Your Documents Are Private. Here Is Exactly How We Protect Them.

Before uploading anything to any platform the right question to ask is: what happens to my document after I submit it?

It is the right question. And you deserve a straight answer.

Here is exactly what happens when you upload a medical bill, a denial letter, or a government notice to Vindicate — and what never happens.

We Read It. We Do Not Keep It.

When you upload a document to Vindicate our system reads it to identify what laws and rights apply to your situation.

That is the entire purpose of the upload. Find what the document says. Cross-reference it against the law. Return the analysis to you.

After that process is complete, the original document file is not stored. We apply HIPAA data minimization principles — collecting only what is needed to do the job — and redact structured identifiers like your SSN, phone number, and email before your case history and analysis output are saved.

Your document itself is a means to an answer — the file is not kept. A redacted record of the analysis becomes part of your case history.

“The most sensitive documents you own are your medical records. We treat them that way.”

What We Actually Do With Your Information

When you use Vindicate three things happen with your data.

Your document content is processed to generate your analysis. The text is read by our system the same way a document scanner reads a page. It is processed, and the original file is discarded — a redacted record of the analysis, not the document itself, becomes part of your case history.

Your analysis results are returned to you. The findings — what laws apply, what your rights are, what steps you can take — come back to you in your session.

Your account email and plan type are kept to manage your account. Your saved case history — including your analysis results — is associated with your account so you can return to it, with structured identifiers like SSN, phone, and email redacted before that history is saved.

What We Never Do

We do not sell your data. Not to insurers. Not to employers. Not to data brokers. Not to anyone.

We do not use your medical information to train AI models without your explicit consent.

We do not share your document content with third parties.

We do not store the full text of your uploaded documents. We do redact structured identifiers like SSN, phone, and email before saving your case history — though the analysis output itself, including details like provider names or service dates where relevant, is retained under your account until you request deletion.

These are not promises buried in a terms of service document. They are the actual architecture of how Vindicate works.

Why This Matters for Medical Documents Specifically

Medical documents are different from other files you might upload online. A hospital bill contains diagnosis codes. An EOB contains treatment history. A denial letter contains clinical information your insurer used to make a decision about your care.

This is some of the most sensitive information that exists about you.

HIPAA — the Health Insurance Portability and Accountability Act — establishes the legal framework for how health information must be handled. The core principle is data minimization: collect only what is necessary, use it only for the stated purpose, and do not hold onto it beyond what the purpose requires.

That principle is built into how Vindicate works. Not as a compliance checkbox. As the actual design.

You Decide What to Upload

Vindicate works with whatever you choose to share.

Vindicate is completely free — upload your bill or denial letter and see every violation and statute that applies. Generate your dispute letter at no cost.

When you are ready to upload you are in control of what you share. If you want to remove identifying information from a document before uploading you can. The analysis will still work.

The decision about what to share is always yours.

A Note on AI and Health Data

There is a reasonable concern about AI systems and health data right now.

Some AI tools train their models on user inputs. Some store conversations indefinitely. Some are built by companies whose business model involves monetizing the data they collect.

Vindicate is document intelligence software built for one purpose: to find the law that applies to your situation and tell you what you can do about it.

The business model is subscription access — not data monetization. What you upload is not the product. The analysis is the product.

That distinction matters.

The documents you bring to Vindicate represent some of the hardest moments you have faced — a bill you cannot understand, a denial you did not expect, a system that feels designed to confuse you.

You should not have to worry about your privacy on top of everything else.

You do not have to.

Vindicate applies HIPAA data minimization principles to all document processing. Vindicate is not a HIPAA Covered Entity as defined under 45 CFR § 160.103 but voluntarily applies these standards as a matter of commitment to user privacy. For complete details see our Privacy Policy.