The Medical Fairness Project

The short version

We collect only what a hospital needs to decide a charity care application.
We use it to prepare your application, send it to the hospital for you, and follow it up, and for nothing else.
We never sell it, rent it, or use it for advertising.
We share it with the hospital you name, and with the service providers that run this website.
You can ask us to delete it at any time.

1. Who we are

The Medical Fairness Project (“we”, “us”) is a California nonprofit. We help patients apply for the free and discounted hospital care California law requires hospitals to offer. This policy covers this website and the information you give us through it, by email, or by phone.

2. What we collect

When you check your eligibility

Household size
Annual household income before tax
The California hospital that sent the bill
Bill type: the hospital’s own bill, or a separate emergency room physician bill

The eligibility check runs in your browser. These answers are not sent to us unless you go on to submit an application. If you do, they are saved with it, along with whether your income was under the qualifying limit at the time.

When you submit an application

Full name
Email address and phone number
Mailing address
Approximate bill amount and date of service
Documents: a copy of the bill and proof of income, such as a pay stub or tax return, and, where the hospital requires one, its own application form signed by you. You can add these when you apply or afterwards, and we may add letters the hospital sends about your application. They are uploaded to private storage (see section 5). Only the staff member who reviews and sends applications can open them, and they go to no one but the hospital.
Your electronic signature on our authorization to act for you: the name you type to sign it, and when you signed.

The bill amount, date of service, and hospital name reveal that you received medical care. We treat all of this as sensitive, whether or not a particular law classifies it that way.

When you contact us

If you email or call us, we keep what you send us and our replies, so we can help you and keep your case record accurate.

Collected automatically

Our hosting provider records standard request logs: IP address, browser type, the page requested, and the time. These logs are used to keep the site running and secure, are kept for a limited time, and are not used to identify you. We do not use analytics, advertising, or tracking cookies, and no third-party trackers run on this site.

If something on the site breaks, an error report is sent to our error-monitoring service so we can fix it. It contains technical details such as the error message, browser type, and the page’s address. It is set up so that it does not include what you typed into a form, your cookies, or who you are.

While you fill in the forms, your answers are saved in your browser’s session storage so you do not lose them if you open another page. That copy stays on your device and is erased when you close the tab. After you submit, the confirmation page keeps a copy of your application there too, so it still works if you reload it; that copy is erased the same way. The staff sign-in area sets a login cookie for staff only; patients never receive one.

3. How we use it

We use your information to:

Tell you whether you are likely to qualify for charity care
Prepare your application for the hospital’s financial assistance program
Send it to the hospital for you, under the authorization you sign when you apply, and follow up until there is a written decision
Call, text, or email you about your application, including to ask for missing documents. These messages are about your case only; reply STOP to any text, or tell us, and we will use another way to reach you.
Appeal a denial, if you want us to
Count what we do (for example, how many applications were approved and the total amount forgiven) in totals that cannot identify you

We do not use your information for marketing, and we will not add you to a fundraising or newsletter list unless you ask to be on one.

We share your information only in these cases:

The hospital or physician group that billed you. Submitting your application means sending it the information in your application, your documents, and the authorization you signed. We share it with no other hospital.
Our service providers, who store or deliver data for us, and whose terms limit how they may use it. They are listed in the next section.
When the law requires it, such as a valid subpoena or court order. Where the law allows, we will tell you before we respond.
With your permission, for example with a family member or advocate you ask us to speak with.

We do not sell or rent personal information, and we do not share it for advertising.

We never publish your name, photo, or story, including as a testimonial, without your written permission.

