Security and Data Retention

Effective: October 24, 2026

This page covers the security of the payortransparency.com website and the app at app.payortransparency.app (together, the Platform), both operated by Unified Web, and how long the Platform keeps information.

1. Health data boundaries

The Platform is designed to ingest, aggregate, and display publicly available pricing data derived from the machine-readable files health plans publish under federal price transparency rules, together with public Medicare data. It does not ask for protected health information and is not designed to hold it. Users are strictly prohibited from entering patient data or identifiable health records.

2. Security architecture

2.1 Encryption

Connections to the website and to the app are encrypted in transit using TLS 1.2 or higher. Files the Platform keeps in cloud storage are encrypted at rest with AES-256, and the tokens for a connected Google Drive are encrypted with managed encryption keys before they are stored.

2.2 Access

People sign in to the app with Google or with a one-time code sent by email, through Amazon Cognito, and the app never asks for a password. We use role-based access control. Each workspace has owners and members with different permissions, and the app reaches its database through separate roles that each hold only the access they need.

2.3 Network

A web application firewall in front of the app blocks known bad requests and limits how often any one address can attempt to sign in.

2.4 Infrastructure

The Platform runs on Amazon Web Services (AWS), whose infrastructure is independently audited.

3. Data retention

Everything the Privacy Statement lists under account details, subscription details, use of the app and Google Drive is kept for as long as the account exists. The addresses a user has invited or sent a shared insight to, and the record of each email the app sends to a user or on a user’s behalf, are kept for as long as that user’s account exists. A Round 2028 digest sign-up belongs to no account, so its address stays on the digest’s contact list with no end date, confirmed or not, and so does the record of each digest sent to it. Unsubscribing stops the digest and leaves the address on the list. An undeliverable address stays on the list of addresses the app does not send to, with no end date.

Web application logs, web application firewall logs, load balancer access logs and network flow logs are kept for 12 months. Database backups are taken automatically every day and kept for seven days. The record of administrative actions in our cloud account is kept for at least 12 months.

When a subscription ends, access to paid data ends, and the account and its information stay in place. To ask for an account and its personal information to be deleted, write to billing@payortransparency.com from the email address on the account.

4. Reporting a problem

A security problem found on the Platform can be reported to billing@payortransparency.com or through the booking link in the page header. If any of this stops being true, this page changes and the effective date above changes with it.