Skip to main content

Your data

Privacy Policy

Last updated: October 3, 2026 · Effective October 13, 2026

The short version

  • Free tools: your records are processed in your browser and never stored on our servers. The one exception is yours to choose: you can have scanned pages read on our secure server instead, which is faster. Then only those pages are sent, read once, and the file is deleted right after (Section 5).
  • Paid plans: your case is saved encrypted, under signed HIPAA agreements with our storage providers (Neon and Amazon Web Services), so you don't lose progress — delete it anytime with Start Over.
  • We never sell your information or use it to train AI.
  • If you connect your VA.gov account (optional and free): we read your ratings, service history and claim status from VA, read only, and keep it encrypted on our servers until you disconnect. It is never sold, and it is never sent to AI unless you choose to make part of it your own entry, as Section 8c explains. Disconnecting deletes it (Section 8c).
  • Nothing goes to VA unless you or your representative sends it. Where a document is submitted to VA through this platform, it is at the direction of the person filing, and we act only as the courier.
  • Questions or deletions: support@vaclaimcommander.com.

This summary is for quick reading. The full policy below is the authoritative version.

1. Who We Are

VA Claim Commander is a software tool that helps veterans prepare documentation for VA disability claims. We are not a healthcare provider, health plan, or healthcare clearinghouse. We are not a covered entity under the Health Insurance Portability and Accountability Act (HIPAA).

Even though HIPAA does not require it of us, we hold ourselves to HIPAA-aligned safeguards throughout — because the medical information you share deserves that level of care. In the free veteran flow your records are processed in your browser and are not stored on our servers at all. The one exception is information you choose to connect from VA.gov (Section 8c). Where you ask us to store information on your behalf, it is encrypted and held under HIPAA Business Associate Agreements (BAAs) with our infrastructure providers (see Sections 5a and 5b).

1a. What's Free

Veterans can build a claim and generate a complete personal statement, nexus letter draft, and buddy statement drafts at no cost, with no card required. Downloading, printing, sending a document for signature, or generating a full claim package requires a paid plan.

2. What Information We Process

When you use VA Claim Commander, you may upload or enter:

  • Military service records (DD-214, OMPF, STRs)
  • Personal medical records, lab results, and clinical notes
  • Personal identifying information (name, date of birth, last 4 digits of SSN, address)
  • VA rating decisions and correspondence
  • Contact details for people you name as witnesses (name, email, and the relationship they have to you) so we can send them a statement request on your behalf, and — in Commander for Advocates — the contact details of the representative's clients
  • Your account email address, and payment records held by Stripe (we never see or store card numbers)

We do not collect precise geolocation, your device's contacts, biometric data, or genetic information. Our servers see your IP address in the course of serving requests, as every website does; it is kept in short-lived server logs and is not linked to your records. If a record you upload mentions a family member's medical or family history, it is handled exactly like the rest of your records — used only to prepare your claim, never shared, and deleted with the rest.

You are uploading your own records for the purpose of generating your own VA disability claim documents. This is your information, and you are choosing to share it with this tool.

3. How Your Information Is Used

Your uploaded documents and entered information are used exclusively to:

  • Generate nexus letters, personal statements, buddy statements, and cover letters for your VA claim
  • Map your documented symptoms to the rating criteria your statements address, and prepare you for the C&P exam
  • Analyze your records to identify conditions and suggest secondary claim opportunities

We do not sell your information, for money or for anything else. We do not share it with marketers, data brokers, or partners. We do not use your health or claim information to target advertising to you or anyone else.

We do not share de-identified, anonymized, or pseudonymized versions of your records with any third party. Besides aggregate product counts (for example, how many documents were generated in a month), we keep a short first-use record for each account — the date and time you first reached steps such as starting a claim, generating a document, or starting a trial, and whether you used a phone, tablet, or computer — so we can see where veterans get stuck. It contains no record content, condition, or document text, is never shared with any analytics or advertising service, and is deleted with your account. Every third party that processes your information is a service provider working for us under a written agreement (Section 4). None of them may use or disclose it for any purpose of their own — including attempting to re-identify anyone — without your consent.

