Privacy Policy & Cookie Notice

1. Information We Collect

We collect only what we need to help you with your medical bills:

• Account information — your name, email, date of birth, and location (city, state, ZIP).
• Documents and information you upload — bills, Explanations of Benefits (EOBs), insurance cards, collection notices, court documents, and the details extracted from them. Some of this is health-related information.
• Household members you add, if you manage bills on their behalf.
• Usage information — basic technical logs needed to operate and secure the service.

2. How We Use Your Information

We use your information to:

• Analyze your bills, surface possible issues, and prepare letters and documents you choose to create.
• Operate, secure, maintain, and improve the service.
• Communicate with you about your account and important changes.

3. How We Handle Your Health Information

When you submit your own medical and billing information to Pancho, we act as a “vendor of personal health records.” That means the Federal Trade Commission’s Health Breach Notification Rule applies to us: if there is a breach of your identifiable health information, we are required to notify you (and, where required, the FTC).

Pancho is generally not a “covered entity” or “business associate” under HIPAA for the information you submit yourself, because you are giving it to us directly as a consumer rather than through your provider or health plan. We still treat your health information as sensitive and protect it accordingly. [Scope to be confirmed with counsel; a HIPAA Business Associate Agreement will be added for any future business/provider offering.]

4. AI Processing

To read documents and identify possible billing issues, Pancho sends document contents to our AI processor (Anthropic) under a contract that prohibits using your data to train their models. For analysis that does not require it, we minimize the personal and health details we send — see our internal minimum-necessary controls.

5. Service Providers We Share With

We share information only with the vendors that help us run Pancho, each under a data-processing agreement, and only as needed to provide the service:

• Our AI document/analysis processor (Anthropic).
• Our hosting and database infrastructure provider(s).
• Our email/notification provider, when we send you account messages.

6. We Do Not Sell Your Data

We do not sell your personal or health information, and we do not share it with advertisers. Any future community pricing features would use only de-identified, aggregated data and would be described to you before launch.

7. Your Rights and Choices

You can view and update your information in Settings. You can permanently delete your account and all of your data at any time from Settings → Security — this is a true erasure, not a soft delete. You may also contact us to request a copy of your information.

8. Data Retention

We keep your information for as long as your account is active. When you delete your account, we erase your data from our active systems. Limited records may persist briefly in routine backups before they age out.

9. Security

We protect your data with measures including encryption in transit, per-user data isolation so one account cannot access another’s records, restricted internal access, and audit logging of sensitive actions. No system is perfectly secure, but we work to protect your information and to meet our breach-notification obligations if something goes wrong.

10. Cookies

Pancho uses only essential cookies needed to keep you signed in and to keep your session secure. We do not use third-party advertising or cross-site tracking cookies. Because we use only essential cookies, you will not see an intrusive cookie-consent wall.

11. Children

Pancho is intended for adults (18+). We do not knowingly collect information directly from children. You may, however, add a child as a household member if you are their parent or guardian and are managing their medical bills.

12. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify you. The “Effective” date above shows the current version.