Overturn — Privacy Policy

Last updated: June 22, 2026

The short version: Your medical bills, EOBs, and denial letters are read and stored only on your device. When Overturn uses AI to help, it is designed to remove your name, member ID, and other identifiers first, so that our servers and our AI provider receive de-identified text. We never store your medical documents or images.

Who we are

Overturn is made by NYRAI LLC ("we", "us"). Contact: hello@nyrai.ai.

What stays on your device

Photos of your bills, EOBs, and denial letters.
The text read from them (on-device OCR via Apple's Vision framework).
Your case details (insurer, plan, member ID, claim number, amounts, dates).
Draft and finished appeal letters, including any PDF you export.

This data is stored encrypted in the app's private storage and protected by your device passcode/biometrics. You can optionally require Face ID to open the app, and you can delete any case (and its documents) at any time.

What we send off the device — and how it's de-identified

To run the AI audit and draft an appeal, Overturn sends a tokenized, de-identified version of your text to our server, which relays it to our AI provider. Before anything leaves your device, identifiers — your name, member ID, claim number, address, provider and insurer names, and patterns like SSN/phone/email — are replaced with neutral placeholders (e.g. {{PATIENT_NAME}}). A safety check is designed to block the request if a recognized identifier is still present, though no automated de-identification is perfect. The real values are re-inserted into your letter locally on your device; they never reach our servers.

What our servers store

Account: your email address and a user ID (to sign you in).
Entitlements: your appeal-credit balance and subscription status.
Usage counts: non-identifying counts and token totals for each AI call (no document content).

We do not store your medical documents, the text of your bills, or any protected health information on our servers.

AI processing

De-identified text is processed by our AI provider (Anthropic) solely to generate your audit and letter. We seek no-training / no-retention handling for these requests. The AI is instructed to use only the facts you provide and to never invent diagnoses, amounts, or legal citations.

Tracking & third parties

We do not track you across other apps or websites and we do not sell your data. We use Supabase (auth, entitlement storage) and Anthropic (AI) as processors, plus Apple for in-app purchases.

Your choices

Export: Settings → "Export my data".
Delete: Settings → "Delete account" removes your server data and sign-in; your on-device cases are erased too.

Children

Overturn is not directed to children under 13 and is rated 17+.

Changes

We'll update this page and the "last updated" date for material changes.