4. Third-Party Services That Process Your Information

VA Claim Commander uses a small number of third-party services for AI processing, document reading and search, hosting and storage, authentication, payment, email, and error monitoring. Each one is under a written agreement (its API or service terms, and where the service handles health information, a HIPAA Business Associate Agreement) that limits it to providing the service to us. None of them is permitted to sell your information or use it to train AI models. Your information is transmitted to or stored by the following services:

  • Anthropic (AI provider) — When you generate documents, your claim content — including your conditions, service history, symptoms, and any information you entered — is transmitted to Anthropic's Claude API for AI processing. This is the most sensitive data flow in the application. Anthropic does not use API inputs or outputs to train their models (per their API Terms of Service). Under standard API terms, Anthropic may retain API inputs and outputs for up to 30 days for safety and abuse monitoring. We have not enabled zero-data-retention (ZDR) options at this time — if that changes, this policy will be updated. Anthropic's privacy policy governs their handling of this data.
  • Voyage AI (record search) — So a representative or a veteran can search a file and ask questions of it, the text of uploaded records is sent to Voyage AI's embeddings API. It turns each page into a numeric index used to find the relevant pages.Under Voyage AI's terms, we have opted out of its use of customer content for model training, effective September 6, 2026. Text sent since then is deleted by Voyage AI immediately after it is processed and is not used to train its models.Voyage AI does not disclose customer content to third parties other than its own sub-processors. Voyage AI's privacy policy governs their handling of this data.
  • Amazon Web Services (AWS) — The Commander for Advocates and Commander Health products run on AWS. Stored records and generated documents live in encrypted AWS storage and databases under a HIPAA Business Associate Agreement (see Sections 5a, 6, and 8b). If you connect your VA.gov account, the information we read from VA and the access keys VA gives us are stored in the same encrypted AWS database (Section 8c). Scanned pages that contain no readable text are read with Amazon Textract, AWS's optical character recognition service, so the file can be searched; the page image is sent to Textract for that purpose only.In the veteran app, scanned pages are read in your browser unless you choose to have them read on our server. If you choose that, only the scanned pages are sent to our AWS server, where Amazon Textract reads them once, under the same HIPAA Business Associate Agreement. The file is deleted as soon as it has been read; if the read is interrupted, a cleanup that runs every half hour deletes it, and an automatic storage rule deletes anything left within a day. We do not keep the text Textract produces: it goes back to your browser. Textract itself keeps the results of a read inside our AWS account for a limited time (up to 7 days) so our server can collect them, then deletes them automatically. Our AWS account opts out of AWS using content from its AI services, including Textract, to improve or train those services.
  • Neon (database) — On a paid veteran plan, your saved case (Section 5b) is stored in our PostgreSQL database run by Neon, hosted on AWS in the United States, under a HIPAA Business Associate Agreement with Neon. It is encrypted with AES-256-GCM before it is saved. Neon's privacy policy governs their handling of this data.
  • Department of Veterans Affairs (VA) — When an accredited representative using Commander for Advocates chooses to submit a document package to VA through this platform, the selected documents are transmitted to VA's Benefits Intake API. The veteran's identifying details required by VA (name, VA file number or Social Security number, and ZIP code) are sent with them. VA's receipt and processing status are stored with the case. This happens only at the representative's explicit direction, document by document; nothing is sent to VA automatically. VA's own privacy rules govern the records once received.
  • Resend (email) — Account, intake, and notification emails (for example, the secure intake link a representative sends a veteran, or a deadline digest) are delivered through Resend, which receives the recipient's email address and the message. Medical records and document content are never sent by email.
  • Sentry (error monitoring) — When the application encounters an error, a report describing the error is sent to Sentry so we can fix it. Reports are scrubbed of record content and identifying fields before they leave our servers.
  • Vercel — Our public website and the free veteran flow are hosted on Vercel's infrastructure. Vercel processes API requests and retains server logs (which may include file names and request metadata) per their data retention policies. Vercel does not store your document content.
  • Clerk — We use Clerk for user authentication. Clerk stores your sign-in credentials (email address and authentication identity) on their servers. Your Clerk account persists until you delete it. Clerk's privacy policy governs their handling of this data.
  • Stripe — We use Stripe to process payments. When you make a purchase, Stripe stores transaction records (purchase amount, date, and payment method metadata — not full card numbers) on their servers. Stripe's privacy policy governs their handling of this data.

