Privacy Policy

UnderPay Tracker is a billing-revenue tool, not a clinical or treatment record system. Our standard claim fields do not ask you to provide:

• Patient names
• Dates of birth
• Member IDs or insurance ID numbers
• Medical record numbers
• Diagnosis codes or clinical information
• Social Security numbers
• Financial account numbers
• Credit or debit card numbers (billing is handled by our payment processor)
• Insurance card images

We do not use advertising cookies, advertising identifiers, or location-based advertising.

Because the app lets you add free-text notes and upload files (such as remittance advice, EOBs, PDFs, or images), it is technically possible for such content to include patient information. UnderPay Tracker is designed to support billing and revenue workflows rather than clinical record keeping. We encourage clinics to avoid entering or uploading patient information that is not necessary for those workflows. Any information you do enter or upload is stored and processed as described in this policy.

“Clinic Notes” in UnderPay Tracker are private operational notes about payers (for example, contacts, appeal behavior, or documentation requirements) — they are not patient treatment notes.

Depending on how you use the app, we may collect and store:

• Claim details you enter (payer, CPT or procedure code, date of service, expected and actual amounts, status, and notes)
• Payer responses and remittance/ERA files you upload, which may contain patient names, dates of birth, and other identifiers present in the file
• Attachments you upload to claims (PDFs, images, or other files)
• Appeal letters and drafts generated by you or by the app's AI features
• Private operational Clinic Notes about payers (contacts, appeal behavior, documentation requirements) — not patient treatment notes
• Provider records (name, NPI, email, specialty)
• Clinic and clinic-user records (clinic name, invited users, and roles)
• Payer directory and payer-verification data
• Activity and audit-log events (claim events and clinic audit entries)
• AI-generated insights, summaries, suggestions, risk scores, and reports
• Email tracking events (sent, delivered, opened) for appeal emails
• Billing references (such as Stripe customer/subscription IDs and plan) needed to manage your subscription
• Basic usage information collected by the platform to operate and secure the app

We collect only what is needed to provide the service, and we do not collect unnecessary personal or patient information beyond what you choose to enter or upload.

Your data is used to provide UnderPay Tracker's features:

• Track claims, underpayments, and missing payments
• Generate appeal letters and drafts, including using AI models that process your claim and payer details
• Send appeal-related emails and daily-digest emails
• Schedule and track follow-ups
• Generate reports, insights, summaries, suggestions, and risk scores
• Sync and verify payer directory information
• Manage your clinic, providers, invited users, and subscription
• Produce audit and activity history

We do not use your data for advertising, profiling, or resale.

We apply administrative, technical, and organizational safeguards designed to protect your information, including:

• Role-based access controls that limit each clinic to its own data
• Audit logging of key billing and account actions
• Data in transit protected using HTTPS, as provided by our hosting platform
• Data minimization — we collect only what is needed to operate the app

Authentication, database storage, file storage, and encryption at rest are provided by our application platform. Specific infrastructure controls — such as encryption at rest, password hashing, and platform-level access management — are handled by the platform rather than by this application directly.

For confirmation of any specific safeguard, please contact us.

We retain your data while your account is active. You can request deletion at any time from Settings.

Using the in-app Delete Account control, we delete the UnderPay Tracker records associated with your account, including claims, appeals, follow-ups, attachment metadata, remittance file records, reports, insights, risk scores, summaries, suggestions, scan results, appeal drafts, daily-digest logs, settings, and clinic records.

Important limitations:

• Deletion is best-effort and not atomic — if an error occurs, some records may be missed
• The control does not remove your login account itself; it logs you out and the platform user record remains
• Some associated records — such as providers, clinic-user links, audit logs, payer notes, payer flags, email-tracking records, payer summaries, and billing references — are not fully removed by the current deletion workflow
• Uploaded files in storage (logos, attachments, remittance files) may persist after their database records are deleted
• Data held by external service providers (such as our payment processor, email provider, and AI model provider) is subject to those providers' own retention practices
• Records may exist in platform backups for a limited period

We are improving the deletion workflow. For complete deletion, including your login account and external-provider data, please contact us.

You may:

• Request a copy of your account data
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Request clarification about how your data is used

To exercise any of these rights, contact us. We will respond in accordance with applicable law.

For privacy questions or data requests, email:

careprepstudio@gmail.com

We may update this Privacy Policy as the app evolves. If changes are made, we will update the “Last Updated” date above.

We do not sell or rent your clinic data, and we do not share it with advertisers. To operate the app, limited data is processed by, or shared with, the following categories of service providers only as needed:

• Our application platform (Base44), which provides hosting, database, authentication, and file storage
• An AI model provider that processes claim and payer details to generate appeal letters, summaries, insights, and reports
• A transactional email provider used to send appeal emails and daily-digest emails to your registered email
• Payment processors (Stripe and Base44 Payments) that handle subscription billing and store billing references
• An affiliate-referral service that receives subscription lifecycle events needed to calculate referral commissions

These providers process data on our behalf to deliver the features you use, subject to their own terms and retention practices. We do not name a specific provider in this policy unless its use is confirmed.

The app stores limited information in your browser to function:

• An authentication session/token, managed by the platform, so you stay logged in
• Display preferences (such as light/dark theme)
• Onboarding and feature-dismissal state (for example, whether you have seen a welcome screen or dismissed a banner)
• Activity-panel “last seen” timestamps used to highlight new items

Appeal emails include a tracking image that records when an email is opened, so the app can show delivery and open status. This is a functional email feature, not advertising tracking.

We do not use advertising cookies, advertising identifiers, third-party analytics trackers, or location-based advertising.