PRIVACY POLICY
InvisaClaim LLC
Effective Date: June 1, 2026
Last Updated: October 21, 2026
InvisaClaim LLC (“InvisaClaim,” “Company,” “we,” “us,” or “our”) respects the privacy and confidentiality of information entrusted to us by healthcare providers, medical practices, billing organizations, and other authorized users.
This Privacy Policy (“Policy”) explains how we collect, use, process, disclose, retain, and protect information in connection with:
Our website at https://www.invisaclaim.com;
Our software platform at https://app.invisaclaim.com;
Our artificial intelligence-powered healthcare revenue cycle management services;
Our medical claims analysis, denial management, appeal generation, and workflow automation tools;
Our electronic health record, practice management, and third-party email integrations;
Related technical support, account management, and communications.
Collectively, these are referred to as the “Services.”
This Policy applies to website visitors, prospective customers, Client representatives, authorized Platform users, and other individuals interacting with InvisaClaim.
IMPORTANT HIPAA NOTICE
InvisaClaim may process Protected Health Information (“PHI”) on behalf of healthcare organizations acting as Covered Entities or Business Associates under HIPAA.
Where PHI is processed under an applicable Business Associate Agreement (“BAA”), that agreement and applicable HIPAA requirements govern the permitted use, disclosure, safeguarding, retention, and disposition of PHI.
In the event of a conflict concerning PHI, the BAA shall control to the extent required by applicable law.
This Privacy Policy does not replace a healthcare provider's HIPAA Notice of Privacy Practices.
1. INFORMATION WE COLLECT
1.1 Account and Registration Information
When individuals register for or access the Services, we may collect:
Names and professional titles;
Business email addresses;
Telephone numbers;
Healthcare organization names;
Business addresses;
Account identifiers;
Login and authentication information;
User roles and permissions;
National Provider Identifiers (“NPIs”);
Subscription selections and account preferences.
We use this information to establish and administer accounts, authenticate users, provide Services, and communicate with authorized representatives.
1.2 Healthcare Claims and Revenue Cycle Information
In connection with the Services, Clients may provide information including:
Insurance claims and claim identifiers;
Patient demographic information;
Medical billing and procedure codes;
Diagnosis codes;
Insurance payer information;
Explanation of Benefits information;
Insurance denials and adjustment codes;
Reimbursement records;
Medical necessity documentation;
Appeal correspondence;
Supporting medical records;
Claims processing histories;
Other healthcare administrative information.
Some or all of this information may constitute PHI under HIPAA.
InvisaClaim processes such information only as authorized by the applicable BAA, contractual arrangements, and applicable law.
1.3 Billing and Subscription Information
We may collect information relating to:
Provider subscriptions;
NPI-based billing identifiers;
Subscription categories;
Billing administrators;
Payment transaction histories;
Invoices;
Payment status;
Billing contact information.
Payment information may be processed by Stripe or another authorized payment processing provider.
We do not require Clients to provide complete payment card information directly to InvisaClaim where payment information is collected and processed through a designated payment processor.
1.4 Technical and Usage Information
When individuals access our website or Platform, we may automatically collect:
Internet Protocol (“IP”) addresses;
Browser types and versions;
Device identifiers;
Operating system information;
Login timestamps;
Session information;
Platform usage activity;
Error reports;
Security logs;
Authentication events;
Diagnostic and performance information.
We use this information to operate, maintain, secure, and improve the Services.
1.5 Connected Third-Party Account Information
If a user authorizes an integration with Google Workspace, Microsoft 365, or another supported provider, we may access the information necessary to perform the authorized integration.
Additional information concerning connected email accounts is provided in Section 5.
2. HOW WE USE INFORMATION
InvisaClaim processes information for legitimate operational, contractual, administrative, and legally authorized purposes.
These purposes include:
2.1 Providing Services. Operating the Platform, processing claims information, identifying insurance denials, generating appeal drafts, and performing authorized workflow automation.
