Privacy Policy
Last updated: April 17, 2026
1. Introduction
AIVA Claims Assistant ("AIVA," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered VA claims assistance platform.
2. Information We Collect
Personal Information
- Name and email address (for account creation)
- Authentication data managed by Clerk
- Documents you upload (medical records, service records)
- Information you provide in forms and claim documents
Automatically Collected Information
- Device and browser information
- IP address and approximate location
- Usage data and analytics (via Umami and Google Analytics)
3. How We Use Your Information
- To provide and maintain our AI-powered claim preparation services
- To analyze your medical records and generate draft claim documents
- To communicate with you about your account and services
- To send email updates (you can unsubscribe at any time)
- To improve our platform and develop new features
- To comply with legal obligations
4. Subprocessors & Third-Party Services
To provide our service we rely on the following subprocessors. Each processes only the data required for its function, under a data-processing agreement where applicable.
| Subprocessor | Purpose | Data processed | Region |
|---|---|---|---|
| Cloudflare | Hosting, CDN, edge security, DDoS protection | IP address, request metadata | Global |
| Clerk | Authentication, session management | Email, name, auth tokens | US |
| Cloudflare Email Sending | Transactional email delivery | Email, message content | US |
| DocuSeal | Electronic signature for HIPAA authorization & VA forms | Name, signature, document content | US |
| Cloudflare Workers AI | First-party AI inference for the claim-assistant chat, the benefits finder, and the support chat. Runs on Cloudflare's network (already AIVA's hosting provider). Per Cloudflare's published Workers AI data policy, inference content is not used to train models and is not retained. | Typed chat questions, lightweight claim-status context (claim type, current step, intent-to-file flag), and benefits-finder inputs (location, disability rating, service dates). No documents. | US / global |
| Umami | First-party, cookie-free usage analytics | Anonymized page views, device type | Self-hosted |
| Google Analytics | Optional usage analytics (only after opt-in) | Anonymized IP, page views | US |
| Telegram | Human handoff of AI support-chat conversations | Name, email, chat transcript | US / EU |
We do not use Meta / Facebook tracking pixels, ad networks, or session-replay tools. If we add a new subprocessor we will update this list before that processor goes live.
5. How AI Processes Your Claim
AIVA uses artificial intelligence to answer questions about the VA claim process and to help you find benefits you may be eligible for. These AI features run on Cloudflare Workers AI, a first-party service on Cloudflare's network (Cloudflare is already AIVA's hosting provider). Per Cloudflare's published Workers AI data policy, inference content is not used to train models and is not retained by Cloudflare.
What this means for you:
- The website sends the AI only your typed questions, a lightweight summary of your claim status (claim type, current step, and intent-to-file flag), and the inputs you enter into the benefits finder (location, disability rating, and service dates).
- It does not upload your documents, and it does not draft nexus letters through this website. Nexus-letter drafting and medical-record analysis are performed in AIVA's local processing pipeline and are not transmitted to any third-party AI gateway by this website.
- We do not sell, rent, or share your claim content with advertisers, data brokers, or other third parties.
- We do not opt your data into model training.
- AI output is a draft for your review — you always decide what gets submitted to the VA.
- You can request that we delete your AI-processing history at any time by emailing help@aivaclaims.com.
6. Data Security
We implement industry-standard security measures including:
- TLS/SSL encryption for all data in transit
- Encrypted storage for sensitive documents
- Secure authentication via Clerk
- Regular security audits and monitoring
- Access controls and audit logging
7. Data Retention
We keep your data only as long as we need it. The table below shows our default retention windows; shorter periods apply on request.
- Account & profile data — kept while your account is active; deleted within 30 days of account closure.
- Uploaded documents (medical records, service records) — kept while your account is active; deleted within 30 days of account closure or on request.
- AI chat history & drafts — kept for active claim reference; deleted with the account or on request.
- Server logs & error events — automatically purged after 90 days.
- Analytics events — aggregated or purged after 14 months (GA default) or 90 days (Umami default).
- Billing / tax records — retained for 7 years where required by IRS / state tax law.
You can request deletion at any time by emailing help@aivaclaims.com. We will complete the deletion within 45 days and confirm in writing.
8. Breach Notification
If we discover a security incident that compromises your personal information we will notify affected users and the required regulators. Our internal commitment:
- Initial investigation and containment within 24 hours of discovery.
- Notification to affected users without undue delay, and in any case within 72 hours of confirming an EU/UK resident is affected (GDPR Art. 33).
- Notification to affected users within the timeframes set by each applicable US state breach-notification law (generally 30-60 days).
- A post-incident summary explaining what happened, what we changed, and what you can do to protect yourself.
To report a suspected security issue, email help@aivaclaims.com or see our security.txt.
9. Your Rights
Depending on where you live, you may have additional rights under California (CCPA/CPRA), EU/UK (GDPR), or other state privacy laws. Exercising these rights is free and will never result in worse service or higher prices.
Rights available to all users
- Right to know — what personal information we have about you and how it is used
- Right to access — a copy of your personal information in a portable format
- Right to correct — fix inaccurate data
- Right to delete — request deletion of your account and personal data (some records may be retained where required by law)
- Right to opt out of marketing — unsubscribe from any marketing email with one click
- Right to non-discrimination — we will not penalize you for exercising any of these rights
California residents: Do Not Sell or Share My Personal Information
AIVA does not sell your personal information, and we do not share it for cross-context behavioral advertising. We also do not use third-party advertising cookies, Meta / Facebook pixels, or session-replay tools.
If your browser sends a Global Privacy Control (GPC) signal we will treat it as a valid Do-Not-Sell / Do-Not-Share request. You can also exercise any privacy right (access, deletion, correction, opt-out) by emailing help@aivaclaims.com. We will respond within 45 days as required by CPRA §1798.130.
EU / UK residents (GDPR)
In addition to the rights above, you have the right to restrict or object to processing, to withdraw consent at any time, and to lodge a complaint with your local supervisory authority. Our lawful basis for processing is consent (optional cookies, marketing) and contract performance (account, claim preparation).
10. Children's Privacy
Our services are not intended for individuals under 18 years of age. We do not knowingly collect personal information from children.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.
13. Contact Us
If you have questions about this Privacy Policy, please contact us at: help@aivaclaims.com