Trust & security
ClaimParrot is software that turns a de-identified behavioral-health denial into an appeal packet, and a person checks every packet before it is released. This page sets out what we accept, where it goes, how long we keep it and who processes it for us.
De-identified only
ClaimParrot does not accept protected health information (PHI) or anything else that identifies a patient, and we do not offer or sign business associate agreements. That is a deliberate design choice, not a gap: an appeal argument rests on the payer's stated reason, the criteria it cited and the clinical picture, none of which needs the patient's identity. Your team adds the identifiers inside its own systems before submitting.
The identifier checks catch common patterns. They are a backstop, not a guarantee, so de-identify the summary before you send it. Requests that still contain identifiers are deleted without being processed. If we ever offer a service that handles PHI, it will run under a signed BAA on eligible infrastructure, and this page will say so first.
The request form refuses names that follow a label (such as "Patient:"), member and record numbers, dates of birth, Social Security numbers, non-toll-free phone numbers, email addresses, street addresses, calendar dates and ages over 89. The server checks again before storing a request, and again before any drafting.
The ClaimParrot packet engine drafts the packet; a person checks it against the payer's stated reason and your summary before it is released. Your clinician still reviews, signs and submits.
Every page, form and download is served over HTTPS (TLS) with HTTP Strict Transport Security. Our database and storage providers encrypt stored data at rest.
Only the ClaimParrot operator can read submitted requests. In a ClaimParrot account, each customer sees only their own requests and packets.
Paddle.com is our Merchant of Record. Card and bank details are entered in Paddle's checkout and never reach ClaimParrot; no case text is sent to Paddle.
Account requests and packets are deleted automatically after 12 months, and public-form requests after 120 days. Requests that contain patient identifiers are deleted without being processed.
Retention
You can ask us to delete a request or packet sooner by writing to hello@claimparrot.com. The privacy policy has the full detail.
| Data | Where it is kept | How long |
|---|---|---|
| Requests sent from your ClaimParrot account, and the packets delivered there | Request database (Neon) | Deleted automatically 12 months after the request |
| Requests sent through the public form on this site | Cloudflare storage | Deleted automatically after 120 days |
| The operator's working copy of a request, its notification email and the delivered packet | ClaimParrot case files and the operator mailbox | Up to 12 months after delivery, for billing, revisions and follow-up appeals; then deleted |
| Requests that contain patient identifiers | Nowhere: never processed | Deleted without being drafted |
| Pilot inquiries | Cloudflare storage or the request database | About 18 months, unless they lead to a pilot or customer relationship |
| Form rate-limit counters (a one-way hash of your network address) | Cloudflare storage | Deleted automatically after one hour |
| Orders, invoices and tax records | Paddle, and our accounting records | As long as tax and accounting law requires |
| Card and bank details | Paddle only | Never reach ClaimParrot |
Procurement checklist
Questions from a security or compliance review? Write to security@claimparrot.com.
| Area | ClaimParrot status | What it means |
|---|---|---|
| Patient data (PHI) | Not accepted | Requests must be de-identified. Identifiers are blocked at intake, and requests that still contain them are deleted unprocessed. |
| Business associate agreement | Not offered | Because no PHI is accepted, no BAA is needed, and ClaimParrot does not sign one. |
| HIPAA compliance | Not automatic | No software makes a workflow compliant on its own. Keep identifiers and medical records in your own systems; packets come back with placeholders. |
| AI output | Draft only | A person checks every packet before release; your clinician reviews, signs and submits the appeal. |
| Clinical and coding review | Human controlled | Qualified staff must verify medical-necessity, level-of-care, diagnosis, coding, criteria and deadline conclusions. |
| Licensed criteria | Not reproduced | Packets name the criteria a payer cited. They do not reproduce ASAM, LOCUS, InterQual, MCG or payer criteria. |
Subprocessors
Each provider receives only what its task needs. We use no advertising or cross-site tracking cookies (see the cookie notice). We update the subprocessor list at least 30 days before a new provider starts processing customer data, and our Data Processing Addendum explains how customers can object.
These providers process data for every visitor and customer.
| Provider | Purpose | Data it processes | Location |
|---|---|---|---|
| Cloudflare, Inc. | Website hosting and DNS, storage for public-form requests and pilot inquiries, email routing for claimparrot.com addresses, cookie-free page-view statistics | Website request logs; business contact details and the de-identified case in public-form requests; email sent to our addresses | United States company; global network |
| Paddle.com Market Limited | Merchant of Record: checkout, payment processing, sales tax and VAT, invoices, refunds | Billing details entered at checkout (name, email, address, payment method, tax ID). Never case text. | United Kingdom |
| Anthropic, PBC | Drafts packets with Claude models | De-identified case text only (payer, care setting, review stage, the payer's stated reason, criteria cited, clinical summary). Never your name, email or organization. | United States |
| Google LLC (Gmail) | The operator's mailbox: email sent to claimparrot.com addresses, and request notifications, are delivered there | Your messages to us; business contact details and the de-identified case in request notifications | United States |
These providers process data once you create a ClaimParrot account and send requests from it. Accounts are opening in stages; until yours is open, only the providers above are involved.
| Provider | Purpose | Data it processes | Location |
|---|---|---|---|
| Railway Corporation | Application hosting for the account portal (app.claimparrot.com) | Account and request data in transit; request logs | United States (US East) |
| Neon, Inc. | Database for accounts, requests and delivered packet files | Account details, de-identified requests, packet files | United States (AWS US East) |
| Clerk, Inc. | Sign-in and account management | Name, email, sign-in identifiers and sessions | United States |
| Resend, Inc. | Account emails: request received, packet ready, and the operator's new-request alert | Your name and email, the request reference, packet type, payer and care setting. Never the case summary. | United States |
| Upstash, Inc. | Rate limiting on forms | One-way hashed counters of network address and email; no case text | United States (US East) |
These providers process the business contact details of organizations we contact about ClaimParrot. They never receive customer requests or case text.
| Provider | Purpose | Data it processes | Location |
|---|---|---|---|
| Instantly (instantly.ai) | Sends and tracks our outreach email sequences and records opt-outs | Business name, contact name and role, work email, sending history, replies and opt-outs | United States |
| Resend, Inc. | Sends one-off follow-up emails to organizations we have contacted | Business name, contact name, work email | United States |
HHS guidance says a cloud service provider that creates, receives, maintains, or transmits ePHI on behalf of a covered entity or business associate is itself a business associate. ClaimParrot stays outside that boundary by never receiving PHI: the case arrives de-identified and leaves with placeholders.
Payer, care setting, review stage, the payer's stated reason, criteria cited, a clinical summary without identifiers.
Names, member and claim numbers, dates, contact details, the notice itself and the medical record.
Editable files with placeholders such as [Member name] that your team fills in inside your own systems.
Your organization, with the patient's identifiers and your clinician's signature. ClaimParrot never contacts the payer.
Responsible disclosure
Send suspected vulnerabilities or unauthorized access to security@claimparrot.com, and anything else to hello@claimparrot.com. Please never include patient information. ClaimParrot is operated by KERA Tech Solutions L.L.C., Prizren, Kosovo.
Reviewed by a person.Every packet.