Your medical records and claim document content are transmitted securely over HTTPS and are not permanently stored on our servers. Document content processed through our API exists only for the duration of the request.

5. Data Storage

For veterans using the free direct-to-consumer flow, VA Claim Commander does not maintain a database of your medical records or claim documents on our servers. Your data is stored as follows:

Note: the Commander for Advocates (Pro) product and Commander Health store information server-side — see Section 5a and Section 8b. Commander Health stores structured clinical summaries with veteran consent. If you choose to connect your VA.gov account, what we read from VA is stored on our servers, encrypted — see Section 8c.

  • Browser session storage (cleared when you close the tab or browser) — Your uploaded documents, generated claim materials, and active session state are stored in your browser's session storage. This clears automatically when your session ends.
  • Browser local storage (persists until you clear it) — Your form data — veteran information, conditions, and intake answers — is stored in your browser's local storage so you can return to an in-progress claim. Click "Start Over" to clear this data, or clear your browser data manually.
  • In transit — When you generate documents, your data is transmitted to our servers and to Anthropic for processing, then discarded from our servers when the request completes.
  • Scanned pages, only if you choose our server read — when an upload has scanned pages, you can choose to have them read on our secure server instead of in your browser (it is faster). Only the scanned pages are sent. They are held in encrypted AWS storage only while Amazon Textract reads them, then deleted (Section 4). The text comes back to your browser and is handled like any other upload. You can change this choice at any time under Your records; until you choose it, nothing changes.
  • Clerk (sign-in account) — Your account credentials (email address and authentication identity) are retained on Clerk's servers until you delete your account.
  • Stripe (payment records) — If you make a purchase, Stripe retains transaction records on their servers per their data retention policies.

5a. Commander for Advocates (Pro) — Server-Side Client Records

The Commander for Advocates product, used by accredited representatives (VSO officers and claims agents) to manage their clients, works differently from the free veteran flow above. So a representative can manage a veteran's case over time, the following is stored on our servers, strictly isolated to the representative's organization:

  • Client records — the veteran's name and contact details, with sensitive identity fields (date of birth and the last four digits of the SSN) encrypted at rest using AES-256-GCM.
  • Documents the representative uploads — such as VA decision letters, claims files (C-files), medical and service records, and prior evidence — stored in encrypted object storage to support the veteran's claim. Document storage is an organization-level setting the representative controls and can turn off.
  • Work product for each client — generated documents, the veteran's and witnesses' signed statements, claimed conditions, tasks, and deadlines.
  • Submissions to VA, at the representative's direction — when the representative chooses to submit a document package to VA through the platform, a record of what was sent is kept with the case: which documents, when, and VA's receipt and status. That way the file shows exactly what VA received. The platform transmits only what the representative selected, and only when they choose to send it; the representative remains the filer of record.
  • Records packets for a reviewing clinician — when the representative chooses to send records to a clinician (Commander Health or a provider of their own), the platform assembles only the records the representative selected into one packet. It keeps a copy with the case and delivers the packet to the representative to pass on. Nothing is sent to any clinician without the representative choosing it.

This information is retained until the representative deletes the document or client, or closes the account, and is held on infrastructure operated under HIPAA Business Associate Agreements (BAAs) with our infrastructure providers. A veteran whose representative uses this product may contact us at support@vaclaimcommander.com with questions about data held on their behalf.

5b. Saved Veteran Account (Paid Plans)

On a paid veteran plan, we save the case information you enter — your service details, the conditions you're claiming, your statements, your witnesses' information, and the documents you generate — to your account so your work follows you across devices and over the months a VA claim can take. This saving is on by default on paid plans so you never lose your progress; we protect it quietly rather than asking you to manage a setting.

