About Privacy policy
Privacy Policy
The short version
- HerePup runs on your own device, in your web browser at herepup.health/app. (A desktop version with direct insurer connections is in private testing.) Your documents, claims and insurer records are read and stored there, and HerePup never stores them. The only time any of it passes through a HerePup service is when the sign-in helper relays an insurer's reply to your browser.
- To learn how many people HerePup helps, the website counts anonymous visits and a few steps, such as "Answer shown", using Plausible Analytics. It uses no cookies, and none of your documents, numbers or health information are included. Details and how to opt out.
- HerePup does not sell, rent or share your information, and does not use it for advertising, marketing or insurance underwriting.
- The app connects to your health insurer only when you choose to, with your own sign-in at the insurer, and only to read your data. For some insurers, the sign-in step, and for some the claims themselves, pass through HerePup's sign-in helper on the way to your browser. The helper stores and logs nothing.
- You can disconnect your insurer or delete all of your data in the app at any time.
- HerePup follows the CARIN Alliance Code of Conduct, a voluntary set of privacy rules for consumer health apps.
Who we are
HerePup ("HerePup", "we", "us") makes HerePup | Pick yoUr Plan, an app that helps households compare health plan options using their own claims history. HerePup is operated by Christopher Arthur, its founder, who is responsible for its privacy practices. Contact us at [email protected] or through our contact page.
What the app uses, and why
| Information | Where it comes from | How it is used |
|---|---|---|
| Household members' first names and whether each is an adult or child | You type it in | To work out coverage levels (for example, employee plus family) and match claims to people |
| Benefit guides and plan details: premiums, deductibles, copays, HSA contributions | Documents you upload, and numbers you enter | To model what each plan would charge |
| Claims: service dates, providers, billed and allowed amounts, what the plan paid, what you owed, place of service, procedure and revenue codes, provider specialty | Explanation-of-benefits PDFs and claim summaries you upload, or your insurer's Patient Access API if you connect it | To replay your claims through each plan and to check the model against what your insurer actually charged |
| If you turn on "We're expecting a baby": the due month, who is pregnant, and the birth scenario and price level you pick | You choose it | To add the usual costs of a pregnancy, birth and the baby's first year, at national average prices, to the estimate. It is saved on your device like everything else, never sent to HerePup and never included in the usage counts. |
| Programs your employer offers, such as virtual physical therapy, counseling or video visits | The benefit guides you upload (the name, page, a short quote and any sign-up link or phone number printed next to it), and programs you tick in PupPlace | To list them in PupPack and show them first in PupPlace when they fit the care you need. They're saved on your device, never sent to HerePup and never included in the usage counts. |
| A photo or PDF of a medical bill you check with PupPair (in preview for PupPen members), and a dispute you prepare from it: the issues, what you ask for, your name and contact, insurance details and the names of documents you add | You take the picture, add the files and type the details | To read the provider, dates, amounts and wording on the bill, on your device, compare them with your saved claims, and prepare the dispute and track replies. The photo is never sent to HerePup or saved. PupPay payments you schedule for a bill PupPair has checked (the provider, amount, dates and the kind of account, never account numbers) are kept the same way. During the preview, disputes and payments stay in your browser, nothing is sent and no money moves; before PupPen sends a dispute for real, this policy will say what's shared and with whom, and you'll be asked to agree. |
| Prior authorizations you track with PupPermit (in preview for PupPen members): the service, the steps you mark done, dates, the approval or denial details you enter, and an appeal you prepare (your name, member ID, insurer, reference number and contact) | You enter them; PupPermit also counts the physical therapy visits on your saved claims as evidence for the appeal | To show what's still needed before your plan can decide, when the decision is due, and to draft an appeal. During the preview, everything stays in your browser and nothing is sent; before PupPen sends an appeal for real, this policy will say what's shared and with whom, and you'll be asked to agree. |
| Insurer coverage record (plan name, coverage dates) | Your insurer, if you connect it | To show which plan your claims were processed under |
| Access tokens from your insurer | Your insurer, after you approve the connection | To read your data from the insurer when you press Pull claims |
The app does not use diagnosis information to make its estimates. It reads only what is needed to price claims under each plan, and it uses your information only for what you see in the app: estimating plan costs, showing when costs land, and showing where the same care cost less.
