Privacy policy
What Revise Medical collects on this site and from clients, how we use and protect it, your US state privacy rights and how to make a request.
The short version
- This website collects business contact details you choose to send us. It never asks for patient data.
- Patient data we handle for provider clients is protected health information. A Business Associate Agreement and HIPAA govern it, not this policy.
- We do not sell personal information or share it for cross-context behavioral advertising.
- No advertising cookies, no third-party trackers, no pixels. We honor Global Privacy Control.
- You can ask what we hold about you, correct it, delete it or stop our emails. Write to privacy@revise-medical.com.
On this page16 sections
Who we are and what this covers
Revise Medical, LLC (“Revise Medical,” “we,” “us”) runs out-of-network revenue recovery for healthcare providers: open negotiation, independent dispute resolution (IDR) under the No Surprises Act, and collections. The platform is in build and we are onboarding our first design partners.
This policy covers personal information we collect:
- through this website, including its forms and calculators;
- when you email, call or meet with us;
- about the people we work with at client, prospect, vendor and partner organizations.
It does not cover protected health information (PHI) we process for provider clients. We handle PHI as a HIPAA business associate, under the Business Associate Agreement (BAA) we sign with each client and under that client’s own Notice of Privacy Practices. If you are a patient, your provider’s notice explains your rights. See Patient data and HIPAA below.
Revise Medical is not a law firm and does not give legal advice. Nothing in this policy is legal advice to you.
Information we collect
Information you give us
Our forms (contact, free audit, demo and BAA requests) ask for your name, work email, phone number, organization, role, specialty, an annual volume band and an optional message. The forms take no file uploads and do not ask for claims, patient names or any other PHI. Please do not put PHI in a form field or an email to us.
We also keep what you send when you email us, book a call, apply for a job or ask about a partnership. That is usually your name, contact details, employer and the content of your message. Job applicants may send a résumé and work history.
Information collected automatically
- Hosting logs. Our host, Netlify, records standard request data when your browser loads a page: IP address, browser and device type, the page requested, the referring page and the time.
- Form metadata. When you send a form, Netlify stores your IP address, browser type and the referring page alongside your answers.
- First-party usage events. Our own code notes when you use a calculator, start or send a form, or click a button. These events carry no name, email or device identifier, and today they never leave your browser. See Cookies and analytics for the full list.
The fee and deadline calculators run in your browser. The numbers you type into them are not sent to us.
Information from clients and other sources
- Clients give us business contact details for their staff, such as billing contacts and the people who will use our portal.
- A referral partner or billing company may introduce you to us and pass on your work contact details.
- We may look up public business information, such as an organization’s website or a provider’s entry in the NPPES NPI Registry, to confirm who we are speaking with.
We do not ask for sensitive personal information (such as Social Security numbers, financial account numbers, precise location or health information about you) through this site.
How we use it
- To answer your message, run the free audit you asked for, schedule a demo or send a BAA.
- To decide whether we are a fit and to prepare and manage a contract with your organization.
- To provide our services, support client users and handle billing.
- To send product and company updates you asked for or that relate to work we do together.
- To evaluate job applications.
- To understand which pages and tools people use, so we can fix what is confusing.
- To keep the site and our systems secure, and to screen out spam and abuse.
- To meet legal, tax, accounting and regulatory duties, and to establish or defend legal claims.
We may turn information into aggregate or de-identified statistics that cannot reasonably be tied back to you. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
How we share it
We share personal information only in these cases:
- Service providers. Companies that work for us under contract and may use the information only to provide that work. Today that includes Netlify, which hosts this site, stores form submissions and screens them for spam; Resend (resend.com), which delivers an email copy of each verified submission to our team; and our email, calendar and document tools. The trust center lists the categories of providers we plan to use for client data, each under a BAA.
- Professional advisers. Lawyers, accountants, auditors and insurers, under a duty of confidentiality.
- Legal and safety reasons. To comply with law, a subpoena or court order, to respond to a lawful request from a regulator, or to protect the rights, property or safety of our clients, our company or others.
- Business transfers. If we are involved in a merger, financing, acquisition or sale of assets, personal information may transfer to the other party under terms that keep this policy’s protections in place. We will tell you if that happens.
- With your direction. When you ask us to, for example to send a BAA to your counsel.
We do not sell personal information. We do not share it for cross-context behavioral advertising, use it for targeted advertising, or pass it to data brokers. We have not done any of these in the past 12 months.
