DRAFT — under attorney review, not yet in effect. This is launch-candidate copy; the fields marked in brackets are filled in on publication.
Tyndale Privacy Policy
Effective Date: [EFFECTIVE DATE]
Tyndale is a medical-billing and health-advocacy tool. It provides information and self-advocacy assistance only — it is not medical, legal, financial, or tax advice, and using it does not create an attorney-client relationship. For advice about your situation, consult a licensed professional.
This Privacy Policy explains what information The Little Guy LLC, doing business as Tyndale ("Tyndale," "we," "us," or "our") collects, how we use and share it, and the choices and rights you have. It applies to the Tyndale website, applications, and services (the "Service"). The Service is for adults (18 or older) in the United States.
We take privacy seriously because the Service handles sensitive health and financial information. We use your information to provide the Service to you. We do not sell your personal information, and we do not use your health or financial information for advertising.
About our regulatory status. Tyndale is a direct-to-consumer tool. You voluntarily provide your own information so that Tyndale can help you with your own bills. Tyndale is not acting as a healthcare provider or health plan, and it is not a "covered entity" under HIPAA. We are committed to protecting your information and handle it in accordance with this Policy and applicable federal and state law, including the Federal Trade Commission Act and the FTC Health Breach Notification Rule, and applicable state privacy and health-data laws.
1. Information we collect
Information you provide:
- Account information — your name, email address, and password; for paid plans, billing information handled by our payment processor (we do not store full card numbers).
- Documents you upload — such as medical bills, Explanation of Benefits (EOB) statements, insurance cards, and plan summaries — and the information extracted from them.
- Information about your coverage and your care that you enter or confirm.
- Communications you send us, such as support requests and feedback.
Information about minors, handled on a parent or guardian's behalf: If you use the Service to manage a minor child's medical bills, you may provide the child's health and billing information. You represent that you are the parent or legal guardian with authority to do so. We handle that information as described in this Policy. The Service is not directed to children, and children may not create accounts.
Information you may choose to connect in the future: If, in a future version, you choose to connect your insurer or provider data through a data-connection service, we will receive your coverage and claims information from that source to provide the Service. We will describe this clearly and obtain your authorization before any such connection.
Information collected automatically: Limited device and usage information and cookies or similar technologies, as described in Section 8.
2. The sensitive nature of this information
Much of what you provide is health and financial information. We apply heightened protections to it, we do not use it for advertising, and we limit who can access it. We use it to operate the Service for you and — only if you separately opt in — to improve the Service, as described in Section 5.
3. How we use your information
We use your information to:
- Provide the Service — read and analyze your documents, compute what you may owe, identify potential errors, and help you take action.
- Maintain your account, history, and case files so the Service can remember your context and track deadlines and follow-ups for you.
- Communicate with you about your account, your matters, and the Service.
- Process your payments, through our payment processor.
- Maintain security, prevent fraud and abuse, and comply with law.
- Improve the Service — only with your separate, optional opt-in, and only after de-identification (see Section 5).
4. How the AI uses your information
Tyndale uses artificial intelligence to analyze your documents and information. Your information is processed by AI service providers under contracts that require them to protect it and that prohibit them from using your information to train their own general models. The AI grounds its analysis in authoritative data sources and your own documents and is designed not to assert facts it cannot support.
5. Improving the Service — separate, optional consent
Using your information to improve Tyndale is different from using it to serve you, and we treat it that way. We will use your bills, feedback, and case outcomes to improve the Service only if you separately opt in, and even then only after de-identification — an automated and reviewed process that removes information identifying you. This consent is optional, is never required to use the Service, and you can withdraw it at any time in your settings. See our separate Data Improvement Consent (below) for details.
6. How we share information
We share information only as needed to run the Service:
- Service providers that help us operate — such as cloud hosting, AI processing, payment processing, email delivery, and (in the future) data-connection services. They are bound by contract to protect your information and to use it only to provide services to us.
- At your direction — for example, a letter or communication you approve to be sent to your insurer or provider.
- For legal and safety reasons — to comply with law, respond to lawful requests, enforce our Terms, or protect rights and safety.
- In a business transfer — if we are involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction, subject to this Policy.
We do not sell or rent your personal information, and we do not share your health or financial information with advertisers.
7. Security
We implement administrative, technical, and physical safeguards designed to protect your information, including encryption of sensitive data in transit and at rest, access controls, audit logging, and removal of identifying information from internal system logs. No system is perfectly secure, and we cannot guarantee absolute security. If a breach affecting your information occurs, we will notify you and applicable authorities as required by law, including the FTC Health Breach Notification Rule and applicable state breach-notification laws.
8. Cookies & tracking
We use cookies and similar technologies to operate the Service:
- Strictly necessary technologies that are required to run the Service, keep you logged in, and maintain security. These cannot be turned off.
- Functional technologies that remember your preferences.
- Analytics — we use privacy-respecting, first-party analytics to understand how the Service is used and to improve it. We do not use advertising or retargeting trackers, and we do not place advertising trackers on any page that handles your health or billing information.
We honor browser-based opt-out preference signals, such as Global Privacy Control, where required by law. Where applicable law requires it, we provide a mechanism to manage non-essential cookies.
9. Your choices and rights
- Access and correction — you can view and update much of your account information in the Service.
- Deletion — you can request deletion of your account and associated personal information, subject to information we are required or permitted by law to retain (such as certain audit records, and de-identified data that no longer identifies you).
- Improvement opt-out — you can withdraw improvement consent at any time in your settings.
- Communications — you can opt out of non-essential emails.
Residents of certain states have additional rights — see the State-Specific Rights Addendum (below), which is part of this Policy.
