.

1. What we collect

What you type into Verd

• Account: your email address and a password (the password is stored only as a hash by our authentication provider).
• Your profile (the questionnaire): age, sex (optional, used only for the preventive-care checklist), state and county, ZIP code, household size and income, whether you use tobacco, height and weight, health conditions, medications and what you pay for them, planned procedures, how often you see doctors, your risk preference, and your current coverage situation, including whether an employer offers you a plan and what it costs.
• What you track in the dashboard: the plan you chose, expenses and claims you log, benefits you mark as used, medications you watch, appointments, life events and their dates, appeals you track, and savings you record.
• What you send to the Assistant and the document tools: chat messages, and documents you upload (bills, Explanations of Benefits, plan summaries). The extracted findings — line items, amounts, provider names, plan terms — and any appeal letter drafted for you are saved to your account. The uploaded file itself is not kept after analysis.
• Contact form and newsletter: your name, email, and message.

What your browser sends automatically

• IP address, browser, and operating system, in the ordinary server logs of our hosting provider and for rate limiting; not used to profile you.
• The ?ref= code on a shared link, if you arrived through one, so we can see which kinds of sharing bring people to Verd. It is stored in your browser and attached to your profile; it never identifies who shared the link.

Verd does not use advertising trackers, analytics cookies, or third-party pixels. The only cookies and local storage we use are the ones needed to keep you signed in and to keep your answers on your device.

2. Where your information lives

Your answers are stored in your browser (so the free comparison works without an account) and, once you have an account, in our database so they follow you across devices. That database is hosted by Supabase, in the United States, with row-level security that lets each account read only its own rows. Everything in the list above under "what you type into Verd" is stored this way, including chat history, bill findings, and appeal drafts.

3. How we use it

• To estimate what each kind of plan would cost you and to rank them.
• To run the dashboard tools you choose to use.
• To answer your questions in the Assistant and analyze documents you upload.
• To run your account, bill you if you subscribe, and answer your messages.
• To send the email you asked for: a welcome message, a purchase confirmation, and, if you sign up for it, the newsletter. Every newsletter email has an unsubscribe link.
• To fix bugs: if something breaks, the error message and the page you were on are logged. We do not log your health answers with errors.

We do not sell your information, share it with insurers, brokers, or advertisers, or use it to build advertising profiles. We take no commissions from anyone.

4. Who receives it

These companies process data for us, under contracts that limit them to providing the service:

• Supabase — sign-in and the database that holds your account data.
• Vercel — hosts the website and receives ordinary web-server logs (IP address, pages requested).
• Render — hosts the analysis service that powers the Assistant and document tools. It receives your chat messages, uploaded documents, your plan figures (deductible, out-of-pocket maximum, what you have spent), and a pseudonymous account ID — never your email.
• Anthropic — the AI model behind the Assistant and document tools. It receives the same material as Render in order to generate a response. Under the API terms we use, Anthropic does not train its models on this data.
• Stripe — payments. You enter card details directly with Stripe; we see your email, a customer ID, and your subscription status, never your card number.
• Resend — sends our email (welcome, purchase confirmation, contact-form replies, newsletter). It receives your email address and the content of those emails.
• Google Fonts — serves the typefaces on the site; your browser sends Google your IP address to fetch them.
• Mixkit (Envato) — serves the two short video clips on the Features and About pages; your browser sends its IP address to fetch them.

We may also disclose information if the law requires it, or as part of a sale or merger of the company, in which case this policy continues to apply to it.

5. How long we keep it

• Your account and everything in it: until you delete your account. There is a Delete my account button on the dashboard; it removes your profile, dashboard data, chat history, bill findings, and appeal drafts, cancels any subscription, and deletes your login, usually within minutes and always within 30 days for backups.
• Assistant sessions on the analysis service: held in memory for the conversation and discarded within about two hours. Your saved chat history lives in your account, not there.
• Uploaded documents: not retained after analysis.
• Contact-form messages: in our support inbox for up to two years.
• Payment records: as long as tax and accounting law requires.
• Error logs: 90 days.

6. Your choices and rights

Wherever you live, you can see what we hold about you, correct it, download it, or delete it. Most of it is on the dashboard already; the profile can be edited from "My answers"; deletion is the button described above. For anything else, use the contact form and choose "Privacy & Data Request." We answer within 30 days (within 45 days for Washington residents, as that state's law provides), we will never charge you or treat you differently for asking, and you may appeal our decision by replying to it.

California residents: the California Consumer Privacy Act gives you the right to know, delete, correct, and to limit the use of sensitive personal information such as health data. We do not sell or share personal information for advertising, and we use sensitive information only to provide the service you asked for.

Washington, Nevada, and Connecticut residents: your consumer health data rights, including consent and withdrawal of consent, are described in the Consumer Health Data Privacy Policy.

Nevada residents: we do not sell covered information; you may still send a request not to sell through the contact form.

7. Security

Data is encrypted in transit, stored encrypted at rest by our database provider, and protected by row-level security so that no account can read another's. Payment card data never touches our servers. The service that runs the AI features accepts requests only from our own website, authenticated with a shared secret. No system is perfectly secure; if a breach ever affects your information, we will notify you and, where required, the Federal Trade Commission under the Health Breach Notification Rule, without unreasonable delay and within the time the rule allows.

8. Children

Verd is for adults. We do not knowingly collect information from anyone under 18; if you believe we have, contact us and we will delete it.

9. HIPAA

Verd is not a healthcare provider, health plan, or clearinghouse, so it is not a covered entity under HIPAA, and the information you give us is not protected health information under that law. It is protected by this policy, by the Consumer Health Data Privacy Policy, and by the FTC's Health Breach Notification Rule, which does apply to health apps like Verd.

10. Changes

If we change this policy in a way that matters — new categories of data, new recipients, new uses — we will email account holders before the change takes effect and post the new effective date here. Minor clarifications are posted here without notice.

11. Contact

Verd Health LLC, a Nevada limited liability company
801 Pennsylvania Avenue NW, Washington, DC 20004
verdhealth.com/contact · choose "Privacy & Data Request"