  • What we store — the case information you provide to build and track your claims, the documents we draft for you (including any edits you make to them), and — so your records follow you to a new device without re-uploading — the text we read from the records you upload (the words on the page, never the PDF files themselves, which stay in your browser). We do not sell any of it, and we do not use it to train AI models.
  • Where it's stored — your saved case (the case information you provide and the documents we draft) and the index of facts found in your records are kept in our PostgreSQL database run by Neon, hosted on Amazon Web Services (AWS) in the United States, under a signed HIPAA Business Associate Agreement (BAA) with Neon. The text we read from your records is kept in private AWS S3 storage under our signed HIPAA BAA with AWS, the same agreement that covers Commander Health records. All of it is encrypted with AES-256-GCM before it is saved, on top of each provider's own encryption, and travels only over encrypted connections.
  • AI processing — when you ask us to draft a document, the relevant text is sent to our AI provider for processing and is not used to train AI models.
  • You stay in control — the way to turn saving off is to delete your data. Click "Start Over" in the app to permanently erase your saved case — including the records text — at any time, or email support@vaclaimcommander.com to delete your account and permanently purge all associated data (see Section 8, Your Rights). If you cancel your plan, your saved case stays until you delete it or delete your account — you can do either at any time ("Start Over" in the app, or Delete account on the Account page).
  • De-identified information — with your permission, de-identified (non-identifying) information may be used to improve the tool. This is never your identifiable records.

Without cloud save, the flow is unchanged. Unless your case is saved to your account as described above, nothing you enter is stored on our servers — your records are processed in your browser and discarded after each request (see Section 5).

6. Security

We implement appropriate technical safeguards including:

  • HTTPS encryption for all data transmission
  • Access controls requiring a password to use the application
  • In the free veteran flow, no permanent server-side storage of medical records (records are processed in your browser and discarded after the request)
  • For Commander for Advocates and Commander Health, encryption at rest and strict organizational isolation for stored records (see Sections 5a and 8b)
  • If you connect your VA.gov account, AES-256-GCM encryption of the access keys VA gives us and of everything we read from VA, on top of AWS's own database encryption (see Section 8c)

No method of transmission over the internet is 100% secure. You use this service at your own risk and should exercise care about what documents you upload.

Commander for Advocates — encryption & Business Associate Agreements

VSO officers and accredited claims agents are not covered entities under HIPAA. We've built Commander for Advocates with the technical safeguards HIPAA requires: AES-256-GCM encryption on sensitive identity fields, encrypted object storage for the documents a representative uploads, strict organizational data isolation, and access controls. The records and documents a representative stores (see Section 5a) are encrypted at rest and can be deleted by the representative at any time.

7. Cookies, Analytics & Tracking

We use a small number of third-party analytics services to understand how visitors find and use the site — and whether our advertising leads to a sign-up — so we can improve them. These services may set cookies or use similar technologies. They are page-level analytics only — we never pass your medical records, claim content, document text, or the identifying information you enter into any analytics service.

  • Google Analytics 4 — measures aggregate traffic and page views (for example, which pages visitors land on and how they navigate the site). Governed by Google's privacy policy.
  • Microsoft Clarity — helps us see how pages are used (clicks and navigation patterns) so we can fix confusing layouts. Sensitive input fields, uploaded documents, and generated document previews are masked and are not captured. Governed by Microsoft's privacy policy.
  • Meta Pixel — measures the performance of our advertising so we can reach veterans who may need this tool. It records that a page was viewed; it is not passed your claim content or medical information. Governed by Meta's privacy policy.
  • Google Ads conversion tracking — Google's advertising tag (gtag.js). It records page views and a single "sign-up" event so we can measure whether an ad led a veteran to create a free account. Because a sign-up completes inside the app, this tag also loads on signed-in pages, not only marketing pages. Even there it is passed only the page address and title — never your medical records, claim content, document text, or the information you enter. Governed by Google's privacy policy.

You can limit or block these technologies using your browser's cookie and privacy controls, browser extensions that block trackers, or your device's "Do Not Track" / opt-out settings. Blocking them does not affect your ability to use VA Claim Commander. Analytics services are used to improve the product and our outreach — never to sell your information (see Section 3).

