Working draft. This document is pending attorney review and must not be treated as final before public launch.

Privacy Policy

REVIEWER NOTE — INTERNAL, DOES NOT RENDER

This is a working draft. It has not been reviewed by an attorney. Do not publish this page, and do not open checkout to the public, until a licensed attorney has reviewed and approved it. SPEC D7 makes attorney review of Terms and Privacy a launch gate.

This draft describes only what the product actually does, per SPEC D2 plus the two email tables added in migration 0004 (ten dynamic tables in total), D5 (PostHog, cookieless, no session recording), and D7 (no uploads; the only free text is the two-field issue report). If a reviewer adds a data-collection description, check it against the schema first — a privacy policy that overstates collection is as wrong as one that understates it.

Open items for the attorney:

North Carolina assumed-business-name filing. The operating entity is King Tech Solutions LLC and this page names "The Remit Lab" as the brand. Confirm whether an assumed-business-name certificate must be filed with the county register of deeds (N.C.G.S. Ch. 66, Art. 14A) before selling under the brand name. Open. Do not resolve internally. (SPEC D7.)

Which state privacy laws apply. The customer base is US and nationwide. Confirm the disclosure set and the rights section for California (CCPA/CPRA) and the other comprehensive state laws now in force, and whether a separate "Your California privacy rights" section, a notice at collection, or an appeals process is required.

Sale/share language. We do not sell personal information and do not share it for cross-context behavioral advertising. Confirm the wording meets the statutory definitions.

Analytics configuration. PostHog is specified cookieless with no session recording (SPEC D5). Before this page ships, confirm in the actual configuration: whether person profiles are enabled, whether events are linked to a user ID, and how IP addresses are handled. Section 4 must match the configuration, not the intent.

Subprocessor list. Section 7 must be verified against production configuration at launch, including [[HOSTING_PROVIDER]], which the SPEC does not name.

Retention periods. Section 9 sets defaults. Confirm they are compatible with tax and accounting record-keeping obligations on the Stripe side.

Certificate verification page. /verify/[certId] is v1.5 and not live. Section 11 describes it as not live. Either keep it as advance notice or cut it until it ships — reviewer's call.

Breach notification. Confirm whether any state notification commitment should be stated here.

Page title: Privacy Policy

Effective: [[EFFECTIVE_DATE]] · Last updated: [[LAST_UPDATED]]

The short version

We collect the least we can get away with and still run a training product.

We hold your email address, an optional display name for your certificate, what you bought, and how you are doing in the lab.
Payment is handled by Stripe. We never see your card number.
Analytics are cookieless. There is no session recording, no advertising pixel, and no ad network.
No patient data enters this product. There are no uploads anywhere, and the only free-text box is a two-field form for reporting a problem with a lesson or scenario.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

The rest of this page is the detail.

1. Who we are

The Remit Lab is operated by King Tech Solutions LLC, d/b/a The Remit Lab, a [[FORMATION_STATE]] limited liability company. We are the controller of the personal information described here.

Privacy contact: [[PRIVACY_EMAIL]] · [[ENTITY_ADDRESS]]

2. What we collect, and why

What	Examples	Why we have it	Where it lives
Account identity	Email address, password, account creation date	Sign you in and give you the access you bought	Supabase Auth. Passwords are stored hashed by Supabase; we never see them
Display name	The name you enter for your certificate	Print your name on the certificate	Our `users` profile table
Purchase record	Which tier or pack you own, the Stripe checkout session ID, the date it was granted	Unlock the right content	Our `entitlements` table
Payment and billing details	Card details, billing address, tax location	Take payment and calculate sales tax	Stripe only. We never see or store card numbers
Lesson progress	Lesson ID, completion date, quiz score	Show your progress and gate the exam	Our `user_progress` table
Simulation attempts	Scenario ID, mode, component scores, total score, hints used, the variation seed, completion time	Score your work, build the dashboard, drive Drill Mode	Our `simulation_attempts` table
Category mastery	Category ID, mastery box, streak, last seen	Build the Daily Drill queue and badges	Our `mastery_state` table
Certificate record	Certificate ID, issue date, readiness score, exam score	Issue and re-issue your certificate	Our `certificates_issued` table
Issue reports	What you typed about a lesson or scenario, the content ID, and your email if you chose to give it	Fix the content and follow up with you	Our `issue_reports` table, and a copy emailed to our own maintenance inbox through Resend
Email signups	Your email address and which page you signed up from	Send the free scenarios and the email sequence you asked for	Our `email_captures` table, and Resend when we send you an email
Email sending record	Your email address, which sequence and which email, whether it sent, and when	Make sure you get each email once and never twice	Our `email_sequence_sends` table
Unsubscribe record	Your email address and why it was suppressed — you unsubscribed, or mail bounced	Make sure we never mail you again after you ask us to stop	Our `email_suppressions` table
Product usage events	A short fixed list of ten events — demo started, demo scenario completed, email captured, checkout started, purchase completed, first simulation completed, simulation completed, exam attempted, certificate issued, issue reported — with properties like scenario ID, score, mode, and hints used. Recorded against your account ID, or against your email address for the signup and purchase events, which happen before an account exists	See where the product works and where it does not	PostHog
Technical request data	IP address, browser type, page URL, timestamps	Serve the site, keep it up, and prevent abuse	Server and provider logs

