Subprocessors
The providers that store or process data for ClaimDoc, what each one handles, and how patient records are covered. For the full security packet, write to hello@claimdoc.co.
Business associate agreements
- ClaimDoc handles protected health information for a clinic only under a business associate agreement with that clinic.
- Patient records are stored or processed only by the providers below that handle them, each under its own business associate agreement with ClaimDoc.
- The clinic remains the covered entity and stays responsible for what it sends to a payer. See the terms.
Providers and the data each one handles
| Provider | Role | Data it handles |
|---|---|---|
| Google Cloud | Application hosting, database, private file storage and AI processing (United States) | Account and sign-in details, clinic settings and signatures, uploaded documents, case details, letters, packets and the audit record; the text and page images of uploaded documents and drafted statements, sent to read, match evidence, draft and verify; request metadata such as IP address in server logs |
| Stripe | Billing | Billing contact and payment details only. Never patient data. |
No advertising, analytics or tracking provider receives any data. No third-party script, font or tracker loads in your browser, on the public site or inside the product.
Safeguards
| Safeguard | What it means for your clinic |
|---|---|
| Clinic isolation | No clinic can see another clinic's cases, records or totals. |
| Private files | Records, packets and signatures are private, and open only for a signed-in person with rights to that clinic. |
| Nothing in the open | Patient details never appear in web addresses, logs, analytics or email. |
| Audit record | Views, changes, exports, downloads, applied signatures and sign-ins are recorded, and no one can edit or delete an entry. |
| Sign-in | Two-step sign-in available to every user, and unattended sessions sign themselves out. |
| Roles | Owner, admin, biller and viewer, each limitable to specific clinics. |
| Encryption | In transit and at rest. |
How AI is used
- AI runs only from ClaimDoc's servers, never in your browser, and only with provider features eligible for protected health information.
- Uploaded documents are evidence, never instructions. Text planted in a record can't steer the result.
- Looking up payer rules uses the payer, plan and billing codes only, never patient details.
- Every drafted statement must cite a source and pass an independent check before a packet is built.
Automatic signatures
ClaimDoc has no per-appeal signing step. Where a letter or payer form needs a signature, the clinic's stored signature is applied automatically.
- It is set up once per clinic, with a recorded standing authorization naming who gave it and when.
- It is applied only to that clinic's appeal letters and the payer forms that require one, including the Medicare Advantage waiver of liability, and every use is recorded.
- An owner or admin can replace it or withdraw the authorization at any time. Without an authorization on file, no packet is built.
Measurement on the public site
The public pages count visits and button presses so we can see whether the site is clear. It is first-party and minimal: an event name, the page, the referring site, campaign tags, screen width and a random identifier that lasts only as long as the browser tab. No cookies, IP addresses, fingerprints, form contents or anything about a patient. Browsers that send Do Not Track or Global Privacy Control are not measured, and none of this runs inside the signed-in product.
Contact
ClaimDoc is a product of Genta AI Solutions LLC. Security and compliance questions, the security packet, or a business associate agreement: hello@claimdoc.co. See also Security, Privacy and Terms.