Privacy Policy

1. Private beta

The service on jengu.health is a private beta. Use synthetic or sample data only. Do not upload a real medical bill, a real explanation of benefits, a real veteran record, a real clinical note, or any file that identifies a patient or a veteran.

If you already uploaded a real document, email privacy@jengu.health from your account address and ask us to delete it. Do not upload another.

We do not have a business associate agreement in place with a clinician, an employer, a health plan, or a vendor for this beta. Do not send us protected health information.

2. Information we collect in the beta

We collect:

• The email address and password you use to create an account, if you create one.
• Files you upload. They are supposed to be synthetic. We do not want real health information.
• Messages you send to privacy@jengu.health, legal@jengu.health, or security@jengu.health.
• A session cookie that keeps you signed in, if you sign in.

We do not buy personal information. We do not collect information from advertising networks.

Cloudflare, Inc. runs a bot check on the contact form, and on sign-in and password reset when that check is turned on. The same check is built into the sales form and the waitlist. Cloudflare receives signals such as the IP address, the browser user-agent, a TLS fingerprint, and the site key and page origin. It does not receive what you type in the form. Cloudflare describes this at https://www.cloudflare.com/turnstile-privacy-policy/.

3. How we use it

We use account information to run the beta, to keep you signed in, and to answer a support or deletion request.

We use an uploaded file only to show the beta feature you asked for. We do not sell it. We do not use it to train a model. We do not show it to an employer, a plan, a broker, or a third-party administrator.

4. What the product is, and what it is not

Jengu is software for a clinician. The clinician, not Jengu, is the author of any letter or opinion. Jengu does not choose a medical conclusion.

Jengu is not accredited by the Department of Veterans Affairs. Jengu does not prepare, present, or prosecute a claim for VA benefits. Jengu does not file a claim, and it does not act under VA Form 21-22 or VA Form 21-22a. A veteran does not pay Jengu.

We do not charge a fee that depends on a claim result, a rating, a write-off, or money recovered.

An employer service, if it is offered later, is a flat fee paid by the employer. The employee pays nothing. The fee does not change if a bill goes down. Jengu sends a request only after the employee approves the exact text. Jengu does not represent the employee, does not take a power of attorney, and does not settle a bill. The employer would see counts only, after a written de-identification step, and would not see a name, a bill, or a dollar amount. That employer service is not part of this beta. Do not send employee health information until that written agreement and that de-identification record exist.

5. HIPAA

Jengu is not, in this beta, acting as a business associate. A business associate agreement is required before a covered clinician may let Jengu create, receive, maintain, or transmit protected health information. 45 CFR 164.502(e). No such agreement is signed.

Do not rely on this site for HIPAA rights. We are not offering access, amendment, or an accounting of disclosures under 45 CFR 164.524, 164.526, or 164.528, because we are not supposed to have protected health information.

The May 2026 HIPAA page is withdrawn. It said business associate agreements were in place and that uploads were treated as protected health information. That description is not accurate.

6. Federal Trade Commission

Section 5 of the FTC Act makes unfair or deceptive acts or practices in or affecting commerce unlawful. 15 U.S.C. 45(a)(1). We will not describe Jengu as HIPAA-compliant, as a VA representative, or as a service that saves a stated amount of money, unless that description is true.

The FTC Health Breach Notification Rule, 16 CFR part 318, applies to vendors of personal health records, PHR related entities, and third party service providers. It "does not apply to HIPAA-covered entities, or to any other entity to the extent that it engages in activities as a business associate of a HIPAA-covered entity." 16 CFR 318.1(a). A personal health record is an electronic record of PHR identifiable health information that can draw from multiple sources and is managed, shared, and controlled by or primarily for the individual. 16 CFR 318.2.

This beta does not offer a personal health record of a real person, because real health information is not accepted. If we later hold unsecured PHR identifiable health information outside a business associate role, the Rule's notice duties in 16 CFR 318.3 through 318.6 apply. Work done strictly as a business associate under a signed agreement is outside 16 CFR 318.1(a) for that work.

7. Florida and North Carolina

Florida's data-privacy part, Fla. Stat. sections 501.701 through 501.722, applies to a controller. A controller under section 501.702(9) must make more than $1 billion in global gross annual revenue and meet another condition in that subsection. Jengu is not a controller under Fla. Stat. section 501.702(9), so Part V of Chapter 501 is not the privacy law for this beta.

Florida's breach statute, Fla. Stat. section 501.171, is separate. It uses "covered entity" for a business that holds personal information. That phrase is not the HIPAA phrase. If a breach involves personal information of a Florida resident as section 501.171 defines it, notice to the resident is due without unreasonable delay and no later than 30 days after determination of the breach, unless a delay or waiver in that section applies. Notice to the Florida Department of Legal Affairs is due no later than 30 days after determination if the breach affects 500 or more individuals in Florida. https://www.leg.state.fl.us/Statutes/index.cfm?App_mode=Display_Statute&URL=0500-0599/0501/Sections/0501.171.html

North Carolina requires a business that owns or licenses personal information of a North Carolina resident to notify the affected person of a security breach without unreasonable delay, subject to a law-enforcement delay. G.S. 75-65(a) and (c). If notice is given, the business also notifies the Consumer Protection Division of the Attorney General's Office. G.S. 75-65(e1). Notice to more than 1,000 persons at one time also requires notice to nationwide consumer reporting agencies. G.S. 75-65(f). A violation of that section is a violation of G.S. 75-1.1. A waiver of that article is void. G.S. 75-65(g) and (i). https://www.ncleg.gov/EnactedLegislation/Statutes/HTML/BySection/Chapter_75/GS_75-65.html

We did not find a North Carolina statute, in the sections opened for this draft, that grants a general right to a copy of all personal data in the way a comprehensive state privacy law does. The access and deletion process below is our promise. It is not a claim that North Carolina requires it.

8. Cookies

We use a cookie to keep a session signed in. We do not use advertising cookies, and we do not sell browsing data to an ad network.

The public privacy page, reviewed on October 2, 2026, did not load a third-party analytics script.

You can block cookies in your browser. If you block the session cookie, the signed-in beta will not stay signed in.

9. How long we keep information

• Account email and sign-in records: until you ask us to delete the account, then within 30 days of our confirming the request, except a record we must keep to show we deleted it or to meet a breach-notice duty.
• Uploaded files and drafts: until you delete them or ask us to, then within 30 days. A real health document, if one was uploaded against this policy, is deleted when you ask, and we do not keep a copy for product use.
• Security logs: 90 days, unless a security incident is open, in which case the relevant log is kept until the incident is closed.
• Employer counts: not collected in this beta. If the employer service opens, counts that have had identifiers removed may be kept by the employer. We do not keep a key that would put a name back on a count.

We do not retain information in order to charge a fee based on a result.

10. Your requests

Email privacy@jengu.health from the account address to access, correct, or delete account information, or to ask for a copy of what we hold for that account. We will respond within 30 days. We may refuse a request that would disclose someone else's information.

This process is not a HIPAA authorization and it is not an exercise of 45 CFR 164.524.

11. Children

The beta is not for anyone under 18. We do not knowingly collect personal information from a child under 13. If we learn that we have, we will delete it. Email privacy@jengu.health.

12. Changes

If we change this policy in a way that allows a new use of information already collected, we will post the new policy and change the date at the top before that use begins. The May 2026 policy is replaced by this one on the date above.

13. Contact

Privacy questions: privacy@jengu.health

Security concerns: security@jengu.health