Those tables are the entire list. Everything else in the product — every lesson, scenario, payer, provider, and code — is static content in our repository, identical for every customer, and holds nothing about you.

3. What we do not collect

No patient information. No PHI, no patient names, no dates of birth, no member IDs, no claims of yours. Every patient, provider, payer, and claim in the lab is fictional.
No uploads. There is no upload feature anywhere in the product. Not for claims, not for EOBs, not for documents, not for images.
No free-text fields we store other than the display name you choose for your certificate and the two-field issue report. Please do not put patient details in either. The claim reference in the filing tracker never leaves your browser.
No card numbers. Stripe handles payment on its own systems.
No session recording, no heatmaps, no screen capture.
No advertising cookies, no ad pixels, no third-party ad networks, no cross-site tracking.
No calculator inputs. The calculators run entirely in your browser. What you type into the denial cost calculator, the denial rate calculator, or the filing deadline tracker is never sent to us and is not stored on our servers.
No data brokers. We do not buy or enrich customer data.

4. Analytics

We use PostHog to understand how the product is used, configured to be cookieless and with session recording off.

We record a short, fixed list of product events — the ones in the table above. We do not track you across other websites, we do not build advertising profiles, and we do not use analytics data for advertising.

PostHog, like any web service, receives standard request information such as your IP address and browser type as part of serving a request.

[note] Attorney open item 4 — this section must be verified against the production PostHog configuration before the page ships, specifically person profiles, user-ID linkage, and IP handling.

5. Cookies

We use the minimum set:

One browser flag. After you unlock the free scenarios we store a single yes/no marker in your browser so you are not asked for your email twice. It holds no personal information and is never sent to us.
Essential cookies keep you signed in. Without them the app cannot tell one signed-in user from another. These are set by our authentication provider.
No analytics cookies. Analytics run cookieless.
No advertising cookies.

Stripe sets its own cookies on Stripe's checkout page for payment processing and fraud prevention. That is Stripe's page and Stripe's policy applies there.

Because we do not run non-essential cookies, there is no consent banner to click through.

6. Email

Two kinds:

Transactional email — sign-in links, email-change confirmations, and password resets. Sent by Supabase, our authentication provider. You cannot unsubscribe from these while you have an account, because they are how the account works. Stripe emails your receipt from its own systems, and your certificate is on your account page rather than in an email.
Marketing and course email — the sequences you get after signing up for the free scenarios or after buying. Sent through Resend. Every one has an unsubscribe link, and unsubscribing is instant and stops all of our marketing and course email, not just the one sequence. To make that stick we keep your address on a suppression list — that record is what stops us ever mailing you again.

We do not sell or rent our email list.

7. Who we share your information with

We share only with the vendors that make the product run, and only what each one needs.

Vendor	What it does	What it gets
Supabase	Authentication and the Postgres database	Your account identity and all learning data in the table above
Stripe	Payments, checkout, and sales tax	Name, email, billing and card details, purchase amount
Resend	Marketing, course and notification email	Email address and the message content
PostHog	Product analytics	The product events listed above, cookieless — recorded against your account ID, or your email address for the signup and purchase events
Vercel	Application hosting	Standard request and server logs

Each vendor processes data under its own agreement with us and its own privacy policy.

