Your health data is yours.

• We only get what you choose to send us: an email address you confirm, a question you write, or a letter, EOB or bill you upload.
• We use what you send only to answer you and to keep the service working. A person on our team reviews answers before they are emailed to you.
• We do not sell your data. We do not use your health data for advertising or marketing.
• We do not share your data with anyone else unless you ask us to, each time, on a screen that names who gets it.
• You can delete an upload right after you send it, on the upload page. You can ask us to delete everything. We will.
• K.Actuary is an information tool. We are not your insurer, an insurance agent or broker, a law firm, or a licensed public adjuster. We do not file, negotiate or settle claims for you, and we do not give legal advice.

If anything here is unclear, email [email protected].

K.Actuary is the brand of KActuary, Inc., a Delaware corporation ("K.Actuary," "we," "us"). This policy covers kactuary.com and the K.Actuary web app. Our phone app has its own short notice: app privacy.

Contact: [email protected]

• We follow generally accepted industry practices for privacy and security.
• K.Actuary is not endorsed or certified by the Centers for Medicare & Medicaid Services or the U.S. Department of Health and Human Services. When we mention Medicare, it is to point to Medicare's own public rules and publications.
• Our Terms of Use never reduce the protections in this policy. If the two ever seem to conflict, this policy wins.

Confirming your email. There is no password to make. Before you send a question or upload a file, we ask you to confirm your email address: we email you a 6-digit code, which works for 10 minutes. After 5 wrong tries you need a new code.

What the email check keeps. When the code matches, we store your confirmed email address with a coded key made from it, and the dates you confirmed it, so we can email you the answer. We delete it 180 days after your last contact with us (see "How long we keep data"). We set a cookie (kx_e) in your browser for 30 days. The cookie holds that coded key and an expiry date — not your email address — so you don't have to confirm again on each visit.

Questions you send. When you send a question, we store it with the insurance type and state you picked and a reference number. Questions can contain health information, so they are stored in a database kept in the United States. The record links to your coded key, not to your email address. We do not put the text of your question in our team chat or in our error logs.

How the answer is made. We look up the state insurance records and public rules that may apply. A draft answer may be prepared with an AI model that runs on our own computers, not an outside AI service. A person on our team reviews it, and only then is the answer emailed to you. When we get your question we email you a short note with the reference number; it does not include your question.

Published answers. If an answer could help others, we may publish it on kactuary.com. The published question is reworded by our team and carries no personal information — no name, email address or details that identify you.

Only to:

1. answer the question you sent or read the papers you uploaded;
2. explain them in plain English — what was billed, what was allowed and paid, what you may owe, and which rules or deadlines may apply;
3. email the answer to the address you confirmed;
4. keep the service secure and working.

We do not use your health data to sell insurance, to recommend a specific insurance product, to set prices, or to build advertising profiles. We do not send it to outside AI services. We do not act for you with any insurer, provider or agency.

We do not sell your data. We never use your health data for advertising or marketing — by us or by anyone else. We do not share any personal information for cross-context behavioral advertising. We never sell health data in any form, including de-identified or aggregated data.

• Only with your specific, explicit consent. We do not share your health data with anyone outside K.Actuary unless you ask us to. If a feature lets you send something to someone (for example, a family member or caregiver, or your own insurer), you will see a screen that says exactly what will be sent and to whom. Nothing is sent until you tap to confirm.
• One-time or ongoing. Every share is one-time unless the screen clearly says it is ongoing and you turn it on. You can turn off any ongoing share at any time.
• Service providers that run our service for us (next section) process data only on our instructions.
• If the law requires it (for example, a valid court order), we share only what is required and, where allowed, tell you first.

We use a small number of service providers. Each one is bound by its agreement with us to protect data, to use it only to provide its service to us, and to tell us about security incidents. We do not use a provider for health data unless it commits to protection at least as strict as this policy.

Provider	What it does	Health data?
Cloudflare, Inc.	Website hosting, database and file storage, security, cookieless page-visit counts	Yes — stored encrypted
Resend	Sends the emails you ask for (6-digit codes, "we got it" notes, answers, sheets, notices)	No — email address and our email text; "we got it" notes carry only a reference number
Slack	Internal notices to our team when someone signs up, asks for a sheet, or sends a question or file	No — a partly hidden email address and the page used, or the insurance type, state and reference number; never the question or file

Questions you send and files you upload are stored with our cloud provider in the United States.

Our team is small. The same protections apply wherever we work.

Apart from published answers, where the question is reworded to carry no personal information, we do not create, use, share or sell de-identified, anonymized or pseudonymized versions of your health data. Removing names lowers, but does not remove, the risk that a person could be identified again by combining data with other information. That is why we do not do it.

Data	How long
Letters, EOBs and bills you upload, questions you send and our answers, and the email address you confirmed	Deleted 180 days after your last contact with us. Your last contact is the most recent question, upload or email check from that address. You can delete uploads sooner with "delete now", or ask us to delete everything by writing to [email protected].
Rate-alert and sheet email addresses	Until you unsubscribe or ask us to delete them. Deleted within 30 days after that.
Email check for heavy use of the price tools	The code expires in 10 minutes. The confirmed address is deleted 180 days after your last contact with us.
Emails you send us	As long as needed to answer you and keep a record of the conversation, and no longer than 3 years

• Uploads: right after you upload, the upload page shows a "delete now" link. Deleting removes the files and the short summary we kept with them. Later, write to [email protected] from the address you confirmed.
• Questions and your email address: write to [email protected] from the address you confirmed and we will delete them.

