Privacy Policy

1. Who We Are

VA Rating Calculator is a service operated by Delvir LLC ("Delvir," "we," "our," or "us"). If you have questions about this Privacy Policy, please contact us at team@delvir.co.

2. Information We Collect

Information you provide:

• Medical record text: When you upload a PDF, your browser extracts the text locally using pdf.js. That extracted text is transmitted to our servers solely to perform the AI analysis and is never written to disk or stored in any database.
• Payment information: When you purchase a full report, your payment is processed by Stripe. Delvir never sees, stores, or has access to your credit card number or other payment credentials. Stripe's privacy policy governs the handling of your payment data.
• Email address: We do not collect your email address as part of the standard Service flow.

Information collected automatically:

• Standard web server logs may capture your IP address, browser type, and referring URL for security and diagnostic purposes. These logs are retained for no more than 30 days and are not used for marketing purposes.

3. How We Use Your Information

We use the information we collect exclusively to:

• Perform the AI-powered disability analysis on your uploaded medical record text.
• Generate and deliver your paid report upon successful payment.
• Temporarily store a tokenized version of your paid report in Upstash Redis for up to 24 hours solely to survive the Stripe payment redirect. This token is deleted immediately upon your first report retrieval.
• Diagnose technical errors and maintain the security and integrity of the Service.

We do not use your information for advertising, profiling, or any purpose other than delivering the Service to you.

4. What We Do Not Do

• We do not store your military medical records or any personally identifiable health information on our servers.
• We do not sell, rent, lease, or share your personal information with any third party for marketing or commercial purposes.
• We do not use your data to train AI models.
• We do not retain your analysis results after your report is delivered.
• We do not use cookies for tracking or advertising.

5. Third-Party Service Providers

We work with the following third-party service providers to operate the Service:

• Anthropic: We transmit your extracted medical record text to Anthropic's API to generate the disability analysis. Anthropic's data use policy governs how they process this data. Anthropic does not use API inputs to train its models by default.
• Stripe: Payment processing. Stripe collects and processes your payment information under their own privacy policy.
• Upstash: Temporary Redis storage used exclusively for the 24-hour report token that enables delivery of your paid report across the Stripe payment redirect. Data is automatically deleted after 24 hours or upon first retrieval, whichever occurs first.
• Vercel: Web hosting and serverless function execution. Standard access logs may be retained per Vercel's data practices.

We select service providers that maintain high standards of data security. We do not authorize any of these providers to use your data for their own purposes beyond delivering the Service.

6. Data Security

We take reasonable technical and organizational measures to protect your information against unauthorized access, alteration, disclosure, or destruction. All data transmitted between your browser and our servers is encrypted using TLS (HTTPS). Medical record text is processed in memory only and is never written to persistent storage.

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your information, we cannot guarantee absolute security.

7. Data Retention

We operate a minimal data retention model:

• Medical record text: Processed in memory and discarded immediately after analysis. Never persisted.
• Analysis results: Not stored at any point after delivery to your browser.
• Report tokens (paid reports): Stored in Upstash Redis for a maximum of 24 hours and deleted immediately upon first retrieval.
• Server logs: Retained for up to 30 days for security and diagnostic purposes, then automatically purged.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Right to access: Request a copy of any personal information we hold about you.
• Right to deletion: Request deletion of any personal information we hold about you.
• Right to correction: Request correction of inaccurate personal information.
• Right to opt out: Opt out of any data processing to the extent applicable.

Given our minimal data retention practices, there is typically no personally identifiable information stored that would be subject to these requests. To submit a privacy request, contact us at team@delvir.co.

9. Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has submitted information through the Service, please contact us immediately at team@delvir.co.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date at the top of this page. We encourage you to review this Policy periodically. Your continued use of the Service after any changes constitutes your acceptance of the revised Policy.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Delvir LLC
Email: team@delvir.co