Privacy Policy

Page title: Privacy Policy

Effective: August 5, 2026 · Last updated: August 12, 2026

The short version

We collect the least we can get away with and still run a training product.

We hold your email address, an optional display name for your certificate, what you bought, and how you are doing in the lab.
For payment-event replay protection, after account deletion we retain a normalized email address and the deletion time needed to stop an older event from recreating the deleted account or access.
Payment is handled by Stripe. We never see your card number.
Analytics are cookieless. There is no session recording, no advertising pixel, and no ad network.
No patient data enters this product. There are no uploads anywhere. The customer free-text fields are your optional certificate display name and a two-field form for reporting a problem with a lesson or scenario; neither asks for patient information.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

The rest of this page is the detail.

1. Who we are

The Remit Lab is operated by King Tech Solutions LLC, d/b/a The Remit Lab, a North Carolina limited liability company. We are the controller of the personal information described here.

Privacy contact: support@theremitlab.com · 604 E Front St #274, Clayton, NC 27520

2. What we collect, and why

What	Examples	Why we have it	Where it lives
Account identity	Email address, password, account creation date	Sign you in and give you the access you bought	Supabase Auth. Passwords are stored hashed by Supabase; we never see them
Temporary commerce-delivery marker	A SHA-256 one-way hash derived from the Stripe Checkout Session ID. The raw Session ID is never placed in this Auth metadata field	Coordinate the brief step between creating a new Auth user and committing its normal or already-refunded entitlement transaction; after a database/Auth race, identify only the unentitled orphan created for that exact checkout	Supabase Auth `app_metadata`, under `commerceBootstrapHash`. Cleared after the entitlement transaction succeeds
Display name	The name you enter for your certificate	Print your name on the certificate	Our `users` profile table
Purchase and refund record	Which product or add-on you own; whether that access is active and whether each backing purchase is marked refunded; the buyer email Stripe supplied; Stripe Checkout Session, PaymentIntent, refund, line-item, and price identifiers; amount, currency, quantity; record, grant, and refund timestamps; and, for an upgrade, the parent purchase or internal account-owner identifier	Unlock the right content, keep an upgrade attached to the account that owns the underlying learning access, prevent duplicate grants, reconcile payment delivery and refunds, and end only the access no longer backed after a full refund	Our `entitlements` table and Stripe Checkout metadata. We do not receive or store your card number
Payment and billing details	Card details, billing address, tax location	Take payment and calculate sales tax	Stripe only. We never see or store card numbers
Lesson progress	Lesson ID, completion date, quiz score	Show your progress and gate the exam	Our `user_progress` table
Simulation attempts	Scenario ID, mode, component scores, total score, hints used, the variation seed, completion time	Score your work, build the dashboard, drive Drill Mode	Our `simulation_attempts` table
Category mastery	Category ID, mastery box, streak, last seen	Build the Daily Drill queue and badges	Our `mastery_state` table
Certificate record	Certificate ID, issue date, readiness score, exam score	Issue and re-issue your certificate	Our `certificates_issued` table
Issue reports and commerce incidents	What you typed about a lesson or scenario, the content ID, and your email if you chose to give it; or an internal incident key and technical message when payment fulfilment or a refund needs operator review	Fix the content, follow up with you, and make sure a commerce exception is reviewed once rather than lost or duplicated	Our `issue_reports` table. Customer issue reports are also copied to our maintenance inbox through Resend
Email signups	Your email address and which page you signed up from	Send the free scenarios and the email sequence you asked for	Our `email_captures` table, and Resend when we send you an email
Email sending record	Your email address, which sequence and which email, whether it sent, and when	Make sure you get each email once and never twice	Our `email_sequence_sends` table
Email suppression and deleted-account replay record	Your normalized email address; why email was suppressed, such as an unsubscribe or bounce; and, after account deletion, the deletion timestamp	Keep marketing email stopped and prevent a payment event created before deletion from recreating the deleted account or access	Our `email_suppressions` table
Product usage events	A short fixed list of thirteen events — demo started, demo scenario completed, demo email gate shown, email captured, checkout started, purchase completed, first simulation completed, simulation completed, exam attempted, certificate issued, issue reported, library page viewed, and library demo link clicked — with properties like scenario ID, score, mode, hints used, library page type, denial category ID, and which of the two places on the demo the email gate appeared. Server events use your account ID when one exists. Email capture uses the submitted email; purchase completion uses the account ID returned by entitlement delivery, including the verified owner of the qualifying parent purchase for a receipt upgrade. Browser-only demo, checkout, and library events are not identified to an account or email by our code	See where the product works and where it does not	PostHog
Anonymous page-view analytics	Page path (without query strings), timestamp, referrer, approximate location, and browser/device information	Understand aggregate traffic to the site	Vercel Web Analytics
Technical request data	IP address, browser type, page URL, timestamps	Serve the site, keep it up, and prevent abuse	Server and provider logs

Receipt upgrades deliberately separate payment contact from account ownership. The child Stripe Checkout collects its own payer email. We do not give it the original purchase's Stripe Customer, email, or saved-payment context. We keep the child payer email in that payment's purchase record, but the verified parent Checkout Session — not an email match — identifies the existing owner that receives the upgrade.