5. Third-party services

Supabase, Inc.: Hosts our database, the documents you upload, and staff sign-in. Applications and documents are stored there. Access is restricted so that they can be read or written only from our own server, never directly from a web browser. Your documents go into private storage through a single-use upload link, and only the staff member with access to our case queue can open them, through links that stop working after ten minutes. Data is encrypted in transit and at rest. Supabase’s own privacy policy is at supabase.com/privacy.
Vercel, Inc.: Hosts and serves this website, and processes the request logs described above. Vercel’s privacy policy is at vercel.com/legal/privacy-policy.
Functional Software, Inc. (Sentry): Receives the error reports described in section 2, so we can find and fix problems. We remove form contents, cookies, request headers, and anything identifying you before a report is sent, Sentry is set not to store IP addresses, and we do not use it to record sessions or track visitors. Sentry’s privacy policy is at sentry.io/privacy.
Google LLC (Gmail): Runs our email inbox. Messages you send us and their attachments are stored there, and so are applications we email to hospitals and the hospitals’ replies and decisions, which we ask them to copy to us. Google’s privacy policy is at policies.google.com/privacy.
Phone provider: If you call or text us, the call or message passes through our telephone service provider.

Fonts are served from our own website, so loading a page does not contact Google or any other font service. If we add a service that receives your personal information, we will list it here first.

6. How long we keep it, and deleting it

Open cases: we keep your application for as long as we are working on it, including any appeal.
Closed cases: we keep a closed case for two years after the hospital’s final decision, so we can help if the hospital reverses itself, bills you again, or sends the account to collections. After that we delete it.
Applications we never act on: if we cannot reach you and the case goes nowhere, we delete it one year after you submitted it.
Documents: your documents and signed authorization are kept with your application and deleted with it, on the timelines above.
Totals: counts and amounts that cannot identify you may be kept indefinitely.

Asking us to delete your information

Email MedicalFairnessProject@gmail.com or call (925) 999-5020 and ask. We will confirm it is you, then within 30 days delete your application, the documents you uploaded, our correspondence with you, and any copies our staff hold, and tell you when it is done. If your application is still with a hospital, we will ask whether you want us to withdraw it first. Copies in our encrypted backups are erased as those backups roll over, and are never used to restore your record. We cannot delete copies we have already sent to a hospital; those are held under the hospital’s own privacy obligations.

7. Your other choices

At any time you can ask us to:

Tell you what information we hold about you, and send you a copy
Correct anything that is wrong
Stop working on your application

Contact us using the details in section 12. We will not treat you differently for asking. You do not need an account to use this site, and there is nothing to sign up for.

Do Not Track. We do not track visitors across websites, so we treat every visitor the way a Do Not Track or Global Privacy Control signal would ask, whether or not your browser sends one.

8. How we protect it

Data is encrypted in transit and at rest. Only the staff member we have given access to our case queue can see applications and documents; staff accounts are created individually by our administrator, and there is no public sign-up. Staff are told to treat application data as confidential and use it only to work on the case. No system is perfectly secure; if a breach affects your information, we will notify you as required by California law.

9. HIPAA

The federal privacy law HIPAA applies to health care providers, health plans, and health care clearinghouses, and to “business associates” working on their behalf. We are none of these. We work for you, the patient: we do no work on behalf of any hospital and are not paid by any hospital. So the information you give us is generally not protected health information under HIPAA and HIPAA’s rules do not apply to us.

That does not change how carefully we handle it. We follow the commitments in this policy, and we comply with the California privacy laws that do apply to us, including the Confidentiality of Medical Information Act where applicable. Once your application reaches a hospital, the hospital’s handling of it is governed by HIPAA and its own notice of privacy practices.

10. Schools and FERPA

We do not work with schools or colleges, and we do not collect or receive student education records. FERPA, the federal law protecting those records, therefore does not apply to our service. If a student applies for help with their own bill, we handle their information under this policy like anyone else’s. If we ever partner with a school, we will update this policy before any education records are shared with us.

11. Children

This site is meant for adults. We do not knowingly collect information from children under 13 through the site. If the bill is for a child’s care, a parent or guardian should apply for them. If you believe a child has sent us information, contact us and we will delete it.

12. Contact us, and changes to this policy

Questions or requests about your information: MedicalFairnessProject@gmail.com or (925) 999-5020.

If we change this policy, we will post the new version here with a new effective date. If a change would let us use information you have already given us in a new way, we will not apply it to your information unless you agree.

What we collect, and what we do with it.