Patient data and HIPAA
When a provider hires us, we receive claims, remittances, explanations of benefits and payer correspondence. That is PHI. We process it as a business associate of the provider, who is the HIPAA covered entity. For that data:
- We sign a BAA with the client before any PHI moves.
- We use and disclose PHI only to perform the services and as the BAA and HIPAA permit, and only the minimum necessary.
- Any vendor that touches PHI signs its own BAA with us first.
- We report security incidents and breaches to the client as the BAA and HIPAA require.
- At the end of the engagement we return or destroy the PHI, as the BAA sets out.
Patients who want to see, correct or ask questions about their health information should contact their provider. If a request reaches us, we will pass it to that provider. If PHI reaches us through this website or a general email address by mistake, we delete it and do not use it.
Read our HIPAA notice for more, or request our Business Associate Agreement.
Cookies and analytics
This site sets no advertising or analytics cookies. It loads no third-party analytics, advertising pixels, tag managers or session-recording scripts. If we ever need a cookie for the site to work, such as one that remembers a setting, it will be strictly necessary and we will list it here.
Site measurement is first party. Our own code records these usage events:
| Event | When it fires | What it carries |
|---|---|---|
cta_clicked | You click a button | Button label, page section, link destination |
audit_started | You click a link that starts the free audit | Link label, page section, destination |
audit_submitted, demo_requested, contact_submitted | A form sends successfully, or you click a link tagged with one of these events | The form name, or the link label, section and destination |
calc_started | You first change a fee calculator input | Which input you changed, not its value |
calc_completed | The fee calculator shows a result | The estimated difference, rounded to whole dollars |
calc_shared | You share a calculator result | Nothing beyond the event name |
deadline_calc_used | You enter a date in the deadline calculator | Which date field you used, not the date |
Each event also carries a timestamp. None carries your name, email, IP address or a device identifier, and none includes what you typed into a form. Today these events stay in the page: they are held in your browser’s memory for the visit and announced as an in-page browser event, and they are sent nowhere. They disappear when you close or leave the page. If we later send them to an analytics tool, it will run under our own domain, it will not track you across other sites, and we will update this policy before it goes live.
Global Privacy Control. We treat a Global Privacy Control signal from your browser as a valid request to opt out of the sale or sharing of your personal information. Since we do none of that, the signal changes nothing about how we handle your data, but we honor it and will keep honoring it.
Do Not Track. We do not track you across other sites, so a Do Not Track signal does not change how this site behaves.
How long we keep it
We keep personal information only as long as we need it for the purpose we collected it for, or as long as the law requires. When the period ends, we delete it or de-identify it.
| Category | How long |
|---|---|
| Form submissions (in Netlify and in our inbox) and emails from prospects who do not become clients | Up to 24 months after our last contact |
| Business contact details and records for clients, vendors and partners | The length of the relationship, plus up to 7 years for contract, tax and accounting records |
| PHI received from clients | As the BAA sets out; returned or destroyed at the end of the engagement |
| Job applications | Up to 24 months, unless you ask us to delete it sooner or you join us |
| First-party usage events | Not stored by us today; they stay in your browser and end with the visit |
| Hosting logs held by Netlify | For the period Netlify’s service sets. We do not export or combine them with form data |
| Records of privacy requests and how we answered | At least 24 months, as state privacy laws require |
| Email opt-out list | As long as we send email, so we keep honoring your opt-out |
We may keep information longer if the law requires it or if it is needed for a legal claim or investigation.
Security
This site is served over HTTPS, takes no file uploads and does not receive PHI. Form submissions are stored in Netlify, and a Netlify function emails each verified submission to a small team inbox through Resend. That email holds only the fields you filled in, not your IP address or browser details. Access is limited to the people who need it.
The client platform is being built with encryption in transit and at rest, isolation of each organization’s data at the database row level, an audit log of every PHI read, and US-only hosting. Our HIPAA risk analysis and policies are being drafted with counsel before the first client data arrives. A penetration test is planned before our first hospital client, and a SOC 2 Type I audit is targeted for Q1 2027. We have not completed a SOC 2 audit yet and we will not claim one until we have the report.
No system is perfectly secure. If a security incident affects your personal information, we will notify you and regulators as the law requires, and notify clients as their BAAs require. See Security and the trust center for current status. To report a vulnerability, email security@revise-medical.com.
