1. Information We Collect
We collect the following categories of information:
- Account Information: Name, email address, and password when you create an account.
- Health-Related Documents: Insurance denial letters, medical bills, Explanation of Benefits (EOBs), prescription information, and other documents you voluntarily upload.
- Insurance Information: Provider name, plan type, member ID, deductible and out-of-pocket amounts you enter.
- Case and Assistant Information: Case titles, amounts, statuses, deadlines, generated analyses and letters, messages you send to Lysco AI, and any short assistant-memory notes saved for future conversations.
- Optional Voice Input: If you choose browser voice dictation, your browser's speech service may process microphone audio under the browser vendor's terms. Lysco receives the resulting transcript through the form, not the microphone audio.
- Usage Data: Pages visited, features used, timestamps, device type, IP address, and browser information.
- Payment Information: Processed securely by Stripe. We do not store credit card numbers.
- Consent Records: Timestamps and metadata of your consent actions for compliance purposes.
2. How We Use Your Data
- Provide and improve Lysco's informational services, including AI-powered analysis of your documents
- Generate informational templates (appeals, negotiation letters, savings reports)
- Process payments and manage subscriptions
- Send service-related communications (case updates, billing notices)
- Maintain security and prevent fraud
- Comply with legal obligations
We do NOT sell, rent, or trade your personal or health data. Lysco does not use your documents, case data, or messages to train an AI model. Service providers process data only to operate the functions described below and under their applicable API terms.
3. Legal Basis for Processing
We process your data under the following legal bases:
- Consent: You explicitly consent to processing when you create an account and upload health documents.
- Contract Performance: Processing necessary to provide the services you subscribed to.
- Legitimate Interest: Security, fraud prevention, and service improvement.
- Legal Obligation: Compliance with applicable laws and regulations.
4. Health Data Protections
Health Information Safeguards
Lysco recognizes the sensitive nature of health-related information. Lysco is a direct-to-consumer software service, not a healthcare provider, health plan, or clearinghouse, and does not claim to be a HIPAA-covered entity or business associate. We voluntarily use safeguards modeled on relevant HIPAA Security Rule principles; this is a description of our security design, not a certification.
- Encryption: TLS protects data in transit and our storage/database provider encrypts data at rest. Selected high-sensitivity text and JSON fields also receive application-level AES-256-GCM encryption with versioned keys.
- Field-Level Scope: The additional application-level layer covers extracted document text, case analysis and strategy, letter content, member and group IDs, bill line items, and assistant memory. It does not currently cover every database field; profile names, case metadata, and document-level analysis metadata rely on provider encryption at rest plus access controls.
- Access Controls: Row-level security helps restrict normal authenticated access to records owned by that account. Narrowly authorized server and operational access uses separate credentials.
- Audit Logging: Selected sensitive API access and account actions are logged with actor, time, and action. Not every server-rendered or internal read currently creates a separate account-visible audit event.
- No Lysco Model Training: Lysco does not train models on your documents, case data, or assistant messages.
- Service-Provider Processing: Data needed for analysis is sent to the processors and for the purposes listed in Section 7.
- Staff Access: Staff do not open case content in normal operation. Narrowly authorized access may occur for requested support, security, abuse investigation, or legal obligations; administrative actions are logged where the admin tooling supports them.
5. Data Security
Our current controls include the encryption, account isolation, expiring file links, input/log redaction, rate limiting, and recorded sensitive actions described on this page and our Security page. No system is completely secure, and these controls do not eliminate all risk.
6. Data Retention
- Account and Case Data: Retained while your account is active. A confirmed account-deletion request attempts to remove active account, case, and file data during that request and reports a warning if a cleanup step does not complete.
- Individual Cases and Files: Retained until you delete the case/file or the account. Active file objects and related records are removed as part of the deletion flow; deleted data may remain temporarily in provider backups until those backups are overwritten under the provider's backup lifecycle.
- AI Assistant Data: Lysco AI messages are processed per-request and are not stored as a browsable chat history. The assistant may save short notes about your cases (memory) to improve future answers; these notes are included in your data export and deleted with your account.
- Consent Records: Retained separately for at least 6 years from creation for compliance audit purposes. After account deletion, the live profile link is removed and a pseudonymous subject hash remains with the consent event.