Those tables are the entire list. Everything else in the product — every lesson, scenario, payer, provider, and code — is static content in our repository, identical for every customer, and holds nothing about you.

3. What we do not collect

No patient information. No PHI, no patient names, no dates of birth, no member IDs, no claims of yours. Every patient, provider, payer, and claim in the lab is fictional.
No uploads. There is no upload feature anywhere in the product. Not for claims, not for EOBs, not for documents, not for images.
No free-text fields we store other than the display name you choose for your certificate and the two-field issue report. Please do not put patient details in either. The claim reference in the filing tracker never leaves your browser.
No card numbers. Stripe handles payment on its own systems.
No session recording, no heatmaps, no screen capture.
No advertising cookies, no ad pixels, no third-party ad networks, no cross-site tracking.
No calculator inputs. The calculators run entirely in your browser. What you type into the denial cost calculator, the denial rate calculator, or the filing deadline tracker is never sent to us and is not stored on our servers.
No data brokers. We do not buy or enrich customer data.

4. Analytics

We use PostHog to understand how the product is used, configured to be cookieless and with session recording off. The thirteen product events in the table above are PostHog events; we do not add other product events in a dashboard.

We also use Vercel Web Analytics for anonymous, aggregate page-view traffic. It does not use third-party analytics cookies or record a browsing session across websites. Our integration sends the page path without query strings and sends no custom Vercel events.

We do not track you across other websites, we do not build advertising profiles, and we do not use analytics data for advertising.

PostHog and Vercel, like any web service, receive standard request information such as browser type and network information as part of serving a request.

5. Cookies

We use the minimum set:

One browser flag. After you unlock the free scenarios we store a single yes/no marker in your browser so you are not asked for your email twice. It holds no personal information and is never sent to us.
Essential cookies keep you signed in. Without them the app cannot tell one signed-in user from another. These are set by our authentication provider.
No analytics cookies. Analytics run cookieless.
No advertising cookies.

Stripe sets its own cookies on Stripe's checkout page for payment processing and fraud prevention. That is Stripe's page and Stripe's policy applies there.

Because we do not run non-essential cookies, there is no consent banner to click through.

6. Email

Two kinds:

Transactional email — sign-in links, email-change confirmations, and password resets. Sent by Supabase, our authentication provider. You cannot unsubscribe from these while you have an account, because they are how the account works. Stripe emails your receipt from its own systems, and your certificate is on your account page rather than in an email.
Marketing and course email — the sequences you get after signing up for the free scenarios or after buying. Sent through Resend. Every one has an unsubscribe link, and unsubscribing is instant and stops all of our marketing and course email, not just the one sequence. To make that stick we keep your address on a suppression list — that record is what stops us ever mailing you again.

We do not sell or rent our email list.

7. Who we share your information with

We share only with the vendors that make the product run, and only what each one needs.

Vendor	What it does	What it gets
Supabase	Authentication and the Postgres database	Your account identity and all learning data in the table above
Stripe	Payments, checkout, and sales tax	Name, email, billing and card details, purchase amount
Resend	Marketing, course and notification email	Email address and the message content
PostHog	Product analytics	The product events listed above, cookieless — recorded against your account ID for account activity and fulfilled purchases, or the submitted email for email capture
Vercel	Application hosting and anonymous page-view analytics	Standard request and server logs, plus the aggregate page-view data described above

Each vendor processes data under its own agreement with us and its own privacy policy.

We will also disclose information if the law requires it, to protect our rights or someone's safety, or as part of a merger or sale of the business — in which case we will notify account holders and this policy will continue to apply until it is replaced.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

8. Where your data is stored

In the United States, on infrastructure operated by the vendors above. The product is built and sold for the US market.