2.2 Account Administration. Establishing accounts, authenticating users, managing subscriptions, and administering access permissions.
2.3 Billing and Payments. Processing recurring subscription payments, managing Provider subscriptions, maintaining transaction records, and resolving billing disputes.
2.4 Technical Operations. Maintaining Platform availability, diagnosing technical issues, supporting integrations, and improving system performance.
2.5 Security. Detecting unauthorized access, investigating security incidents, preventing fraud, and maintaining appropriate administrative, physical, and technical safeguards.
2.6 Communications. Responding to inquiries, providing technical support, sending service notifications, and communicating material changes.
2.7 Legal Compliance. Complying with applicable legal obligations, responding to lawful requests, and enforcing contractual rights.
2.8 Product Improvement. Evaluating Platform performance and improving software functionality using information lawfully available for those purposes, subject to the BAA and applicable privacy restrictions.
We do not sell PHI or use identifiable PHI for unrelated advertising purposes.
3. ARTIFICIAL INTELLIGENCE AND AUTOMATED PROCESSING
3.1 AI-Powered Services
InvisaClaim utilizes artificial intelligence, machine learning, automated decision-support systems, and related technologies to assist healthcare organizations with revenue cycle management.
These technologies may be used for:
Claims analysis;
Insurance denial classification;
Appeal drafting;
Reimbursement opportunity identification;
Claims workflow automation;
Predictive analytics;
Administrative efficiency improvements.
3.2 Processing of PHI
Where PHI is required to provide AI-assisted Services, InvisaClaim processes that information in accordance with the applicable BAA and HIPAA.
PHI may be processed through authorized infrastructure and AI service providers where appropriate contractual and regulatory safeguards are in place.
3.3 AI Model Training
InvisaClaim does not use identifiable PHI to train publicly available or general-purpose artificial intelligence models without an appropriate legal basis and express written authorization from the applicable Client.
Information properly de-identified under 45 CFR § 164.514(b) may be used for lawful product development, model refinement, statistical analysis, and Platform improvement, as permitted by the applicable BAA.
3.4 Human Oversight
Artificial intelligence-generated outputs may contain inaccuracies, omissions, or incomplete information.
Healthcare organizations remain responsible for reviewing and approving material claims, coding determinations, insurance appeals, and reimbursement-related representations before relying upon or submitting them.
InvisaClaim's Services are intended to support administrative workflows and do not independently replace professional medical, billing, or legal judgment.
3.5 Automated Decisions
The Platform may generate automated recommendations, classifications, or draft documents.
InvisaClaim does not independently determine patient eligibility for healthcare treatment or make final insurance coverage or reimbursement determinations on behalf of payers.
4. DISCLOSURE OF INFORMATION
We may disclose information to the following categories of recipients where reasonably necessary and legally permitted.
4.1 Authorized Service Providers
We may engage third-party providers for:
Cloud infrastructure and hosting;
Database management;
Artificial intelligence processing;
Cybersecurity and monitoring;
Payment processing;
Customer support;
Communications;
Software integrations;
Technical operations.
Service providers receiving PHI on our behalf must enter into appropriate Business Associate Agreements where required by HIPAA.
Other providers are subject to applicable contractual confidentiality and data protection obligations.
4.2 Healthcare and Technology Integrations
At a Client's direction, information may be exchanged with authorized electronic health record systems, practice management platforms, clearinghouses, payers, and related healthcare technology providers.
Such exchanges are limited to the purposes authorized by the Client and permitted under applicable law.
4.3 Legal Requirements
We may disclose information where required by applicable law, valid legal process, court order, or other legally enforceable governmental request.
Where legally permitted and appropriate, we may provide notice to the affected Client.
4.4 Corporate Transactions
Information may be transferred in connection with a merger, acquisition, financing, restructuring, or sale of business assets, subject to applicable confidentiality obligations, HIPAA requirements, and other legal restrictions.
