Your Documents Are Private. Here Is Exactly How We Protect Them.

Before uploading anything to any platform the right question to ask is: what happens to my document after I submit it?

It is the right question. And you deserve a straight answer.

Here is exactly what happens when you upload a medical bill, a denial letter, or a government notice to Vindicate — and what never happens.

We Read It. We Do Not Keep It.

When you upload a document to Vindicate our system reads it to identify what laws and rights apply to your situation.

That is the entire purpose of the upload. Find what the document says. Cross-reference it against the law. Return the analysis to you.

After that process is complete your document is not stored in a database with your name attached to it. We apply HIPAA data minimization principles — which means we collect only what is needed to do the job and nothing more.

Your document is a means to an answer. Not a record we keep.

“The most sensitive documents you own are your medical records. We treat them that way.”

What We Actually Do With Your Information

When you use Vindicate three things happen with your data.

Your document content is processed to generate your analysis. The text is read by our system the same way a document scanner reads a page. It is processed. It is not filed.

Your analysis results are returned to you. The findings — what laws apply, what your rights are, what steps you can take — come back to you in your session.

Your account information is stored separately from your document content. Your email address and plan type are kept to manage your account. They are not linked to the content of what you uploaded.

What We Never Do

We do not sell your data. Not to insurers. Not to employers. Not to data brokers. Not to anyone.

We do not use your medical information to train AI models without your explicit consent.

We do not share your document content with third parties.

We do not store the full text of your uploaded documents tied to your identity in a way that creates a permanent medical record on our servers.

These are not promises buried in a terms of service document. They are the actual architecture of how Vindicate works.

Why This Matters for Medical Documents Specifically

Medical documents are different from other files you might upload online. A hospital bill contains diagnosis codes. An EOB contains treatment history. A denial letter contains clinical information your insurer used to make a decision about your care.

This is some of the most sensitive information that exists about you.

HIPAA — the Health Insurance Portability and Accountability Act — establishes the legal framework for how health information must be handled. The core principle is data minimization: collect only what is necessary, use it only for the stated purpose, and do not hold onto it beyond what the purpose requires.

That principle is built into how Vindicate works. Not as a compliance checkbox. As the actual design.

You Decide What to Upload

Vindicate works with whatever you choose to share.

The free plan includes one document analysis — upload your bill or denial letter and see every violation and statute that applies at no cost. The dispute letter is available from $24.

When you are ready to upload you are in control of what you share. If you want to remove identifying information from a document before uploading you can. The analysis will still work.

The decision about what to share is always yours.

A Note on AI and Health Data

There is a reasonable concern about AI systems and health data right now.

Some AI tools train their models on user inputs. Some store conversations indefinitely. Some are built by companies whose business model involves monetizing the data they collect.

Vindicate is document intelligence software built for one purpose: to find the law that applies to your situation and tell you what you can do about it.

The business model is subscription access — not data monetization. What you upload is not the product. The analysis is the product.

That distinction matters.

The documents you bring to Vindicate represent some of the hardest moments you have faced — a bill you cannot understand, a denial you did not expect, a system that feels designed to confuse you.

You should not have to worry about your privacy on top of everything else.

You do not have to.

Vindicate applies HIPAA data minimization principles to all document processing. Vindicate is not a HIPAA Covered Entity as defined under 45 CFR § 160.103 but voluntarily applies these standards as a matter of commitment to user privacy. For complete details see our Privacy Policy.