Privacy Policy
Effective at launch
AffirmDME is a product of NF Labs LLC ("AffirmDME," "we," "us"). This policy explains what information we collect through our website and our application, how we use it, and the choices you have. It is written for our customers — durable medical equipment (DME) supplier businesses and their staff — not for patients.
Protected health information comes first
Our customers use AffirmDME to prepare Medicare prior-authorization documentation, which involves protected health information (PHI) about their patients. When we handle PHI we do so as a business associate under HIPAA, governed by the Business Associate Agreement (BAA) we sign with each customer. For PHI, the BAA and HIPAA control — not this policy. We use PHI only to provide the service, we do not sell it, and we do not use it to train AI models. See our BAA overview.
Information we collect
- Account and business information: your name, work email, practice/business details (name, locations, NPI/PTAN), and role — provided when you sign up or are invited to a workspace.
- Customer content: the cases, documents, and related data your team uploads or creates in the application. This routinely includes PHI and is handled under the BAA as described above.
- Billing information: plan, usage counts, and invoicing details. Payment cards are processed by Stripe; we never store card numbers.
- Usage and log data: standard technical logs (IP address, browser type, pages viewed, actions taken) used for security, audit trails, and improving the service. We also use GoatCounter, a cookieless analytics service, to count page views on our website and a small number of product milestones in the application (for example, that a sign-up or a first case happened). Those counts carry no names, account identifiers, or PHI.
- Communications: emails you send us (for example, to hello@affirmdme.com).
How we use information
- To provide, secure, and support the service.
- To process billing and send transactional messages (invitations, digests, notifications).
- To maintain audit logs required for security and compliance.
- To improve the product — using aggregate, de-identified usage data, never PHI.
- To meet legal obligations.
We do not sell personal information, and we do not use customer content to train AI models. Document AI runs inside Amazon Web Services (Amazon Bedrock); your data is not shared with model providers or used for training.
Service providers (subprocessors)
We use a small set of vendors to run the service — including Amazon Web Services (hosting and document AI), WorkOS (sign-in), Stripe (billing), and, where configured, DocuSign (e-signature) and Sinch (fax delivery). Vendors that touch PHI are engaged under their own BAAs. A current subprocessor list is available on request at hello@affirmdme.com.
Security
Data is encrypted in transit and at rest. Access is role-based and logged. The service runs on HIPAA-eligible AWS services under a Business Associate Agreement. No system is perfectly secure, but security is a design constraint here, not an afterthought — see our security overview.
Retention and deletion
We retain customer content for as long as your account is active. When a customer relationship ends, we return or delete customer content as provided in the BAA and our agreements, subject to legal retention requirements (for example, audit records).
Your choices and rights
You can access and update account information in the application, and can request deletion of your account data by contacting us. Depending on where you live, you may have additional rights under state privacy laws (such as access, correction, or deletion) — contact us and we'll honor applicable requests. Patients seeking access to their own records should contact their DME supplier or clinic, which controls those records; we support our customers in fulfilling such requests.
Cookies
The application uses session cookies necessary for sign-in. Our marketing site does not use advertising trackers.
Children
Our website and application are business tools and not directed to children; we do not knowingly collect information from children through them.
Changes
We'll post updates to this policy here and update the effective date. For material changes affecting customer accounts, we'll notify workspace administrators.
Contact
NF Labs LLC (AffirmDME) · hello@affirmdme.com