Privacy Policy
Effective date: July 22, 2026 · Applies to the BillHawk iOS app and api.billhawk.bulpara.com
- You upload a medical bill (or EOB); we send it to our server and to Anthropic (the AI provider) to produce your audit and answer your questions.
- Your bill is deleted from our server within 24 hours — kept only so you can ask follow-up questions and generate letters, then removed automatically. It is never written to disk and never used for anything else.
- The audit, your questions, and your letters are stored only on your device. We keep no copy.
- We have no accounts, no ads, no trackers, and we sell nothing to anyone.
A note on health information
Medical bills and insurance documents can reveal health information (providers seen, services received, medications). BillHawk is a consumer app you use directly — it is not a healthcare provider or insurer, so HIPAA does not apply to it. Instead, we follow the FTC Health Breach Notification Rule: in the unlikely event of a breach of unsecured, individually identifiable health information we hold, we will notify affected users and the FTC as the Rule requires (and the media where it applies). Our best protection is architectural: your documents exist on our server only in memory, for at most 24 hours, so there is almost nothing to breach.
What we process, and why
Your documents. When you scan, photograph, or import a bill (or add an EOB for cross-checking), it is transmitted over HTTPS to our server and forwarded to Anthropic's Claude API to generate the audit. On our server the document exists only in memory: it is deleted immediately if the audit fails, and within 24 hours if it succeeds (the window in which you can ask follow-up questions and generate letters). We never write your documents to disk, never use them for advertising or training, and cannot recover them after deletion.
Your questions. Questions you ask about a bill are sent to our server and to Anthropic to generate a grounded answer. Recent questions and answers from the same chat are included so follow-ups make sense. Your Q&A history is stored only on your device.
Letters. Request and inquiry letters are drafted from your bill and audit, returned to your device, and stored only there. The letter reminder ("your itemized bill should have arrived") is a local notification scheduled on your device — nothing is sent to us.
Device identifiers. The app generates a random install identifier and, on real devices, an Apple DeviceCheck token. These exist solely to enforce the free tier (one free audit, a limited number of free questions) and are not linked to your identity. Apple's DeviceCheck stores two anonymous bits per device on Apple's servers.
Purchases. Subscriptions are processed entirely by Apple. We receive a signed receipt to verify your subscription is active and to meter fair use; we never see your payment details.
What we do NOT collect: no name, email, account, location, contacts, photos (other than bills you deliberately scan or pick), advertising identifiers, or analytics profiles.
Third-party processor: Anthropic
Audits, answers, and letters are generated by Anthropic's Claude API. Anthropic processes your documents and questions to provide the service, subject to its own commercial terms and privacy practices (see anthropic.com/legal). Anthropic does not use data submitted via its API to train its models by default, and retains API inputs/outputs only for limited periods for abuse prevention per its policies.
Data on your device, and deleting it
Audits, Q&A history, and letters live in the app's local storage. Settings → Delete My Data removes all of it and cancels pending reminders. Deleting the app does the same. There is nothing to delete on our side beyond the automatic 24-hour document window, which requires no action from you.
Retention summary
| Data | Where | How long |
|---|---|---|
| Uploaded bill / EOB | Our server (memory only) + Anthropic | ≤ 24h on our server (immediately on failure); Anthropic per its API policy |
| Audit, Q&A, letters | Your device only | Until you delete them |
| Free-tier counters | Our server (keyed to anonymous install id) | Lifetime of the free-tier program |
| Subscription receipt data | Our server (transaction id only) | While your subscription is active |
Children
BillHawk is not directed at children and processes billing documents; it is intended for users of the age of majority in their jurisdiction.
Changes & contact
We'll update this page when practices change and note the effective date above. Questions or requests: support@bulpara.com.