This policy explains what information ClearPrice collects, why, how long we keep it, and what rights you have over it. We designed the site to collect as little as possible.
Information We Collect
Information You Provide
- Account information: If you create an account, we store your email address, a one-way bcrypt hash of your password, your chosen display name, and your verification status.
- AI chat queries: If you use the AI assistant, we store the question you typed and the AI's response, linked to your session. This helps us improve quality and investigate errors.
- Email preferences: If you subscribe to weekly hospital update digests, we store your email address and ZIP code (optional) until you unsubscribe.
Information Collected Automatically
- Authentication tokens: When you log in, we issue JWT access tokens (30 minutes) and refresh tokens (7 days) stored in your browser's local storage.
- Session records: We log your login user-agent and IP address to help detect suspicious activity. These are deleted when you log out or when the refresh token expires.
- Analytics: We may run a self-hosted Umami analytics instance that records page views, referrers, and browser/country metadata — never anything personally identifying. No third-party tracking scripts.
Information We Do Not Collect
- We do not collect medical records, health history, or treatment information
- We do not collect financial information, insurance details, or payment data (we do not process payments)
- We do not collect Social Security numbers or other government identifiers
- We do not use third-party advertising, retargeting, or behavioral tracking cookies
How We Use Your Information
- To authenticate you and keep your account secure
- To send you password reset and email verification messages
- To send the weekly digest (only if you opt in)
- To improve search relevance and diagnose technical problems
- To respond to your support requests
How We Share Your Information
We do not sell, rent, or trade your personal information. We share data only in these limited cases:
- Claude AI (Anthropic): If you use the AI assistant, your question and relevant pricing data are sent to Anthropic's API to generate a response. Anthropic does not train on API submissions by default.
- Email provider: Transactional emails (password reset, verification) pass through our SMTP provider.
- Legal compliance: We will disclose information if required by valid legal process (subpoena, court order, applicable law).
Data Security
- All traffic is served over HTTPS
- Passwords are hashed with bcrypt (never stored in plaintext)
- Sensitive server-side settings (API keys, SMTP credentials) are encrypted at rest using pgcrypto AES
- Database access is restricted to the application, not exposed to the internet
- We use fail2ban and rate limiting to block brute-force attacks
Data Retention
- Account data: kept for the lifetime of your account. Delete your account to remove it.
- Session records: 7 days (auto-expired)
- AI conversation logs: 12 months
- Analytics data: 13 months
- Server access logs: 30 days
Your Rights
Regardless of where you live, you have the right to:
- Access the personal information we hold about you
- Correct inaccurate information
- Delete your account and associated data
- Export your data in a portable format
- Opt out of non-transactional emails at any time
If you are a California resident, the CCPA gives you additional rights. If you are in the EU/UK, the GDPR gives you additional rights. To exercise any of these, email privacy@clearpricehealth.org.
Children's Privacy
ClearPrice is not directed at children under 13. We do not knowingly collect information from children. If you believe we have collected information from a child, please contact us and we will delete it.
Changes to This Policy
We may update this policy from time to time. If we make material changes, we will notify account holders by email. The "last updated" date at the top reflects the most recent revision.
Contact
Questions about your privacy? Email privacy@clearpricehealth.org.