Patient Stand: Privacy Policy

Effective 8 July 2026.

1. Introduction

This Privacy Policy explains how Patient Stand collects, uses, and protects personal information when you visit our website at patientstand.com (the "Site"), use our free tools, or purchase from us.

Patient Stand is a trading name of Ironwood Brands Ltd, a company registered in England and Wales. Ironwood Brands Ltd is the business behind Patient Stand and the data controller responsible for your information; every reference to "we", "us", or "our" in this policy means Ironwood Brands Ltd trading as Patient Stand.

This policy is written to comply with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, and to provide the disclosures required for visitors resident in the United States, including California. Because our customers share medical billing documents with us, we hold ourselves to a higher standard of care than an ordinary online store, and this policy says exactly what happens to those documents.

2. Who we are and how to contact us

The data controller responsible for your personal information is:

Ironwood Brands Ltd, trading as Patient Stand
Company number: 12856658
Registered office: 85 Great Portland Street, First Floor, London, W1W 7LT, United Kingdom
Contact for privacy matters: support@patientstand.com

ICO registration: We are registered as a data controller with the UK Information Commissioner's Office under registration number ZC131245.

3. The information we collect

3.1 Information you give us

When you purchase a packet, use a free tool, or contact us, you may provide us with:

your name, email address, and, if you provide one, phone number and postal address
information about your matter: the bill, debt, or Medicare issue you want to address, and the circumstances around it
the documents you upload, such as medical bills, itemized statements, explanations of benefits, collection letters, financial assistance forms, or Medicare and Social Security correspondence. These may contain health information; section 4 deals with them specifically.
payment information (processed directly by Stripe; see section 7)
anything else you choose to share with us in correspondence during your 30-day question window

3.2 Information collected automatically

When you visit the Site, and only if you accept our cookie banner, we collect analytics information via Google Analytics (pages visited, how you arrived, how far you read) and advertising-measurement information via Google Ads (whether your visit or purchase followed one of our ads). If you decline, neither runs. Strictly necessary technical information, such as that needed to keep a checkout session working, is collected regardless. Our Cookie Policy at patientstand.com/cookies describes all of this in detail.

3.3 Information from payment processing

When you pay, Stripe collects your payment card and billing information directly. We receive a confirmation of payment and limited billing metadata; we do not see or store your full card number, CVV, or bank account details.

4. Health information: the documents you upload

The documents you send us to prepare your packet, such as bills, explanations of benefits, collection letters, and Social Security correspondence, routinely reveal information about health: providers seen, treatments billed, dates of care. We treat all of it as health information, whether or not each line item is medical.

4.1 How we use it

We use your uploaded documents and matter information for one purpose only: to prepare, correct, and support your packet. We do not use them for marketing, we do not build profiles from them, we do not sell or share them with anyone for their own purposes, and we never use them as examples or testimonials without your separate, explicit written consent.

4.2 Our legal basis

Under UK GDPR, health information is "special category data" and needs an additional legal basis. We rely on your explicit consent, which we ask for at the point you upload your documents, in clear words, separate from anything else. You can withdraw that consent at any time by emailing support@patientstand.com; if you withdraw before your packet is delivered, we will stop work, delete the documents, and refund you in line with our Terms.

4.3 We are not a HIPAA covered entity

The US Health Insurance Portability and Accountability Act (HIPAA) applies to health plans, healthcare providers, and their business associates. Patient Stand is none of those, so HIPAA does not govern our handling of the documents you send us. This policy, UK GDPR, and applicable US state privacy laws do. In plain terms: the protections in this policy come from data protection law and our commitments to you, not from HIPAA, and nothing we do affects your rights against your providers or insurers under HIPAA.

4.4 California: sensitive personal information

For California residents, the health-related content of your uploaded documents is "sensitive personal information" under the CCPA/CPRA. We collect and use it only to provide the product you asked for, a use the law permits without offering a right to limit, and for no other purpose. We do not sell it or share it for cross-context behavioral advertising.

4.5 How long we keep it

Uploaded documents are kept only as long as your purchase needs them: through preparation, delivery, and your 30-day question window, then deleted 90 days after your order completes, unless you ask us to delete them sooner or ask us in writing to keep them longer. Your order record (who bought what, when, for how much) is kept separately for our accounting obligations, without the uploaded documents; section 9 sets out the full retention schedule.

