Privacy Policy

1. Information We Collect

• Account data: when you register, we collect your email address and a securely hashed password. If you sign in via a third-party provider (e.g., Google), we receive a limited profile (name, email, avatar URL) from that provider.
• Subscription & payment data: if you subscribe to a paid plan, our payment processor (Stripe) collects your payment method details. MyCareCost does not store full credit card numbers. We receive from Stripe: a customer ID, subscription status, plan tier, and billing history metadata.
• Health-adjacent usage data: when you search for medical procedures, save items to your cart, set price alerts, or use the bill-comparison tool, we store those selections in association with your account so we can provide the Service. This data reflects your interest in pricing information and is not a medical record, diagnosis, or treatment history (see Section 10 below).
• General usage data: pages viewed, device type, and aggregate interaction patterns. These analytics do not contain personally identifiable health information.
• Contact data that you voluntarily provide when submitting corrections, partner requests, or other forms (name, email, organization, message, and any attachments).
• Technical data automatically logged by our infrastructure (IP address or a hashed/pseudonymous identifier, browser type, timestamps) for security, abuse prevention, and debugging.
• Click-through and referral tracking data when you use outbound links (for example, a session identifier, hashed IP, user agent, and the destination type such as “website” or “directions”).

2. Cookies, Sessions & Local Storage

• Authentication cookies/tokens: used to keep you signed in across pages and sessions.
• Session identifiers: short-lived identifiers used for rate limiting and abuse prevention (powered by Upstash Redis).
• Saved preferences: theme, last-viewed items, and cart contents may be stored in browser local storage.
• We do not use third-party advertising cookies or cross-site tracking pixels.

3. How We Use Information

• Operate, maintain, and improve the Service.
• Authenticate your identity and manage your account and subscription.
• Process payments via Stripe and enforce subscription entitlements.
• Provide personalized features such as search history, saved carts, price alerts, and bill-comparison tools.
• Respond to corrections, partner inquiries, and support requests.
• Send transactional emails (account verification, password reset, subscription receipts, and auto-renewal confirmations).
• Send optional product updates, price-alert notifications, and newsletters if you opt in. You may unsubscribe at any time via the link in any marketing email or from your account settings.
• Monitor compliance coverage, detect abuse, and ensure platform reliability.

4. Legal Basis

We process information on the basis of: (a) performance of a contract (providing the Service and fulfilling your subscription); (b) legitimate interests (operating, securing, and improving the Service); (c) consent (when you submit forms, opt in to marketing, or accept cookies); and (d) compliance with legal obligations.

5. Sharing of Information

• Infrastructure & hosting: DigitalOcean (application servers and CDN) and Neon (PostgreSQL database hosting).
• Payments: Stripe processes subscription payments and stores payment method details on our behalf.
• Email: Mailgun delivers transactional and marketing emails.
• Rate limiting & caching: Upstash (Redis) provides rate limiting and session management.
• Analytics: we use privacy-focused, first-party analytics. No data is shared with third-party advertising platforms.
• We may also disclose information if required by law, subpoena, or court order, or to protect the rights, property, or safety of MyCareCost and its users.
• We do not sell, rent, or trade your personal information to any third party.

6. Data Retention

• Account data: retained for the lifetime of your account. When you delete your account, personal data is purged within 30 days (some anonymized usage records may remain for analytics).
• Payment records: Stripe retains transaction records per its own data retention policies and legal obligations. MyCareCost retains subscription metadata for billing history and audit purposes.
• Search history, cart items, and price alerts: retained for the lifetime of your account. Deleted when you delete your account or remove individual items.
• Usage analytics events: retained for 180 days in identifiable form, then aggregated or anonymized.
• Contact submissions: retained as long as necessary to fulfill the request and maintain an audit trail of transparency corrections.
• Technical/server logs: automatically purged after 90 days.
• You may request deletion of your personal data at any time by emailing [email protected] or by deleting your account in settings.

7. Security

We implement technical, administrative, and physical safeguards to protect information, including encrypted connections (TLS), hashed passwords (bcrypt), scoped API keys, database access controls, and infrastructure-level firewalls. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8. Your Choices & Rights

• Access & portability: request a copy of the personal data we hold about you.
• Correction: request correction of inaccurate personal data.
• Deletion: request deletion of your account and associated personal data.
• Opt out of marketing: unsubscribe from non-essential emails via the link in any marketing message or from your account settings.
• Opt out of sale/sharing: MyCareCost does not sell or share personal information for advertising. No action is required.
• Opt out of targeted advertising: MyCareCost does not engage in targeted advertising based on personal data.
• Opt out of profiling: MyCareCost does not use personal data for profiling that produces legal or similarly significant effects.
• Cookie controls: limit browser-stored identifiers by clearing cookies/site data in your browser settings (note: this may affect sign-in or saved preferences).
• To exercise any of these rights, email [email protected] or use the controls in your account settings. We will respond within 30 days (or the period required by your state’s law).

9. Appeal Process

If we deny or are unable to fully fulfill a privacy request, we will provide a written explanation. You may appeal our decision by emailing [email protected] with the subject line “Privacy Appeal.” We will review and respond to your appeal within 45 days. If you are unsatisfied with the outcome, you may contact your state’s Attorney General or applicable data protection authority.