7a. How Long We Keep Your Information

  • Free veteran flow — your records and claim work are kept in your browser, not on our servers. They reach our servers only during the request that generates a document, and are discarded when that request completes. The one exception is information you choose to connect from VA.gov (next item). If you choose to have scanned pages read on our server, the file is deleted as soon as it has been read, and within a day at the latest (Section 4).
  • Information read from VA.gov (only if you connect your VA.gov account) — stored encrypted on our servers while you stay connected, on free and paid plans alike. It is deleted as soon as you disconnect or delete your account. If VA stops accepting our access, we delete the access keys and keep only the last copy we read, until you disconnect or delete your account (Section 8c).
  • Paid veteran plan — your saved case is kept until you delete it or close your account, including after you cancel your plan. If you have not signed in for 24 months, we may email you a reminder, but we do not delete an account automatically because it has been inactive. You can delete your saved case or your whole account at any time (Section 7b).
  • Commander for Advocates — a client's records and work product are kept until the representative deletes the document or client, or the organization closes its account. If no one in an organization has signed in for 24 months, we may email the organization a reminder, but we do not delete its records automatically because it has been inactive.
  • Commander Health — your clinical summary and your messages with your clinician are kept for the duration of your case plus 90 days (Section 8b).
  • Account and billing records — your sign-in identity is kept by Clerk until you delete your account; Stripe keeps transaction records for the period required by tax and payment rules.
  • Backups — encrypted database backups are kept for 7 days and then expire, so deleted information leaves backups within 7 days of deletion.

7b. Deleting Your Information

You can have 100% of your information deleted — VA-related and not — at any time. Deletion is permanent and complete; it is not merely hidden.

  • Your claim work (free flow) — click "Start Over" in the application, or clear your browser data.
  • Your whole account (veterans) — open Account in the application and choose "Delete account". You will be asked to type DELETE to confirm. This immediately and permanently erases your saved case, generated documents, witness requests, and sign-in identity. If you connected your VA.gov account, it also disconnects it and deletes everything we read from VA.gov.
  • Information read from VA.gov — tap "Disconnect VA.gov" in the application. We ask VA to cancel our access and delete everything we read from VA.gov right away (Section 8c).
  • A client's records or an organization account (Commander for Advocates) — a representative deletes documents and clients from the case file. To close the organization and purge everything it holds, email support@vaclaimcommander.com from the organization's admin email with the subject "Delete our organization".
  • By email, for anything — email support@vaclaimcommander.com from the email address on your account with the subject "Delete my data". We confirm the request with you and complete it within 30 days, including removal from backups. A veteran whose representative holds records about them may also write to us; we will confirm the representative's obligations to them and act on any legally required request.

Deleted information cannot be recovered. Download anything you want to keep before you delete.

7c. If There Is a Data Breach

If we learn that your information was accessed or disclosed without authorization, we will notify you by email at the address on your account without unreasonable delay and within the time required by law. We will tell you what happened, what information was involved, what we have done about it, and what you can do to protect yourself. Where a representative's client records are affected, we notify the representative and, where we can, the veteran.

7d. If VA Claim Commander Changes Hands

If VA Claim Commander is sold, merged, or transferred to a new owner, or if the company ceases operating, we will notify you by email and on this page before any of your information is transferred. You will have at least 30 days to choose one of the following, and we will honor whichever you choose:

  • Download your information (your saved case and documents) and have it securely destroyed on our side, or have it transmitted to a destination you name;
  • Allow your information to move to the new owner, whose policies must be at least as protective as this one; or
  • Close your account, which deletes your information as described in Section 7b.

We will also notify you of any change in ownership of the company, whether or not your information moves.

8. Your Rights

Your claim form data lives in your browser's local storage, which you control. Click "Start Over" in the application or clear your browser data to remove it at any time.

If you use a paid plan, the case you build is saved to your account (Section 5b). You can view, export, or permanently delete your saved case at any time from your account, or by emailing support@vaclaimcommander.com. Deletion permanently purges the stored case — it is not merely hidden.

Your Clerk sign-in account (including your email address and authentication identity) is stored on Clerk's servers. To request deletion of your Clerk account and associated identity data, email support@vaclaimcommander.com and we will assist with account deletion.

Seeing and correcting your information. If you use the veteran app, everything you entered and every document drafted for you is in the app to read, edit, export, or delete. If an accredited representative uses Commander for Advocates on your behalf, your information is held for that representative, who owes you access to your file. The representative can share any document with you through your claim portal, and you can ask them to correct anything that is inaccurate, incomplete, or out of date. You may also email support@vaclaimcommander.com with a correction request and we will correct the information or record your request with it.

