Privacy Policy

Overview

Kupu is built on the principle that your medical data belongs to you. Your documents (bills, EOBs, denial letters) are read on your phone and stay there. A small set of information leaves the phone, described below, and you can delete it at any time. We do not sell your data.

Data Collection & Processing

When you scan a medical bill, EOB, or denial letter, Kupu reads it on your phone. To check it, the app looks up reference information on Kupu's own server: billing codes and code pairs, denial codes, payer and provider names, drug names, and your two-letter state. Each lookup carries a random app ID created when you install the app, not your name. The document itself is not sent. All traffic is encrypted in transit using TLS.

When you mark an appeal as sent, and again when you record its result, the app sends Kupu a short record of it: the payer, the billing and diagnosis codes, the amounts, and the outcome, with the same random app ID. These records help Kupu learn what wins. Deleting your data in Settings removes them from our server too. When you share a letter or packet with your plan or your doctor, you send it; Kupu does not transmit it for you.

What We Can and Cannot See

If you opt in, Kupu collects usage statistics (app opens, screens viewed, letters saved) through an analytics provider to improve the product. These contain no document content. Kupu never receives your scanned documents, your name, or your address. Our server does see the lookup details and appeal records described above, tied to a random app ID.

Account Information

We collect your email address when you join the waitlist. It is used only for product communications. You can request deletion of your account and all associated data at any time.

What We Don't Do

• Sell, rent, or share your data with third parties for marketing.
• Use your health data to train AI models.
• Share data with advertising networks or data brokers.
• Share data with insurers, providers, or employers.

Third-Party Services

Kupu uses Railway to host its server, Vercel to host this website, PostHog for analytics if you opt in, and Kit for the email list. We do not share your medical data with advertising networks or data brokers.

Data Security

All data in transit is encrypted with TLS 1.2+. We will notify affected users of any breach as the law requires.

Your Rights

You can request deletion of your account and all associated data at any time. Contact privacy@kupuhealth.com for any data or privacy requests.

Children's Privacy

Kupu is not directed at children under 13 and we do not knowingly collect personal information from children under 13.

Changes to This Policy

Material changes will be communicated via email. Continued use after notification constitutes acceptance.

Questions? support@getkupu.com · Join the beta →