10. HIPAA Disclaimer & Health Data Notice

• MyCareCost is not a healthcare provider, health plan, or healthcare clearinghouse. We are not a “covered entity” or “business associate” under the Health Insurance Portability and Accountability Act (HIPAA).
• We do not collect, store, or process Protected Health Information (PHI) as defined by HIPAA. We do not access medical records, insurance claims, diagnoses, treatment plans, or prescription information.
• The procedure searches, saved cart items, price alerts, and bill-comparison entries you create on MyCareCost are consumer-generated pricing research—not medical records. This data is created by you for cost-comparison purposes and is not received from or transmitted to any healthcare provider or insurer on your behalf.
• Our bill-comparison tool does not accept file uploads of medical bills, Explanation of Benefits (EOB) documents, or any documents that could contain PHI. Users manually enter dollar amounts only.
• Although HIPAA does not apply to MyCareCost, we voluntarily apply security best practices consistent with HIPAA’s Security Rule, including encryption in transit and at rest, access controls, audit logging, and employee access restrictions.

11. Consumer Health Data (Washington My Health My Data Act)

• If you are a Washington state resident: the searches you perform for medical procedures, the procedures you save or set alerts for, and bill amounts you enter for comparison may constitute “consumer health data” under the Washington My Health My Data Act (RCW 19.373).
• We collect this data solely to provide the price-comparison and cost-tracking features you request. We do not sell consumer health data. We do not share consumer health data with third parties except as necessary to operate the Service (see Section 5).
• You may request deletion of your consumer health data at any time by deleting your account or by emailing [email protected] with the subject line “Washington Health Data Request.”
• You have the right to withdraw consent to the collection of consumer health data by deleting your account, which removes all associated search history, cart items, price alerts, and bill-comparison data within 30 days.

12. State Privacy Rights

• California (CCPA/CPRA): You have the right to know what personal information we collect, use, and disclose; request deletion; and opt out of the “sale” or “sharing” of personal information. MyCareCost does not sell or share personal information for cross-context behavioral advertising. We do not discriminate against you for exercising your rights. To make a request, email [email protected] with the subject line “California Privacy Request.” We will verify your identity and respond within 45 days.
• Texas (TDPSA): You have the right to access, correct, and delete your personal data; opt out of the sale of personal data, targeted advertising, and profiling. MyCareCost does not sell personal data or engage in targeted advertising. To make a request, email [email protected]. We will respond within 45 days. You may appeal a denied request per Section 9 above.
• Virginia (VCDPA): You have the right to access, correct, delete, and obtain a portable copy of your data, and to opt out of the sale of personal data, targeted advertising, and profiling. To make a request, email [email protected]. We will respond within 45 days.
• Colorado (CPA): You have the right to access, correct, delete, and obtain a portable copy of your data; opt out of the sale of personal data, targeted advertising, and profiling. We will respond within 45 days. You may appeal a denied request per Section 9.
• Connecticut (CTDPA): Same rights as Colorado above. We will respond within 45 days.
• Oregon (OCPA): You have the right to access, correct, delete, and obtain a list of third parties to whom we have disclosed data. We will respond within 45 days. You may appeal per Section 9.
• Maryland (MODPA): You have the right to access, correct, delete, and restrict processing of your data. We practice data minimization and do not process sensitive data (including health data) for purposes beyond what is necessary to provide the Service. We will respond within 45 days.
• Illinois (home state): Illinois residents have rights under the Illinois Personal Information Protection Act (815 ILCS 530). You may request information about our data practices and receive breach notifications as required by Illinois law. My Darling Decoy Games LLC is registered in Illinois at 307 Wickliffe St, Troy, IL 62294.
• Other states: If you reside in a state with a consumer privacy law not listed above, you may exercise applicable rights by emailing [email protected]. We will comply with the requirements of your jurisdiction.

13. Data Breach Notification

In the event of a data breach involving your personal information, we will notify affected individuals and applicable state attorneys general or regulators as required by law. Notification will be made as expeditiously as practicable and without unreasonable delay, consistent with the needs of law enforcement and any measures necessary to determine the scope of the breach. Our internal incident response procedure is documented separately.

14. Children’s Privacy

The Service is not directed to children under 13 (or under 16 in jurisdictions that set a higher threshold). We do not knowingly collect personal information from children. If we learn that we have collected information from a child under 13, we will delete it promptly. If you believe a child has provided us with personal data, please contact us at [email protected].

15. International Users

If you access the Service from outside the United States, you consent to the transfer and processing of your information in the United States, where privacy laws may differ from those in your jurisdiction. If you are located in the European Economic Area (EEA) or United Kingdom, we rely on Standard Contractual Clauses or equivalent safeguards for such transfers.

16. CAN-SPAM Compliance

All commercial emails sent by MyCareCost include a clear unsubscribe mechanism. Unsubscribe requests are honored within 10 business days. Emails include accurate sender information and our physical mailing address. We do not use deceptive subject lines or false header information.

17. Changes to this Policy

We may update this Privacy Policy periodically. The “Last updated” date reflects the latest revision. For material changes, we will notify registered users via email or an in-app notice at least 30 days before the changes take effect.

18. Contact & Physical Address

• For privacy questions, data requests, or concerns, email [email protected].
• My Darling Decoy Games LLC (d/b/a MyCareCost), 307 Wickliffe St, Troy, IL 62294.