1. What this policy covers
This privacy policy applies to billfight.io — including the homepage, the dispute intake form, the dispute letter generator, and the static marketing pages (FAQ, guides, blog). It covers information you submit directly to BillFight and information collected automatically when you visit the site.
It does not apply to third-party websites we link to (such as Stripe's checkout page or insurance commissioner complaint portals). When you click a link leaving billfight.io, the destination site's privacy policy applies.
2. Information we collect
We collect information in two categories:
a) Health and personal information you provide in the dispute intake
To generate your dispute letter, we ask you to provide facts about your medical bill. This may include information that could be considered Protected Health Information (PHI) under HIPAA, even though BillFight is not a HIPAA-covered entity. The intake fields include: full name, contact email, the name of the provider or facility, dates of service, descriptions of the diagnosis or condition being billed, insurance carrier information, billing amounts, and a free-text description of what you believe is wrong with the bill.
b) Financial and transactional information
When you pay for a dispute letter, payment data is collected and processed directly by Stripe. BillFight does not see or store your full card number, CVC, or expiration date. We receive back only the transaction status (paid / not paid) and the purchase amount.
c) Information collected automatically when you visit the site
Pages on billfight.io load an internal analytics script (see Third-party processors) that records a visit with a one-way hash of your IP address, the URL you visited, the referring page, browser, device type, and any UTM parameters. We use this to understand site traffic and improve the service. The hash cannot be reversed to recover the original IP.
3. How we use information
We use the information you submit to:
- →Generate your dispute letter. The intake facts you entered — provider, dates, amounts, the description of the dispute — are sent to OpenAI to produce a personalized letter that cites the relevant statutes.
- →Deliver the letter to you by email using our transactional email provider.
- →Provide support if you email us a follow-up question about your dispute.
- →Meet basic accounting and tax record-keeping requirements.
We do not sell your information to data brokers. We do not use your dispute intake data for advertising. We do not contact you about unrelated products. By submitting the intake form, you consent to your dispute facts being transmitted to OpenAI for the sole purpose of generating your letter.
4. Third-party processors
To run the service, BillFight shares specific data with the following processors. Each receives only the data it needs to do its job.
Stripe (payments)
Stripe processes all payments on our behalf through Polsia's Connect platform. Cardholder data — name, card number, expiration, CVC — flows directly from your browser to Stripe; BillFight's servers never receive it. Stripe returns to us the purchase status, amount, and a tokenized transaction ID. Stripe's privacy practices are governed by stripe.com/privacy.
Meta pixel & Meta advertising
billfight.io uses Meta's pixel and advertising services. Because BillFight is classified under Meta's Financial Products and Services Special Ad Category, we restrict the audience for ads accordingly and enable Limited Data Use mode for visitors from California and other jurisdictions that require it. The pixel receives hashed identifiers (email, phone when provided) and event data (page views, button clicks, checkout events). Meta's privacy practices are at facebook.com/policy.php.
OpenAI (letter generation)
The dispute facts you submit in the intake are transmitted to OpenAI through Polsia's OpenAI proxy to generate your personalized letter. By submitting the form, you consent to this transmission. We do not send your email address, payment information, or identifying contact details to OpenAI — only the dispute's substantive facts. OpenAI's privacy practices are at openai.com/privacy. OpenAI does not use API inputs to train its models.
Postmark transactional email (via Polsia proxy)
We use Postmark (via Polsia's email proxy) to send your dispute letter and any support correspondence. Postmark receives your email address and the letter content. Postmark's privacy practices are at postmarkapp.com/privacy-policy.
Self-hosted analytics
billfight.io records each visit in our own database with a one-way hash of the visitor's IP address, the URL, the referring page, the browser and device type, and any UTM parameters. We also record conversion events (dispute form started, checkout initiated, signup). These records are stored in our database and used only by us; they are not shared with any third party for advertising purposes.
6. Data retention
We retain your dispute intake and payment record for as long as needed to deliver the service, comply with tax and accounting obligations, and handle support follow-up. In practice:
- →Dispute intake forms and generated letters — retained to allow us to support follow-up questions and to enforce our partial-refund guarantee. You may request deletion (see below).
- →Email signup records — retained until you unsubscribe or ask us to remove them.
- →Aggregate analytics records — retained indefinitely.
- →Financial transaction records — retained per applicable federal and state tax law (typically seven years).
7. Your rights
You have the right to ask us what we hold about you, to correct it, and — except where retention is required by law (for example, financial records) — to have it deleted. To exercise any of these rights, email support@billfight.io from the address associated with your purchase or signup.
- →Access — we will send you a copy of the dispute intake and your generated letter.
- →Correction — we will correct factual errors in the records we hold.
- →Deletion — we will delete your dispute intake and any associated support correspondence. Financial transaction records may be retained as required by law.
- →Opt out of sale / sharing — California residents and others with similar rights can request that we not share their personal information for cross-context behavioral advertising. We do not sell data; for Meta pixel opt-out please use Meta's in-product controls or contact us.
We respond within 30 days. We may ask you to verify your identity before fulfilling the request to prevent disclosing records to the wrong person.
8. Children's privacy
BillFight is a service for adult patients settling their own medical bills. The service is not directed at children under 18 and we do not knowingly collect personal information from anyone under 18. If you believe we have inadvertently collected information from a minor, please email support@billfight.io and we will delete it.
9. Changes to this policy
We may update this policy as the service evolves or as laws change. When we do, we'll post the updated text here with a new "Last Updated" date. If the changes are material, we'll make a reasonable effort to email existing customers and let them know before the new policy takes effect.
10. Contact
Questions about this policy or your data? Reach us:
BillFight · support@billfight.io