4.5 De-Identified and Aggregated Information
We may use or disclose information that has been appropriately de-identified or aggregated in accordance with applicable law for legitimate analytical, research, and business purposes.
4.6 No Sale of PHI
InvisaClaim does not sell PHI.
We do not disclose identifiable patient information to data brokers or advertising networks for unrelated commercial exploitation.
5. GOOGLE WORKSPACE AND MICROSOFT 365 EMAIL INTEGRATIONS
5.1 Optional Connected Email Functionality
The Platform may permit authorized users to connect supported business email accounts, including:
Google Workspace and Gmail;
Microsoft 365 and Outlook.
These integrations may allow users to view and send authorized email communications through the Platform.
Connection requires authorization through the applicable provider's authentication and consent process.
5.2 Information Accessed
Depending on the integration and permissions granted, InvisaClaim may access:
The connected email address;
Mailbox identity and connection metadata;
Email messages requested for display;
Information required to send user-authorized messages;
Authentication tokens necessary to maintain the connection.
5.3 Google API Permissions
Google integrations may utilize OAuth permissions such as:
gmail.readonly;
gmail.send;
openid;
userinfo.profile.
The permissions requested shall be limited to those necessary for supported functionality.
5.4 Microsoft Graph Permissions
Microsoft 365 integrations may utilize delegated permissions including:
Mail.ReadWrite, where necessary for enabled functionality;
Mail.Send;
offline_access.
Actual permissions depend on the integration configuration and user authorization.
5.5 Email Content Retention
The connected email feature is designed to retrieve and display requested mailbox content through the applicable provider's APIs rather than maintain a separate permanent mailbox repository.
Where this architecture is implemented, email content is processed transiently and is not intentionally retained as a separate archive by InvisaClaim.
Limited technical processing, security logging, or temporary system handling may occur where necessary to operate and secure the integration, subject to applicable law and contractual requirements.
Users should not assume that copies of messages intentionally saved into other Platform functions, such as claims records or appeal documentation, are excluded from normal Client Data retention rules.
5.6 Authentication Tokens
InvisaClaim may retain encrypted OAuth refresh tokens and limited connection metadata necessary to maintain authorized connections.
Access to these credentials shall be restricted to authorized system components and personnel with a legitimate operational need.
5.7 Google Limited Use Requirements
InvisaClaim's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Information received through Google APIs shall not be used for advertising or to develop, improve, or train generalized artificial intelligence or machine learning models in violation of Google's applicable requirements.
5.8 Microsoft Account Data
Information obtained through Microsoft Graph shall be processed in accordance with applicable Microsoft API requirements, authorized permissions, and this Privacy Policy.
5.9 Healthcare Email Accounts
Healthcare organizations are responsible for ensuring that connected email accounts and their use comply with applicable privacy and security obligations.
Where email communications contain PHI, processing shall be subject to the applicable BAA and HIPAA requirements.
5.10 Revocation of Access
Users may disconnect supported accounts through available Platform settings or revoke authorization directly through their email provider.
Upon disconnection, InvisaClaim shall disable the corresponding integration and delete or invalidate stored authorization tokens in accordance with applicable operational and security procedures.
6. HIPAA AND PROTECTED HEALTH INFORMATION
6.1 Business Associate Role
When processing PHI on behalf of a Covered Entity or another Business Associate, InvisaClaim acts in the capacity established by the applicable contractual relationship and HIPAA.
6.2 Business Associate Agreement Requirement
Where HIPAA requires a BAA, the appropriate agreement must be in place before PHI is disclosed to or processed by InvisaClaim.
6.3 Permitted Uses
PHI shall be used and disclosed only as permitted by the applicable BAA, HIPAA, and other applicable law.
6.4 Safeguards
InvisaClaim shall implement administrative, physical, and technical safeguards required by the HIPAA Security Rule.
6.5 Breach Notification
InvisaClaim shall report breaches and security incidents in accordance with applicable law and the BAA.