5. How we use your information

To prepare and deliver your packet. To review your documents, prepare your packet, correct and re-work it under our satisfaction guarantee, and answer your questions during the 30-day window.
To process payments. Through Stripe, to take the payment you have authorized and process any refund.
To manage our business. For accounting, tax, record-keeping, and other administrative purposes.
To communicate with you. To send order confirmations, delivery emails, and answers to your questions.
To measure the Site and our advertising, only with your consent, via Google Analytics and Google Ads conversion measurement, as described in our Cookie Policy.
To meet our legal obligations. For example, retaining records required by HMRC or responding to lawful requests from regulators or law enforcement.

6. Our legal bases for processing (UK/EEA visitors)

Contract. Where you have purchased a packet, we process your information to perform the contract with you or to take steps at your request before entering into one.
Explicit consent. For the health information in your uploaded documents, as section 4.2 describes, and for analytics and advertising-measurement cookies.
Legitimate interests. Our legitimate interest in running, securing, and improving our business, where not overridden by your rights and interests.
Legal obligation. Where we must process your information to comply with a legal obligation, such as keeping accounting records.

7. Who we share your information with

We share your personal information only with the service providers who help us run the business. Each acts either as a "processor" on our instructions (meaning we remain responsible for how your information is handled) or as an independent controller for a clearly defined purpose.

7.1 Service providers we use

Stripe, Inc. (United States). Payment processing. Stripe handles your payment card details directly and is an independent controller for that processing. See stripe.com/privacy.
Netlify, Inc. (United States). Website hosting and delivery, processing information on our behalf.
Supabase, Inc. (United States). Database and secure document storage, processing information on our behalf. Your uploaded documents are held here, in private storage that is not publicly accessible.
Fastmail Pty Ltd (Australia, with servers in the United States). Business email at our domain, used to deliver your packet and answer your questions.
OpenAI, L.L.C. (United States) and Anthropic, PBC (United States). As part of our own human review, an operator preparing your packet may use artificial intelligence tools from these providers to help check and draft the documents. We send only the minimum information needed for that step. We do not upload your documents into these tools, and we never send the identifiers we deliberately do not collect: your Social Security number, your Medicare number, or your insurance ID. The tools are used under business terms that do not permit your information to be used to train their models. This is an operator step in our review, not something the website or your browser does.
Google (United States). Analytics and advertising measurement, only with your consent, as described in our Cookie Policy. Google does not receive your uploaded documents. If you complete a purchase, a hashed form of your email address may be sent to Google solely to confirm the sale came from our advertising.

7.2 Professional advisors

We may share information with our accountants, lawyers, or other professional advisors where necessary to obtain their advice, subject to confidentiality obligations.

7.3 Legal and regulatory disclosures

We may disclose your information where required by law, court order, or request from a competent authority; to investigate or prevent fraud; or to protect the rights, property, or safety of our business, our customers, or others.

7.4 We do not sell your information

We do not sell your personal information, and we do not share it with third parties for their own marketing purposes. Your uploaded documents are never shared for any purpose other than preparing your packet, the legal disclosures above, or with your explicit consent.

8. International data transfers

We are a UK company and most of our customers are in the United States, so your information moves between the two. Several of the providers above are US-based. When personal information is transferred outside the United Kingdom or the European Economic Area, we rely on appropriate safeguards, including the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses where required, the provider's certification under the UK-US Data Bridge or the EU-US Data Privacy Framework where applicable, and any other safeguards recognized by the UK Information Commissioner's Office. For details of the safeguards for a particular provider, contact support@patientstand.com.

9. How long we keep your information

Uploaded documents (bills, explanations of benefits, letters, correspondence): deleted 90 days after your order completes, or sooner on request, or longer only at your written request. See section 4.5.
Your packet and our working file: retained alongside your uploaded documents and deleted on the same schedule.
Free tool inputs: our free tools are guides, not calculators. They do not collect or store details of your income, your household, or your bills. If you give us your email address on a free tool page, we keep it until you unsubscribe.
Order, payment, and invoicing records: at least 7 years, in line with HMRC requirements. These records do not include your uploaded documents.
Correspondence: up to 2 years after your last contact, then deleted.
Analytics data: retained per Google Analytics settings, 14 months, and only where you consented.