Payment records associated with purchases are retained by Stripe. We cannot delete Stripe transaction records on your behalf, but we do not have access to your payment card numbers — only transaction metadata (date, amount, last 4 of card).

8a. The "Send to VA Claim Commander" Button (VA.gov Bookmark)

"Send to VA Claim Commander" is a bookmark you add to your browser. It is not a browser extension and it installs nothing. It runs only when you click it, and only on VA.gov after you have signed in there yourself.

When you click it, it reads, in your own VA.gov tab, the same information VA.gov shows you: your rated conditions and percentages, your combined rating, your open claims and appeals and where they stand, your intent to file, and your service dates. It only reads. It never changes or files anything with VA, and it never sees your VA.gov, ID.me, or Login.gov password.

It keeps only what your board uses — not your name, address, Social Security number, or VA file number — and hands it to your VA Claim Commander tab. Our server checks that it is complete and belongs to your signed-in account, then returns it without saving it. It is stored in your own browser, under your account only, until you remove it ("Remove VA.gov information") or clear your browser data. It is not sent to AI, unless you choose to add one of your rated conditions as a claim, add one of your open VA claims to your board, or use your service history as your own service (as described in Section 8c).

Claim letters. If you choose, the button can also bring over claim letters VA.gov lists for you; you tick the ones you want. Those letters wait in your browser until your board picks them up; letters more than an hour old are not used. Then they are handled exactly like a file you upload yourself, including being read by our AI provider to find your conditions and decisions (Sections 4 and 5).

8b. Commander Health

Commander Health is a clinical review service that connects veterans with licensed clinicians (such as nurse practitioners) for independent, records-based medical opinions in support of VA disability claims. There is no examination or appointment; if a clinician needs more information, they follow up in writing — a message on your secure Commander Health reply page, and an email letting you know it is there.

How your records are read

You can come to Commander Health directly, or from VA Claim Commander. Either way, the files you upload are read in your browser. To screen your case, and — if you continue — to build your clinical summary, we send only the text extracted from those files to our servers, where it is processed by our AI provider (see Section 4) and not saved. If you come from VA Claim Commander, the clinical summary and drafted opinion from your VA Claim Commander account are carried over at your request instead.

What we store

When you open a Commander Health case, we store the contact and service details you give us and the conditions you are claiming (and whether each is direct or secondary). We also store the drafted medical opinion (carried over from VA Claim Commander, or drafted by Commander Health after payment), the signed documents your clinician returns, and your case status and our email correspondence with you. We store the messages you and your clinician exchange on your secure reply page, and any file you choose to attach to one. We also store a structured clinical summary derived from your records, which you review and approve. The summary contains:

  • Identified diagnoses and ICD codes
  • Key diagnostic test results (e.g., AHI scores, lab values, audiogram results)
  • Treatment history extracted from your records
  • Relevant clinical findings documented by your treating providers

What we do not store

We do not store your raw medical records. Your uploaded files stay in your browser, and the text extracted from them is processed and discarded. Only the structured clinical summary you approve — together with the case items listed above — is retained. The one exception is a file you choose to attach to a message to your clinician: that file is stored with your case so your clinician can open it.

Who can access your summary

Your structured clinical summary is accessible only to you and the licensed clinician assigned to your Commander Health case. It is encrypted at rest using AES-256-GCM encryption and transmitted only over HTTPS. Your assigned clinician uses this summary to prepare and sign your independent medical opinion.

Your messages work the same way. Only you (through the secure link in your Commander Health email) and the clinician assigned to your case can read them; Commander Health staff see them only when needed to support your case. Your clinician's name and email address are not shown on your reply page. Message text is encrypted at rest using AES-256-GCM, and attached files are kept in encrypted, access-controlled storage and opened only through your case's secure links — never a public web address.

How long we retain it

Your clinical summary, your messages and any files you attached to them are retained for the duration of your Commander Health case plus 90 days following case completion or cancellation. You may request earlier deletion at any time by contacting support@vaclaimcommander.com.

Your consent

Before your Commander Health case is created, you will be asked to explicitly consent to the storage of your structured clinical summary. You may withdraw consent at any time by requesting case cancellation and deletion of your summary.

