Security & PHI

Last updated October 9, 2026.

The free tools don't need PHI

The appeal generator only asks for the denial code, the payer, and optionally a CPT code and a short description of what happened. Letters come back with bracketed placeholders like [Patient Name] and [Member ID] that you fill in after copying. The free tools are not covered by a Business Associate Agreement, so please don't enter patient names, dates of birth, member IDs, or claim numbers.

What happens when you draft an appeal

1. Your inputs travel over HTTPS to our server.
2. Our server asks OpenAI's API to draft the letter, with storage of the response turned off. Per OpenAI's API terms, API data isn't used to train their models; they may keep it for up to 30 days for abuse monitoring.
3. The letter is returned to your browser. We don't save your inputs or the letter in our database.
4. Your recent letters are saved in your own browser so you can reopen them. That history stays on your device and is never sent to us.

If you email yourself a letter

We send the letter and a checklist to the address you give us through our email provider, Resend. We keep your email address and the denial code, payer, and CPT code on our waitlist. We don't keep the letter.

Analytics

Google Analytics records which tools are used, including the denial code and payer for generated appeals. Microsoft Clarity records page interactions; our tool and signup forms are marked so the text you type is masked from those recordings. See our privacy policy.

Before the paid product touches PHI

The full product will work with real claims, so it will hold protected health information. Before it does, we will have a signed Business Associate Agreement in place with every vendor that handles PHI, use zero-data-retention AI endpoints, and require your approval before any appeal is submitted. We will update this page when that is in place.

Report a security issue

Email hello@undeny.ai. We read every report and will respond quickly.