Deleting does not undo anything you already sent yourself to someone else.

• The kx_e cookie ends 30 days after you confirm your email. After that, we ask you to confirm again with a new code.
• Clearing your browser's cookies removes it sooner.

• Opt in: nothing is sent to us until you confirm your email and send a question, or tick the box that lets us read your files and upload them.
• See: email us and we will tell you what we still hold — questions, uploads and the address you confirmed.
• Correct: if something we sent you looks wrong, reply to the email and tell us.
• Copy: email us and we will send you a copy of what we hold about you.
• Delete: use "delete now" on the upload page right after you upload, or email [email protected] from the address you confirmed. We confirm by email when it is done.

We will not treat you differently for using any of these choices.

We follow applicable federal and state law and generally accepted industry practices to prevent unauthorized access, use, destruction, alteration or disclosure of personal and health information. This includes encryption in transit (HTTPS) and at rest, access limited to the people who need it with multi-factor sign-in, and secret keys kept out of source code. If HIPAA applies to our service, we will comply with it.

If there is a breach of security involving your health information — including any sharing you did not authorize — we will:

• notify you by email without unreasonable delay, and no later than 60 calendar days after we discover it;
• tell you what happened, what data was involved, what we are doing, and steps you can take to protect yourself;
• notify the U.S. Federal Trade Commission, and the media where required, as set out in the FTC Health Breach Notification Rule (16 CFR Part 318), and follow any state breach laws that apply.

If KActuary, Inc. is sold, merges, or transfers this service, we will email you before your data is transferred. The notice will say who the new owner is and whether anything about how your data is used will change. If it would change, you can ask us to delete your data before the transfer. A new owner must keep this policy's promises unless you agree otherwise.

• Before a change takes effect, we will post the new version on this page and say what changed, and how to opt out — including how to delete what you sent us.
• The date at the top of this page will change. Past versions are available on request.

To show prices we use the details you type into a calculator — for example ZIP code, pet species, breed and age, or trip cost and length. We don't ask for your name, email address or phone number to show prices. These details are not connected to any health data.

Some future features — for example a quote request passed to an insurer, or a vehicle-based auto price — may need more details, such as vehicle information or a way to reach you. If we add one, we will say exactly what it needs and why on the page itself, before you type anything, and update this policy first.

If you use the price tools heavily, we may ask you to confirm an email address with a 10-minute code before you continue. We use that address only for this check.

Rate alerts are optional. If you sign up, we store your email address, your state, the lines you picked (pet, travel, auto, Medigap, dental, vision), the page you signed up from and your country, so we can email you when a rate filing affects you. We don't ask for your name, phone number or address.

The claim prep sheet in our web app runs in your browser. If you ask us to email your sheet, we store your email address and the short answer codes needed to reopen it (for example, the kind of claim, the state and a date). We do not store anything you type freely.

Every email lets you unsubscribe, or you can ask us to delete your address by writing to [email protected].

If you upload a letter, an EOB or a bill, we first read it inside your browser. You confirm your email first and tick a box that lets us read your files; we don't ask for a phone number. You can upload up to 3 files at a time (photos or PDFs, up to 10 MB each). We then store the files privately in the United States, with a short summary your browser made (such as the type of letter, the company named, codes and dates), only so we can work out what applies to your claim and email you the answer. Uploaded files have no public address, are never shown to anyone else and are not used for advertising.

Uploaded files are deleted 180 days after your last contact with us. You can delete them sooner with "delete now" on the upload page right after you upload, or by writing to [email protected]. We never file or send anything for you.

Like most websites, our hosting provider processes technical data such as IP address, browser type and pages requested, to deliver the site and protect it from abuse. We count page visits with Cloudflare Web Analytics, a privacy-friendly service that does not use cookies and does not follow you across sites. It sees page addresses and general technical data, not what you type into the tools on this site. When you click through to an insurer's site from a price, we record the line, insurer, plan and state — not who you are.

On some pages we also count a few actions — for example a page view, a button tap, a sent question, a confirmed email or a finished upload — as daily totals, together with the campaign tag in the link you followed (if any). These counts hold no IP address, email address, cookie or text you typed.

• kx_e — set when you confirm your email; lasts 30 days; holds a coded key and an expiry date, not your email address.
• kx_h — set after a person check on the price tools; lasts 30 minutes.

Both are used only by our own site, cannot be read by page scripts, and are not used for advertising. Insurer pages opened from an invite link and our team's own sign-in use separate cookies that are not set for other visitors.

If you email us, we use your message and address only to reply and keep a record of the conversation.

Business inquiries (for example, a carrier asking for a data sample or a pilot) include your name, company, email and message. We use them only to reply and keep a record, and keep them for up to 3 years.

K.Actuary is not directed to children under 13, and sending us a question or file is for adults 18 and over.

KActuary, Inc. (Delaware) · [email protected]

Last updated November 11, 2026.