Privacy Policy

1. Who We Are

VA Claim Commander is a software tool that helps veterans prepare documentation for VA disability claims. We are not a healthcare provider, health plan, or healthcare clearinghouse. We are not a covered entity under the Health Insurance Portability and Accountability Act (HIPAA).

Even though HIPAA does not require it of us, we hold ourselves to HIPAA-aligned safeguards throughout — because the medical information you share deserves that level of care. In the free veteran flow your records are processed in your browser and are not stored on our servers at all; and where you ask us to store information on your behalf, it is encrypted and held under a HIPAA Business Associate Agreement (BAA) with our infrastructure provider (see Sections 5a and 5b).

2. What Information We Process

When you use VA Claim Commander, you may upload or enter:

• Military service records (DD-214, OMPF, STRs)
• Personal medical records, lab results, and clinical notes
• Personal identifying information (name, date of birth, last 4 digits of SSN, address)
• VA rating decisions and correspondence

You are uploading your own records for the purpose of generating your own VA disability claim documents. This is your information, and you are choosing to share it with this tool.

3. How Your Information Is Used

Your uploaded documents and entered information are used exclusively to:

• Generate nexus letters, personal statements, buddy statements, and cover letters for your VA claim
• Pre-fill Disability Benefits Questionnaires (DBQs) from your documented medical history
• Analyze your records to identify conditions and suggest secondary claim opportunities

We do not sell your information. We do not share your information with third parties except as described in Section 4.

4. AI Processing — Third-Party Services

VA Claim Commander uses third-party services for AI processing, authentication, and payment. Your information is transmitted to or stored by the following services:

• Anthropic (AI provider) — When you generate documents, your claim content — including your conditions, service history, symptoms, and any information you entered — is transmitted to Anthropic's Claude API for AI processing. This is the most sensitive data flow in the application. Anthropic does not use API inputs or outputs to train their models (per their API Terms of Service). Under standard API terms, Anthropic may retain API inputs and outputs for up to 30 days for safety and abuse monitoring. We have not enabled zero-data-retention (ZDR) options at this time — if that changes, this policy will be updated. Anthropic's privacy policy governs their handling of this data.
• Vercel — Our application is hosted on Vercel's infrastructure. Vercel processes API requests and retains server logs (which may include file names and request metadata) per their data retention policies. Vercel does not store your document content.
• Clerk — We use Clerk for user authentication. Clerk stores your sign-in credentials (email address and authentication identity) on their servers. Your Clerk account persists until you delete it. Clerk's privacy policy governs their handling of this data.
• Stripe — We use Stripe to process payments. When you make a purchase, Stripe stores transaction records (purchase amount, date, and payment method metadata — not full card numbers) on their servers. Stripe's privacy policy governs their handling of this data.

Your medical records and claim document content are transmitted securely over HTTPS and are not permanently stored on our servers. Document content processed through our API exists only for the duration of the request.

5. Data Storage

For veterans using the free direct-to-consumer flow, VA Claim Commander does not maintain a database of your medical records or claim documents on our servers. Your data is stored as follows:

Note: the Commander for Advocates (Pro) product and Commander Health store information server-side — see Section 5a and Section 8b. Commander Health stores structured clinical summaries with veteran consent.

• Browser session storage (cleared when you close the tab or browser) — Your uploaded documents, generated claim materials, and active session state are stored in your browser's session storage. This clears automatically when your session ends.
• Browser local storage (persists until you clear it) — Your form data — veteran information, conditions, and intake answers — is stored in your browser's local storage so you can return to an in-progress claim. Click "Start Over" to clear this data, or clear your browser data manually.
• In transit — When you generate documents, your data is transmitted to our servers and to Anthropic for processing, then discarded from our servers when the request completes.
• Clerk (sign-in account) — Your account credentials (email address and authentication identity) are retained on Clerk's servers until you delete your account.
• Stripe (payment records) — If you make a purchase, Stripe retains transaction records on their servers per their data retention policies.

