Privacy Policy

Gildage Inc. is a Delaware corporation operating Barley, an AI-powered medical bill analysis service at barleymedical.com. "Barley," "we," "us," and "our" refer to Gildage Inc. This policy describes how we collect, use, and protect your information when you use the Service.

This policy applies to the Barley website at barleymedical.com, the Barley mobile app, and all related features and tools. It does not apply to third-party sites or services you may reach from the Service, or to information you independently share with your insurer, provider, or billing department.

The Service is intended for use by U.S. residents. Your data is stored and processed in the United States.

3.1 Information You Provide

Account information: Your name and email address when you create an account. Barley uses passwordless sign-in — there is no password to create or remember. You sign in either with a one-time secure link we email to you (a "magic link") or with Sign in with Apple. If you use Sign in with Apple, Apple provides your name and email address (or an Apple private-relay email, if you choose to hide your address). Advocate Users may also provide their professional title and organization name.

Phone number (optional): You may add a phone number to your profile. It is optional, and we use it only to reach you about your account or in response to a support request.

Medical bills and health documents: When you use the Service, you upload bills, EOBs, Medicare Summary Notices, or other documents. These may contain your name, date of birth, insurance ID numbers, provider names, procedure codes (CPT), diagnosis codes (ICD), service dates, and account balances. We treat all of this as sensitive health data and apply our strongest protections to it.

Payment information: Barley does not currently charge for anything, so we do not collect any payment or financial information. When paid billing begins, we will collect the billing details needed to process payment — handled by a third-party payment processor (such as Stripe) under PCI DSS standards, and we will not store your full card number. We will update this policy before paid billing begins.

Communications: Content you send us via email or through the app.

Optional Medicare roadmap delivery: The Medicare navigator works without an account or email address and keeps assessment answers in page memory. If you separately request a one-time emailed roadmap and/or one reminder, we collect the email address, the selected purpose and timing, and the closed navigator answers long enough to recompute the reviewed roadmap on the server. The answers are discarded before durable delivery processing. Summary, reminder, and marketing choices are separate; the roadmap form does not subscribe you to marketing.

3.2 Information We Collect Automatically

When you use the Service, we automatically collect:

• Device type, operating system, browser type and version
• IP address and approximate location (city/region level)
• App version, session identifiers
• Pages or screens viewed, features used, time spent, and actions taken (such as uploading a document or generating an analysis)
• Error logs and performance data

We do not automatically read the content of your documents. They are processed only when you actively submit them for analysis.

3.3 Information from Third Parties

If you sign in with Apple, Apple provides your name and email address (or an Apple private-relay email) to create and secure your account. We do not currently receive information from a payment processor; once paid billing begins, a payment processor (such as Stripe) will communicate payment status and fraud alerts to us. We do not purchase data about you from data brokers or combine your health documents with outside data sources.

We use your information for these specific purposes:

To provide the Service: Creating and managing your account, analyzing documents you submit, generating Analysis Output, and providing support. Once paid billing begins, we will also use your information to process payments.

To maintain and improve the Service: Monitoring technical performance, diagnosing errors, maintaining security, and understanding aggregate usage patterns using de-identified data. We do not use document content for this purpose.

To communicate with you: Account notifications (sign-in links, security alerts, and — once paid billing begins — billing and renewal reminders), material updates to this policy or our Terms, responses to your support requests, and occasional emails about new features. You can opt out of marketing emails at any time via the unsubscribe link or by emailing support@barleymedical.com.

Requested Medicare messages: When you explicitly choose them, we use a verified email address to send the one-time Decision Passport and/or the one reminder you selected. We first send a neutral verification message and do not send roadmap details until the address is confirmed. A reminder can be stopped without affecting any other purpose.

For safety and legal compliance: Detecting fraud and abuse, complying with legal obligations, enforcing our Terms of Service.

What We Do NOT Do With Your Information

• We do not sell your data. Ever. To anyone.
• We do not use your health information for advertising of any kind.

We share information only in the limited circumstances below and do not sell, rent, or trade it.

5.1 Service Providers

We work with third-party providers that process data on our behalf, under our instructions, and under contractual obligations not to use your data for their own purposes. Our current primary providers:

We do not currently use a payment processor, because Barley does not collect payment information. When paid billing begins, we will add a payment processor (such as Stripe) to this list and update this policy beforehand.

About our AI provider:

Anthropic (our current AI provider): Today, the only AI provider that receives your documents is Anthropic. We use Anthropic's commercial API, governed by Anthropic's Commercial Terms of Service. Under these terms, Anthropic does not use API customer data to train its AI models. This is entirely separate from Anthropic's consumer products (Claude Free/Pro/Max), which operate under different terms. Under Anthropic's commercial data retention policy, API inputs and outputs are automatically deleted within 30 days — retained longer only where Anthropic must comply with law or review content flagged for violating its Usage Policy (in which case they may be retained for up to two years).

