Privacy, in plain words.
What we collect, why, how long we keep it and how to ask us to delete it. We use no ad trackers.
Version 1 (draft), in effect from . Last updated .
In short
- We collect only what giving, campaigns and your messages need.
- We never sell, rent or trade personal data, and we use no advertising or analytics trackers.
- Giving is not open yet, so this site collects no payment details today.
- You can ask to see, correct or delete your data.
- Counsel has not reviewed this policy yet. Where a legal answer is still missing, we say so.
Who is responsible for your data
The organization below runs this website and decides how the personal data on it is used.
- Legal name
- The Medical Bill, Inc.
- Type of organization
- Not yet
- State of incorporation
- Not yet
- Formed on
- Not yet
- EIN
- Not yet
- Tax status
- Gifts to The Medical Bill, Inc. may not qualify for a federal income tax deduction. Our tax-exempt status is not confirmed yet.
- Mailing address
- 8668 Spring Mountain Rd, Las Vegas, NV 89117
- Registered to fundraise in
- Not yet
A dedicated privacy address will be listed here once it is set up. Until then, use our contact form.
What this policy covers
This policy covers this website in every language we publish, the emails we send, receipt and gift pages, campaign pages and the forms on this site.
It does not cover the websites we link to, or the separate notice we will publish for people whose medical debt we cancel. When giving opens, the secure payment step is run by our payment partner, and its own notice also applies to what you type there.
What we collect, and why
- Read our pages
- Our server records each request: the address asked for, the time, your IP address and your browser type. Why: to run the site and keep it safe.
- Pages count visits
- A page name, the language and a few speed measures. No IP address, no browser details and no identifier. Why: to see which pages help people and which are slow.
- Give (once giving opens)
- Your name, email, country, the amount and currency, the payment type and the last four digits of a card, and any dedication or message you add. Why: to process your gift, send your receipt and keep the records tax and charity law expect.
- Manage a monthly gift
- Your email, a sign-in link that works once, and a record of the changes you make. Why: so you can change, pause or stop your gift.
- Start a campaign
- Your email and display name, the page you write, a photo you upload and the name of anyone the campaign honors. Why: to publish and moderate your campaign.
- Report a campaign or a scam
- What you report and, if you give it, your email. Why: to check the report and act on it.
- Send us a message
- Your name, email and message, and the topic you choose. Why: to read your message and keep a record of it.
- Check a relief letter
- Nothing. The code and ZIP code are compared with scrambled copies and are not stored. Why: to tell you whether a letter is real.
- Use the charity-care checker
- Nothing. Your answers stay in your browser.
- Sign up for updates
- Your email, the list you chose and when you confirmed. Why: to send only what you asked for.
On this preview site, giving is not open. The donate form walks through every step, but no payment details are collected and no gift is recorded.
If you live in the European Union, the United Kingdom or Brazil, the legal basis for each use above will be listed here once counsel confirms it.
What we never collect
- Card numbers or bank account numbers.
- Social Security numbers or dates of birth.
- Medical records, diagnoses or the names of your doctors.
- Letter codes or ZIP codes in a readable form.
- Phone numbers or street addresses of donors.
We do not keep raw IP addresses with gifts, messages or reports. Where we need to slow down abuse, we keep a scrambled version for a short time. Two places do keep a raw IP address today: our server's request records, and the sign-in records of staff and campaign organizers.
How we use it, and what we never do
We use your data only for the reasons listed above. We never sell, rent, trade or swap it. We never use it for advertising, never buy data about you and never research donors' wealth.
Campaign text is checked automatically, and pages that a check flags wait for a person. A person makes every decision to reject a page.
Who else handles it
- Cloudflare
- Every request to this site, with your IP address and browser details, because it delivers our pages. Its bot check on our forms sees signals from your browser. When: every visit, and when you send a form.
- Our hosting provider
- Everything we store, on the server we run. When: always.
- Our payment partner
- What you type into the secure payment step, and your name, email, country and amount. When: only once giving opens. Not today.
- An email delivery service
- Your email address and the message we send you. When: only once we send email. We do not send email from this preview site yet.
- Our professional advisers
- What they need to audit or advise us. When: only when needed.
We will name our hosting provider, our payment partner and our email delivery service here once those choices are final.
Campaign organizers never see donors' emails. They see the display name a donor chose and gift messages after they are checked. The public sees campaign pages and the display names donors choose.
We share data with authorities or charity regulators only when the law requires it.