9. How long we keep it

Account and learning data: while your account exists. Delete your account and we delete it.
Temporary commerce-delivery marker: normally only for the interval between Auth-user creation and a successful normal or already-refunded entitlement transaction, then cleared. If clearing it fails, the webhook stays retryable and creates an internal commerce incident; the marker remains only until retry or operator cleanup completes. It is a SHA-256 one-way hash, never the raw Stripe Session ID in this Auth field.
Email signups: until you ask us to remove you. Unsubscribing does not delete your address — it adds it to a suppression list we keep indefinitely, which is what stops us mailing you again. We also keep a record of which sequence emails were already sent to your address.
Certificate records: kept while your account exists and active learning access remains so a certificate can be re-issued or verified. Deleting your account removes it. A successful full refund also removes it if that refund ends your last active backing for learning access. If a different purchase still backs that access, the certificate remains.
Issue reports and commerce incidents: kept while we work the fix or payment exception and for a period afterward so we can see what has already been handled. If a customer report contains your email, tell us and we will remove it.
Purchase, refund, and access records: kept in our entitlements table while your account exists so we can deliver what you bought and reconcile refunds. Deleting your account removes that entitlement record. Stripe separately keeps transaction records for its own legal, tax, and accounting obligations, which is outside our control.
Deleted-account replay record: after account deletion, we keep the normalized email address and account-deletion timestamp needed to reject older payment-event replays. We do not use this record to restore the deleted profile, learning history, purchase ledger, or certificate.
Logs: short retention, per each provider's default.

10. How we protect it

Traffic is encrypted in transit.
Every table that holds customer data has row-level security switched on and forced, so one customer's rows cannot be read by another.
Purchase entitlements and certificate records have no customer-writable path at all — they are written only by our payment webhook and our certificate issuance, never by a browser.
Issue reports and email signups are write-only: they can be submitted, but not read back by other customers.
We never receive card numbers.
The product has no upload surface.
An operator console at /admin is limited to a named allowlist of our own staff addresses and is read-only. It shows counts, purchase records, the email sending log, and open issue reports, so we can run the business and fix content people report. It cannot change your data.

No system is perfectly secure, and we do not claim otherwise. If a breach affects your information, we will notify you as required by law.

11. Certificate verification — not live

A public certificate verification page is planned but is not part of the current release. If and when it ships, a page at a certificate's own URL would show the name on the certificate, the program name, and the completion date — nothing else, and no scores. We will update this policy before it goes live.

12. Your choices and rights

Whatever state you live in, you can ask us to:

see what we hold about you;
correct anything wrong — your display name, email address and password you can change yourself on your account page, and anything else you can ask us about;
delete your account and your data;
get a copy of your data in a portable form;
stop emailing you — unsubscribe from any marketing email, or ask us.

Email support@theremitlab.com. We will verify that the request comes from the account holder, usually by confirming from the account's email address. We answer within 45 days and will tell you if we need longer.

Depending on where you live, you may also have the right to appeal a decision we make on a request. If we decline, our reply will tell you how.

We will not treat you differently for exercising any of these rights.

13. Deleting your account

Ask us to delete your account by emailing support@theremitlab.com from the address the account uses. There is no self-service delete button in the product today. Deleting removes your profile, progress, attempts, mastery state, entitlements, and certificate record.

It does not by itself remove an email signup, an unsubscribe record, the log of which sequence emails were already sent to your address, or an issue report you filed — those are keyed to your email address rather than your account, and the unsubscribe record is what stops us mailing you again. Ask us and we will remove those too, apart from the unsubscribe record itself.

We also retain a normalized copy of every email address known to have been attached to the account or its purchases, together with the account-deletion timestamp. That minimal record prevents a delayed or replayed payment event created before deletion from recreating the account or its access. It does not contain your former profile, learning activity, entitlement details, or certificate. A genuinely new purchase made after the deletion timestamp can create a new account.

It is permanent, and it ends your access to what you bought. Deleting your account is not a refund — if you want a refund, read the Refund Policy first, because the 14-day window applies either way.

14. Global Privacy Control

We honor the Global Privacy Control signal. Since we do not sell or share personal information for advertising, there is little for it to switch off, but we respect it.

15. Children

The product is for adults working in or training for healthcare billing roles. It is not directed to children, and we do not knowingly collect information from anyone under 18. If you believe a minor has given us information, email support@theremitlab.com and we will delete it.

16. Changes to this policy

We will update this page when the product changes. Material changes get an email to account holders and a new "Last updated" date. Because our data model is small and fixed, changes should be rare — and if we ever start collecting something new, this table is where you will see it first.

17. Contact

support@theremitlab.com King Tech Solutions LLC, d/b/a The Remit Lab · 604 E Front St #274, Clayton, NC 27520