Privacy Policy

Effective Date: July 26, 2026 · Last Updated: August 27, 2026

Overview

MyVetCopilot LLC ("we," "us," or "our") operates the website myvetcopilot.com and the My Vet Copilot platform (the "Service"). This Privacy Policy describes how we collect, use, store, and protect your personal information when you use our Service.

We are committed to protecting the privacy of Veterans, their families, and authorized representatives who use our platform.

Information We Collect

Information You Provide

Account information: Name, email address, date of birth, last four digits of Social Security Number, branch of service, and service dates
Documents you upload: DD-214s, VA claim letters, medical records, Blue Button reports, benefits summaries, buddy statements, and other supporting evidence
Claims information: Conditions, disability ratings, claim status, and related notes
Health information: Symptom logs, medications, daily functioning entries, and C&P exam details
Communications: Messages sent through our secure messaging system

Information Collected Automatically

Usage data: Pages visited, features used, and session duration
Device information: Browser type, operating system, and IP address
Cookies: Session cookies for authentication (no third-party tracking cookies)

Information from Third Parties

VA.gov (when authorized): With your explicit consent and through VA's official OAuth authorization, we may access your claims status, rated conditions, service history, and disability rating from the VA Benefits Claims API

How We Use Your Information

We use your information solely to:

Provide, maintain, and improve the Service
Analyze your uploaded documents to identify claimable conditions and evidence gaps
Generate forms, statements, and nexus letters to support your VA disability claims
Communicate with you about your account and claims
Provide AI-powered guidance and recommendations for your claims process
Sync data from VA.gov (only when you explicitly authorize the connection)

We do NOT:

Sell, rent, or share your personal information with third parties for marketing purposes
Use your data to train AI models
Display advertising or use tracking pixels
Share your information with other veterans or users

Data Storage and Security

All data is encrypted in transit (TLS 1.3) and at rest
Documents are stored on encrypted volumes with access restricted to your account
Passwords are hashed using bcrypt with high cost factor
Sessions expire after 1 hour of inactivity
Access to production systems requires multi-factor authentication
We use industry-standard security practices including rate limiting, CSRF protection, and input validation

Data Retention

Active accounts: We retain your data for as long as your account is active
Deleted accounts: Upon account deletion request, we will delete 100% of your personal data — including all documents, analyses, messages, VA synced data, and profile information — within 30 days, except where retention is required by law
Documents: Uploaded documents are retained until you delete them or close your account
Backups: Encrypted backups are retained for up to 90 days after deletion for disaster recovery purposes

Your Rights

You have the right to:

Access: Request a copy of all personal data we hold about you
Correct: Update or correct inaccurate information in your profile
Delete: Request deletion of your account and 100% of all associated data, including uploaded documents, extracted text, analysis results, VA synced data, messages, symptom logs, and any other information tied to your account. Upon deletion, no personal data, PHI, or PII will be retained in any active system. Encrypted backups containing your data are purged within 90 days of the deletion request.
Export: Download your data in a portable format
Revoke consent: Disconnect your VA.gov account at any time, which immediately removes stored tokens

To exercise any of these rights, contact us at privacy@myvetcopilot.com.

VA.gov Integration

When you choose to connect your VA.gov account:

You are redirected to VA.gov to authenticate directly with the Department of Veterans Affairs
We never see or store your VA.gov login credentials
We store only the OAuth access token (encrypted) and the data returned by the VA API
You can disconnect your VA.gov account at any time from your dashboard
Disconnecting immediately deletes the stored access token and all synced VA data from our system

Children's Privacy

Our Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from children.

Third-Party Services

We use the following third-party services:

Amazon Web Services (AWS): Cloud infrastructure and AI text extraction (Textract)
Cloudflare: CDN, DNS, and DDoS protection
VA.gov API (Lighthouse): Official VA data access (only with your authorization)

We do not use Google Analytics, Facebook Pixel, or any third-party advertising or tracking services.

Third-Party Access to Your Information: Any third party that obtains access to your information through the Service — including advisors, contractors, and service providers acting on our behalf — is contractually bound by this Privacy Policy and our Terms of Service. They are prohibited from using your data for any purpose other than providing the Service, and are subject to the same security, confidentiality, and data handling requirements described herein. No third party may retain, sell, or repurpose your personal information.

Business Transfer

In the event that MyVetCopilot LLC is acquired, merged with another entity, or sells substantially all of its assets:

You will be notified via email and a prominent notice on our website at least 30 days before any transfer of your personal data to a new entity
The acquiring entity will be bound by the terms of this Privacy Policy for all data collected prior to the transfer
You will have the option to delete your account and all associated data before the transfer takes effect
If you take no action, your data will transfer to the new entity under the same protections described in this policy
To exercise your deletion right in such an event, contact privacy@myvetcopilot.com or use the account deletion feature in your portal settings

Dormant Accounts

If your account remains inactive (no login, upload, or API activity) for 18 consecutive months:

We will send you an email notification at 12 months and again at 15 months warning that your account is approaching dormancy
At 18 months of inactivity, your account will be marked dormant
Dormant accounts will have all stored documents, VA synced data, and analysis results permanently deleted
Your account credentials (email, name) will be retained for an additional 6 months so you can reactivate by logging in
After 24 months of total inactivity, your entire account and all associated data will be permanently deleted
You may prevent dormancy at any time by logging into your account

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on our website or sending you an email.

Contact Us

If you have questions about this Privacy Policy or our data practices:

Email: privacy@myvetcopilot.com
Website: https://myvetcopilot.com

Compliance

This Service complies with:

Section 508 of the Rehabilitation Act (accessibility)
HIPAA Security Rule and Privacy Rule (45 CFR Parts 160 and 164)
VA Lighthouse API Terms of Service
VA Ethics Principles for Access to and Use of Veteran Data
Applicable federal and state privacy laws

HIPAA Compliance

My Vet Copilot handles Protected Health Information (PHI) and Personally Identifiable Information (PII) in accordance with the Health Insurance Portability and Accountability Act (HIPAA). Our safeguards include:

Administrative: Workforce training, access controls limited to need-to-know, regular risk assessments, and documented security policies
Physical: All infrastructure hosted in AWS data centers with SOC 2 Type II certification, no on-premises storage of PHI
Technical: Encryption at rest (AES-256 via KMS) and in transit (TLS 1.3), role-based access control, audit logging of all PHI access, automatic session termination

PII and PHI We Handle

Personally Identifiable Information (PII) we collect includes: name, email, date of birth, last four of SSN, military service dates, and VA file number.

Protected Health Information (PHI) we handle includes: medical diagnoses, disability ratings, treatment records, medication lists, symptom logs, C&P exam results, and clinical documents you upload.

All PII and PHI is:

Encrypted at rest and in transit
Stored in private database subnets with no public internet access
Accessible only through authenticated, authorized sessions
Never shared with third parties for any purpose other than providing the Service
Subject to access logging (who accessed what, when)

Breach Notification

In the event of a security breach involving your PII or PHI:

We will notify affected individuals within 60 days of discovery, as required by HIPAA
Notification will include: what happened, what information was involved, steps we are taking, and steps you can take to protect yourself
If a breach affects 500 or more individuals, we will also notify the U.S. Department of Health and Human Services (HHS) and prominent media outlets
We maintain an incident response plan that includes immediate system isolation, forensic investigation, credential rotation, and root cause remediation

To report a suspected security incident: security@myvetcopilot.com