We will also disclose information if the law requires it, to protect our rights or someone's safety, or as part of a merger or sale of the business — in which case we will notify account holders and this policy will continue to apply until it is replaced.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

8. Where your data is stored

In the United States, on infrastructure operated by the vendors above. The product is built and sold for the US market.

9. How long we keep it

Account and learning data: while your account exists. Delete your account and we delete it.
Email signups: until you ask us to remove you. Unsubscribing does not delete your address — it adds it to a suppression list we keep indefinitely, which is what stops us mailing you again. We also keep a record of which sequence emails were already sent to your address.
Certificate records: kept while your account exists so a certificate can be re-issued or verified. Deleting your account removes it, and the certificate can no longer be verified.
Issue reports: kept while we work the fix and for a period afterward so we can see what has already been reported. If a report contains your email, tell us and we will remove it.
Payment records: Stripe keeps transaction records for its own legal, tax, and accounting obligations, which is outside our control.
Logs: short retention, per each provider's default.

10. How we protect it

Traffic is encrypted in transit.
Every table that holds customer data has row-level security switched on and forced, so one customer's rows cannot be read by another.
Purchase entitlements and certificate records have no customer-writable path at all — they are written only by our payment webhook and our certificate issuance, never by a browser.
Issue reports and email signups are write-only: they can be submitted, but not read back by other customers.
We never receive card numbers.
The product has no upload surface.
An operator console at /admin is limited to a named allowlist of our own staff addresses and is read-only. It shows counts, purchase records, the email sending log, and open issue reports, so we can run the business and fix content people report. It cannot change your data.

No system is perfectly secure, and we do not claim otherwise. If a breach affects your information, we will notify you as required by law.

11. Certificate verification — not live

A public certificate verification page is planned but is not part of the current release. If and when it ships, a page at a certificate's own URL would show the name on the certificate, the program name, and the completion date — nothing else, and no scores. We will update this policy before it goes live.

[note] SPEC C1/C10 mark /verify/[certId] as v1.5 and flippable. Cut this section if the reviewer prefers not to describe unshipped features.

12. Your choices and rights

Whatever state you live in, you can ask us to:

see what we hold about you;
correct anything wrong — your display name, email address and password you can change yourself on your account page, and anything else you can ask us about;
delete your account and your data;
get a copy of your data in a portable form;
stop emailing you — unsubscribe from any marketing email, or ask us.

Email [[PRIVACY_EMAIL]]. We will verify that the request comes from the account holder, usually by confirming from the account's email address. We answer within 45 days and will tell you if we need longer.

Depending on where you live, you may also have the right to appeal a decision we make on a request. If we decline, our reply will tell you how.

We will not treat you differently for exercising any of these rights.

13. Deleting your account

Ask us to delete your account by emailing [[PRIVACY_EMAIL]] from the address the account uses. There is no self-service delete button in the product today. Deleting removes your profile, progress, attempts, mastery state, entitlements, and certificate record.

It does not by itself remove an email signup, an unsubscribe record, the log of which sequence emails were already sent to your address, or an issue report you filed — those are keyed to your email address rather than your account, and the unsubscribe record is what stops us mailing you again. Ask us and we will remove those too, apart from the unsubscribe record itself.

It is permanent, and it ends your access to what you bought. Deleting your account is not a refund — if you want a refund, read the Refund Policy first, because the 14-day window applies either way.

14. Global Privacy Control

We honor the Global Privacy Control signal. Since we do not sell or share personal information for advertising, there is little for it to switch off, but we respect it.

15. Children

The product is for adults working in or training for healthcare billing roles. It is not directed to children, and we do not knowingly collect information from anyone under 18. If you believe a minor has given us information, email [[PRIVACY_EMAIL]] and we will delete it.

16. Changes to this policy

We will update this page when the product changes. Material changes get an email to account holders and a new "Last updated" date. Because our data model is small and fixed, changes should be rare — and if we ever start collecting something new, this table is where you will see it first.

17. Contact

[[PRIVACY_EMAIL]] King Tech Solutions LLC, d/b/a The Remit Lab · [[ENTITY_ADDRESS]]