6.6 Patient Rights
Individuals seeking access to, amendment of, or an accounting of disclosures concerning PHI maintained by their healthcare provider should generally direct requests to the applicable provider or Covered Entity.
InvisaClaim shall assist its Clients in fulfilling applicable HIPAA obligations as required by the BAA.
7. INFORMATION SECURITY
InvisaClaim maintains a security program designed to protect information against unauthorized access, disclosure, alteration, and destruction.
Safeguards may include, as applicable:
Encryption of information in transit and at rest;
Access controls;
Authentication and authorization procedures;
Role-based access restrictions;
Audit logging;
Security monitoring;
Risk assessment and management;
Vulnerability management;
Workforce confidentiality requirements;
Incident response procedures;
Secure infrastructure management;
Appropriate vendor oversight.
Safeguards are implemented in accordance with applicable legal requirements and the nature of the information processed.
Although we take reasonable and legally required steps to protect information, no electronic system or transmission method can be guaranteed to be completely secure.
Users are responsible for protecting their account credentials and promptly reporting suspected unauthorized access.
8. DATA RETENTION AND DELETION
8.1 Active Subscriptions
We retain Client Data as necessary to provide contracted Services, maintain account functionality, and satisfy applicable legal and contractual obligations.
8.2 Termination or Cancellation
Following termination or cancellation of a subscription, Clients generally have thirty (30) calendar days to export available Client Data, as provided in the Master Services Agreement and applicable BAA.
8.3 Production Data Deletion
Following the applicable export period, InvisaClaim shall return, delete, or otherwise dispose of Client Data in accordance with the BAA, applicable law, and established retention procedures.
8.4 Backups and Archival Information
Certain information may remain temporarily in encrypted backups, disaster recovery systems, immutable security logs, or archival storage where immediate deletion is not feasible.
Such information shall remain subject to applicable confidentiality and security obligations.
8.5 Legally Required Retention
Information may be retained where necessary to comply with legal obligations, resolve disputes, enforce agreements, or satisfy legitimate recordkeeping requirements, to the extent permitted by applicable law and the BAA.
8.6 Connected Email Accounts
Connection tokens and associated metadata are deleted or invalidated following disconnection in accordance with applicable technical procedures.
8.7 Client Export Responsibility
Clients are responsible for retrieving records they are legally required to maintain, including medical billing documentation and claims records, within applicable export periods.
9. PRIVACY RIGHTS AND REQUESTS
9.1 General Privacy Requests
Subject to applicable law, individuals may request:
Access to personal information;
Correction of inaccurate information;
Deletion of eligible personal information;
Information concerning certain disclosures;
Copies of personal information;
Withdrawal of consent where processing depends upon consent.
9.2 State Privacy Laws
Individuals residing in states with applicable comprehensive consumer privacy laws may possess additional rights, including rights to access, correct, delete, or obtain certain personal information and to opt out of specified processing activities.
The availability of these rights depends upon applicable statutory thresholds, exemptions, and the nature of the information involved.
9.3 California Privacy Rights
Where the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies, eligible California residents may exercise the rights provided by that law, subject to statutory exceptions.
InvisaClaim does not sell personal information as described in this Policy.
9.4 PHI Requests
PHI processed by InvisaClaim on behalf of healthcare organizations is generally governed by HIPAA and the applicable BAA rather than consumer privacy request procedures.
Requests concerning patient records should ordinarily be directed to the relevant healthcare organization.
9.5 Verification
We may request information reasonably necessary to verify identity and authority before responding to privacy requests.
9.6 Contact
Privacy requests may be submitted to:
We will respond within the time required by applicable law.
10. COOKIES AND TRACKING TECHNOLOGIES
10.1 Cookies
Our website and Platform may use cookies and similar technologies for:
User authentication;
Session management;
Security;
Platform functionality;
Performance measurement;
Website analytics;
User preferences.
