Legal

Privacy Policy

Last updated: May 19, 2026

This privacy notice explains how type2.wiki (“we,” “us,” “our”) collects, uses, and shares personal information when you visit https://type2.wiki or use the tools we host (including the AI Appeal Letter Generator). It is written to comply with the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

1. Categories of personal information we collect

From general browsing (only after you accept analytics cookies via our consent banner):

• Identifiers: browser cookie identifiers (Google Analytics), anonymized IP address
• Internet activity: pages viewed, time on page, referring URL, browser and device type

From the AI Appeal Letter Generator (only when you choose to use it):

• Identifiers: your IP address is visible to our backend so we can rate-limit abuse and enforce US-only access. It is not stored beyond temporary log retention (see §8).
• Health-related information: the diagnosis, medication, denial reason, state, insurer name, and any denial letter or prior-authorization text you paste or upload. This is information about your medical and insurance situation that some readers may consider sensitive.
• Bot-mitigation signals: Cloudflare Turnstile collects device characteristics to confirm you are a human. We do not see the raw signals; we receive only a pass/fail token.

Information that stays in your browser and is never transmitted to us:

• Your name, member ID, claim number, and mailing address. The wizard replaces these with placeholders (for example [PATIENT_NAME]) before any request leaves your browser, and re-inserts them only when the finished letter is rendered back to you.
• Any PDF or image of a denial letter you upload — these are processed entirely client-side (in your browser) using pdf.js and Tesseract.js OCR. The file itself never leaves your device. Only the extracted text (with PII removed as above) is transmitted.

2. Sources of personal information

• Directly from your browser as you interact with type2.wiki
• Directly from inputs you submit to the AI Appeal Letter Generator
• We do not buy, lease, or obtain personal information from data brokers or other third parties

3. Business purposes for collection

• Understand which content is useful so we can improve the site (analytics)
• Detect anomalies (broken pages, traffic spikes from incidents)
• Generate the appeal-letter draft you requested
• Enforce rate limits and US-only access so the letter generator stays available and within scope
• Defend the site from automated abuse

We do not sell or share personal information for cross-context behavioral advertising. We do not use your inputs to train any AI model.

4. AI Appeal Letter Generator: how your data flows

When you use the letter generator, this is what happens, in order:

1. You fill out the wizard in your browser. Patient name, member ID, claim number, and address are stored only in your browser’s memory.
2. If you upload a PDF or photo of a denial letter, your browser extracts the text locally. The image never leaves your device.
3. Before any network request is sent, the wizard replaces patient name, member ID, claim number, and address with placeholders such as [PATIENT_NAME].
4. The redacted request (diagnosis, medication, state, insurer name, denial reason, and redacted free-text) is sent to our AWS Lambda function. The Lambda forwards it to Anthropic (the company behind the Claude language model) to generate the draft.
5. The Lambda returns the generated HTML to your browser. Your browser swaps the placeholders back to your real name, member ID, claim number, and address so the letter is ready to file.
6. Our logs record only the case category (state, medication slug, denial reason slug, output length) — never your name, ID, address, denial text, prior-authorization text, or the generated letter body.

Because PII is never sent to us, we cannot recover or re-display a letter once you close your browser tab.

5. Categories of third parties we share with

When you only browse the site:

• Google LLC (Google Analytics 4) — receives Identifiers and Internet activity as a service provider under our instructions. Governed by Google’s Privacy Policy.

When you use the AI Appeal Letter Generator, additionally:

• Amazon Web Services, Inc. — hosts the Lambda function, log storage (CloudWatch), and content delivery network (CloudFront) that serve the generator. Acts as a service provider under our instructions. Governed by the AWS Privacy Notice.
• Anthropic, PBC — receives the redacted request and returns the generated letter. Anthropic states it does not train its models on inputs submitted via its API and retains API inputs only for limited periods for abuse detection. Governed by Anthropic’s Privacy Policy and Commercial Terms.
• Cloudflare, Inc. — provides bot-mitigation (Turnstile). Receives device signals from your browser; we only receive a pass/fail token. Governed by Cloudflare’s Privacy Policy.

We do not share with advertising networks, data brokers, or any other third parties.

6. Your rights under CCPA / CPRA

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and share
• Delete personal information we have about you
• Correct inaccurate personal information
• Opt out of sale or sharing of your personal information
• Limit use of sensitive personal information — note that because the letter generator scrubs PII in your browser before transmission and we do not retain the free-text inputs after a request completes, there is little for us to limit
• Non-discrimination for exercising any of these rights

How to exercise these rights

Email privacy@type2.wiki with the request. We will respond within 45 days.

Do Not Sell or Share My Personal Information

We do not sell or share personal information. To opt out of analytics cookies entirely, click Cookie Settings in the footer of any page and choose Reject all.

7. Cookies

type2.wiki uses these categories of cookies:

• Essential (always on): none for general browsing. The AI Appeal Letter Generator uses Cloudflare Turnstile, which may set short-lived bot-mitigation cookies (cf_*) while you are on the wizard page.
• Analytics (off by default; enabled only if you click Accept): Google Analytics _ga, _ga_* cookies. Lifespan up to 2 years. You can revoke at any time via Cookie Settings.

8. Data retention

• Analytics data: retained by Google for 14 months, then automatically deleted.
• Letter-generator request logs (case category only — no PII, no free-text): retained 30 days in AWS CloudWatch, then automatically deleted.
• Letter-generator inputs and outputs (free-text fields, generated letter): not retained at rest on our side. Inputs pass through the Lambda function in-memory only. Anthropic’s separate short-term abuse-detection retention applies as documented in their policy.
• Rate-limit state: in-memory only; reset when the Lambda instance recycles (within hours).

9. Children’s privacy

type2.wiki is not directed at children under 13. We do not knowingly collect data from anyone under 13.

10. Changes to this notice

If we materially change this notice, we will update the “Last updated” date and prompt you to review the cookie banner again.

11. Contact

Questions: privacy@type2.wiki