Privacy Policy

This Privacy Policy applies to all users of the SolveCare360 website and platform, including people who visit without creating an account, registered users, and subscribers. It describes how SolveCare360 (“Company,” “we,” “us,” or “our”) collects, uses, and protects your information.

Information you provide directly:

• Account information — Your name and email address when you sign up.
• Profile information — Your state of residence, income range, insurance status, and other details you provide during onboarding to power the Benefits Finder. This information is optional beyond what is required to use a feature.
• Uploaded documents — Healthcare documents (Medicare statements, Explanation of Benefits, medical bills, etc.) that you upload for analysis. These are processed by our AI and then stored securely in your account.
• Payment information — Billing details are collected and processed entirely by Stripe. We never see or store your full card number. We receive only a payment token and basic billing details (last 4 digits, card type, expiration) from Stripe.
• Support communications — Messages you send us by email or through any support channel.

Information collected automatically:

• Usage data — Pages visited, features used, time spent, and actions taken within the platform. This helps us improve the service.
• Device and browser information — Browser type, operating system, and IP address, collected for security and to optimize your experience.
• Cookies and local storage — We use session cookies to keep you logged in and local storage for application preferences. We do not use third-party advertising cookies.

We use the information we collect to:

• Provide, operate, and improve the SolveCare360 service.
• Analyze your uploaded documents using AI to produce plain-English summaries and action checklists.
• Match your profile against benefit program eligibility criteria to generate your Benefits Finder results.
• Process payments and manage your subscription through Stripe.
• Send you transactional emails (account creation, password reset, subscription receipts, and service status updates).
• Respond to your support requests.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with applicable legal obligations.

We do not use your personal health information for advertising, cross-site tracking, or sale to third parties under any circumstances.

HIPAA: SolveCare360 is not a covered entity or business associate under the Health Insurance Portability and Accountability Act (HIPAA). When you upload your own medical documents to our platform, you are directing your personal health information to a consumer app of your choosing — a scenario the U.S. Department of Health and Human Services Office for Civil Rights has clarified does not create a HIPAA business associate relationship. We do not receive data from hospitals, insurers, or any other covered entity.

FTC Health Breach Notification Rule: Although HIPAA does not apply to us, SolveCare360 is subject to the Federal Trade Commission's Health Breach Notification Rule (16 C.F.R. Part 318), which covers consumer health applications. In the event of an unauthorized disclosure of your health information, we will notify you, the FTC, and where required, relevant media outlets, within the timeframes required by law.

California CMIA: Because we operate in California, we comply with the California Confidentiality of Medical Information Act (CMIA). We will not share, sell, or disclose the content of your medical documents without your explicit authorization, except as described in Section 6 of this policy (service providers necessary to operate the platform) or as required by law.

Our voluntary security practices: Regardless of which laws apply, we follow these minimum standards for all health-related information:

• All documents are encrypted in transit (TLS 1.2+) and at rest (AES-256).
• Access to your documents is restricted to personnel who need it to operate the service, and only when necessary.
• We do not disclose the content of your documents to insurers, employers, government agencies, or marketers under any circumstances.
• We retain documents only as long as your account is active or as needed to provide the service.
• You can delete any document at any time.

• Sensitive health data encryption — Your medications, decoded documents, appeal letters, care conversations, and emergency binder information are encrypted at rest using AES-256 with a unique encryption key per record. Encryption keys are stored separately from the encrypted data. Decryption happens server-side only — your health data is never transmitted to or stored in your browser in readable form.
• Encryption in transit — All data transmitted between your device and our servers uses TLS 1.2 or higher.
• Access controls — Internal access to user data is restricted on a need-to-know basis and requires authentication.
• Row-level security — Our database enforces row-level security so each user can only access their own data, even at the infrastructure level.
• Logical isolation — Your data is logically separated from other users' data at the database level.
• Third-party auditing — We rely on Supabase (database and auth) and Vercel (hosting), both of which maintain independent SOC 2 Type II certifications.

