Legal
Effective July 28, 2026
This is BillFighter's consumer health data privacy policy, published separately from our general Privacy Policy as the Washington My Health My Data Act requires. It describes what we do with health-related information and the rights you have over it.
The Washington My Health My Data Act protects the "consumer health data" of Washington residents and of people whose data is collected in Washington. Rather than attempt to identify which of our users are Washington residents, we apply the protections described in this policy to this category of data for all of our users in the United States.
We collect health-related information contained in the bills and documents you choose to upload, and the case details you enter. This can include provider names, dates of service, the services or procedures billed, diagnostic or billing codes, amounts charged, and account, member, or record numbers that reflect health care you received or sought. This information is "consumer health data."
Purpose. We collect and use this data solely to provide the service you requested — to analyze your bill for errors and overcharges, generate dispute, debt-validation, and appeal letters, manage your case and its deadlines, and communicate with you about it. We do not use it for advertising, and we do not use it to build advertising profiles.
We collect consumer health data directly from you — the documents you upload and the case details you provide. We do not buy it, and we do not obtain it from data brokers.
To operate the service, the health-related content of your documents and case details is shared with the service providers that perform parts of the service on our behalf, only as needed for their function.
As an added safeguard, before the text of your bill is sent for AI analysis we apply automated redaction to remove direct identifiers — such as your name, mailing address, account number, and date of birth — where they appear in a recognizable form. This reduces the identifying information we send. It is not de-identification: it can miss identifiers that appear in an unlabeled or unexpected form, and the health-related content of the bill is still processed in order to analyze it.
Two parts of the service are not covered by that redaction, and we would rather be clear about them than leave you with a better impression than the truth. Notes you type in your own words — what your visit was for, the reason an insurer gave for a denial, or what a collector said to you — are sent as you wrote them. And when we draft a dispute letter for you, we send your name, your mailing address, and the account or reference number in dispute, because a letter that does not identify you and your account cannot do its job.
The original text of your bill is kept in your own account on our systems, protected by per-user access controls; the redacted copy is what goes to the AI provider for analysis.
We do not sell your consumer health data, and we do not share it for advertising or for any cross-context behavioral advertising.
We share consumer health data only with the following categories of service providers, each contractually restricted to using it solely to provide the service, and barred from using it to train AI models, for their own purposes, or for advertising:
Our payment processor, Stripe, handles payments and does not receive your consumer health data.
Affiliates. We do not share your consumer health data with our affiliates.
You have the right to:
Deletion. You can delete your account and its data yourself from your account settings at any time. You can also request deletion by email. On a valid request, we will delete your consumer health data from our records and notify the service providers and any other third parties that received it to delete it as well, within the timeframes the law requires — generally within 45 days, and up to 6 months for data held in archives or backups.
No sale without your authorization. We do not sell consumer health data, and we would not do so without your separate, valid written authorization as the law requires.
No discrimination. We will not deny you the service, charge a different price, or provide a different level of quality because you exercised any of these rights.
How to exercise them. Email hello@billfighter.com and tell us which right you wish to exercise. We will verify your request and respond within the time the law requires. If we deny a request, you may appeal by replying to our response. If we deny your appeal, you may submit a complaint to the Washington State Attorney General's Office.
We collect and share your consumer health data only as necessary to provide the service you have requested, or with your consent where the law requires it. We will not collect, use, or share categories of consumer health data — or use your consumer health data for purposes — beyond those described in this policy without first disclosing the new category or purpose and obtaining your affirmative consent.
If we make material changes to this policy, we will update it and provide notice as appropriate. We will not apply changes retroactively to data already collected without the consent the law requires.
AAA Incubator, LLC, which operates BillFighter hello@billfighter.com
10676 Colonial Blvd Ste 30 PMB 1019 Fort Myers, FL 33913 United States