Other AI providers we may use in the future: We may add OpenAI or another commercial AI provider later to provide or improve your analysis. If we do, we will use it only through its commercial API, under the same core protections that apply to Anthropic today: no use of your data to train AI models; limited retention (logs typically deleted within about 30 days, kept longer only where required by law or to review content flagged for a policy violation); and access limited to processing your analysis request and returning a result. We will update this policy to name any new provider before it begins receiving your documents.

Whichever commercial AI provider we use accesses your document content only to process your analysis request and return a result, and uses it for no other purpose.

5.2 Business Transfers

If Barley is acquired or merges with another company, your information may transfer to the new entity. We will notify you before your data becomes subject to a different privacy policy, and will require the acquiring entity to honor these commitments.

5.3 Legal Disclosure

We may disclose your information without your consent when we believe in good faith it is necessary to comply with a valid legal obligation, protect someone's safety, or detect or prevent fraud or security threats. Where legally permitted, we will notify you before complying with legal requests. We do not provide bulk or voluntary access to law enforcement.

5.4 At Your Direction

If you direct us to share specific information with a third party — for example, exporting a report to your insurer — we will share only what you specify, with the party you identify, for the purpose you authorize.

5.5 Aggregated and De-Identified Data

We may use and share aggregated, de-identified information (which cannot identify you individually) for purposes such as research or publishing general insights about medical billing trends.

6.1 How We Treat Your Health Documents

The documents you upload — medical bills, EOBs, Medicare Summary Notices — are sensitive. They may contain information about your conditions, treatments, providers, and insurance. We apply our highest level of data protection to this information.

6.2 The Regulatory Framework That Governs Barley

Barley is a consumer software tool, not a healthcare entity. The laws that govern how we handle your health data are:

The FTC Act (Section 5): Prohibits unfair or deceptive practices. This means every promise we make about data handling — in this policy and our Terms of Service — must be accurate and kept. We take this seriously. The FTC has actively enforced against health apps that made privacy promises they did not keep (GoodRX, BetterHelp, 1Health.io). We will not make a commitment we cannot technically honor.

The FTC Health Breach Notification Rule: Requires us to notify you promptly if your health data is breached. See Section 8.1.

State privacy laws: California (CCPA/CPRA) and other state laws give you specific rights described in Sections 13 and 14.

HIPAA — the law that governs hospitals, insurers, and their contractors — does not apply to Barley, because Barley is not a healthcare provider, health insurer, or healthcare clearinghouse, and neither are the individuals who use our Service. We protect your health data to the same high standard regardless of HIPAA's technical non-applicability.

6.3 Security Practices for Health Data

We apply the following safeguards to all health-related information submitted to the Service:

• Encryption in transit (TLS 1.2+) and at rest (AES-256)
• Access controls limiting which Barley employees can access your documents, restricted to what is necessary to provide the Service
• Audit logging of access to systems containing health data
• Contractual data protection requirements for all third-party providers who process health data on our behalf

7.1 How Our AI Provider Handles Your Data

Your documents are transmitted in full. To generate your analysis, the document you submit is sent in its entirety — including your name, insurance and account ID numbers, other personal and health details, and the document image itself — to our AI provider's commercial API. The app does not remove or redact personal information on your device before it is sent. Today, that provider is Anthropic.

Under the commercial API agreement governing our AI provider:

• The provider does not use API customer data to train AI models
• Anthropic automatically deletes API inputs and outputs within 30 days — retained longer only where required by law or to review content flagged for a policy violation
• The provider does not share your documents with other customers or use them for any purpose beyond returning your analysis

If we add another commercial AI provider in the future (such as OpenAI), the same protections will apply, and we will update this policy to name it. See "About our AI provider" in Section 5.1 for more detail.

7.2 De-Identified Aggregate Analysis

We may analyze patterns across many interactions in de-identified form — for example, understanding what types of billing discrepancies are most common — to improve the Service. This does not involve identifiable health data and is not AI model training.

We maintain a security program designed to protect your information, including:

• Encryption of health data in transit (TLS 1.2+) and at rest (AES-256)
• Access controls limiting employee access to user data on a need-to-know basis
• Incident response procedures and a breach response plan
• Contractual data protection requirements for all third-party vendors
• Periodic security reviews of our systems and practices

No system is completely secure. Despite our efforts, we cannot guarantee that security measures will never be defeated.

If you believe your account has been compromised, contact us immediately at security@barleymedical.com.