Despite these measures, no internet transmission or storage system is 100% secure. If you believe your account has been compromised, contact us immediately at help@solvecare360.com.

We do not sell your personal information. We share it only in the following limited circumstances:

• AI processing (Anthropic) — Your uploaded documents and Scam Check inputs (images or text descriptions) are sent to Anthropic's Claude API for analysis. Anthropic's data handling is governed by their API usage policies. Anthropic does not use API inputs to train their models.
• Payment processing (Stripe) — Payment information is processed by Stripe. We share only what is necessary to complete a transaction.
• Database and hosting (Supabase, Vercel) — Your data is stored on infrastructure provided by Supabase and hosted via Vercel. Both are SOC 2 certified.
• Error monitoring (Sentry) — We use Sentry to capture technical errors so we can fix bugs quickly. Sentry receives error events from which we remove all request bodies before sending — meaning no document text, file content, or health information is included in error reports. Only error type, stack trace, and anonymized device information are transmitted.
• Phone number spam-check (SkipCalls) — When you use the Phone Number Check feature, the phone number you enter is sent to SkipCalls, a third-party spam-report database, to retrieve crowd-sourced complaint information about that number. We do not send your name, account details, or any other personal information to SkipCalls. Phone numbers you check are also compared against public government complaint records (FTC Do Not Call data) stored in our own database — no number is sent to the FTC; we download and store their published data locally.
• Legal requirements — We may disclose information if required by law, subpoena, or court order, or to protect our rights or the safety of users.
• PDF generation (server-side) — Emergency Binder PDFs are generated on demand on our servers and streamed directly to your browser. They are not stored by SolveCare360.

We do not share your data with health insurers, Medicare, Medicaid, employers, government benefit agencies, or any marketing company.

SolveCare360 lets you invite a trusted family member or caregiver to your Family Circle. When you send an invitation, you are in full control of who has access and what they can see.

What Family Circle members can view:

• Your upcoming health deadlines and calendar reminders
• Open action items
• Medication reminders
• Benefit programs you are tracking

What Family Circle members cannot view or do:

• Your uploaded documents
• Full benefit details or financial information
• Your account settings
• Make any changes to your profile or data

You control who has access. You can add or remove Family Circle members at any time from your account settings. Access is revoked immediately when you remove a member — they will no longer be able to view your information.

To manage your Family Circle, go to Account → Family Circle in your dashboard settings.

• Active accounts — We retain your data as long as your account is open.
• Cancelled subscriptions — After cancellation, your account reverts to the free tier. Documents and profile data are retained for 90 days and then permanently deleted.
• Deleted accounts — When you delete your account, your account and all documents are deleted immediately. Residual copies in system backups are purged within 30 days.
• Individual documents — You can delete individual documents at any time from your account. Deletion is immediate from the application; backup copies are purged within 30 days.

You have the following rights regarding your information:

• Access — You can view your profile and all stored documents from your account settings at any time.
• Correction — You can update your profile information from your account settings.
• Deletion — You can delete individual documents instantly from your account. You can delete your entire account immediately from Account settings, or by emailing us at help@solvecare360.com.
• Portability — You can export your decoded document summaries from your account. Contact us if you need a full data export.
• Opt-out of marketing emails — We send only transactional emails. If we ever send promotional communications, every email will include an unsubscribe link.

Residents of California and other states with applicable privacy laws may have additional rights. Contact us at help@solvecare360.com to exercise any of your rights.

SolveCare360 is intended for adults aged 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us at help@solvecare360.com and we will delete it promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by displaying a notice in your account dashboard at least 14 days before the change takes effect. The “Effective date” at the top of this page will always reflect the most recent version.

If you have any questions about this Privacy Policy, how we handle your data, or to exercise your rights, please contact us:

We aim to respond to all privacy inquiries within 5 business days.