Consumer Health Data Privacy Policy

Recourse Health LLC

Last updated: July 1, 2026

This policy is required by state consumer-health-privacy laws, including Washington's My Health My Data Act. It explains, specifically for your consumer health data, what we collect, why, who we share it with, and the rights you have to access it, delete it, and withdraw your consent. It supplements — and, for consumer health data, controls over — our general Privacy Policy and our Terms of Service.

Recourse Health LLC ("Recourse," "we," "us") provides a document-preparation and appeal-submission service for Medicare Advantage coverage denials. To do that, you share health-related information with us, and this policy governs how we handle it.

1. What "consumer health data" means

"Consumer health data" is personal information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. For Recourse, this includes information in the notice and records you upload — such as the health condition, service, or care your Medicare plan denied (for example, skilled nursing, rehabilitation, or home health), the diagnoses or clinical facts in your documents, your health-plan and member ID numbers, and the fact that you are seeking care and appealing a coverage denial.

2. The consumer health data we collect, and where it comes from

We collect consumer health data directly from you when you use the Service:

  • the Medicare notice you upload (denial, reduction, or termination of coverage);
  • any supporting records you choose to upload (for example, an Explanation of Benefits, care records, or provider letters);
  • beneficiary details needed to appeal — name, date of birth, plan, and member ID; and
  • the service or care at issue and related clinical details contained in your documents.

We do not buy consumer health data about you, and we do not collect it from third-party data brokers.

3. How we use your consumer health data

We use your consumer health data only to provide the Service you asked for — to read your notice, identify the applicable appeal process, prepare and review your appeal letter and CMS-1696, mail the appeal to your plan at your direction, receive the decision, and support you with next steps — and to keep the records we need for security, audit, dispute-resolution, and legal compliance.

We do not use your consumer health data for advertising, and we do not use it — or allow our service providers to use it — to train AI models.

4. Consent

We collect and process your consumer health data based on your consent. When you choose to upload your notice and start your appeal, we describe the health data we collect and why, and we ask for your agreement before we process it. We ask for separate consent for anything beyond providing the Service.

You may withdraw your consent at any time (see Section 8). Withdrawing consent stops future processing; because the Service is delivered by processing this data, withdrawing consent may mean we can no longer continue your appeal.

5. Who we share your consumer health data with

We do not sell your consumer health data, and we do not share it for advertising. We share it only as needed to provide the Service, in these categories:

  • Processors that help us operate the Service, each under a written contract that limits them to processing your data on our instructions and prohibits using it for their own purposes:

- Vercel — hosting and private file storage; - Neon — encrypted database; - Anthropic — AI reading and drafting; - Stripe — payment processing (does not receive your clinical records); - Resend — transactional email; - Lob — printing and certified mailing of your appeal; - VirtualPostMail — receiving and scanning the decision letter your plan mails back.

  • Your health plan and the Medicare appeal system. At your direction and under your signed CMS-1696, we mail your appeal — which necessarily contains consumer health data — to the plan's appeal address you confirm. The plan, the Quality Improvement Organization, and the Independent Review Entity receive it to decide your appeal.
  • When required by law, or to protect rights and safety, as described in our Privacy Policy.

We do not otherwise share your consumer health data, and we will not sell it. A sale, or any sharing beyond the above, would require your separate, valid written authorization, which we do not seek.

6. How we protect your consumer health data

We restrict access to your consumer health data to the people and processors who need it to provide the Service, and we protect it with encryption in transit and at rest, private (non-public) storage, and access controls. See our Privacy Policy for more on our safeguards and on the magic-link account model.

7. How long we keep it

We keep your consumer health data for the duration of your appeal and for a limited period afterward to support next steps and to meet legal, audit, and dispute-resolution obligations, then delete or de-identify it. You may request deletion sooner (see Section 8).

8. Your rights

For your consumer health data, you have the right to:

  • Confirm and access — ask whether we are processing your consumer health data and get a copy of it, including a list of the third parties and affiliates with whom we have shared it;
  • Delete — ask us to delete your consumer health data. When you do, we will delete it from our records and instruct our processors to delete it too, except for the narrow categories we are required to keep by law or need to resolve a dispute; and
  • Withdraw consent — withdraw your consent to our collection and processing of your consumer health data at any time.

How to make a request. Email privacy@recourse.health with your request and the email address associated with your account. We verify requests (typically by confirming control of that email) and respond within the time the law requires — generally within 45 days, with one 45-day extension where permitted. Exercising these rights is free.

If we deny your request, we will tell you why and how to appeal. To appeal, reply to our response; we will review and respond to the appeal within the time the law allows. If you are in Washington and remain unsatisfied, you may also contact the Washington State Attorney General.

9. Changes to this policy

We may update this policy from time to time. If we make material changes, we will post the updated policy with a new "Last updated" date and, where appropriate, notify you. Changes apply prospectively.

10. Contact us

Recourse Health LLC

  • Consumer health data requests and questions: privacy@recourse.health
  • Support: support@recourse.health
  • Phone: (347) 389-3258 — Mon–Fri 9am–5pm ET