Your choices
Wherever you live in the US, you can ask us to:
- tell you what personal information we hold about you and give you a copy;
- correct information that is wrong;
- delete your information, subject to the exceptions the law allows (for example, records we must keep);
- stop sending you marketing email.
You can also choose not to fill in a form. Some details, such as an email address, are needed for us to reply.
US state privacy rights
California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and other states give their residents rights over personal information. Each law has its own thresholds and exemptions, and most do not apply to PHI handled under HIPAA. Depending on where you live, your rights may include:
- Access or know: confirm whether we process your personal information, learn the categories and purposes, and get a copy in a portable format.
- Correct: fix inaccurate information.
- Delete: have information we collected about you deleted.
- Opt out: of the sale or sharing of personal information, targeted advertising and profiling with significant effects. We do none of these.
- Limit sensitive information: restrict the use of sensitive personal information. We do not collect it through this site.
- Appeal: ask us to reconsider if we decline your request.
- Non-discrimination: we will not deny service, charge a different price or treat you differently for using any of these rights.
California notice at collection
In the past 12 months we have collected the categories below. We collected them from you, from your device, from clients and partners, and from public sources, for the purposes in How we use it. We disclosed them only to the recipients in How we share it, and we keep them for the periods in How long we keep it.
| Category | Examples | Sold or shared |
|---|---|---|
| Identifiers | Name, work email, phone number, IP address (in hosting logs and form records) | No |
| Professional information | Organization, role, specialty, résumé for job applicants | No |
| Commercial information | Volume band, services discussed, contract and billing records | No |
| Internet activity | Pages requested, referring page, browser type | No |
| Sensitive personal information | None collected through this site | No |
Making a request
Email privacy@revise-medical.com with the subject line “Privacy request,” or write to us at the address in Contact us. Tell us which right you want to use and how we can reach you. We honor requests from anyone in the US, whether or not a state law requires us to.
Verification
We will confirm your identity before we act, usually by matching details you give us with what we hold or by replying to the email address on file. We ask only for what we need to verify you and use it for nothing else. Opt-out requests do not need verification.
Authorized agents
Someone else can make a request for you. We will ask for your signed permission, and we may ask you to confirm your identity with us directly. A valid power of attorney is also accepted.
Timing
We confirm receipt within 10 business days and aim to answer within 30 days. We will always answer within the period the law sets, generally 45 days, which some laws let us extend once by up to 45 more days if we tell you why. We do not charge for requests unless they are clearly unfounded or excessive.
Appeals
If we decline all or part of your request, we will explain why. You can appeal by replying with “Appeal” in the subject line within 60 days. Someone who did not make the first decision will review it, and we will answer in writing within the time your state’s law sets, generally 45 to 60 days. If you disagree with the outcome, you can contact your state attorney general.
Email from us
We send marketing email only to people who asked for it or whose work gives us a clear reason to write, such as a contact at a client or a provider group that requested an audit. Every marketing email has an unsubscribe link, and you can also write to privacy@revise-medical.com. We act on opt-outs within 10 business days. Clients will still receive service and account messages.
We do not send marketing text messages. If that changes, we will ask for your consent first.
Children
This site and our services are for businesses and the people who work at them. They are not directed to children, and we do not knowingly collect personal information from anyone under 16 through this site. If you believe a child has sent us information, write to privacy@revise-medical.com and we will delete it. Patient information about minors that clients send us is PHI and is governed by the BAA.
Visitors outside the US
We serve healthcare providers in the United States, and our systems are hosted in the United States. We do not offer services to people in other countries. If you visit from outside the US, the information you send is processed in the US, where privacy laws may differ from those where you live.
Changes to this policy
We will update this policy as the platform and our practices change. The date at the top shows the latest version. If we make a material change, we will post it here before it takes effect and email clients and contacts we hold an address for. We will not use information already collected in a materially different way without telling you first and, where the law requires, getting your consent.
Links on this site to other websites, including payer and government sites, are governed by those sites’ own policies.
Contact us
Questions about this policy or a privacy request:
- Email: privacy@revise-medical.com
- Security issues: security@revise-medical.com
- Mail: Revise Medical, LLC, Attn: Privacy, [Registered mailing address to be added]
- Privacy lead: [Name of privacy officer to be added]
If you need this policy in another format because of a disability, email privacy@revise-medical.com and we will provide it.
Effective date: [Effective date to be set at launch].