Cookies and browser storage
We use no advertising or analytics cookies. The few we set keep you signed in, keep a campaign draft or protect a payment. Our page counts use no cookies, and they stop when your browser sends a Global Privacy Control or Do Not Track signal.
| Name | Type | Set by | When | Why | How long |
|---|---|---|---|---|---|
| __Host-tmb_manageStrictly necessary | Cookie | Us | When you open your gifts from an emailed link | Keeps you signed in to manage your gifts | 60 minutes after your last action |
| __Secure-tmb.session_tokenStrictly necessary | Cookie | Us | When staff or a campaign organizer signs in | Keeps you signed in | Until you sign out, at most 12 hours |
| __Host-tmb_cdraftStrictly necessary | Cookie | Us | While you set up a campaign | Keeps your campaign draft | Until you submit, at most 30 days |
| tmb:exp:upsellTest of a page variant | Session storage | Us | On your first visit to the donate page | Remembers which version of the page you sawCounsel is confirming how this item is classified. | Until you close the tab |
| tmb:donate:openStrictly necessary | Local storage | Us | When the payment step opens | Remembers that a payment is in progress, so you are not charged twice | 6 hours |
| TurnstileStrictly necessary | Cookie or local storage | Cloudflare Turnstile | On forms that check for bots | Checks that a person is sending the formCounsel is confirming how this item is classified. | A short time, set by the provider |
| tmb-themeYour preference | Local storage | Us | When you choose light or dark | Remembers your light or dark choice | Until you clear it |
| tmb:lang-suggest:dismissedYour preference | Local storage | Us | When you close the language suggestion | Remembers that you closed the suggestion | 180 days |
How long we keep it
| Data | How long we keep it | What happens then |
|---|---|---|
| Gift and receipt records | 7 years from the giftCounsel is confirming this period. | Names and addresses are erased; amounts stay for the books |
| Gifts that were started but not finished | 90 days from when it is recorded | Deleted, with any dedication |
| Scrambled network addresses | 90 days from when it is recorded | Erased |
| Messages donors add to a gift | 2 years from when it is recorded | Erased |
| Messages from our payment processor | 90 days from when it is recorded | The message content is erased |
| Records that those messages arrived | 13 months from when it is recorded | Deleted |
| Links to manage your gifts | Until it expires, plus 7 days | Deleted |
| Sign-in sessions | Until it expires, plus 1 day | Deleted |
| Counters that limit repeated attempts | Until it expires, plus nothing more | Deleted every hour |
| Campaign drafts | 30 days from the last change | Deleted, with any uploaded files |
| Campaign pages | While it is public | Taken down, then deleted two years later |
| Reports about campaign pages | 2 years from the decision | Deleted |
| Messages from contact and partner forms | 24 months from when it is closed | Deleted; open conversations are kept |
| Email update subscriptions | Until you unsubscribe | Unsubscribed addresses are kept two years so we never email them again; unconfirmed ones go after seven days |
| Addresses on emails we sent | 24 months from when it is recorded | Erased |
| Relief letter files being imported | 24 hours from when it is recorded | Deleted |
| Scrambled codes of relief letters | 10 years from when it is recordedCounsel is confirming this period. | Deleted |
| Counts of page events, with nothing you typed | 13 months from when it is recorded | Deleted |
| Page speed measurements | 90 days from when it is recorded | Deleted |
| Records of what staff changed | 7 years from when it is recorded | Deleted |
| Server logs | As the server's log settings allow | Logs never hold personal data |
How long our server keeps its request records is not set yet. We will add it here when it is.
Your rights and choices
Wherever you live, you can ask us to:
- show you the personal data we hold about you, or send you a copy;
- correct it;
- delete it;
- stop using it for something you agreed to before;
- stop sending you updates.
Some limits apply. Gift records must be kept for a set time for tax and charity law; after that, your name is removed and only the amounts and dates stay. An active monthly gift has to be stopped before its records can be deleted. Choosing “Anonymous” hides your name from the public, not from your receipt or our records.
To ask, use our contact form. We may ask you to confirm the request from your email address. We store every message and review it. We can't promise a reply yet. The time limits that apply to your request depend on where you live; they will be listed here once counsel confirms them.
We do not sell personal data, so there is nothing to opt out of. You will not be treated differently for using any of these rights.
Health details
We do not ask for health information. If you mention health details in a message or a campaign, we use them only to answer you or to review the page, and we delete them when you ask.
Children and young people
This site is not meant for children under 13, and we do not knowingly collect their data. If we learn that we have, we delete it. Campaign organizers must be 18 or older.
How we protect it
- Every page and form uses an encrypted connection.
- Sign-in links, gift links and letter codes are stored only in scrambled form.
- Staff see only what their role needs, and every staff action is logged.
- Our application logs never record the content of your personal data.
If your data is ever exposed, we will tell you and the authorities as the law requires.
Where your data is processed
Our server and the services above may process your data in the United States. If you live elsewhere, your data travels there when you use this site.
People whose medical debt we cancel
We have not bought any medical debt yet, so we hold no information about anyone's medical bills. Before our first purchase, we will publish a separate notice for the people whose debt we cancel. This website will only ever hold scrambled copies of letter codes.
Links and share buttons
Share buttons open WhatsApp, LINE, Telegram, VK or your email app only when you tap them. Nothing is sent to those services before you tap, and their own policies apply after.
Changes to this policy
The version line at the top of this page shows when this policy took effect and when it last changed. Every change is listed at the end of the page. You can ask us for an earlier version.
How to reach us about privacy
Use our contact form and choose the topic that fits, or write to the mailing address above.
Changes to this page
Questions
Questions about this page? Send us a message.