No de-identified data. HerePup does not create, use, sell or share de-identified, anonymized or pseudonymized versions of your health information. The only counts HerePup keeps are the anonymous usage counts, which never include health information. We will never try to re-identify anyone from data that has had identities removed.
Other people in your household
A household's claims include care for everyone on the plan, so they can reveal information about your spouse, partner or children. Add only people you are authorized to act for, and connect only your own insurer account: each adult signs in to their own account, and the insurer decides what it shares for each person. Information about other people stays on your device like everything else, and "Delete all my data" removes it.
Where your information is stored
Web version (herepup.health/app). Your files are read by your browser on your device; they are not uploaded. What HerePup reads from them (your household, plans and claims, but not the files themselves) is saved in your browser's own storage on that device so you can come back to it. It stays there until you choose "Delete all my data" or clear your browser's site data. Anyone who uses the same browser profile on that device could see it, so use your own device and browser profile.
The web version loads its program files, including the free open-source PDF reader (pdf.js) and the reader for scanned pages (Tesseract), from herepup.health itself. Other than the anonymous usage counts described under Usage counts, it does not contact any other service unless you connect an insurer (see Connecting to your insurer).
Desktop version (in private testing, not publicly available). Everything above is stored in the app's data folder on the computer where you run HerePup. HerePup has no servers that receive or store your health information, and we cannot see it. Copies of the data you pull from your insurer are kept in that folder so you can review exactly what was received.
Because your information lives on your device, its security also depends on your device. We recommend using HerePup only on a computer you control, with a password and up-to-date software.
How your information is protected
- No HerePup servers hold it. Your documents, plans and claims are read and kept on your own device. HerePup has no database of user information to lose. The sign-in helper passes some insurer replies through but never keeps them.
- Encrypted in transit. herepup.health, the sign-in helper and every insurer connection use encrypted HTTPS connections.
- On your device. HerePup doesn't add its own encryption to what it saves in your browser or the desktop app's folder; it is protected by your device and browser. Turning on your device's disk encryption and a screen lock protects it further.
- Insurer access. You sign in on your insurer's own page, using your insurer's own credentials; HerePup never sees or stores your insurer password. Access is read-only. In the web version the access token is kept only in that browser tab.
- The sign-in helper. HerePup's app secrets are kept in Cloudflare's encrypted settings, never in the app. The helper only answers requests from herepup.health, only for HerePup's own callback page, and only ever contacts the insurer sign-in and claims addresses it was built for. It reads claims only with your own access token, never with HerePup's app secret, and only read-only. Request logging is turned off.
- No accounts. HerePup has no user accounts or passwords, so there are no dormant accounts to take over. Insurer access tokens expire on the insurer's schedule.
If something goes wrong
If we learn of a security incident affecting HerePup's systems (such as this website or the sign-in helper) or our users' information, we will investigate promptly, fix the cause, and notify affected users, insurers and regulators as the law requires, including the Federal Trade Commission's Health Breach Notification Rule where it applies. Because HerePup has no accounts, we will post a notice on herepup.health and in the app, and email anyone who has given us their email address.
Connecting to your insurer
Direct insurer connections are in testing, in a private desktop version and in the web version, and aren't available to the public yet. Today you download your claims from your insurer yourself and drop the files in. The rest of this section describes how connections work in testing, and how they will work once insurers approve HerePup.