10. Your rights under UK GDPR

If you are in the United Kingdom or the European Economic Area, you have the following rights in respect of your personal information:

Right of access. Ask for a copy of the personal information we hold about you.
Right to rectification. Ask us to correct information that is inaccurate or incomplete.
Right to erasure. Ask us to delete your information in certain circumstances, and note that uploaded documents are deleted on the schedule in section 9 in any event.
Right to restrict processing. Ask us to stop or limit how we use your information in certain circumstances.
Right to data portability. Ask us for your information in a structured, machine-readable format.
Right to object. Object to our use of your information on the basis of legitimate interests.
Right to withdraw consent. Where we rely on consent, including the explicit consent for your health information, you can withdraw it at any time.

To exercise any of these rights, email support@patientstand.com. We will respond within one calendar month and may need to verify your identity first. If you are unhappy with how we have handled your information, you have the right to complain to the UK Information Commissioner's Office (ICO): ico.org.uk, 0303 123 1113. We would appreciate the chance to address your concerns first.

11. Your rights under US state privacy laws

11.1 California residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act as amended by the California Privacy Rights Act gives you specific rights regarding your personal information.

Categories of personal information we collect: identifiers (name, email address, IP address); commercial information (records of products purchased); internet or network activity (via Google Analytics, with consent); sensitive personal information (the health-related content of your uploaded documents, used only to provide the product you asked for, see section 4.4); and, to the limited extent needed to prepare your packet, inferences drawn from the above. We collect this information directly from you, from your interaction with the Site, and from the service providers in section 7.

Your rights:

Right to know what personal information we have collected, used, or disclosed about you in the past 12 months.
Right to delete personal information we hold about you, subject to legal exceptions.
Right to correct inaccurate personal information.
Right to opt out of sale or sharing. We do not sell your personal information. Our Google Ads measurement is configured for conversion measurement only, not for building advertising audiences or retargeting, and it runs only if you accept cookies. You can opt out at any time in three ways: decline or change your choice on our cookie banner; use the "Your Privacy Choices" link in our footer; or send a Global Privacy Control signal from your browser, which we honor automatically as an opt-out.
Right to limit use of sensitive personal information. We use sensitive personal information only to provide the product you requested, a purpose for which the CCPA/CPRA does not require a limit option; we offer no other use to limit.
Right to non-discrimination for exercising any of these rights.

To exercise any of these rights, email support@patientstand.com with "Privacy Request" in the subject line. We may need to verify your identity, and you may designate an authorized agent to act for you.

11.2 Other US states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Delaware, Iowa, Nebraska, New Jersey, Tennessee, Montana, Indiana, New Hampshire, Maryland, and other states with comprehensive privacy laws have similar rights, including to access, correct, delete, and obtain a copy of personal information, and to opt out of targeted advertising, sale, or profiling. Several of these laws also require consent for processing sensitive data, including health data, which is how we operate for everyone: your documents are processed only with your explicit consent, for the single purpose of preparing your packet. To exercise any right under the law of your state, email support@patientstand.com.

12. Children's privacy

Our products are for adults handling their own or a family member's medical bills. We do not knowingly collect personal information from anyone under the age of 18. A bill may of course relate to a child's medical care; in that case the customer is the parent or guardian, and we treat the information with the care section 4 describes. If you believe a child has provided information to us directly, contact us and we will delete it.

13. Security

We take appropriate technical and organizational measures to protect your personal information against loss, misuse, unauthorized access, and disclosure. These include encryption in transit, storage of your uploaded documents in private storage that is not publicly accessible, access limited to those preparing your packet, and the deletion schedule in section 9. No method of internet transmission or electronic storage is completely secure, and we cannot guarantee absolute security.

14. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or the law. The date at the top shows when it was last updated. For material changes, especially any change to how uploaded documents are handled, we will take reasonable steps to notify you.

15. Contact

For any privacy-related question or request, email support@patientstand.com, or write to Ironwood Brands Ltd (trading as Patient Stand), 85 Great Portland Street, First Floor, London, W1W 7LT, United Kingdom.