Legal
Last updated July 28, 2026
BillFighter is a service operated by AAA Incubator, LLC ("BillFighter," "we," "us," or "our"). This Privacy Policy explains what personal information we collect when you use our websites and applications (the "Service"), how we use and share it, how long we keep it, and the choices and rights you have.
BillFighter helps you review medical and other bills, identify potential errors or overcharges, and generate dispute and related letters. Because the bills you upload can reveal health information, we treat that information as sensitive and describe our handling of it specifically below. BillFighter provides tools; it is not a law firm and does not provide legal advice.
The Service is intended for users in the United States. This policy is written for U.S. federal and state privacy law and is not directed to individuals in the European Economic Area, the United Kingdom, or other jurisdictions.
This summary is for convenience only; the full policy below controls.
Information you provide
Information collected automatically
We collect information directly from you (for example, when you create an account, upload a bill, or enter an address); automatically from your use of the Service (for example, usage and device data); and from our service providers (for example, a payment confirmation from our payment processor).
Because the bills you upload can reveal information about your health conditions or the health care you received, that information may qualify as "consumer health data" under the Washington My Health My Data Act and comparable laws in other states. We treat it as sensitive, and we apply the protections described in this section to that data.
What we collect. Health-related information contained in the bills and documents you choose to upload, and the case details you provide. This can include provider names, dates of service, the services or procedures billed, diagnostic or billing codes, amounts charged, and account, member, or record numbers that reflect health care you received or sought.
Why we collect it. Solely to provide the service you requested — to analyze your bill for errors and overcharges, generate dispute, debt-validation, and appeal letters, manage your case and its deadlines, and communicate with you about it. We do not use it for advertising, and we do not use it to build advertising profiles.
Where it comes from. Directly from you. We do not buy it, and we do not obtain it from data brokers.
Who we share it with. Only the service providers listed in "How we share information" below, each contractually restricted to using it solely to provide the Service and barred from using it to train AI models, for their own purposes, or for advertising. As an added safeguard, before your bill text is sent for AI analysis we apply automated redaction to remove direct identifiers where they appear in a recognizable form. This safeguard applies to the bill text at the analysis step and not to every part of the Service — "AI processing of your bills" below sets out exactly what is and is not redacted.
What we do not do. We do not sell your consumer health data. We do not share it for advertising or for any cross-context behavioral advertising. We would not sell it without your separate, valid written authorization, which the law requires and which we have never sought.
Your rights. You may confirm whether we collect, share, or sell your consumer health data and access that data; obtain a list of the third parties and affiliates with whom we have shared it; withdraw your consent to our collection and sharing of it; and have it deleted. On a valid deletion request, we will delete it from our records and notify the service providers that received it to delete it as well, within the timeframes the law requires — generally within 45 days, and up to 6 months for data held in archives or backups. We will not deny you the Service, charge you a different price, or provide a different level of quality because you exercised any of these rights. See "Your privacy rights and choices" below for how to make a request.
Washington residents: our separate Washington Consumer Health Data Privacy Policy describes these protections in the form that state's law requires.
To analyze your bills and draft your letters, the text from your documents and the details you give us are processed by a third-party artificial-intelligence provider (Anthropic) and related infrastructure providers acting on our behalf. This text can include health-related information.
We reduce what we send where we can, but we do not send it anonymously, and what is protected depends on the step. We would rather tell you exactly where the line falls than leave you with an impression that is better than the truth.
The original text of your bill is kept in your own account on our systems, protected by per-user access controls; the redacted copy is what goes to the AI provider for analysis.
These providers process your data only as needed to deliver the Service, under commercial agreements that prohibit using your data to train their models or for their own purposes. They may retain limited data briefly for security and abuse-prevention in accordance with their own policies. We never send your data to any provider for advertising.
We do not engage in cross-context behavioral advertising, and we do not use third-party advertising pixels or cookies on our site. We never send your bill, your health details, your dispute activity, or your email address to any advertising platform.
To understand whether our advertising works, we send a limited signal to the advertising platform that referred you, indicating that a signup occurred and which campaign it came from. This signal is subject to your consent choices and to the Global Privacy Control, and it is not sent where you have opted out or where opt-in consent is required and has not been given. It does not include your name, email address, mailing address, IP address, bill contents, health information, or dispute activity.
We share your information only with service providers (subprocessors) that help us operate the Service, and only as needed for them to perform their function. They are contractually restricted from using your data for their own purposes, from using it to train AI models, and from using it for advertising.
We do not share your consumer health data with our affiliates.
We may also disclose information when required by law, to enforce our terms, to protect the rights, safety, or property of BillFighter or others, or in connection with a merger, acquisition, or sale of assets (subject to this policy).
We do not sell or rent your personal information, and we do not share it for cross-context behavioral advertising. Your information is used to provide and improve the Service, not to build advertising profiles.
We use administrative and technical safeguards designed to protect your information, including transmission over HTTPS/TLS, per-user row-level security in our database, access controls, and the data-minimization measures described above. No method of transmission or storage is completely secure, but we work to protect your information and to limit who can access it.
Depending on where you live — including California and other states with comprehensive privacy laws — you may have the right to know what personal information we hold about you; to access or receive a copy of it; to correct it; to delete it; to obtain it in a portable form; to opt out of the sale or sharing of personal information and of targeted advertising; and to limit the use of sensitive personal information. You also have the right not to be treated differently for exercising these rights.
Because we do not sell your personal information, do not share it for cross-context behavioral advertising, and use sensitive information only to provide the Service, some of these rights may not apply to us in practice — but you may still exercise them.
How to exercise your rights
We honor the Global Privacy Control (GPC) signal as a request to opt out of non-essential tracking. Because there is no common industry standard for older "Do Not Track" browser signals, we do not separately respond to them; our first-party, non-advertising analytics practices are described above.
You must be at least 18 years old to create an account or use the Service. The Service is intended for adults, and we do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us personal information, contact us at hello@billfighter.com and we will delete it.
If we experience a breach of security affecting your personal information or your health-related information, we will notify you and the appropriate authorities as required by applicable law, including the Federal Trade Commission's Health Breach Notification Rule and applicable state breach-notification laws.
The Service is operated in the United States and intended for U.S. users. If you access it from outside the United States, you do so on your own initiative and are responsible for compliance with local law.
We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by posting a notice on the site, and we will update the "last updated" date.
If you have questions about this Privacy Policy or your data, or to submit a privacy request, contact us at hello@billfighter.com.
AAA Incubator, LLC 10676 Colonial Blvd, Ste 30 PMB 1019 Fort Myers, FL 33913 United States