Before connecting, the app asks you to confirm that you want it to read your claims and coverage from that insurer, with a link to this policy. When you choose to connect an insurer (for example, Aetna), the app sends you to the insurer's own sign-in page. You sign in there and approve read-only access; HerePup never sees or stores your insurer username or password. The insurer then gives the app an access token, which is used only to read your claims when you connect or ask the app to pull claims. The desktop version stores it on your computer. The web version keeps it only in that browser tab, and it's gone when you close the tab. Either way, your claims end up only on your device: the desktop version and most insurers send them straight there, and in the web version, insurers that don't let a web page read claims directly send them through the sign-in helper, which passes them on without keeping them.
Sign-in helper (web version). Some insurers, including Aetna, require an app secret to finish a sign-in, and don't let a web page do that step itself. For those insurers, the web version sends the one-time sign-in code from your insurer to HerePup's sign-in helper, a small service HerePup runs on Cloudflare's network. The helper adds HerePup's app secret, exchanges the code with your insurer for an access token, and passes your insurer's answer straight back to your browser. It doesn't store or log the code or the token.
Passing claims through (web version). Some insurers, including Aetna, also don't let a web page read your claims directly. Your browser always tries your insurer first. If the insurer blocks it, your browser sends the helper your access token and the insurer address it needs; the helper makes that one read-only request to your insurer and streams the insurer's reply (your coverage, claims and the providers they name) straight back to your browser. It uses only your own access token, never HerePup's app secret, so it can't read anything you didn't approve. It only contacts that insurer's claims server, and it doesn't store, log, read for any other purpose, or keep a copy of your token or your claims.
One-time, not ongoing. HerePup reads your records only when you connect or press "Pull claims again". It does not refresh them in the background or on a schedule. What it reads is your coverage record, your explanations of benefits (claims) and the providers they name.
You can end this access at any time with Disconnect in the app, which deletes the stored tokens so HerePup can't read anything more. Claims already brought into HerePup stay on your device until you remove them with "Delete all my data". You may also manage connected apps with your insurer directly. Each adult on a plan connects separately and the app receives only the data the insurer makes available to that person.
Seeing, correcting and checking your information
- Everything HerePup has is in front of you. Every claim is shown for you to review before it's saved, and your household, plans and saved claims are all in the app. The desktop version also keeps a copy of exactly what your insurer sent; the web version lets you download it while testing a connection.
- You can correct it. You can change, skip or delete any row before saving, edit plan details at any time, and re-import. Changes stay in HerePup on your device; they aren't sent to your insurer. To correct your insurer's own records, contact your insurer.
- Where each claim came from. HerePup records which file or insurer connection each saved claim came from, and when it was added.
- Incomplete or late data. Claims usually reach your insurer's records a few weeks after the care, and documents or insurer data can be incomplete or contain errors. HerePup highlights rows it couldn't read fully or whose amounts don't add up, asks you to check them, and shows how closely its model matches what your insurer actually charged. Its results are estimates, not guarantees.
Information sent to anyone else
The web version sends only the anonymous usage counts described under Usage counts, which never include your information, and any feedback or contact message you choose to send (see Messages you send us). If you connect an insurer from the web version, it also contacts your insurer to read your own records, and HerePup's sign-in helper for the one-time sign-in exchange and, for insurers that require it, to pass your claims through. The desktop version sends requests directly from your computer to:
- Your insurer, only after you connect it, to read your own records.
- The public NPI Registry run by the U.S. Centers for Medicare & Medicaid Services, to look up a provider's specialty (for example, whether a visit was with a specialist). Only provider names, and a state if you enter one, are sent; never your name, amounts or diagnoses. You can turn this off in the app.
Nothing else is sent. The desktop version includes no advertising, analytics or tracking, and neither version includes advertising or tracking across other websites. HerePup never sends your information to anyone you didn't choose: the only destinations are your own device and the insurer you connect.
