Overturn
Privacy Policy
Effective July 8, 2026 · Updated August 1, 2026 (optional outcome check-ins)
Overturn generates appeal letters for denied health-insurance claims. Denial letters contain sensitive information — names, member IDs, claim numbers, diagnoses — so we designed the service to keep as little of it as possible, for as short a time as possible. This page describes exactly what we collect, what happens to it, and what we never do with it.
What we collect
Two things, both provided by you: the text of your denial letter (pasted, uploaded, or photographed) and your answers to a few short questions about your claim (state, how you got your insurance, pre-authorization, network status, prior appeals, urgency). We do not require your name, email address, or account of any kind. One optional exception: after your letter is generated, you may choose to leave an email address so we can check in once about your appeal's outcome — see "Outcome check-ins" below.
How we use it
For one purpose: analyzing your denial and generating your appeal letter. Your denial text is processed by large-language-model providers through OpenRouter to extract the facts, classify the denial, and draft the letter. We instruct OpenRouter to route requests only to providers that do not store or train on the content of those requests.
What we keep, and for how long
Uploaded files (PDFs, photos) are processed in memory and are not stored. Your generated letter and analysis are available at a private, unguessable link that expires within about one hour — download your letter when you get it. For debugging, we keep a redacted diagnostic record of each run for up to 30 days, after which it is automatically deleted: the raw denial-letter text is replaced with an anonymous fingerprint, and identifiers such as member IDs, claim numbers, provider names, and service dates are masked before anything is written to disk.
Outcome check-ins (optional)
After your letter is generated you can opt in to a single outcome check-in. If you enter an email address, we store it with a private link for your run and send one email about 30 days later asking how your appeal went — nothing else, ever. Whether or not you leave an email, reporting your outcome stores only the result you choose (for example "overturned"), an optional amount, any note you type, and non-identifying context about the claim decision (state, insurer name, denial category). Outcome records never include your denial letter or medical details. To delete your email or outcome record, reply to the check-in email or contact us at the address below.
What we never do
We do not sell your information. We do not use it for advertising. We do not use your denial letter to train AI models or permit our processors to. We do not send anything to your insurer — you decide whether and how to send your letter. If we ever add usage analytics, it will be privacy-preserving, cookie-free measurement that cannot identify you.
Security
All traffic is encrypted in transit (TLS). Processing happens on access-restricted servers we control. No third party receives your information except the language-model providers described above, solely to generate your letter.
A note on HIPAA
Overturn is a consumer tool you use directly; it is not a health plan, health-care provider, or clearinghouse, and is not a HIPAA covered entity. The protections described on this page come from this policy, not from HIPAA.
Your choices
You can use Overturn without creating an account or telling us who you are. You may edit the pasted text before submitting to remove anything you prefer not to share. To ask about, or request deletion of, any diagnostic record connected with your use, email support@overturn.co — include the approximate date and time of your run so we can locate it.
Children
Overturn is intended for adults 18 and older.
Changes
If this policy changes, we will update this page and its effective date. Material changes will be noted prominently on the home page.