To exercise any of these rights, contact us at [PRIVACY EMAIL] or [SUPPORT EMAIL]. We will verify your request as required by law before acting on it.
10. Data retention
We retain your information while your account is active and as needed to provide the Service, then as required for legal, compliance, and audit purposes. You may request deletion as described above, subject to retention we are legally required or permitted to maintain.
11. Children
The Service is for adults 18 and older. Children may not use the Service or create accounts. We do not knowingly allow children to use the Service or knowingly collect information directly from children as users. A parent or guardian may provide a minor's information to manage that minor's bills, as described in Section 1. If you believe a child has created an account, contact us at [PRIVACY EMAIL] and we will address it.
12. Changes to this Policy
We may update this Policy. If changes are material, we will notify you and update the Effective Date.
13. Contact
The Little Guy LLC d/b/a Tyndale 336 E University Pkwy #1043, Orem, Utah 84058 [PRIVACY EMAIL]
Data Improvement Consent (Optional)
This consent is optional. You can use Tyndale fully without agreeing to it, and your choice never changes the service you receive. It covers one thing: whether we may use your information — with everything that identifies you removed — to make Tyndale more accurate and helpful. It is presented separately from account signup and the Terms, is off by default, and is never bundled into Terms acceptance.
Help make Tyndale better. With your permission, we'll use your bills, your feedback, and the outcomes of your cases — with all your personal information removed — to improve how Tyndale catches errors and helps people. This is optional, it never affects the service you receive, and you can turn it off anytime in Settings.
What you are agreeing to, if you opt in: You allow us to use your uploaded bills and statements, your feedback (such as thumbs up or down and corrections), your confirmations (such as whether a billed service matched your care), and the outcomes of your cases — only after de-identification, an automated and human-reviewed process that removes information identifying you, such as your name, contact details, member and account numbers, and other identifiers — to evaluate and improve Tyndale's accuracy, including building and testing the Service's analysis and future features.
What you are NOT agreeing to:
- Any use of information that still identifies you for improvement purposes.
- Any sale of your information.
- Any advertising use of your information.
- Any sharing of your identifiable health or financial information with third parties for their own purposes.
De-identification comes first. Before any of your information is used for improvement, it passes through a de-identification process designed to remove identifiers. Information that does not pass de-identification is not used for improvement. Opting in gives permission; de-identification is what makes the information safe to use. Both are required.
Withdrawing your consent. You can withdraw this consent at any time in your Settings. After you withdraw, we stop using your information for improvement going forward. Information that was already fully de-identified may remain in our improvement datasets, because it no longer identifies you.
Opting in is entirely your choice. Tyndale works exactly the same whether you opt in or not.
State-Specific Rights Addendum
This Addendum is part of the Tyndale Privacy Policy and provides additional rights and disclosures for residents of certain states. If you are a resident of a state listed below, the corresponding section applies to you. If anything here conflicts with the main Privacy Policy, this Addendum controls for residents of that state.
Across all states: we do not sell your personal information, we do not "share" it for cross-context behavioral advertising, and we do not use your health or financial information for advertising. We will not discriminate against you for exercising any privacy right.
To exercise any right described here, contact us at [PRIVACY EMAIL]. We will verify your identity as required by law before acting on your request, and we will respond within the timeframe your state’s law requires. If we deny a request, you may appeal by replying to our response; where your state provides it, you may also contact your state attorney general.
California. If you are a California resident, you have the right to: know and access the personal information we collect about you; know whether we disclose it and to whom; correct inaccurate personal information; delete your personal information; and limit the use of sensitive personal information (which includes health information). We collect the categories of information described in the Privacy Policy, use them for the purposes described there, and disclose them only to the service providers and in the situations described there. We do not sell or share your personal information as those terms are defined under California law. You may use an authorized agent to submit requests.
Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with comprehensive privacy laws. If you are a resident of a state with a comprehensive consumer privacy law, you have the right to: confirm whether we process your personal data and access it; correct inaccuracies; delete personal data; obtain a portable copy of data you provided; and opt out of targeted advertising, sale of personal data, and certain profiling. We do not engage in targeted advertising, sale of personal data, or such profiling. Health information is treated as sensitive data under these laws. Where your state requires your consent before processing sensitive data, we obtain it; where your state instead requires that we offer a way to opt out of sensitive-data processing, we provide that option. Because providing your health and billing information is essential to how Tyndale helps you, processing that information is necessary to deliver the Service you request.
Washington (and other consumer-health-data laws). If you are a Washington resident, the My Health My Data Act provides specific rights regarding "consumer health data," including the right to access it, to withdraw consent to its collection and sharing, and to have it deleted. We collect consumer health data only to provide the Service to you, with your consent; we do not sell consumer health data; and we do not share it except with service providers who help us operate the Service or as you direct. To exercise these rights, contact us at [PRIVACY EMAIL]. Residents of other states with consumer-health-data laws (such as Nevada) have comparable rights, which we honor where applicable.
State medical-debt and billing protections. Some states provide specific protections regarding medical bills and medical debt, including limits on certain collection practices and on the reporting of medical debt. Tyndale helps you understand and exercise rights you may have, but Tyndale does not collect debt and is not a debt collector or a credit-reporting agency. Nothing in the Service is a substitute for legal advice about your rights under your state's law.
Auto-renewal and subscription rights. Some states have specific requirements regarding automatically renewing subscriptions, including clear disclosure of renewal terms and an easy way to cancel. You can cancel your paid plan at any time in your account settings, effective at the end of your current billing period, as described in the Terms of Service.
This Addendum will be updated as additional state laws take effect. Check the Effective Date for the latest version.