When we would disclose anything. HerePup shares your information with a third party only if you choose to, and the app asks for your clear permission first. The only disclosures without your permission would be ones the law requires (for example, a valid court order) or a change of ownership described under If HerePup is sold or closes. Because your health information stays on your device, the only things we hold that could ever be requested are messages you send us; we would tell you about any legal request unless the law forbids it.
Marketing. HerePup does not market its own or anyone else's goods or services using your information, and does not share it for marketing. If that ever changed, we would ask for your separate permission first, and saying no would not affect your use of HerePup.
Service providers. HerePup uses GitHub Pages to host this website, Cloudflare to run the sign-in helper, Plausible Analytics for anonymous usage counts, and Web3Forms to deliver messages you send us. Each is bound by its own terms and privacy commitments. None of them receives your documents, plans or claims; Cloudflare handles only the one-time sign-in exchange described above, which it doesn't keep.
What we never do
- Sell, rent, license or trade your information.
- Share it with employers, insurers, brokers, advertisers or data brokers.
- Use it for advertising, or for underwriting or pricing insurance.
- Change how your information is used without asking you first.
Deleting your information
"Delete all my data" in the app permanently removes your household, plans and claims from that browser (web version), or your household, plans, claims, uploaded files, insurer tokens and pulled data from your computer (desktop version). Clearing herepup.health's site data in your browser, or removing the desktop app's folder, does the same. Because we never receive your information, there is nothing for us to delete on our side.
If HerePup is sold or closes
If HerePup or its assets are sold or transferred, there is no database of user information to hand over: your information stays on your device. Any new owner must keep the promises in this policy for HerePup, or ask for your permission before changing how your information is used or shared, as described under Changes to this policy. We will post a notice on herepup.health and in the app before a transfer takes effect.
If HerePup shuts down, we will post a notice on herepup.health and in the app, turn off the sign-in helper and delete HerePup's insurer app secrets, and ask insurers to end HerePup's access. Information already on your device stays there until you delete it, and "Delete all my data" will keep working in the copy of the app you have open.
HIPAA
HerePup is a consumer app that you choose to use with your own information. It is not a health plan or health care provider, and it does not act on behalf of one, so HIPAA generally does not apply to information you bring into HerePup. We handle it as described in this policy regardless.
Children
HerePup is meant to be used by adults managing their household's coverage. It is not directed to children under 13, and we don't knowingly collect information from them. A household's claims may include children's care, entered by a parent or guardian; that information is handled the same way as everyone else's and stays on your device.
Usage counts
To know how many people use HerePup, and where they get stuck, herepup.health uses Plausible Analytics, a privacy-focused service that keeps its data in the EU. It uses no cookies and does not follow you across other websites or from one day to the next.
What is counted:
- Page visits on herepup.health, including the app at herepup.health/app.
- A few steps, each sent by its name only: "Plan added", "Claims added", "Answer shown", "Month by month opened", "Feedback clicked", "Check a bill opened", "Bill checked" and "Insurer requested". The last one doesn't say which insurer.
- "Guide read", each time the app reads a benefit guide, with three labels and nothing else: whether the plans were read fully, partly or not at all; which kinds of detail were missing (premiums, prescriptions or HSA deposits); and whether any of the app's checks flagged a number. It never includes the file, its name, the employer, plan names or any amount. These counts tell us which kinds of guides the reader gets wrong.
With each count, Plausible receives what any website receives: the page address, the site you came from, your browser, operating system and device type, and an approximate location (country, region and city) that it works out from your IP address. Plausible does not store your IP address; it groups the pages of one visit with an identifier that is reset every 24 hours. Plausible does not sell this data or use it for advertising.
What is never sent with these counts: your documents or their file names, the names of people in your household, plan names or details, premiums, claims, providers, amounts, or any other health information. The app never puts any of these in a page address.