Database storage

Commander Health case data — including your clinical summary, assigned clinician, case status, messages, and generated documents — is stored in a secured PostgreSQL database hosted on Amazon Web Services (AWS) under a signed HIPAA Business Associate Agreement (BAA). Data is encrypted at rest and access is restricted to authenticated application processes and your assigned clinician.

8c. Connecting Your VA.gov Account

You can choose to connect your VA.gov account so your VA information shows up in VA Claim Commander. Connecting is optional and free. Everything in VA Claim Commander also works if you type or upload your information instead. We are turning this option on gradually; if you do not see it in the app, it is not on for your account yet.

VA Claim Commander is not part of the Department of Veterans Affairs, and VA does not endorse us. Connecting your account does not make us your representative and does not file anything with VA.

How connecting works

When you tap a Connect button (for example, "Connect ratings and service history"), we send you to VA's own sign-in page. You sign in there with ID.me or Login.gov, and VA asks whether to share your information with us. We never see your VA.gov, ID.me, or Login.gov password. VA asks separately for each of the two kinds of information below, so you can say yes to one and no to the other.

If you agree, VA gives us access keys that let us read your information. One of them lets us read it again later without asking you to sign in each time. VA's sign-in also includes basic profile details so we can confirm the connection. From them we keep only your first, middle, and last name, encrypted with the access keys, so you can choose to copy your name into your own information (see "Not sent to AI unless you choose" below). We do not save anything else from them.

What we read from VA, and only if you agree on VA's page

  • Ratings and service history — your combined disability rating and its effective date; each rated condition, with its name, percentage, diagnostic code, whether it is service connected, its effective and end dates, and whether VA has marked it as not needing re-examination; whether you are rated permanent and total, and whether you receive individual unemployability (and since when); your periods of service (branch, component, type of service, dates, pay grade, discharge status, separation reason, and deployment locations and dates); and whether VA confirms your veteran status.
  • Your name — your first, middle, and last name as VA's sign-in gives it, if it does. It is kept with the access keys and deleted with them.
  • Claims and intent to file — for each open VA claim: its type, status, date filed, VA's estimated decision window, whether VA is asking you for documents, whether a decision letter was sent, the conditions in the claim, and its steps and dates. For closed claims we keep only how many there are. We also read whether you have an intent to file, with its type, status, start date, and expiration date.

Read only. We ask VA only for permission to read. We cannot file, change, or withdraw anything with VA through this connection, and we never try.

How we use it

Only to show it to you and help you with your own claim — for example, your ratings on your board, how many days are left on your intent to file, and where your open claims stand. Everything we read is labeled "From VA.gov" with the date we read it. It sits beside what you entered yourself and never replaces it. Only VA can correct its records; if something VA holds is wrong, contact VA to fix it.

Not sent to AI unless you choose

Information we read from VA is never sent to Claude or any other AI model, and it is never used to train one. There are three exceptions, and each is your choice. If you tap "Add as a claim" on one of your rated conditions (for example, because you think it is rated too low), that condition's name, rating, and diagnostic code are added to your claim as if you had typed them. If you tap "Add to my board" on one of your open VA claims, the conditions in that claim become your own board cards, as if you had typed them, and each card shows VA's claim number and step. If you tap "Use this as my service" (or "Use what VA.gov shows" on your board), your branch, service dates, and character of discharge are copied into your own information, as if you had typed them, and so is your name (first name, middle initial, and last name) if VA's sign-in gave it to us. Nothing else from your service history is copied, and never your Social Security number, address, or date of birth. If you already typed something different, we ask before replacing it. From then on these entries are treated like anything else you entered, including in the documents you ask us to draft.

Never sold, never used for advertising

We do not sell, rent, or license information we read from VA.gov, and we do not use it or share it for marketing or advertising. It is never passed to our analytics or advertising tools. We do not share it with anyone except as you direct, and no one else who uses VA Claim Commander — including a representative using Commander for Advocates — can see it. Using or disclosing it for any other purpose without your consent is prohibited. Our infrastructure provider stores it for us under a written agreement and may not use it for anything else.

Where it is kept and how it is protected

In our database on Amazon Web Services (AWS) in the United States, operated under our HIPAA Business Associate Agreement with AWS — not on the servers that host our public website. The access keys VA gives us, and everything we read from VA, are encrypted in that database with AES-256-GCM, on top of AWS's own encryption, and travel only over encrypted connections. We save only the items listed above; VA's full responses are not saved.

