Privacy Policy

1. Who is responsible

Superbill (therapysuperbill.com) is a Heyi Lab product. Heyi Lab is a trading name of Ning Zhang, an individual, who operates Superbill and is responsible for the personal information described on this page. Contact: support@dtchain.org. Payments are handled by Creem, which is a separate controller of your payment data (see section 6).

2. What stays in your browser

When you use the app, the information you type is saved in your browser’s local storage, on your device, so it is still there next time. It is never sent to us. Specifically, one local-storage entry named localsuperbill_web_v1 holds:

• provider details (name, credentials, NPI, license number, TIN, address, phone, email, typed signature, and the practice logo if you upload one, kept as an image inside that entry);
• client records and their insurance details (names, dates of birth, addresses, member IDs, diagnosis codes, any notes you type) and session records (dates of service, codes, fees);
• a counter of how many PDF exports you made this month (used for the free-plan limit);
• if you activated Pro: the license key, the device (instance) ID that Creem returned, the plan and its status, and the dates of the last license checks.

3. What the app sends, and to whom

The only requests the app makes are license requests to our own server (the same site, path /api/license/). They happen when you activate, check, or remove a Pro license, and automatically at most about once a week while a Pro license is active. They contain:

• when activating: your license key and a device name made of the app name and your browser family, for example “Superbill web – Chrome”;
• when checking or removing: your license key and the device ID.

4. What is never sent

No provider, client, session, diagnosis or other practice information is ever included in any request. PDFs, Good Faith Estimates and client guides are generated inside your browser and saved to your device. The FSA deadline checker and all other free tools run in your browser and send nothing.

Our license server passes the key and device name on to Creem to confirm the license and returns the result. It does not store them, and our code does not write them to any log. The site is hosted on Cloudflare Pages, which, like any web host, receives each request (see section 5).

Opening the Creem checkout, or a link to the Creem customer portal, takes you to creem.io, a different website with its own privacy policy.

5. What the host collects

The site and the license endpoint run on Cloudflare. Cloudflare processes the technical details of each request, such as your IP address, the page requested, the browser and device type, and the time, to deliver the site and keep it secure. We have not set up any analytics or advertising, we run no third-party scripts, and we cannot see what you do inside the app. Cloudflare’s own practices are described at cloudflare.com/privacypolicy.

Superbill sets no cookies. The site loads no third-party fonts, trackers, tag managers or ad networks; its security policy only allows resources from the site itself.

6. What Creem collects when you buy

If you buy Pro, you give your payment details, name, email address, billing country or address, and any tax information directly to Creem at checkout. Creem, as the merchant of record, uses them to take payment, calculate tax, prevent fraud, send receipts and the license key, and run the customer portal. We do not see your card number. Creem may tell us limited information about the purchase, such as the plan, the status of the subscription and the email address used, so we can give you support. How Creem handles your data is set out in the Creem Privacy Policy.

7. If you contact us

If you email support@dtchain.org, we receive your email address and what you write. We use it only to answer you and to keep a record of the conversation. Please do not send client names, diagnoses or other health information; we do not need it to help you.

8. How long we keep things

• Practice data in your browser: until you delete it. Use “Clear local data” in the app (a Pro license is removed separately, under Pro settings), or clear your browser’s site data. Clearing browser data cannot be undone, and we cannot restore it.
• Backups and PDFs you download: they are files on your device. You control them; please store them securely.
• Our license server: it keeps no copy of license requests.
• Support emails: kept for as long as needed to help you, and for a reasonable period afterwards in case you write again or we need a record of a refund or dispute.
• Cloudflare and Creem: according to their own policies.

9. Your choices and rights

Because your practice data lives only on your device, you already control it: you can view, edit, export and delete it inside the app, and delete it entirely by clearing local data. You can remove a Pro license from a device in the app (Pro settings), which also frees the activation slot.

Depending on where you live (for example California, the EU or the UK), you may have the right to ask what personal information a business holds about you, to correct or delete it, and to object to or limit its use. The information we can hold about you is limited to support emails. To make a request, email support@dtchain.org. For payment data held by Creem, write to Creem as described in its privacy policy.

10. Children

Superbill is a professional tool for adult practitioners. It is not directed at children, and we do not knowingly collect information from them.

11. Security

The site is served over HTTPS. Keeping data in the browser means it is protected mainly by the security of your own device. Use a screen lock and disk encryption, keep your browser up to date, and be careful on shared computers, because anyone who can open your browser profile can open the app.

12. Changes to this policy

If our practices change (for example if we add analytics), we will update this page and the “Last updated” date before the change takes effect.

13. Contact

Privacy questions: support@dtchain.org (reply within 3 business days), or the Contact page.