Opting out. Ad and tracker blockers stop these counts, or you can turn them off in this browser here:
Messages you send us
If you fill in the feedback questionnaire in the app, request an insurer connection, ask us to list a provider, or use the form on our contact page, what you type is sent through Web3Forms, a form service, to our email so we can read it and reply. Providers who send us their listing (prices, hours, wait times and booking details) use the same service; a listing carries information about the location, never about patients. PupPlace, HerePup's care finder, can show your PupPack, the places your household already uses, by reading the claims you saved in HerePup on the same device; it reads them in your browser and never sends them. PupPack also lists the programs your household has through an employer: those your benefit guide names, those on your saved claims, and those you tick. It works them out in your browser and never sends them. If you ask us to list providers from your PupPack, only the provider names you tick are sent, with no dates, amounts, diagnoses or names of people. That includes your email address only if you enter it. The app never adds your documents, plans, claims or amounts to a message, and we ask you not to type health information into one. Web3Forms may keep a copy for a limited time under its own privacy policy. We use messages only to improve HerePup, to decide which insurers to connect and which providers to list first, and to reply to you. If you give your email with an insurer or provider request, we write to you only about that connection or listing.
Reviews you send
PupPlace lets you review a provider: the month of your visit, whether you'd go back, tags such as "Seen on time" or "Ran late", an optional written review, an optional name to show, and an optional email address. It's sent through Web3Forms to our email, like the messages above. We read every review before publishing it. If it follows the review rules shown with the form, we publish it on PupPlace with the provider, the month, your answers, your words and the name you chose, or "A patient" if you leave the name blank. Before publishing, we may remove contact details, anyone else's personal or health information, and anything else that breaks the rules; we don't change what you meant. We never publish your email address, and use it only to write to you about that review. Please leave out health details you don't want public. A review is never linked to the claims, plans, documents or care path answers on your device. To change or remove a review you sent, contact us. When PupPass check-in is available, a review from a visit you checked into will be marked "Verified visit"; we'll describe how that works here before it starts. Until then, reviews show as not verified.
This website
herepup.health is a simple informational site hosted on GitHub Pages. It uses no cookies and no advertising or cross-site tracking; it counts anonymous visits as described under Usage counts. Like any web host, GitHub may keep standard server logs, such as IP addresses, for security; see GitHub's privacy statement. If you email us, we use your message only to reply.
Before you connect: what to know
- Once your insurer sends your claims to HerePup, they're on your device and protected by this policy, not by HIPAA. Keep your device secure.
- Your claims can show sensitive things, such as visits, prescriptions and providers, for you and your family. Only connect when you're comfortable with that data being on the device you're using.
- You don't have to connect to use HerePup: you can download your claims from your insurer's website and drop the files in instead.
- Before connecting any health app, read its privacy policy, check whether it sells or shares data, and check how you can delete your information.
Our commitments
- HerePup follows the CARIN Alliance Code of Conduct, a voluntary code for consumer-facing health apps covering transparency, consent, use and disclosure, individual access, security, provenance, accountability, education and advocacy.
- We follow the federal and state laws that apply to HerePup. Christopher Arthur, HerePup's founder, is responsible for these practices, reviews them at least once a year and whenever HerePup changes how it handles information, and will train anyone who joins HerePup on them.
- HerePup has no third-party privacy or security certification (such as SOC 2, HITRUST or CARIN accreditation) at this time. We will list any we earn here, with their dates.
- HerePup uses open standards (HL7 FHIR and the CARIN Blue Button format) and supports giving people secure, easy access to their own health information.
Changes to this policy
If we change this policy, we will update the date above and note what changed. If a change would affect how your information is used or shared, we will explain it in the app and ask you to agree before it applies to your information. If you agree, HerePup continues under the updated policy. If you don't, the change won't be applied to your information: you can keep what's on your device or delete it. Connecting an insurer after a change to the connection terms asks for your agreement again.
Contact and complaints
Questions, requests or complaints: [email protected] or our contact page. We reply within 30 days, and usually much sooner.