Privacy Policy

Reclaimly, Inc. operates Patient Payments at patient-payments.com. Healthcare providers use it to show patients what they owe and take payment.

For your bill and your health information, your provider decides what happens and we act on their instructions, bound by a business associate agreement. For the rest, we decide, and this policy is what we have decided.

Your bill

Your name, date of birth, an account reference, what you owe, dates of service, and — if you ask to see it — an itemised list of charges. Comes from your provider. Kept for as long as our agreement with them requires.

Card details

Go straight from your browser to the payment processor. We never receive or store your full card number. We keep a record that a payment was made, for how much, and the last four digits.

How we reach you

Your mobile number, your email address and, where your provider still posts paper, your postal address — all of them from your provider, along with your agreement to be contacted. Used to tell you about your bill and nothing else. See How we contact you.

Messages you send us

Emails and calls to support, and what we needed to answer them. Kept while the matter is open and for a reasonable period after.

Technical information

Your IP address, browser and device type, and which pages loaded — the ordinary records a web server keeps. Used to keep the service running and secure.

As a HIPAA business associate of your healthcare provider, Patient Payments may use and disclose your health information only as HIPAA, our agreement with your provider, and your provider's own privacy notice permit.

For your rights under HIPAA, contact your healthcare provider. They hold your medical record and they are the ones HIPAA gives the duty to answer. Health Information Privacy explains this in full.

Your card details never touch our systems. When you type a card number, it goes directly from your browser to Stripe — the PCI-compliant payment processor — over an encrypted connection.

What we get back is confirmation that a payment succeeded, the amount, and the last four digits of the card. That is enough to show you a receipt and tell your provider you have paid, and it is all we keep.

Stripe handles your card details under its own privacy terms.

Two tools run on this site, and both are configured deliberately narrowly because the pages they run on can contain health information.

Keeping the page working

When you confirm your identity to see the itemised charges, the result is held in your browser for an hour so the next screen can show them. It is cleared when you close the tab, and Sign out in the menu clears it immediately.

Product analytics

Counts of specific, named actions — a page opened, a payment started, a plan chosen — with the code from the web address removed. It sets one cookie and a little browser storage so repeat page loads in one visit are not counted as several people. Session recording and automatic capture are switched off. We never record what is on your screen or what you type.

Error reporting

When something breaks, we record what broke so we can fix it. Personal information is stripped before it is sent, including the code from the web address.

Neither tool is used for advertising, and neither is given your bill.

To turn analytics off entirely, use your browser's "Do Not Track" or Global Privacy Control setting, which we honour, or write to info@reclaimly.com.

Your healthcare provider gave us your contact details, along with your agreement to be contacted about your account. Depending on what they hold and what they have chosen, that can be a text message, an email or — occasionally — a printed statement in the post. Every one of them says the same thing: that you have a bill, that a payment is coming up, or that a card needs updating.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Information sharing with subcontractors in support services, such as customer service, is permitted. All other use case categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

The same holds for your email address and your postal address: we do not sell them, rent them, or pass them to anyone for marketing.

Message frequency varies. Message and data rates may apply. Reply STOP to any text message to stop them, or email us to stop any of it. The full terms are on Text Message Terms.

We do not sell your personal information. We do not share it for cross-context behavioural advertising. We do not run targeted advertising, and we do not give your information to data brokers or advertising networks.

This applies to everything, including the sensitive categories — your health information, your date of birth, and every way we have of reaching you. We honour Global Privacy Control signals from your browser.

• Your healthcare provider — they sent us the bill and they receive the payment.
• The payment processor — Stripe, to take your payment.
• Service providers — hosting, messaging and support tools that run the service for us, under written terms that stop them using your information for their own purposes.
• When the law requires it — for example, a valid court order. We tell you where we are allowed to.
• If the business is sold or merged — and any buyer would be bound by this policy and by the agreements with providers, or would have to obtain your consent.

Some states protect health-related information separately from HIPAA, and their protections can reach a company like us even where HIPAA already applies. This section is for residents of those states.

What we collect

Your name, date of birth, the fact that you were billed for care by a named provider, dates of service, amounts, and — if you ask to see it — itemised charges.

Where it comes from

Your healthcare provider. We do not buy health data, and we do not collect it from any other source.

Why we collect it

To show you your bill and take your payment. There is no secondary purpose.

Who we share it with

Your provider, the payment processor, and the service providers listed above. We never sell it, and we never share it for advertising.

How to withdraw consent

Write to info@reclaimly.com. Note that withdrawing consent does not cancel your bill — your provider still holds it.

How to ask us to delete it

Write to info@reclaimly.com. We will delete what we are able to, and forward the rest to your provider, who holds the record.

Depending on where you live, you may have the right to know what information we hold, to get a copy, to correct it, to have it deleted, and to opt out of sale or targeted advertising — which, in our case, is a right you never need to use, because we do neither.

To make a request, email info@reclaimly.com. Because there is no account here, we verify a request by asking for enough detail to match it to our records — usually the name and date of birth on the bill. We will not ask for more than we need.

If we refuse a request, we will tell you why, and you may appeal by replying to that answer. If your appeal is refused you may complain to your state attorney general.

Requests about your health information are forwarded to your healthcare provider, because those rights run to them. See Health Information Privacy.

This site is meant to be used by an adult paying a bill. It is not directed at children, and we do not knowingly let a child under 13 create anything here — there is nothing to create.

The patient on a bill may well be a child. That happens whenever a parent or guardian pays for a child's care. That information is health information belonging to the child, handled for the provider under the same rules as any other patient's, and questions about it go to the provider.

• Bill and health information — for as long as our agreement with your provider requires. When that agreement ends we return it to them or destroy it.
• Payment records — for as long as financial and tax rules require us to keep proof of a transaction.
• Your contact details and your messaging preference — while you are receiving messages about a bill, and after you opt out we keep the fact that you opted out, so nothing reaches you again.
• Support correspondence — while the matter is open and for a reasonable period after.
• Technical logs — a short period, for security and troubleshooting.

• Everything is served over an encrypted connection, and stored information is encrypted.
• Access is limited to the people who need it, and access is logged.
• Card numbers never reach our systems.
• Pages carrying your information are not indexed by search engines and are not listed anywhere public.
• Everyone we use to help run the service is bound by written terms with the same obligations.

No system is perfectly secure and we will not claim otherwise. If something goes wrong we tell your provider without unreasonable delay, and they tell you.

When this policy changes, we change the date at the top of the page. There is no account here, so there is no mailing list to notify — the date is the notice, and it is worth checking it if you are about to pay.

Privacy questions

info@reclaimly.com

Everything else

info@reclaimly.com

Who we are

Reclaimly, Inc., a Delaware corporation.