Privacy Policy

Recourse Health LLC

Last updated: July 5, 2026

This Policy applies to the Recourse website at recourse.health, our application, and the document-preparation and appeal-submission services we offer (the "Service"), operated by Recourse Health LLC, a New York limited liability company ("Recourse," "we," "us," "our").

1. A note on how Recourse handles health information

You upload a Medicare notice and records so we can prepare and mail an appeal for you. That information is sensitive. We handle it with administrative and technical safeguards comparable to those required under HIPAA — including encryption in transit and at rest, private (non-public) storage, and access controls.

Recourse is not a HIPAA covered entity or business associate in this consumer-direct model, and nothing here creates a HIPAA obligation or represents that HIPAA applies to us. Instead, we are governed by the FTC Health Breach Notification Rule and by state consumer-health-privacy laws such as Washington's My Health My Data Act. Your rights under those laws are described here and in our Consumer Health Data Privacy Policy.

2. Information we collect

Information you give us

• Account and contact information — your email address (we use "magic links" instead of passwords), and, if you provide them, your name and phone number.
• Appeal and health information — the Medicare notice you upload (for example, a denial, reduction, or termination notice), and any records you choose to upload to support your appeal. This can include the beneficiary's name and date of birth, health-plan and member ID numbers, the service or care at issue (such as skilled nursing, rehabilitation, or home health), dates and providers of care, and clinical details contained in your documents.
• Appointment and signature information — the information needed to prepare and sign your CMS-1696 Appointment of Representative form, and your typed or click-to-sign signature.
• Communications — messages you send us (for example, to support@recourse.health).

Information we collect automatically

• Signature and security audit data — to evidence your electronic signature and protect your account, we record limited technical information such as IP address, browser/device information (user-agent), and timestamps.
• Basic usage data — limited, privacy-minimized analytics about how the Service is used. We do not put health information into analytics.

Payment information

• Payments are processed by Stripe. We do not collect or store your full card number. We keep a record that a payment occurred, the amount, and Stripe's transaction identifiers.

3. How we use your information

We use your information only to run the Service and meet our legal obligations, including to:

• read your notice and records (with AI assistance) and identify which appeal process applies;
• prepare your draft appeal letter and your CMS-1696, run automated verification checks on the appeal (flagged appeals are reviewed by a Recourse team member), and mail it by certified mail with tracking to the address you confirm;
• receive and match decision letters your plan sends for your appeal, and help you with next steps;
• communicate with you about your appeal and account (for example, magic-link sign-in, status updates, and service notices);
• process your payment;
• keep records for audit, dispute-resolution, security, and legal-compliance purposes; and
• maintain and improve the security and reliability of the Service.

We do not use your documents or information — and we do not permit our AI or service providers to use them — to train AI models, for advertising, or for any purpose other than providing the Service and complying with law.

4. How AI is used

We use Anthropic's Claude models to read the notice you upload and to help draft your appeal. Anthropic acts as our service provider (processor) under a contract that limits it to processing your information to provide the Service and prohibits using it for its own purposes, including model training. AI can make mistakes; every appeal passes automated verification checks before it is mailed (flagged appeals are reviewed by a Recourse team member), and you review it too. AI-assisted drafts are not legal or medical advice.

5. When we share information, and with whom

We do not sell your information, and we do not share it for cross-context behavioral advertising. We share information only in these limited ways:

• Service providers (processors) who help us run the Service, each under a written contract limiting them to processing your information on our instructions:

- Vercel — website/application hosting and file storage (Vercel Blob, private mode); - Neon — our managed, encrypted database; - Anthropic — AI reading and drafting; - Stripe — payment processing; - Resend — transactional email (for example, magic links and status updates); - Lob — printing and certified mailing of your appeal packet; - VirtualPostMail — receiving and scanning the decision letters your plan mails back.

• Your health plan and the Medicare appeal system. To submit your appeal, we mail your appeal packet — at your direction and under your signed CMS-1696 — to the plan's appeal address you confirm. The plan, the Quality Improvement Organization, and the Independent Review Entity are the deciders of your appeal, not Recourse.
• Legal and safety. We may disclose information if required by law, to respond to lawful requests, to enforce our Terms, or to protect the rights, safety, and property of our users, the public, or Recourse.
• Business transfers. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

Any sharing of your consumer health data beyond what is needed to provide the Service, and any sale of it, would require your separate, specific authorization — which we do not seek and would not act on without it. See the Consumer Health Data Privacy Policy.

6. How we protect your information

We use administrative and technical safeguards, including encryption in transit and at rest, private (non-public) file storage, and access controls that limit who can view your information. No system is perfectly secure, and we cannot guarantee absolute security.

Because we use magic links instead of passwords, anyone with access to your email may be able to access your account and the information in it. Keep your email account secure, do not share or forward magic links, and contact us at support@recourse.health if you believe your account has been accessed without your authorization.

7. How long we keep your information

We keep your information only as long as needed to provide the Service and to meet our legal, audit, and dispute-resolution obligations:

• Appeal materials and records (your notice, uploaded documents, generated letter, signed CMS-1696, and the archived mailed packet) — retained for the duration of your appeal and for a limited period afterward so we can help with next steps, respond to a plan that contests the appeal, and handle any dispute.
• Payment and transaction records — retained as required for financial, tax, and audit purposes.
• Account and audit records — retained as needed for security and to evidence your signatures and acceptances.

You may ask us to delete your information at any time (see Section 8). We will honor deletion requests, except for the narrow categories of records we are required to keep by law or need to retain to resolve a dispute; we delete or de-identify the rest.

8. Your choices and rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you and obtain a copy of your appeal materials;
• Correct inaccurate information;
• Delete your information;
• Withdraw consent to our processing of your consumer health data; and
• Opt out of the sale or sharing of personal information (we do not sell or share it for advertising).

To exercise a right or ask a question, email privacy@recourse.health. We will verify your request (typically by confirming control of the email associated with your account) and respond within the time the applicable law requires. Exercising these rights is free, and we will not deny you service or charge you a different price for doing so, except that if you delete information we need to provide the Service, we may be unable to continue your appeal. If we decline a request, we will explain why, and you may appeal that decision by replying to our response.

Consumer health data. You have additional, specific rights over your consumer health data — including the rights to access it, delete it, and withdraw consent — described in our Consumer Health Data Privacy Policy.

9. Communications

We send you service and transactional messages (such as magic-link sign-in and status updates) as part of the Service. If we offer promotional emails, you can opt out using the unsubscribe link; we may still send messages necessary to provide the Service. If we ever offer text-message updates, we will obtain your consent first and you may reply STOP to opt out.

10. Children's privacy

The Service is intended for adults (18 and older). It is not directed to children, and we do not knowingly collect personal information from children. Medicare beneficiaries are adults; a caregiver acting for a beneficiary must have authority to do so.

11. Data breach notification

If a breach of your unsecured health or personal information occurs, we will notify you, and any regulator or authority, as and when required by the FTC Health Breach Notification Rule and applicable state law.

12. Changes to this Policy

We may update this Policy from time to time. If we make material changes, we will post the updated Policy with a new "Last updated" date and, where appropriate, notify you. Changes apply prospectively.

13. Contact us

Recourse Health LLC

• Privacy requests and questions: privacy@recourse.health
• Support: support@recourse.health
• Mailing address available on request at /contact
• Phone: (347) 389-3258 — Mon–Fri 9am–5pm ET