5a. Commander for Advocates (Pro) — Server-Side Client Records

The Commander for Advocates product, used by accredited representatives (VSO officers and claims agents) to manage their clients, works differently from the free veteran flow above. So a representative can manage a veteran's case over time, the following is stored on our servers, strictly isolated to the representative's organization:

• Client records — the veteran's name and contact details, with sensitive identity fields (date of birth and the last four digits of the SSN) encrypted at rest using AES-256-GCM.
• Documents the representative uploads — such as VA decision letters, claims files (C-files), medical and service records, and prior evidence — stored in encrypted object storage to support the veteran's claim. Document storage is an organization-level setting the representative controls and can turn off.
• Work product for each client — generated documents, the veteran's and witnesses' signed statements, claimed conditions, tasks, and deadlines.

This information is retained until the representative deletes the document or client, or closes the account, and is held on infrastructure operated under HIPAA Business Associate Agreements (BAAs) with our infrastructure providers. A veteran whose representative uses this product may contact us at support@vaclaimcommander.com with questions about data held on their behalf.

5b. Saved Veteran Account (Paid Plans)

On a paid veteran plan, we save the case information you enter — your service details, the conditions you're claiming, your statements, your witnesses' information, and the documents you generate — to your account so your work follows you across devices and over the months a VA claim can take. This saving is on by default on paid plans so you never lose your progress; we protect it quietly rather than asking you to manage a setting.

• What we store — only the case information you provide to build and track your claims. We do not sell it, and we do not use it to train AI models.
• Where it's stored — encrypted, access-controlled storage operated under a signed HIPAA Business Associate Agreement (BAA) with Amazon Web Services (AWS) (the same infrastructure that protects Commander Health records), encrypted at rest and in transit.
• AI processing — when you ask us to draft a document, the relevant text is sent to our AI provider for processing and is not used to train AI models.
• You stay in control — the way to turn saving off is to delete your data. Click "Start Over" in the app to permanently erase your saved case at any time, or email support@vaclaimcommander.com to delete your account and permanently purge all associated data (see Section 8, Your Rights). If you cancel your plan, we keep your case for 60 days so you can return, then permanently delete it.
• De-identified information — with your permission, de-identified (non-identifying) information may be used to improve the tool. This is never your identifiable records.

The free flow is unchanged. On the free tier nothing you enter is stored on our servers — your records are processed in your browser and discarded after each request (see Section 5).

6. Security

We implement appropriate technical safeguards including:

• HTTPS encryption for all data transmission
• Access controls requiring a password to use the application
• In the free veteran flow, no permanent server-side storage of medical records (records are processed in your browser and discarded after the request)
• For Commander for Advocates and Commander Health, encryption at rest and strict organizational isolation for stored records (see Sections 5a and 8b)

No method of transmission over the internet is 100% secure. You use this service at your own risk and should exercise care about what documents you upload.

Commander for Advocates — encryption & Business Associate Agreements

VSO officers and accredited claims agents are not covered entities under HIPAA. We've built Commander for Advocates with the technical safeguards HIPAA requires: AES-256-GCM encryption on sensitive identity fields, encrypted object storage for the documents a representative uploads, strict organizational data isolation, and access controls. The records and documents a representative stores (see Section 5a) are encrypted at rest and can be deleted by the representative at any time.

7. Cookies, Analytics & Tracking

We use a small number of third-party analytics services to understand how visitors find and use our marketing pages so we can improve them. These services may set cookies or use similar technologies. They are page-level analytics only — we never pass your medical records, claim content, document text, or the identifying information you enter into any analytics service.

• Google Analytics 4 — measures aggregate traffic and page views (for example, which pages visitors land on and how they navigate the site). Governed by Google's privacy policy.
• Microsoft Clarity — helps us see how pages are used (clicks and navigation patterns) so we can fix confusing layouts. Sensitive input fields, uploaded documents, and generated document previews are masked and are not captured. Governed by Microsoft's privacy policy.
• Meta Pixel — measures the performance of our advertising so we can reach veterans who may need this tool. It records that a page was viewed; it is not passed your claim content or medical information. Governed by Meta's privacy policy.

You can limit or block these technologies using your browser's cookie and privacy controls, browser extensions that block trackers, or your device's "Do Not Track" / opt-out settings. Blocking them does not affect your ability to use VA Claim Commander. Analytics services are used to improve the product and our outreach — never to sell your information (see Section 3).

8. Your Rights

Your claim form data lives in your browser's local storage, which you control. Click "Start Over" in the application or clear your browser data to remove it at any time.

