Privacy and data rights
Privacy Policy
This policy explains what personal data ClaimParrot collects, why, who processes it for us, how long we keep it, and the rights you have. ClaimParrot is built for de-identified case information and does not accept protected health information.
Version 2026-10-19 · Last updated October 19, 2026
Download (Markdown)Who we are
ClaimParrot is operated by KERA Tech Solutions L.L.C., a company registered in Kosovo and based in Prizren. In this policy, "ClaimParrot", "we", "us", and "our" mean KERA Tech Solutions L.L.C., which decides how and why the personal data described here is processed (the controller).
Send privacy requests to privacy@claimparrot.com and other questions to hello@claimparrot.com. We have not appointed a data protection officer; privacy@claimparrot.com reaches the person responsible for data protection at ClaimParrot.
Scope and our role
This policy covers claimparrot.com, our request and pilot forms, ClaimParrot accounts, the emails we send and our business outreach. It does not cover Paddle's own processing as Merchant of Record (Paddle's privacy notice applies) or the patient records your organization keeps in its own systems.
We are the controller for the account, contact, billing, website and outreach data described here. When we process personal data inside the content a customer submits, we do so on that customer's behalf, as its processor or service provider, under our Data Processing Addendum (claimparrot.com/dpa).
What ClaimParrot does
ClaimParrot is software for behavioral-health insurance denial appeals, sold to providers, treatment programs and billing companies. A customer submits a de-identified summary of a denial, the ClaimParrot packet engine drafts an appeal packet, and a person checks the draft before it is released to the customer.
No protected health information
ClaimParrot does not accept protected health information (PHI) or any other information that identifies a patient, and we do not sign business associate agreements. Because the service only receives de-identified information, it is designed so that one is not needed.
The request form refuses a request when its case fields contain names that follow a label (such as "Patient:" or "Dear Mr."), member, patient or record numbers, dates of birth, Social Security numbers, phone numbers other than toll-free lines, email addresses, street addresses, calendar dates or ages over 89. The server checks again before storing a request, and the drafting step checks again before any text reaches the AI model. These checks catch common patterns, not every identifier, so please de-identify the summary yourself before sending it.
If a request, file or email reaches us with patient identifiers despite these checks, we do not draft it. We delete it from our storage, case files and mailbox, tell the sender, and ask for a de-identified version. Requests that still contain patient identifiers are deleted without being processed. Please do not send patient information to any ClaimParrot email address.
Information we collect
Account data: name, work email, organization, sign-in identifiers and account settings when you create a ClaimParrot account.
Packet request data: business contact name, work email, organization and role, plus a de-identified description of one denial (payer, care setting, denial type, review stage, the payer's stated reason, criteria cited and a clinical summary without identifiers) and the packet files we deliver.
Pilot inquiry data: business contact name, work email, organization, website, role, team size, denial-volume range, workflow bottleneck, plan interest and referral source. The pilot form does not ask for, and must not receive, patient information.
Workspace data (design-partner pilots): fictional or properly de-identified denial text, case notes and drafts that pilot users enter, and audit records of AI activity in the workspace.
Billing data: Paddle collects your payment details at checkout (see Payments below). We receive order and customer identifiers, the product bought, the amount, the tax country and the billing email.
Communications: emails you send us and our replies.
Business contacts for outreach: business names, roles, work emails and phone numbers of behavioral-health organizations and billing companies, taken from public sources such as the NPI Registry, FindTreatment.gov and organization websites, so we can contact them about ClaimParrot. Every outreach email includes a way to opt out.
Technical data: IP address, browser and device information and request logs that our hosting providers process to deliver and secure the website; a one-way hash of your network address, kept for one hour, to rate-limit forms; and aggregate page-view statistics collected without cookies.
We collect this information from you, from Paddle (order details), automatically from your browser (technical data) and, for outreach, from the public sources named above.
How we use information, and our legal bases
The table shows each purpose, the data it uses and the legal basis we rely on under the GDPR and Kosovo's Law No. 06/L-082 on Protection of Personal Data, which follows the GDPR.
