1. Scope
This notice explains how VA Claims Brain handles information when you visit, create an account, answer questions, upload an allowed document, request wording help, or download a packet. VA Claims Brain is independent from the Department of Veterans Affairs.
2. Information processed
We process your email address for authentication; claim-workspace answers and drafts you choose to provide; document files and extracted text you choose to upload; confirmation decisions; security and audit events; and basic technical data needed to operate and protect the service. Claim narratives and medical information can be highly sensitive even when they do not include direct identifiers.
3. Information you must not provide
Never provide Social Security numbers, full dates of birth, home addresses, VA file numbers, financial-account numbers, payment-card information, passwords, access tokens, or identity-document numbers. The service does not ask for or require them. A sensitive-data detector may warn you, but it cannot find everything.
4. How information is used
We use information to authenticate you, save and restore your workspace, provide requested analysis and wording assistance, generate your downloads, protect the service, investigate errors, honor deletion requests, and maintain an audit trail. We do not use advertising pixels or session replay, and we do not sell personal information.
5. Service providers
Supabase provides authentication, database, and private file storage. Vercel hosts the web application. OpenAI processes the minimum text needed for an AI-assisted task when you request it. Provider settings are configured to avoid model training where available, and AI requests are configured not to store response data. Providers may process data in locations described in their own terms and privacy materials.
6. Retention
Original uploaded files are scheduled for deletion after 30 days unless deleted sooner. Confirmed structured facts and workspace content remain until you delete the workspace or account. Security and audit records may be retained when reasonably necessary for integrity, legal compliance, and abuse prevention. Generated downloads stored on your device are controlled by you.
7. Security and limits
Private storage, row-level database rules, signed upload links, quarantine, malware scanning, encryption in transit, and access controls reduce risk. No internet service can promise absolute security. Do not upload a file unless the application confirms that secure scanning is available.
8. Your choices
You can review or change workspace content, remove individual files, delete a workspace, export available account data, or permanently delete your account using the service controls. You can stop using the service at any time.
9. Breach and legal obligations
Health-related information may be regulated by laws outside HIPAA, including consumer-protection and breach-notification rules. The operator will assess and provide legally required notices if a qualifying incident occurs. This service does not claim HIPAA compliance or status as a HIPAA covered entity or business associate.
10. Contact and account controls
Use the account controls to export available account data or permanently delete the account and its stored files. A dedicated privacy contact address and formal operator details will be added when established; this notice will be updated when they are available.