What we collect, what we keep, and what we don't.

The short version

• We collect what you type into our request form, and the billing documents you choose to send us for an audit.
• We keep the parts that describe the care and the money: the procedure, billing codes, dates of service, dollar amounts, the facility and the insurer. We also keep your email so we can reply.
• We remove the parts that identify you: your name, date of birth, member and claim numbers, your address, and anything about your diagnosis beyond the procedure itself.
• We use de-identified billing data to make the next person's estimate more accurate. That is the whole reason we ask for it.
• We don't sell your information, and we don't share it with hospitals, doctors, insurers or advertisers.
• You can ask us to delete everything we have about you at any time, and we will.

Who we are

Yubita, LLC ("Yubita", "we", "us") is a company based in Austin, Texas. We are the controller of the personal information described here. We are not a healthcare provider, a health plan or a clearinghouse, so we are not a "covered entity" under HIPAA, and HIPAA does not govern what we do with your information. This policy does. We have written it to hold ourselves to a stricter standard than the law alone requires.

What we collect

When you request an estimate

What you type into the form: the procedure in your own words, where it is being done if you know, your health plan as written on your card, your ZIP code, when the procedure is scheduled, any price you have already been given, and the email address to send the estimate to. We do not ask for, and ask you not to send, your name, date of birth, member ID or any medical details beyond the procedure.

When you request a bill audit

The same kind of basics (procedure, when it was, insurer, ZIP code, email), and then the billing documents you choose to upload through the private link we send you: itemized bills, statements and explanations of benefits. These documents usually contain identifying information. See "What we remove" for what we do about that.

When you reply to our follow-up

About six weeks after a procedure we email you once to ask which of the lines we predicted actually appeared on your bills. Whatever you tell us in reply, we keep in the same de-identified form as everything else.

Automatically

When you submit the form, we record the page it came from, a short tag that tells us which link brought you to the site (for example, which online community), and a shortened description of your browser. We do this to learn where requests are coming from and to catch spam. We do not use cookies, analytics scripts or advertising trackers on yubita.care. Our fonts are loaded from Google Fonts, which means your browser sends Google your IP address when the page loads; Google's privacy policy applies to that.

When you email us

We keep the correspondence, the way anyone keeps email.

What we keep

From everything above, we keep:

• The procedure, the billing codes, and the dates of service
• Dollar amounts: what was billed, what your plan allowed, what it paid, and your share
• The facility and the insurer
• Your ZIP code (for regional pricing, not to locate you)
• Your email address, so we can send you the estimate or report and the one follow-up
• Your answers to the follow-up

What we remove

Before any uploaded document is stored for longer than it takes to produce your report, and before any information is used to improve our estimates, we remove:

• Your name and date of birth
• Member, subscriber, claim, account and patient numbers
• Your street address and phone number
• Names of individual clinicians, where they are not needed to understand a charge
• Anything about your diagnosis beyond the procedure itself

What remains cannot reasonably be used to identify you, and we do not try to re-identify it, nor permit anyone else to.

How we use it

• To answer you. To produce your estimate or audit report and to email it to you.
• To ask you once. To send the single follow-up email after your procedure, if you agreed to it when you made the request.
• To improve estimates. De-identified billing data is compared to what we predicted, and the comparison is used to make future estimates more accurate, for you and for everyone who comes after you.
• To run the service. To understand where requests come from, to prevent abuse, and to meet our legal obligations.

We do not use your information to market anything to you. We do not use it to make decisions about you. We do not build a profile of you.

What we don't do

• We do not sell personal information, and we have never done so.
• We do not share your information with hospitals, physicians, surgery centers, laboratories, insurers, employers or advertisers.
• We do not share it with data brokers.
• We do not use it to target advertising, on our site or anywhere else.

If Yubita ever works with a medical practice or a patient advocate to deliver estimates, what they receive is an estimate for a procedure and a plan, not your request and not your documents.

Who else can see it

We use a small number of service providers to run Yubita, and they process information only on our instructions:

• A business email and spreadsheet provider, where form submissions and correspondence are stored
• A cloud storage provider, where uploaded documents are held, encrypted, while we produce your report
• A cloud database, where de-identified pricing and billing data is analyzed
• A web hosting provider, which serves this site

We will also disclose information if the law requires it, for example in response to a valid subpoena, and we will tell you when we are allowed to. If Yubita is ever acquired or merges with another company, the information we hold would move with it, under this policy or one at least as protective, and we would tell you first.

How we protect it

Uploaded documents are stored encrypted and are accessible only to the people producing your report. Access to our systems requires a password and a second factor. We keep identifying information for as short a time as the work requires, and we remove it rather than relying on security alone to protect it. No system is perfectly secure; if we ever discover a breach that affects your information, we will tell you promptly and plainly.

How long we keep it

• Uploaded documents containing identifying information: deleted within 30 days of sending you your report, once the de-identified billing lines have been recorded.
• Your email address and request details: kept for 12 months after your request, and then deleted unless you have asked us to keep in touch.
• De-identified billing data: kept indefinitely, because it is what makes the estimates accurate. It is no longer about you.
• Email correspondence: kept for as long as it is useful to answer your questions, and deleted on request.

Your choices and rights

Wherever you live, you can email hello@yubita.care and ask us to:

• Tell you what information we hold about you
• Correct anything that is wrong
• Delete everything we hold about you, including documents, request details and your email address. We will confirm when it is done, normally within 30 days. De-identified billing lines that can no longer be connected to you will remain, because they cannot be found.
• Withdraw consent to the follow-up email, or to the use of your de-identified data, at any time
• Get a copy of what you gave us, in a usable format

We will not treat you differently for exercising any of these rights. We don't require an account, so we will verify a request by replying to the email address you used with us. If you believe we have not handled a request properly, you can also contact your state attorney general's office.

Residents of some states have additional rights over health-related information, including the right to know who has received it and to withdraw consent to its collection. Washington, Nevada and Connecticut have specific consumer health data laws. If you live in one of those states, this policy is our notice under those laws, the rights above apply to you, and we treat the billing information you send us as consumer health data that we collect only with your consent, use only for the purposes listed here, and never sell.

Children

Yubita is for adults making decisions about their own care, or care for someone they are responsible for. We do not knowingly collect information from anyone under 18. If you send us billing documents for a minor in your care, we remove the identifying information as described above. If you believe a child has sent us information directly, email us and we will delete it.

Changes

If we change this policy, we will change the date at the top and, for anything that affects how we use information you have already given us, we will email you before the change takes effect. We will not quietly expand what we do with your data.

Contact

Yubita, LLC · Austin, Texas
hello@yubita.care