Security and privacy

How your information is protected

• Encrypted in transit and at rest
• Access restricted to your own account
• Authentication handled by a dedicated identity provider
• API credentials stored as protected secrets, never in application code
• Case data isolated so one account cannot access another account’s cases

What we collect

• Account information you provide at signup
• The medical bill you upload
• Your answers to the review questions
• Findings and documents generated for your case
• Provider communications and responses tied to your case
• Basic device and technical information

Who we share it with

Information is shared only with service providers necessary to deliver the service you requested, subject to applicable contractual restrictions. That includes our hosting and database provider, authentication provider, AI processing provider, payment processor, email delivery provider, and print-and-mail provider. We do not sell your information.

Retention and deletion

Uploaded bill documents are scheduled for deletion 30 days after upload, or until case closure if longer. Analysis results and case records are retained for 12 months after case closure. Letters, correspondence, and authorization records are retained for 3 years for audit and dispute purposes. Payment and transaction records are retained for 7 years. Account information is deleted within 30 days of account deletion. Backups are overwritten within 90 days through normal lifecycle. You can delete a bill or close a case at any time from Case Settings. See our Data Retention and Deletion page for the full schedule.

Note: ItemizeIt is a direct-to-consumer service. You send us your own bill; we do not receive information from a provider or insurer on their behalf. This means we operate under the FTC Health Breach Notification Rule rather than as a HIPAA-covered entity. We hold ourselves to the security practices described above regardless.