Privacy Policy

Last Updated: February 2026

1. Introduction

ReCapture (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

2. Information We Collect

We collect information that you provide directly to us, including:

  • Account information (name, email, phone number)
  • Practice information (practice name, size, specialty)
  • Protected Health Information (PHI) you upload or enter, including patient names, dates of birth, phone numbers, email addresses, and insurance details
  • Payment information (processed securely through Stripe)
  • Usage data and analytics

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve our Service
  • Generate AI-powered insurance appeals
  • Send SMS messages and portal links to patients on your behalf for appeal-related data collection
  • Process payments and manage subscriptions
  • Send administrative and support communications
  • Comply with legal obligations and HIPAA requirements
  • Generate de-identified analytics for quality improvement and organizational reporting
  • Detect and prevent fraud and security threats

4. PHI Data Lifecycle & Transient Processing

ReCapture operates as a transient data processor for PHI. We process PHI only for the purpose of generating insurance appeals and facilitating the denial management workflow. Our data lifecycle is as follows:

  • Collection: PHI is collected when you create a case and is immediately encrypted using organization-specific AES-256-GCM encryption keys derived via HKDF. Patient consent confirmation is required before any PHI is accepted.
  • Processing: PHI is decrypted only when needed for display, appeal generation, or patient outreach. All PHI access is logged in a HIPAA-compliant audit trail.
  • Retention: PHI is retained for a maximum of 7 years from case creation, in accordance with HIPAA record retention requirements.
  • Purge: Upon expiration of the retention window, all PHI fields (patient name, date of birth, phone, email, insurer name, policy number, member ID) are automatically and irreversibly replaced with purge markers ([PURGED]). The case record itself is retained with status “purged.”
  • Analytics Retention: After purge, de-identified clinical data (CPT codes, ICD codes, denial reason, claim amount, appeal outcome, turnaround time) is retained in a separate analytics table. This data cannot identify individual patients and is used for organizational reporting and quality improvement.

This transient processing model minimizes the amount of PHI stored at any given time, reducing breach exposure and simplifying HIPAA compliance.

5. Data Sharing and Disclosure

We do not sell your personal information. We may share your information with service providers who assist us in operating our Service, subject to strict confidentiality agreements and Business Associate Agreements where applicable.

6. Business Associates & Sub-Processors

We maintain Business Associate Agreements (BAAs) with the following service providers who may process PHI on our behalf:

  • Convex — Backend database and serverless functions (data storage and processing)
  • Google Cloud Platform — AI/ML services (Vertex AI for appeal generation) and infrastructure
  • Mailgun — Transactional email communications
  • Twilio — SMS patient outreach communications
  • Sentry — Error monitoring (PHI is scrubbed before transmission)
  • Vercel — Application hosting and deployment

7. Data Security

We implement industry-standard and HIPAA-required security measures including:

  • AES-256-GCM encryption at rest with per-organization key derivation (HKDF)
  • TLS 1.3 encryption in transit
  • Multi-factor authentication via Clerk
  • Role-based access controls (RBAC) with owner, admin, physician, and staff roles
  • Comprehensive HIPAA audit logging of all PHI access events
  • Automatic PHI purge after 7-year retention window
  • Rate limiting on all public-facing endpoints

8. Patient Communications

When healthcare providers use our patient outreach features, we may send SMS messages to patients containing portal access links. These messages are HIPAA-compliant and do not contain any PHI in the message body. Portal access links expire after 72 hours. Patient phone numbers are stored encrypted and are purged along with other PHI after the 7-year retention window.

9. Your Rights

You have the right to:

  • Access your personal information
  • Correct inaccurate information
  • Request deletion of your information
  • Export your data
  • Opt-out of marketing communications
  • Request an accounting of PHI disclosures (as required by HIPAA)

10. Data Retention

We retain different categories of information for different periods:

  • Patient PHI: Maximum 7 years from case creation, per HIPAA retention requirements
  • De-identified analytics: Retained indefinitely for organizational reporting
  • HIPAA audit logs: Retained for 7 years per regulatory requirements
  • Account information: Retained for as long as your account is active, plus 30 days after cancellation
  • Payment records: Retained per applicable financial regulations

11. International Users

Our Service is hosted in the United States. If you access our Service from outside the US, your information will be transferred to and processed in the United States.

12. Children's Privacy

Our Service is not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.

13. CCPA Rights (California Residents)

California residents have additional rights under the California Consumer Privacy Act, including the right to know what personal information is collected and the right to opt-out of the sale of personal information.

14. GDPR Rights (EU Residents)

EU residents have rights under the General Data Protection Regulation, including the right to access, rectification, erasure, and data portability.

15. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to collect and use information about you and your interaction with our Service.

Types of Cookies We Use:

  • Essential Cookies: Required for the Service to function properly. These cannot be disabled.
  • Authentication Cookies: Used to keep you signed in and maintain your session.
  • Preference Cookies: Remember your settings and preferences.
  • Analytics Cookies: Help us understand how visitors interact with our Service (can be disabled).

Managing Your Cookie Preferences:

You can manage your cookie preferences through our cookie consent banner when you first visit our site. You can also control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of our Service.

16. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last Updated” date.

17. Contact Us

For questions about this Privacy Policy, please contact us at privacy@daventry.ai, or by mail at Daventry Cyber Solutions, 14425 Falcon Head Blvd, Building E, Suite 100, Austin, Texas 78738.