- Security and Deletion Audits: Limited audit records may be retained after account deletion to document security events and the fact that deletion was executed. These records are not used to recreate your account.
- Payment Records: Stripe retains transaction records under its own financial, fraud-prevention, and legal obligations. Lysco does not store payment-card numbers.
- Anonymized Analytics: May be retained indefinitely in aggregate, non-identifiable form.
7. Sub-Processors and Third Parties
We use the following third-party services to operate Lysco. Each processes data only as necessary for their specific function:
| Service | Purpose | Data Processed |
|---|---|---|
| Supabase | Database, Authentication, File Storage | All user data (encrypted at rest) |
| Anthropic API | Core document analysis, drafting, verification, web-source retrieval, and Lysco AI chat | Uploaded or extracted document content; case facts and instructions; generated output; chat messages. For signed-in chat, context can also include first name, plan tier, savings totals, and active-case titles, types, statuses, amounts, and deadlines. |
| Google AI (optional) | Legal-source query embeddings and discovery of candidate public source pages | Case-fact query text, including procedure or diagnosis codes when present, to create an embedding; limited public-web discovery queries. Google is not configured as an automatic backup model for core analysis or chat. |
| Stripe | Payment Processing | Email, payment details |
| Vercel | Application Hosting | IP address, usage analytics |
| Upstash | Rate limiting, caching, and job coordination when configured | Operational identifiers, rate-limit/cache keys, and job metadata |
| Sentry (optional) | Error monitoring | Filtered technical diagnostics and request metadata; sensitive values are scrubbed from application logs |
| Resend | Transactional email when configured | Email address and the service-message content being delivered |
| Browser speech service (optional) | Voice dictation only when you press the microphone control | Microphone audio may be processed by the browser vendor; Lysco receives the resulting transcript, not the audio |
Core user-facing inference uses Anthropic; Lysco does not automatically fail a core request over to OpenAI or Google. Anthropic states that commercial API inputs and outputs are not used for model training by default and are normally deleted from its backend within 30 days, subject to safety/legal exceptions or a different account agreement. Google's terms distinguish paid and unpaid services; Lysco's policy is to use paid-service terms whenever optional Google processing receives user-derived content and not to opt that content into voluntary dataset sharing. Provider terms and configured retention controls can change, so this section will be updated when the processing arrangement changes.
8. Your Rights
Regardless of your location, you have the following rights:
- Access: Request a copy of all personal data we hold about you
- Rectification: Correct inaccurate personal data
- Deletion: Request deletion of active account data, subject to the limited consent, security, deletion-audit, payment, legal, and backup-retention exceptions described above
- Export: Receive your data in a portable, machine-readable format
- Restrict Processing: Limit how we use your data
- Withdraw Consent: Withdraw consent at any time without affecting prior processing
- Object: Object to processing based on legitimate interest
Exercise these rights from your account settings or by contacting privacy@lysco.com. We will respond within 30 days (or as required by applicable law).
9. International Users
Lysco is a US service directed to US residents, and your data is processed in the United States. If you access the service from outside the US, you do so on your own initiative and your data will be transferred to and processed in the US. If you have questions about how your data is handled, contact privacy@lysco.com.
10. California Users (CCPA / CPRA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):
- Right to Know: What personal information we collect, use, and disclose
- Right to Delete: Request deletion of your personal information
- Right to Opt-Out: We do NOT sell or share your personal information for cross-context behavioral advertising
- Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights
- Sensitive Personal Information: Health data is treated as sensitive personal information. We process it only with your explicit consent and solely to provide our services.
To exercise CCPA rights, email privacy@lysco.com with subject line "CCPA Request." We will verify your identity and respond within 45 days.
11. Children's Privacy
Lysco is not intended for use by individuals under 18 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us at privacy@lysco.com and we will promptly delete it.
12. Breach Notification
In the event of a data breach affecting your personal information, we will: (a) notify relevant regulators and authorities as required by applicable law; (b) notify affected users without undue delay; (c) provide details about the nature of the breach, data affected, and remediation steps taken.
13. Changes to This Policy
We may update this policy periodically. Material changes will be communicated via email or in-app notification at least 30 days before taking effect. Continued use after changes take effect constitutes acceptance. Previous versions are available upon request.
14. Contact
Privacy inquiries: privacy@lysco.com
General support: support@lysco.com