Privacy policy

Scope

This policy covers rebuttal.health and the business information we handle in the course of an engagement. Protected health information received under a Business Associate Agreement is governed separately by that agreement and by our HIPAA and security commitments, not by this policy.

Information we collect

• Information you give us. Name, work email, organization, role, and anything you write in a contact form or send by email.
• Engagement data. Claims extracts, remittance data, documentation, and correspondence provided by a client or its counsel under a written agreement.
• Site data. Standard server logs and analytics: IP address, browser, pages viewed, referring page, and, where you arrived from an advertisement, the click identifier that records which ad brought you here.

We do not ask for protected health information through the website, and we ask that you not send it there. We provide a secure channel at intake.

How we use it

• To respond to your inquiry and scope an engagement.
• To perform the analysis a client has retained us to perform.
• To operate, secure, and improve the website.
• To meet legal, regulatory, and contractual obligations.

We do not sell information. We do not use client engagement data to train general-purpose models or for any purpose outside that engagement.

Cookies and tracking

Nothing that measures or identifies you runs until you choose. On your first visit a banner asks whether to allow it. Until you accept, advertising and analytics storage are switched off, and the services named below are not loaded at all. If you decline, they are never loaded, and the site works exactly as it would otherwise. Your choice is kept in your browser; clearing site data will bring the banner back.

If you accept, the following run:

• Google Analytics and Google Ads, through Google Tag Manager, to measure which pages are read and which advertisements lead to an inquiry.
• SampleAd, an advertising service that helps us reach similar audiences.
• Apollo, a visitor identification service. It uses your network address to estimate the organization a visit came from, and supplies that to us. It does not tell us who you are as an individual, but you should understand that accepting allows your employer to be inferred from your visit.

When a form is submitted we record that a request was made, and nothing else. No name, email address, organization, amount at issue, or free text is sent to Google, SampleAd, Apollo, or any other analytics provider, and protected health information is never sent to them under any circumstances. Where you arrived from an advertisement, the Google click identifier is kept in your browser for up to 90 days and submitted with the form, so we can tell Google which inquiries became engagements.

The contact form itself is hosted by HubSpot, which stores the submission and notifies us. The form is functional rather than analytical, so it loads whatever you choose above; if you would rather not use it, email or call us instead and nothing is recorded by a third party.

You can also block or delete cookies in your browser, and Google offers its own opt-out tools and advertising controls. None of this affects your ability to use the site or to contact us.

As stated throughout, do not send protected health information through the form. We provide a secure channel at intake.

Disclosure

We share information only with the client and the counsel it designates, with vetted subprocessors bound by written confidentiality and security terms, and where compelled by law. We do not take payer engagements, and we do not share client information with payers.

Retention

Engagement data is retained for the period set out in the engagement letter, then deleted or returned at the client’s direction. Website inquiry records are retained for 24 months. Server logs are retained for 90 days.

Security

Encryption in transit and at rest, least-privilege access, logged access to engagement data, and annual review of controls. Detail is in HIPAA and security.

Your choices

Write to info@rebuttal.health to ask what we hold about you, correct it, or ask us to delete it. Where state or federal law grants you additional rights, we honour them. Individuals whose PHI we process should direct requests to the provider that holds the record; we act on that provider’s instruction.

Changes and contact

Material changes will be posted here with a revised date. Questions: info@rebuttal.health.