Data Policy

Last updated: September 30, 2026. This Data Policy describes, in technical detail, what data RedoClaim stores, where it is processed, how long it is kept, and how it flows through our systems. It supplements our Privacy Policy.

Data Categories & Storage

Data Type	Examples	Storage Location
Account data	Name, email, hashed password	PostgreSQL (Neon)
Claim data	Policy number, insurer, claim amount, status, rejection reason, claim analysis findings / potential regulatory inconsistencies	PostgreSQL (Neon)
Documents	Uploaded claim/policy/medical/motor documents	Object storage
Document embeddings	Vector representations of document text for retrieval	Qdrant vector database
Translated reports	Cached translations of analysis reports	PostgreSQL (Neon), linked to claim
Timeline/deadline data	Applicable grievance and claim timelines and reminder status	PostgreSQL (Neon)

Data Processing Flow

You upload a document, which is stored in object storage.
The document is processed via OCR to extract text.
Extracted text is analyzed by our AI/LLM pipeline to identify claim details, potential policy or regulatory inconsistencies, relevant supporting information, and generate an AI-assisted analysis report.
Text chunks may be embedded and stored in our vector database to support retrieval-augmented analysis.
If you request a translation, the relevant report text is sent to our translation provider and cached against your claim. Translation is performed only when the user requests a translated report.

Cross-Border Data Transfers

Some of our service providers (AI/LLM providers, cloud hosting, translation services) may process data outside your country of residence. Where this occurs, we rely on the provider's own data protection safeguards and contractual commitments.

Data Retention & Deletion

Account and claim data is retained while your account is active
Uploaded documents are retained while they are needed to provide the requested service and support the user's ongoing claim or appeal workflow, subject to applicable deletion requests and legal requirements
Upon account deletion request, we delete or anonymize your personal data and documents within a reasonable period, except where retention is required by law
Cached translations are deleted when the associated claim is deleted

Access Controls & Sub-processors

Access to production data is restricted to authorized personnel on a need-to-know basis. Database and storage credentials are managed as environment secrets and are not exposed in application code.

We use the following categories of sub-processors: cloud infrastructure hosting, managed PostgreSQL database, object storage, vector database, AI/LLM inference providers, and translation API providers. A current list of named sub-processors is available on request.

In the event of a data breach affecting your personal information, we will notify affected users and relevant authorities as required by applicable law.

Back to Dashboard