Consumer Health Data Privacy Notice

Barley is a consumer service that helps you find errors on your own Medicare bills. We are not a doctor, hospital, insurer, or other healthcare provider, and we are not a HIPAA-covered entity — you give your documents to us directly.

This policy covers consumer health data — information that identifies your past, present, or future physical health. For everything else (account info, payments, website analytics), see our main Privacy Policy.

When you upload or scan a Medicare bill, Medicare Summary Notice (MSN), or Explanation of Benefits (EOB), we collect:

• Your name, date of birth, and insurance/member ID numbers
• Provider names, procedure codes (CPT), diagnosis codes (ICD), and dates of service
• Billed amounts and account balances
• The image or PDF of the document itself, and the text extracted from it
• If you optionally request an emailed Medicare roadmap or reminder, the closed Medicare orientation answers needed to recompute that requested message

We collect this information directly from you — from the documents you upload or scan. We do not buy health data about you or obtain your records from your providers or insurers.

The anonymous Medicare navigator keeps answers in the page. If you request email delivery, the browser sends the closed answers directly to Barley for synchronous server recomposition; Barley discards them before durable delivery processing.

We use your consumer health data only to:

• Analyze your bill and identify possible billing errors
• Show you the results and help you act on them
• Maintain and secure your account

We do not use the content of your documents for advertising, and we do not use identifiable health data to train AI models.

To analyze your bill, we share your document with service providers who act only on our instructions, under contract, and may not use your data for their own purposes:

Both are bound by data-processing agreements that prohibit training on your data and require deletion. We never sell your consumer health data, and we never share it for advertising.

We keep your consumer health data until you delete your account. When you delete your account, we delete your data within 30 days (and from backups within 90 days).

Your data is encrypted in transit (TLS) and at rest (AES-256). Access is limited to what's needed to run the service, and document files are reachable only through short-lived, private links.

You can:

• Access / confirm what consumer health data we hold about you
• Delete your consumer health data
• Limit how we use your sensitive health data
• Withdraw your consent (see Section 10)
• Appeal if we deny a request

To exercise any of these rights, email support@barleymedical.com. We will respond within the time required by law. To appeal a denial, reply to our decision or email support@barleymedical.com; we will respond to appeals within the same timeframe.

You can withdraw your consent to collect and use your health data at any time by:

• Deleting your account (this also deletes your data), or
• Emailing support@barleymedical.com and asking us to stop.

The health data above is "sensitive personal information" under California law (CPRA). You may limit our use of it and exercise access/deletion rights as described above. We do not sell or "share" (for cross-context advertising) your sensitive personal information.

If we make material changes, we will update the effective date and notify you as required by law.

Privacy, legal, and withdrawal requests: support@barleymedical.com

Gildage Inc. d/b/a Barley, [address available on request]