Overturn
Privacy Policy
Effective July 8, 2026 · Updated October 6, 2026 (what the diagnostic record keeps, email retention, error monitoring, the practice portal preview)
Overturn generates appeal letters for denied health-insurance claims. Denial letters contain sensitive information: names, member IDs, claim numbers, diagnoses. We designed the service to keep as little of it as possible, for as short a time as possible. This page describes exactly what we collect, what happens to it, and what we never do with it.
What we collect
Only what you give us: the text of your denial letter (pasted, uploaded, or photographed), your answers to a few short questions about your claim (state, how you got your insurance, pre-authorization, network status, prior appeals, urgency), and, if you choose to answer them, a second round of questions tailored to your denial (for example, treatments you have already tried). We do not require your name, email address, or an account of any kind. One optional exception: after your letter is generated, you may leave an email address so we can check in once about your appeal's outcome. See "Outcome check-ins" below.
How we use it
For one purpose: analyzing your denial and generating your appeal letter. Your denial text and answers are processed by Anthropic Claude models, currently reached through the OpenRouter API service, to extract the facts, classify the denial, and draft and check the letter. We instruct OpenRouter to route requests only to providers that do not store or train on the content of those requests, and the model vendor's terms do not permit training on content sent through its API. Photographed or scanned letters are transcribed by the same class of model. We may move this processing to a direct connection with the model vendor; the purpose and the no-training commitment do not change.
What we keep, and for how long
Uploaded files (PDFs, photos) are processed in memory and are not stored. Your generated letter and analysis are available at a private, unguessable link that expires within about one hour; download your letter when you get it. For debugging, we keep a redacted diagnostic record of each run for up to 30 days, after which it is automatically deleted. In that record the raw denial-letter text and your second-round answers are replaced with anonymous fingerprints; member IDs, claim numbers, provider names, and service dates are masked wherever they appear; and the generated letter and the automated analysis are retained in masked form so we can investigate a bad result you report to us. The record also notes which version of our software and datasets produced the letter. If you prefer that no diagnostic record be kept, contact us after your run with its approximate date and time and we will delete it.
Outcome check-ins (optional)
After your letter is generated you can opt in to a single outcome check-in. If you enter an email address, we store it with a private link for your run and send one email about 30 days later asking how your appeal went, and nothing else, ever. Your email address is deleted automatically 30 days after that check-in is sent, as soon as you report an outcome, or no later than 60 days after your run, whichever comes first. Whether or not you leave an email, reporting your outcome stores only the result you choose (for example "overturned"), an optional amount, any note you type, and non-identifying context about the claim decision (state, insurer name, denial category). Outcome records never include your denial letter. Please do not put medical details in the note. To delete your outcome record, reply to the check-in email or contact us at the address below.
Error monitoring
If the service encounters an error, a short technical report (the error type, a truncated message, and the code location) may be sent to an error-monitoring service we use to keep the site working. These reports are scrubbed before they leave our servers and never include your denial letter, your answers, or your generated letter.
What we never do
We do not sell your information. We do not use it for advertising. We do not use your denial letter to train AI models or permit our processors to. We do not send anything to your insurer; you decide whether and how to send your letter. If we ever add usage analytics, it will be privacy-preserving, cookie-free measurement that cannot identify you, and this page will say so.
Security
All traffic is encrypted in transit (TLS). Processing happens on access-restricted servers we control. No third party receives your information except the model providers described above, solely to generate your letter, and the error-monitoring service described above, which receives no content.
A note on HIPAA
Overturn's free service is a consumer tool you use directly; it is not a health plan, health-care provider, or clearinghouse, and is not a HIPAA covered entity or business associate. The protections described on this page come from this policy, not from HIPAA. If you are a health-care provider or advocate using the free service for a patient, you are responsible for having the patient's authorization to share their information.
Practice portal preview
The practice portal at /portal is a design-partner preview built on synthetic data. Everything you enter there is stored only in your own browser and is never sent to our servers. It is not secured for real patient, claim, or remittance information and must not be used with any. A production practice tier will have its own privacy notice and a business associate agreement.
Your choices and rights
You can use Overturn without creating an account or telling us who you are. You may edit the pasted text before submitting to remove anything you prefer not to share. To ask about, or request deletion of, any diagnostic or outcome record connected with your use, email support@overturn.co and include the approximate date and time of your run so we can locate it. California residents may use the same address to exercise rights to know and delete under California law; we do not sell or share personal information as those terms are defined there.
Children
Overturn is intended for adults 18 and older.
Changes
If this policy changes, we will update this page and its effective date. Material changes will be noted prominently on the home page.