8.1 Breach Notification

If we experience a breach of unsecured health data affecting your account, we will notify you as required by the FTC Health Breach Notification Rule — within 60 days of discovery, and without unreasonable delay. Notification will include what happened, what data was involved, what we are doing about it, and what steps you can take to protect yourself. We will also notify the FTC as required by law.

We retain your information only as long as needed to provide the Service, meet legal obligations, and resolve disputes.

Deleting your account: You can delete individual documents at any time within the app. To delete your account and all associated data, use the account deletion option in your settings or email support@barleymedical.com. Upon verification, we will delete your account and health data from active systems within 30 days. Encrypted backups will be purged within 90 days. Payment records required for tax or legal purposes will be retained separately. We will confirm deletion by email.

Legal holds: We may need to retain certain information longer if required by a legal obligation, litigation hold, or regulatory requirement. We will delete the data as soon as the obligation is satisfied.

Essential cookies: Required for the Service to function — keeping you logged in, maintaining session security. You cannot opt out of these while using the Service.

Analytics: We use Google Analytics 4 to understand aggregate usage patterns (what features are used, where errors occur). Analytics data does not include the content of your health documents. Google Analytics uses cookies to distinguish unique users and sessions. IP addresses are automatically anonymized by Google Analytics 4.

Advertising measurement: We use Google Ads conversion tracking to measure the effectiveness of our advertising. This involves cookies that record when you arrive at our site from a Google ad and when you complete a signup. We do not use retargeting pixels or build advertising profiles based on your activity within the Service.

Your privacy choices: California residents have the right to opt out of the sharing of personal information for advertising purposes under the CCPA/CPRA. To exercise this right, contact us at support@barleymedical.com.

Managing cookies: You can control cookies through your browser settings. Disabling certain cookies may affect Service functionality.

The Service is for users 18 and older and is not directed to children under 13. We do not knowingly collect information from children under 13. If you believe a child under 13 has provided information to us, email support@barleymedical.com and we will delete it promptly.

Medical bills sometimes reference minor dependents on a family plan. If your document includes information about a minor family member, we treat it with the same protections as your own health information.

You have the following rights with respect to your information:

Access: Request a copy of the personal information we hold about you.

Correction: Update inaccurate information through your account settings or by contacting us.

Deletion: Request deletion of your account and personal information (see Section 9).

Withdraw consent: Where we process information based on consent (such as marketing emails), you can withdraw consent at any time.

Portability: Request a copy of your account data and uploaded documents.

Opt out of sale: We do not sell your data, so this right is already honored.

Submit requests to support@barleymedical.com or through your account settings. We will verify your identity before processing requests that affect your data. We will respond within 30 days (up to 60 days for complex requests, with notice). We will not discriminate against you for exercising these rights.

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the CPRA gives you additional rights.

Categories of personal information we collect (as defined by CCPA):

• Identifiers (name, email, phone number, IP address, account ID)
• Commercial information (subscription and payment history, once paid billing begins)
• Internet activity (usage data, device identifiers, log data)
• Sensitive personal information (health data in your documents)

Your California rights (in addition to Section 12):

• Know: Request disclosure of what we collect, why, and who we share it with
• Delete: Request deletion, subject to legal exceptions
• Correct: Request correction of inaccurate data
• Opt out of sale/sharing for advertising: We do not sell or share for advertising — this right is already honored
• Limit use of sensitive personal information: We already use health data only to provide the Service — no further action is required on your part
• Non-discrimination: We will not discriminate for exercising these rights

To submit a California privacy request: Email support@barleymedical.com with subject line "California Privacy Request." We will verify your identity and respond within 45 days (extendable by 45 days with notice). Authorized agents may submit requests with written authorization from you.

Residents of Virginia, Colorado, Connecticut, Texas, and other states with comprehensive consumer privacy laws have rights similar to those in Section 12, including rights to access, delete, correct, and opt out of certain data uses. Contact support@barleymedical.com to exercise these rights. We will respond per applicable law and will not discriminate against you for exercising them.

For material changes — those affecting what we collect, how we use it, or your rights — we will notify you by email at least 14 days before they take effect. Non-material changes (clarifications, formatting) take effect when posted. Prior versions are available on request. If you disagree with changes, close your account before the effective date.

Gildage Inc. d/b/a Barley
5101 Santa Monica Blvd Ste 8 Pmb 1491
Los Angeles, CA 90029-2480, USA

• Privacy, your data rights, and legal: support@barleymedical.com
• Security: security@barleymedical.com
• General support: support@barleymedical.com
• Website: barleymedical.com

We aim to respond to privacy inquiries within 10 business days.

Last updated: June 8, 2026. Prior versions available on request.