Yourdata.Protectedbydesign.

CoClaim.AI ("CoClaim", "we", "us", or "our") is an AI-powered Revenue Cycle Management platform operated by LisbonCodeLab™. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you use our website, applications, and services (collectively, the "Services").

We take privacy and data protection seriously. Because our Services are designed for healthcare billing workflows, we build with HIPAA, GDPR, and industry best practices in mind. Every layer of our infrastructure reflects that commitment.

We collect only the data necessary to operate and improve the Services. Specifically:

• Account Information: name, business email, organization, role, and authentication credentials.

• Usage Data: device type, browser, IP address, pages visited, and interaction events collected through privacy-respecting analytics.

• Clinical & Billing Data: when authorized by your organization, we process denied claims, invoices, remittance information, payor responses, and supporting clinical documents strictly on your behalf.

• Communications: messages sent to support, sales, or through our contact forms.

CoClaim operates as a Business Associate under HIPAA when processing Protected Health Information on behalf of Covered Entities. A Business Associate Agreement (BAA) governs every engagement that involves PHI.

PHI is stored in isolated, tenant-specific clinical databases. It is never shared between organizations, never used to train general-purpose AI models, and never sold. Access is limited to authorized personnel on a strict need-to-know basis and fully audited.

We use collected information to:

• Provide, maintain, and improve the Services.

• Automate denial management workflows and produce appeal packages on your behalf.

• Generate analytics and reports requested by your organization.

• Secure the platform, detect fraud, and respond to incidents.

• Comply with legal obligations and enforce our Terms of Service.

• Communicate with you about product updates, billing, and support.

Our AI agents perform preparatory actions such as gathering context, retrieving documents, and drafting appeal packages. External actions, such as submitting appeals to payors, sending communications, or modifying records, always require explicit human approval.

We do not use your clinical data, PHI, or claim information to train public or shared AI models. Model fine-tuning, when performed, is scoped to your organization only.

We do not sell personal data. We share information only in the following limited circumstances:

• With trusted sub-processors (cloud hosting, monitoring, analytics) bound by confidentiality and data-protection obligations.

• With your EMR or billing systems (e.g., Brightree, Bonafide, NikoHealth) as explicitly authorized by your organization.

• With payors, when submitting appeal packages on your behalf with human approval.

• When required by law, court order, or to protect the rights, safety, or property of CoClaim, our users, or the public.

Security is foundational, not optional. We implement:

• Encryption in transit (TLS 1.2+) and at rest (AES-256).

• Isolated, per-organization clinical databases with no cross-tenant data sharing.

• Role-Based Access Control (RBAC) with granular permissions.

• Continuous monitoring, audit logging, and intrusion detection.

• Secure cloud-native infrastructure with regular vulnerability assessments.

No system is invulnerable, but we work continuously to minimize risk and respond quickly to threats.

We retain information for as long as needed to provide the Services, comply with legal obligations, resolve disputes, and enforce agreements. PHI retention is governed by the applicable BAA and HIPAA requirements. You may request deletion of your account data at any time, subject to retention obligations imposed by law.

Depending on your jurisdiction, you may have rights to:

• Access, correct, or delete your personal data.

• Object to or restrict certain processing activities.

• Receive a portable copy of your data.

• Withdraw consent where processing is based on consent.

• Lodge a complaint with a data protection authority.

To exercise these rights, contact us using the details below. We will respond within the timeframes required by applicable law.

CoClaim is built by LisbonCodeLab™ and operates with infrastructure that may process data in multiple jurisdictions. Where data is transferred across borders, we use appropriate safeguards (including Standard Contractual Clauses) to ensure a level of protection consistent with applicable law.

We use strictly necessary cookies to operate the website and, with your consent where required, analytics cookies to understand how the Services are used. You can control cookies through your browser settings. Disabling cookies may affect certain features.

The Services are intended for business use by healthcare organizations and are not directed to children under 16. We do not knowingly collect personal data from children. If you believe we have, please contact us so we can remove it.

We may update this Privacy Policy from time to time. When we make material changes, we will notify you by updating the "Last Updated" date and, where appropriate, providing additional notice. Continued use of the Services after changes take effect constitutes acceptance of the updated policy.

Questions about this Privacy Policy, data requests, or our privacy practices? Contact us at [email protected] or through our contact page.