Privacy Policy
Effective Date: October 25, 2026
RetroHSA is built upon the foundational principles of data sovereignty, confidentiality, and zero health data monetization. This Privacy Policy outlines how Jared Nussbaum, doing business as RetroHSA ("RetroHSA", "we", "our", or "us"), handles your personal and financial records.
We never sell, rent, monetize, or trade your medical receipts, personal identity, family roster, or tax information. We do not participate in cross-context behavioral advertising.
Your medical receipts, diagnoses, prescription details, and financial figures are never used to train public third-party AI models.
1. Geographic Restriction (Washington State Residents Prohibited)
RetroHSA is not directed to, and does not intend to target, provide products or services to, or conduct business with residents of the State of Washington or individuals located within the State of Washington. If you are located in or are a resident of Washington State, you are strictly prohibited from using this Service. Because we prohibit access by Washington consumers, we do not collect, share, or sell "Consumer Health Data" of Washington residents as defined by the Washington My Health My Data Act (MHMDA).
2. Categories of Personal Information Collected & Stored
In accordance with statutory consumer transparency requirements (including the California Consumer Privacy Act / CPRA), the following table details the specific categories of personal information we collect and store:
| Category | Specific Data Elements | Source & Purpose |
|---|---|---|
| Account & Identity Information | Email address, account UUID, cryptographic password salt/hash, and two-factor authentication (TOTP) seed secrets. | Provided directly by you during signup to secure, authenticate, and manage your account. |
| HSA & Tax Profile Data | HSA Establishment Date (hsa_start_date), verification status, resident tax state (e.g., CA, NJ, or Conforming State), and optional family member labels/tags. | Provided by you to calculate IRS Form 8889 eligibility cutoffs and state tax adjustments (California Form 540 / New Jersey NJ-1040). |
| Medical Substantiation Records & Uploads | Original receipt images and PDF documents (invoices, Explanation of Benefits, clinic statements); extracted provider names, dates of service, itemized treatments/supplies, monetary figures (gross billed, adjustments, patient responsibility), reimbursement status, and IRS Pub 502 medical necessity notes. | Uploaded by you and parsed via multimodal AI to assemble an audit-grade substantiation ledger under IRS Rev. Proc. 97-22 and IRC § 223. |
| Subscription & Payment Tokens | Stripe Customer ID, Subscription ID, plan tier (free vs. pro), and renewal status. We do not collect or store credit card numbers, CVVs, or bank account numbers. | Collected directly and tokenized by Stripe, Inc. to process annual subscription fees. |
| Security & Diagnostic Telemetry | IP addresses, browser user-agent headers, and error timestamps. | Recorded in transient server access logs solely for brute-force defense, session security, and rate limiting. |
3. Data Storage, Access Controls & Security Safeguards
When you upload medical receipts, invoices, and Explanation of Benefits (EOB) documents to RetroHSA:
- Storage Isolation & Row-Level Security: All user records, change logs, and document assets are housed in authenticated cloud databases protected by strict Row-Level Security (RLS). Storage path validation guards ensure each user's files can only be accessed by their authenticated account UUID.
- Encryption in Transit & at Rest: All data transmitted between your device and RetroHSA is encrypted in transit using industry-standard TLS/SSL protocols. Document files and database volumes are encrypted at rest on underlying cloud infrastructure.
- Document Integrity Verification: While not a privacy mechanism, documents are processed with SHA-256 digests solely to establish an immutable evidentiary audit trail under IRS Revenue Procedure 97-22 to verify that files match your tax substantiation ledger.
4. AI Multimodal Vision Processing (Gemini Vision)
To eliminate manual data entry, RetroHSA uses Google Gemini multimodal API endpoints strictly for optical extraction:
- Processing Scope: Document files are transmitted securely over HTTPS solely to parse dates, provider names, itemized lines, monetary amounts, and IRS substantiation elements.
- Zero Model Training: Under commercial enterprise API agreements, your inputs and document images are not used to train Google foundational models.
5. Healthcare Regulatory & HIPAA Status
RetroHSA is a personal consumer record-keeping and tax document compilation utility. We are not a healthcare provider, health plan, healthcare clearinghouse, or "Business Associate" under HIPAA. Your records are managed under robust consumer privacy frameworks (including CCPA/CPRA) rather than clinical HIPAA conduits.
6. Sovereign Data Rights: Access, Portability & Permanent Erasure
ledger.csv containing all metadata and SHA-256 hashes alongside your original, uncompressed receipt PDFs and images.7. Payment Processing via Stripe
Payment card numbers, CVCs, and billing credentials are never handled by or stored on RetroHSA servers. All checkout sessions and billing portal operations are handled directly by Stripe in compliance with PCI-DSS Level 1 standards.
8. Multi-Decade Data Retention Schedule & 60-Day Sunset Notice
Because Section 223 of the Internal Revenue Code allows taxpayers to take tax-free HSA distributions decades after qualified expenses occurred, RetroHSA is intentionally designed for multi-decade record retention. We retain your stored receipts, metadata, and audit logs for as long as your account remains open, or until you affirmatively delete items or request account termination.
60-Day Sunset Notice Guarantee: In the event that RetroHSA elects to discontinue, sunset, or permanently terminate the Service, we will provide at least sixty (60) calendar days advance written notice via email and an in-app banner. Your account and export tools will remain fully functional during this entire 60-day window to guarantee you can download your complete Vault ZIP archive prior to final server decommissioning and permanent data erasure.
9. Limitation of Liability & Disclaimers
THE SERVICE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND. WE SHALL NOT BE LIABLE FOR ANY DATA LOSS, UNINTENDED DATA CORRUPTION, THIRD-PARTY STORAGE OUTAGES, OR UNAUTHORIZED ACCOUNT ACCESS RESULTING FROM COMPROMISED USER CREDENTIALS.
10. Dispute Resolution & Governing Law
This Privacy Policy shall be governed by and construed in accordance with the laws of the Commonwealth of Massachusetts. Any individual disputes arising out of or related to this Policy shall be resolved exclusively in the state or federal courts located in Middlesex County, Massachusetts, subject to a mutual waiver of jury trials and a waiver of class-wide arbitration and representative claims.
For privacy inquiries, data requests, or compliance questions, please contact:
privacy@retrohsa.com · Jared Nussbaum d/b/a RetroHSA · Middlesex County, MA