Last updated: 20 August 2026

Privacy policy

This policy explains what happens to your data when you use Evenstand — in particular to the documents you upload, which contain health data.

1. Controller and contact

INeed Technology LLC
30 N Gould St Ste N
Sheridan, WY 82801
United States of America
E-mail: privacy@evenstand.com

2. Categories of data processed

—Account data: e-mail address, password hash, account creation date, credit balance.
—Document data: the files you upload and the text extracted from them, including the health data they contain.
—Generated content: analyses and draft letters produced for you.
—Payment data: purchase amount, package, payment status. Card and account details are processed by the payment service provider, not by us.
—Usage and technical data: IP address, browser and device information, timestamps, error logs.
—Communication data: the content of your enquiries to us.

3. Health data under Article 9 GDPR

This is the most sensitive part of the service. Rejection notices and medical bills say something about your health. That makes them a special category of personal data under Article 9 GDPR, and processing is lawful only with your explicit consent under Article 9(2)(a) GDPR.

What is processed: diagnoses, treatments, prescribed services, billing items and any other health-related content of the documents you upload.
Why: solely to analyse the document and to generate the text template you requested.
Legal basis: your explicit consent, given separately before the first upload, Article 9(2)(a) in conjunction with Article 6(1)(a) GDPR.
Who processes it: the controller, the hosting provider and the provider of the AI model, each as processor under a data processing agreement.
How long: until you delete the document, and at the latest on deletion of your account. You can delete individual documents at any time in your account.
Withdrawal: you can withdraw your consent at any time with effect for the future, by e-mail or in your account. Withdrawal does not affect the lawfulness of processing already carried out.
No model training: your documents and the content generated from them are not used to train AI models.

4. Purposes and legal bases

Purpose	Legal basis
Providing the account and the service	Art. 6(1)(b) GDPR — performance of the contract
Analysing documents and generating letters	Art. 6(1)(b) and Art. 9(2)(a) GDPR — contract and explicit consent
Payment processing and invoicing	Art. 6(1)(b) and (c) GDPR — contract and legal obligation
Security, abuse prevention, error analysis	Art. 6(1)(f) GDPR — legitimate interests
Answering enquiries	Art. 6(1)(a), (b) or (f) GDPR
Optional analytics	Art. 6(1)(a) GDPR — consent, plus applicable cookie rules

5. Recipients and processors

We use service providers who process data on our behalf under Article 28 GDPR. Data is not sold, and it is never passed to health insurers, private insurers, employers or other third parties.

Service provider	Purpose	Location
Hosting provider	Operating the application, storing documents	EU
AI model provider	Analysing documents, generating text	EU / third country
Stripe	Payment processing	EU / USA
E-mail service	Transactional e-mails	EU
Analytics (if used)	Aggregated usage statistics	EU

6. Transfers to the USA

The controller is established in the United States. Personal data — including the health data described in section 3 — is therefore transferred to a country outside the European Economic Area.

The transfer is safeguarded under Article 46 GDPR by the mechanism named here: standard contractual clauses adopted by the European Commission, or self-certification under the EU-US Data Privacy Framework where the recipient participates in it.

You have the right to request a copy of these safeguards. Write to privacy@evenstand.com.

7. Retention periods

—Uploaded documents and generated letters: until you delete them, at the latest on deletion of your account.
—Account and credit data: for the life of the account.
—Billing records: for the statutory retention period applicable to tax and commercial records.
—Server log files: for a short period for security and error analysis, then deleted or aggregated.

8. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21 GDPR). Where processing rests on consent, you can withdraw it at any time with effect for the future.

To exercise these rights, write to privacy@evenstand.com.

You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence.

9. Hosting, log files, cookies

When you visit this website, the server automatically records the requested address, the time of the request, the amount of data transferred, the browser and operating system, and the IP address. This is necessary for secure operation and rests on Article 6(1)(f) GDPR.

We use only cookies that are technically necessary to operate the website and to keep you signed in. These do not require consent. Any cookie that is not strictly necessary is set only after you have actively agreed.

10. Analytics and consent

If analytics or tracking is used, it is activated only after your active consent through a consent banner that offers a reject option of equal prominence, in line with the applicable rules on cookies and similar technologies. You can change or withdraw your decision at any time.

11. Changes to this policy

We adapt this policy when the service or the legal position changes. The current version always carries the date shown at the top of this page.