Security & privacy
Your name never reaches our servers.
Not because we promise to delete it — because we never receive it. The step that blacks out your details runs inside your browser, on your own machine, before the file is sent anywhere.
On your device
We find the identifying details
Your browser scans the bill for names, dates of birth, medical record numbers, account numbers, insurance IDs and social security numbers. Nothing is sent anywhere to do this.
On your device
We propose the blackouts across every page
Your name sits in the same header position on all 200 pages, so we find it once and mask it everywhere. You review a list, not a stack of pages.
On your device
You confirm, add anything we missed, remove anything we got wrong
You have the final say on every box. If a blackout would cover part of the billing table — a service date, say — we warn you, because losing those breaks the checks that find repeated charges.
On your device
The details are destroyed, not covered over
A black rectangle drawn over a PDF still leaves the text underneath, selectable and copyable. We remove the text itself from the redacted areas and repaint them, and leave the rest of the page’s text intact so we can still read your charges accurately.
Uploaded
Only the redacted file leaves your device
The original never does. What we receive is the version you approved.
What we store, and for how long
The redacted file is kept only as long as the audit needs it — a short window, after which it is deleted automatically. What survives is the extracted charge data: codes, dates, amounts, and the page positions they came from, plus small cropped images of the specific rows we flagged, so you can still check a finding after the file is gone.
You can delete everything from your account page. That deletes the data, not just the view of it.
Our safety net, described honestly
After we read your bill, we scan the extracted text again for anything that looks like a social security number, a date of birth or a record number, strip what we find, and log that it happened. This is a backstop, not the main defence.
We are not going to tell you it is impossible for a detail to slip through. We do not ask for identifying details, we remove them before upload, and we strip anything we spot afterwards. That is a real protection, and describing it accurately is part of it.
Where your data is not
The service that downloads hospital price files runs on a separate machine that never touches anything of yours. It only fetches public government data and files that hospitals publish on their own websites. If that machine were compromised tomorrow, nothing of yours would be on it.
On very large files and phones
Redacting a large PDF happens entirely in your browser, which takes memory. On a phone, a very large file can exhaust it. We check before we start and, if your device cannot manage the file, we tell you to switch to a desktop rather than letting the tab crash halfway through.
If we cannot read your file
We read the text your PDF already carries rather than looking at a picture of it and guessing what the numbers say. That is what lets every figure in your report be a figure printed on your bill. A statement that is a photograph or a scan has no text behind it, so there is nothing for us to read — and we would rather tell you than transcribe it approximately.
The fix takes about two minutes and is free: upload the PDF to Google Drive, open it with Google Docs (which reads the text off the page as it opens), then choose File › Download › PDF Document and upload that version instead. The layout will look different; we read the text, not the design.
That step puts a copy of your bill in your own Google account, which is worth knowing before you do it. We never see that copy — you come back with the downloaded file, and your browser blacks out identifying details before anything reaches us.
What we have not settled yet
Whether HIPAA applies to a service like this — where a patient hands us their own bill directly, rather than a provider or insurer sharing it — is genuinely unsettled, and we are getting proper advice rather than guessing in public. We are designing as though it applies. When we have a clear answer, this page will say so.