Security and patient privacy
How Claimvera handles the information you work with. Last updated October 16, 2026.
The short version
- Patient details stay on your computer. The insurer's remittance file is read in your web browser. Patient names, member and Medicare IDs, claim and account numbers, and dates are kept in that browser and never sent to Claimvera or to an AI company.
- Claimvera receives de-identified facts: codes, amounts, the payer, the service year and day counts.
- Anything you type is masked on our server before it's sent to an AI or saved.
- No training on your data. We use the paid business APIs of Anthropic, OpenAI and Google.
- Saved reviews contain no patient details and are deleted automatically after 90 days.
What stays on your computer
When you open a remittance file (835) or add a denial by hand, these details are kept only in your browser's storage on that computer: patient name, member or Medicare ID, patient control and payer claim numbers, dates of service, the remittance date, and the rendering provider. Claimvera uses them on your computer to count deadlines and to fill in appeal letters and packets. Forget patient details on this computer, at the bottom of the work list, removes all of them at once. Rows marked finished are removed automatically after 120 days.
Because these details live in the browser, protect the computer as you would your billing software: your own login, a screen lock, and no shared browser profiles. On a shared computer, forget patient details when you finish.
What Claimvera receives
| Sent to Claimvera | Never sent |
|---|---|
| Payer name and payer type; procedure, revenue and diagnosis codes; modifiers; units; billed and paid amounts; denial (CARC) and remark (RARC) codes; claim status; the service year; the number of days between service and denial | Patient name, member or Medicare ID, claim and account numbers, medical record numbers, dates of service or birth, addresses, phone numbers |
These fields are designed to follow the HIPAA Safe Harbor method of de-identification (no names, no identifying numbers, no dates except the year). An independent privacy review of the design is under way; until it's complete, early-access users should use made-up or fully de-identified examples unless their organization has approved Claimvera for real claims.
What you type is masked
Notes, questions and draft appeals are first cleaned in your browser (the patient details Claimvera knows from your work list are replaced), then masked again on our server before they're sent or saved: names you list and names after labels such as "Patient:", Medicare numbers (MBI), member IDs, claim, account and record numbers, Social Security numbers, dates, street addresses, ZIP codes, phone numbers, email addresses and ages over 89 become placeholders such as [MEMBER-ID-1]. Masking is a safety net, not a guarantee: don't type patient details. Photos can't be masked automatically; cover private details with the Cover tool before sending.
Who receives what
| Recipient | What they receive | Why |
|---|---|---|
| Anthropic (Claude), OpenAI (ChatGPT), Google (Gemini) | The de-identified case and masked notes | To review the denial and draft the appeal, through paid business APIs whose terms don't allow training on the data. Where a provider offers a no-storage setting, Claimvera uses it. |
| Cornell Legal Information Institute, ecfr.gov, govinfo.gov, ssa.gov, cms.gov | Only the rule being looked up, e.g. "42 CFR 405.942" | To confirm the rule exists and read its official text |
| Render (hosting, United States) | Accounts, payer profiles, saved reviews and recorded results, none with patient details | To run the service, over encrypted connections (HTTPS) |
We don't sell data, and we don't use your reviews to train any AI model.
What we store, and for how long
- Saved reviews (de-identified case, verdicts, rules cited, the AIs used and the time): 90 days, then deleted automatically. Delete any of them, or all, from your account at any time.
- Recorded results (payer, denial code, path, amounts; no patient details): kept with your account to show what's being recovered.
- Payer profiles: until you delete them.
- Your account: name, email, company, plan and a usage log (dates, review type and cost, with no content), until you delete your account.
- Backups: a copy of the database is made daily and the last 7 are kept, so a deleted review can remain in a backup for up to 7 days.
- Server logs record that a review ran, its scores and cost, never its text.
Accounts and access
- Passwords are stored only as salted, slow hashes (PBKDF2-SHA256, 310,000 rounds). Repeated wrong passwords lock the account for a few minutes.
- Sign-in uses secure, HttpOnly cookies over HTTPS. Changing your password signs out your other devices.
- Claimvera is invite-only. Each person has their own login. A billing company's admin can see the company's people, usage, recorded results and saved reviews.
- PODNalious staff can see account and usage information to run the service, but don't open reviews.
Uploaded documents are evidence, not instructions
Every AI is told that documents, notes and photos are evidence only and to ignore any instructions written inside them.
If something goes wrong
If we learn of unauthorized access to customer information, we will notify affected customers without unreasonable delay and as required by law. Report a security concern to steve@podnalioustechnologies.com.