10.2 Analytics
We may use website analytics services to understand visitor activity and improve website performance.
Any analytics technology deployed on authenticated healthcare pages or pages containing PHI must comply with applicable HIPAA requirements.
10.3 Advertising and Tracking Restrictions
InvisaClaim does not authorize the disclosure of PHI to advertising platforms through tracking technologies unless expressly permitted by applicable law and supported by all required agreements and authorizations.
10.4 Cookie Preferences
Users may manage certain cookies through browser settings or available website preference controls.
Disabling essential cookies may interfere with Platform functionality.
11. THIRD-PARTY WEBSITES AND SERVICES
The Services may include links or integrations with third-party websites, applications, and systems.
Third-party services may operate under their own privacy policies and contractual terms.
InvisaClaim is not responsible for independent third-party privacy practices outside its control, except to the extent applicable law or contractual obligations impose responsibility.
12. CHILDREN'S PRIVACY
The Services are intended for business and professional users who are at least eighteen (18) years of age.
We do not knowingly solicit personal account registrations from children.
However, authorized healthcare organizations may process information concerning minor patients through the Platform where legally permitted and subject to applicable HIPAA requirements.
This distinction does not eliminate the privacy protections applicable to minor patient information.
13. INTERNATIONAL DATA PROCESSING
InvisaClaim is headquartered in the United States.
Information may be processed in the United States or other jurisdictions where authorized service providers operate, subject to applicable law and contractual restrictions.
Where international data transfers are subject to additional legal requirements, InvisaClaim shall implement appropriate measures as required.
PHI shall not be transferred or processed in a manner inconsistent with applicable contractual restrictions, HIPAA requirements, or other governing law.
14. DATA BREACHES AND SECURITY INCIDENTS
InvisaClaim maintains procedures for identifying, investigating, and responding to suspected information security incidents.
Where an incident involves PHI, notification and cooperation obligations shall be governed by the applicable BAA and HIPAA.
Where an incident involves other personal information, InvisaClaim shall provide notifications required by applicable federal or state law.
Security incident reporting does not, by itself, constitute an admission of negligence or legal liability.
15. BUSINESS TRANSFERS
In connection with a merger, acquisition, financing, restructuring, or transfer of substantially all relevant business assets, information may be disclosed or transferred to authorized parties where legally permitted.
Any transfer involving PHI shall remain subject to applicable HIPAA and BAA requirements.
16. CHANGES TO THIS PRIVACY POLICY
InvisaClaim may revise this Privacy Policy to reflect:
Changes in applicable law;
Changes in Platform functionality;
New integrations;
Security or privacy improvements;
Changes in data processing practices;
Regulatory developments.
Material changes shall be communicated through appropriate methods, which may include website publication, Platform notifications, or email.
The “Last Updated” date identifies the most recent revision.
Changes to this Policy shall not independently amend an executed BAA or authorize uses of PHI prohibited by law.
17. RELATIONSHIP TO OTHER AGREEMENTS
This Privacy Policy supplements the applicable Master Services Agreement, Order Forms, and Business Associate Agreement.
In the event of inconsistency:
The BAA controls regarding PHI privacy, security, permitted uses, and HIPAA compliance.
The MSA and applicable Order Forms govern contractual Services, subscriptions, payment obligations, and other commercial matters.
This Privacy Policy describes InvisaClaim's applicable information processing practices and privacy commitments.
Nothing in this Policy reduces rights or obligations imposed by applicable law.
18. CONTACT INFORMATION
Questions, privacy requests, or concerns regarding this Privacy Policy may be directed to:
InvisaClaim LLC
433 Plaza Real, Suite 275
Boca Raton, FL 33432
General Inquiries: hello@invisaclaim.com
Privacy and Legal: legal@invisaclaim.com
Website: https://www.invisaclaim.com
Platform: https://app.invisaclaim.com
© 2026 InvisaClaim LLC. All rights reserved.