Privacy Policy

This policy explains what data FairBill collects and who controls it. FairBill is one of several early-stage products built and operated by AppTechLab, which acts as the data controller for all of them.

Who controls your data

AppTechLab (apptechlab.com) is the data controller for information collected through this page, not FairBill individually. This gives you one place to ask about, correct, or delete your data across every AppTechLab product.

The bill you paste is never stored — anywhere

This is the most important thing to know before you use FairBill. The itemized bill text you paste, the line items the AI extracts from it, the summary it writes, and the dispute letter it drafts are never written to a database, a log file, or any other storage, by us or by any error-monitoring tool we use. They exist only in your browser and in the memory of the single request that builds your result, for as long as it takes to send that result back to you, and are discarded immediately after. If our server crashes while handling your request, the error report we receive contains only a route name and an error message — never the bill text or the AI's output. We recommend blacking out your name and date of birth before pasting your bill anyway, purely as good practice — FairBill doesn't need them to audit the charges.

What we do collect

• Email address — only if you submit the "Reserve early access" form, together with what kind of bill brought you here (optional), a timestamp, and the consent you gave at signup.
• Anonymous page views — the page path and referrer for each visit, with no cookies, no IP storage, and no identifier tied to you personally.
• Anonymized audit log — every time you run "Audit my bill", one row is recorded with a timestamp, how many line items were on that bill, and how many of them were flagged as worth asking about. Nothing else about that audit — not the bill text, not the AI's summary, not the letter — is ever written to that log or any other storage.

What we don't collect

No cookies are set by this page — the page-view counter and audit log above are both cookie-free and carry no visitor identifier, so there is nothing here that requires a cookie consent banner. No third-party advertising or tracking pixels are loaded. No payment information is collected — this page has no live payment processing. Your IP address is never stored in readable form; it is hashed with a server-side secret salt before being used to enforce the demo's rate limit, and that hash is not linked to your email or to any audit-log row.

About the live demo specifically

The bill text you paste is sent to Google's Gemini API to identify structurally suspicious charges and draft a letter — it is not sent anywhere else, and (as above) is never stored by us before or after that call. FairBill only flags charges based on evidence visible in the bill itself (duplicate lines, unbundling, vague catch-alls, quantity anomalies, math mismatches, routinely-included items, and balance-billing indicators) — it has no pricing database and never claims a charge is above Medicare, a CPT rate, or any other external price benchmark. Uncertain findings are always phrased as worth asking about, never as a confirmed error, and this is enforced in our code, not only in how we prompt the AI. FairBill is not legal, medical, or financial advice, and it does not verify anything with your insurer or provider.

How we use it

Your email is used to notify you when FairBill opens for self-serve access, and occasionally about other AppTechLab tools. It is never sold or shared with third parties.

Your rights

You can ask AppTechLab to access, correct, or delete your data at any time by emailing the contact address on apptechlab.com, or by calling POST /api/delete-account with your email and the deletion code shown when you signed up — this removes your signup record (and the bill-type note attached to it) and logs a one-way hash of the deletion for audit purposes only. The code is only ever shown once, at signup, so that knowing someone else's email address alone is not enough to delete their data; if you lose it, use the email option instead. As part of AppTechLab's data retention policy, data belonging to a discontinued product is deleted within 30 days of that product's retirement.

Storage

Data is stored with Supabase, our database provider. Your email address and bill-type note are only ever written by our server, through the "Reserve early access" endpoint, which validates and rate-limits every submission before it reaches the database — this page's own browser code cannot write to the signup table directly. The page-view table is protected by a row-level security policy that restricts this page to inserting new records only — it cannot read, modify, or delete existing rows. The audit log has no public read or write access at all; only the server-side audit function can write to it, and only the server-side dashboard endpoint can read from it (and only ever returns an item count, a flag count, and a minute-rounded time — never a bill, a summary, or a letter).