We do not sell personal information and we do not use it for advertising. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Where we rely on consent, you can withdraw it at any time. Where we rely on legitimate interests, you can object, and you can always object to outreach.
| Purpose | Data used | Legal basis |
|---|---|---|
| Provide the service: draft, check and deliver packets, run accounts and pilots, send service emails | Account, request, workspace and communications data | Performance of a contract with you or your organization; our legitimate interest in serving our business customers' staff |
| Billing, tax and accounting | Billing and order data | Performance of a contract; legal obligations |
| Security and abuse prevention: identifier checks, rate limits, logs | Technical data and hashed counters | Our legitimate interest in keeping ClaimParrot and its users secure; legal obligations |
| Answer questions and pilot inquiries | Inquiry and communications data | Steps you ask for before a contract; our legitimate interests |
| Business outreach to organizations | Business contact data | Our legitimate interest in telling relevant businesses about ClaimParrot (you can object at any time) |
| Improve ClaimParrot | Aggregate usage and your feedback | Our legitimate interests |
| Comply with law and handle legal claims | The records concerned | Legal obligations; our legitimate interest in establishing or defending claims |
How we use AI
Packets are drafted with Anthropic's Claude models. Only the de-identified case text is sent for drafting (payer, care setting, review stage, the payer's stated reason, criteria cited and the clinical summary); your name, email address and organization are not. A person checks every draft before it is released.
In the design-partner workspace, AI features process the fictional or de-identified text pilot users enter, and prompts and responses are logged in an audit table for product safety, dispute investigation, abuse prevention and quality review.
AI output is a draft. We do not use it to make decisions about you, and it never guarantees a claim or appeal outcome.
Payments
Payments are processed by Paddle.com Market Limited, our reseller and Merchant of Record. Paddle receives the billing details you enter at checkout (name, email, billing address, payment method, tax identifiers) and processes them under its own privacy notice (paddle.com/legal/privacy). We never see or store card numbers. We send Paddle only internal account and order identifiers; denial details and case text are never sent to Paddle.
Sharing and subprocessors
We share personal data only with the service providers we need to run ClaimParrot, and each receives only what its task requires. The current list, with what each provider processes and where, is at claimparrot.com/subprocessors (also on our Trust & security page, claimparrot.com/trust#subprocessors).
Website and public request form: Cloudflare (hosting, DNS, form storage, email routing for claimparrot.com addresses and cookie-free page-view statistics). Payments: Paddle. Drafting: Anthropic (de-identified case text only). Operator mailbox: Google (Gmail), where email sent to our addresses and request notifications are delivered.
ClaimParrot accounts: Railway (application hosting), Neon (database for accounts, requests and delivered files), Clerk (sign-in), Resend (account emails) and Upstash (rate limiting). Business outreach: Instantly and Resend.
We may disclose information if required by law, to protect users or the service, to investigate abuse, or as part of a merger, financing, acquisition, or similar corporate transaction with appropriate safeguards.
International transfers
We are based in Kosovo, and our providers process data in the United States, the United Kingdom and other countries. Where the law requires a safeguard for these transfers, we rely on the mechanisms it allows, such as standard contractual clauses in our providers' data processing terms or a provider's certification under the EU-U.S. Data Privacy Framework. You can ask privacy@claimparrot.com for more information about the safeguard for a particular transfer.
Retention, export, and deletion
Packet requests sent from a ClaimParrot account, and the packets delivered to it, are kept in your account for 12 months and then deleted automatically. Requests sent through the public form on our website are kept in our hosting provider's storage for up to 120 days and then deleted automatically.
The request and the delivered packet are kept in the ClaimParrot team's case files for up to 12 months after delivery for billing, revisions and follow-up appeals, then deleted. You can ask us to delete them sooner.
Pilot inquiries that do not lead to a pilot or a customer relationship are deleted about 18 months after they are received. Design-partner workspace data is kept while the pilot runs; afterwards the workspace stays read-only for 30 days so you can export it, and we then delete it unless you become a customer or ask us to keep it. Account data is kept while your account is open; when you close it, we delete or anonymize it unless we must keep some records for tax, accounting, security or legal reasons. Payment records are kept by Paddle and by us for as long as tax and accounting law requires.
Outreach records are kept for up to 24 months after our last contact with your organization. If you opt out, we keep only your email address on a suppression list, so that we never contact you again. Hosting providers keep technical request logs for short periods under their own settings.