How long we keep it

While you stay connected. We read your information from VA when you connect. After that we read it again when you open the app, at most once an hour, and whenever you tap "Refresh." Each new read replaces the last one.

If VA stops accepting our access — for example, you removed VA Claim Commander in your VA.gov profile, or the access expired — we delete the access keys as soon as VA refuses them and show a "Reconnect VA.gov" button. We keep the last copy we read, marked with the date we read it, so it does not disappear from your board. It stays until you disconnect or delete your account. We cannot read anything new until you reconnect.

Disconnecting deletes it

Tap "Disconnect VA.gov" at any time. We ask VA to cancel our access, and we delete the access keys and everything we read from VA.gov right away — even if VA's system does not answer. If VA does not confirm the cancel, the app tells you, and you can also remove VA Claim Commander from the connected apps in your VA.gov profile. What you entered yourself, including any condition you chose to add as a claim, stays. Deleting your account (Section 7b) also deletes everything we read from VA.gov. Deleted information leaves our encrypted backups within 7 days (Section 7a).

Questions

Email support@vaclaimcommander.com with any question about your VA.gov connection or to ask us to delete what we hold.

9. Your Rights Under State Privacy Laws

Depending on where you live, state privacy laws — such as the California Consumer Privacy Act (CCPA/CPRA), the Virginia Consumer Data Protection Act, and similar laws in other states — may give you the right to:

  • Know what personal information we hold about you and how it is used
  • Access or receive a copy of that information
  • Request correction of inaccurate information
  • Request deletion of your information
  • Opt out of the sale or sharing of your personal information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising in exchange for money. For veterans in the free flow, most of your data never leaves your browser, so there is nothing on our servers for us to access or delete (see Section 5). The exception is if you connect your VA.gov account: then you can see what we read in the app and delete it at any time by disconnecting (Section 8c). For paid saved accounts, Commander for Advocates, and Commander Health, you may exercise these rights as described in Sections 5a, 5b, and 8b, or by contacting us.

Some states — including Washington (My Health My Data Act), Nevada, and Connecticut — provide additional protections for consumer health data. Because we treat the medical information you share with HIPAA-aligned safeguards regardless of where you live (Section 1), those protections are reflected in how we handle your data throughout this policy. To exercise any state privacy right, email support@vaclaimcommander.com. We will verify your request and respond within the timeframe your state law requires. We will not discriminate against you for exercising these rights.

10. Children's Privacy

VA Claim Commander is intended for veterans and accredited representatives and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact support@vaclaimcommander.com and we will delete it.

11. Not a Medical Service

VA Claim Commander generates documentation to support your VA claim. We are not a healthcare provider. Medical opinion documents we draft (such as nexus letters) require review and signature by a licensed healthcare provider before submission to the VA. Personal and buddy statements are lay evidence that you or your witness review and sign yourselves. Nothing in our application constitutes medical advice or a medical opinion.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make a material change, we will email the address on your account and post a notice on this page before the change takes effect, with the updated date above. Continued use of VA Claim Commander after changes constitutes acceptance of the updated policy.

13. Contact

Questions about this Privacy Policy:

support@vaclaimcommander.com

If you're in crisis or thinking about suicide, you're not alone. The Veterans Crisis Line is free, confidential, and available 24/7 — you don't need to be enrolled in VA care.

© 2026 VA Claim Commander. All rights reserved. · Veteran Owned & Operated

VA Claim Commander LLC · 9301 State Highway 75 S #4, New Waverly, TX 77358

Not affiliated with or endorsed by the Department of Veterans Affairs.

Your records get HIPAA-aligned protection, and anything you choose to save is encrypted and stored under a signed HIPAA Business Associate Agreement (BAA) with AWS. We're a software tool — not a HIPAA covered entity — and your data is never sold or used to train AI models.

VA Claim Commander is a self-service software tool — not a VSO, law firm, or VA-accredited representative. It does not file, submit, present, or prosecute claims on anyone's behalf, and does not provide legal or medical advice. We recommend working with a free, VA-accredited VSO — find one near you.