If you use a paid plan and turned on "Save my case to my account" (Section 5b), you can view, export, or permanently delete your saved case at any time from your account, or by emailing support@vaclaimcommander.com. Deletion permanently purges the stored case — it is not merely hidden.

Your Clerk sign-in account (including your email address and authentication identity) is stored on Clerk's servers. To request deletion of your Clerk account and associated identity data, email support@vaclaimcommander.com and we will assist with account deletion.

Payment records associated with purchases are retained by Stripe. We cannot delete Stripe transaction records on your behalf, but we do not have access to your payment card numbers — only transaction metadata (date, amount, last 4 of card).

8a. Commander Connect (VA.gov Import)

Commander Connect (our Chrome extension) reads benefits data displayed on your VA.gov screen after you log in — your rated conditions, percentages, static status, combined rating, Intent to File status, active claims, and service dates. It never sees, reads, or stores your VA.gov password or credentials.

This data is never stored on our servers by the import itself — it travels directly to your VA Claim Commander session in your browser, and only after you explicitly confirm the import. The extension makes no network requests of its own and contains no analytics or tracking.

8b. Commander Health

Commander Health is a clinical review service that connects veterans with licensed nurse practitioners for independent medical opinions in support of VA disability claims.

What we store

When you use Commander Health, we create and store a structured clinical summary derived from the medical records you upload through VA Claim Commander. This summary contains:

• Identified diagnoses and ICD codes
• Key diagnostic test results (e.g., AHI scores, lab values, audiogram results)
• Treatment history extracted from your records
• Relevant clinical findings documented by your treating providers

What we do not store

We do not store your raw medical records. Your uploaded files are processed during your session and discarded. Only the structured clinical summary derived from those records is retained.

Who can access your summary

Your structured clinical summary is accessible only to you and the licensed clinician assigned to your Commander Health case. It is encrypted at rest using AES-256-GCM encryption and transmitted only over HTTPS. Your assigned clinician uses this summary to prepare and sign your independent medical opinion.

How long we retain it

Your clinical summary is retained for the duration of your Commander Health case plus 90 days following case completion or cancellation. You may request earlier deletion at any time by contacting support@vaclaimcommander.com.

Your consent

Before your Commander Health case is created, you will be asked to explicitly consent to the storage of your structured clinical summary. You may withdraw consent at any time by requesting case cancellation and deletion of your summary.

Database storage

Commander Health case data — including your clinical summary, assigned clinician, case status, and generated documents — is stored in a secured PostgreSQL database hosted on Amazon Web Services (AWS) under a signed HIPAA Business Associate Agreement (BAA). Data is encrypted at rest and access is restricted to authenticated application processes and your assigned clinician.

9. Your Rights Under State Privacy Laws

Depending on where you live, state privacy laws — such as the California Consumer Privacy Act (CCPA/CPRA), the Virginia Consumer Data Protection Act, and similar laws in other states — may give you the right to:

• Know what personal information we hold about you and how it is used
• Access or receive a copy of that information
• Request correction of inaccurate information
• Request deletion of your information
• Opt out of the sale or sharing of your personal information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising in exchange for money. For veterans in the free flow, most of your data never leaves your browser, so there is nothing on our servers for us to access or delete (see Section 5). For paid saved accounts, Commander for Advocates, and Commander Health, you may exercise these rights as described in Sections 5a, 5b, and 8b, or by contacting us.

Some states — including Washington (My Health My Data Act), Nevada, and Connecticut — provide additional protections for consumer health data. Because we treat the medical information you share with HIPAA-aligned safeguards regardless of where you live (Section 1), those protections are reflected in how we handle your data throughout this policy. To exercise any state privacy right, email support@vaclaimcommander.com. We will verify your request and respond within the timeframe your state law requires. We will not discriminate against you for exercising these rights.

10. Children's Privacy

VA Claim Commander is intended for veterans and accredited representatives and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact support@vaclaimcommander.com and we will delete it.

11. Not a Medical Service

VA Claim Commander generates documentation to support your VA claim. We are not a healthcare provider. The documents generated by this application require review and signature by a licensed healthcare provider before submission to the VA. Nothing in our application constitutes medical advice or a medical opinion.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will post any changes on this page with an updated date. Continued use of VA Claim Commander after changes constitutes acceptance of the updated policy.

13. Contact

Questions about this Privacy Policy:

support@vaclaimcommander.com