You can download your packets from your account at any time and ask us for a copy of your data. Deletion requests anonymize personal identifiers where possible.
| Data | Where it is kept | How long |
|---|---|---|
| Requests sent from your ClaimParrot account, and the packets delivered there | Request database (Neon) | Deleted automatically 12 months after the request |
| Requests sent through the public form on this site | Cloudflare storage | Deleted automatically after 120 days |
| The operator's working copy of a request, its notification email and the delivered packet | ClaimParrot case files and the operator mailbox | Up to 12 months after delivery, for billing, revisions and follow-up appeals; then deleted |
| Requests that contain patient identifiers | Nowhere: never processed | Deleted without being drafted |
| Pilot inquiries | Cloudflare storage or the request database | About 18 months, unless they lead to a pilot or customer relationship |
| Form rate-limit counters (a one-way hash of your network address) | Cloudflare storage | Deleted automatically after one hour |
| Orders, invoices and tax records | Paddle, and our accounting records | As long as tax and accounting law requires |
| Card and bank details | Paddle only | Never reach ClaimParrot |
GDPR rights
Under the GDPR, Kosovo's Law No. 06/L-082 and similar laws, you may request access, rectification, erasure (deletion), restriction, portability, objection to certain processing (including an absolute right to object to direct marketing and outreach), and review of decisions based solely on automated processing where applicable.
Send requests to privacy@claimparrot.com. We may need to verify your identity first. We reply within one month, or tell you within that month if a complex request needs up to two more months.
You may also lodge a complaint with the Information and Privacy Agency of Kosovo (Agjencia për Informim dhe Privatësi, aip.rks-gov.net), or with the supervisory authority where you live or work. We ask that you contact us first so we can try to resolve the concern quickly.
US state privacy rights (CCPA and CPRA)
Residents of California and of other US states with comprehensive privacy laws (such as Colorado, Connecticut, Oregon, Texas and Virginia) may have the right to know what personal information we collect and how we use and disclose it; to access, correct and delete it; to receive a portable copy; to opt out of its sale, sharing for cross-context behavioral advertising, targeted advertising and profiling; and to limit the use of sensitive personal information. Some of these laws may not apply to a business of our size, but we honor these requests from anyone.
In the last 12 months we collected these categories of personal information, for the purposes and from the sources described above: identifiers (name, email, IP address); professional information (organization and role); commercial information (orders and plans); internet activity (request logs and aggregate page views); and the content of your communications with us. We disclose them only to the service providers listed on our subprocessor page, for business purposes.
ClaimParrot does not sell or share personal information for cross-context behavioral advertising, does not use it for targeted advertising, and does not knowingly collect sensitive personal information; requests must not contain health information that identifies anyone. We honor opt-out preference signals such as Global Privacy Control, although there is nothing to opt out of.
You can use an authorized agent; we may ask for proof of the agent's authority and verify your identity. We respond within 45 days, and we will not discriminate against you for exercising these rights.
Business outreach and email preferences
We contact behavioral-health organizations and billing companies at their business addresses. Every outreach email identifies itself as a business solicitation and includes our postal address and a way to opt out. Reply "no thanks", or write to unsub@claimparrot.com, and we stop promptly and in any case within 10 business days. More at claimparrot.com/unsubscribe.
Children
ClaimParrot is a business service for adults and is not directed to children. We do not knowingly collect personal data from anyone under 18; if you believe a child has given us personal data, write to privacy@claimparrot.com and we will delete it. Case summaries about minor patients must be de-identified like any other.
Security
Every page, form and download is served over HTTPS (TLS) with HTTP Strict Transport Security. Our database and storage providers encrypt stored data at rest. Only the ClaimParrot operator can read submitted requests, and each customer can see only their own requests and packets. Forms are rate-limited and checked for patient identifiers before anything is stored.
No system is perfectly secure. Keep your account credentials private and contact security@claimparrot.com if you suspect unauthorized access or find a vulnerability. If a personal data breach affects you, we will notify you and the competent authorities as the law requires, without undue delay.
Changes to this policy
We post changes on this page and update the version and date above. If a change materially affects how we use personal data you have already given us, we will email account holders before it takes effect. If we add a subprocessor, we update the subprocessor list first.
Contact
Privacy requests can be sent to privacy@claimparrot.com. We may need to verify your identity before exporting, correcting, or deleting account data. Postal correspondence: KERA Tech Solutions L.L.C., Prizren, Kosovo.
Questions or requests?
Email privacy@claimparrot.com for privacy requests, legal@claimparrot.com for terms, the DPA and legal notices, or hello@claimparrot.com for anything else. Please never include patient information.