Privacy policy
You are handing us your service record and your medical history. This page explains plainly what we do with it — and, just as importantly, what we do not.
What we collect
Your identity and contact details: name, date of birth, email address, telephone number, postal address, and your VA file number.
Your service history: the periods you served, your branch and component, where you were stationed, any deployments, and the roles you performed.
The conditions you are claiming, what happened in service, and how you connect the two — along with any current service-connected conditions and previous VA decisions relevant to the request.
The documents you upload: proof of service, medical records, decision letters, witness statements, and anything else you choose to attach.
We collect this because a physician cannot write a defensible medical opinion without it. We do not ask for anything we do not use.
What we do with it
One thing: prepare the Nexus Letter you asked for, and support you through the request. That is the entire purpose.
We do not sell your information. We do not share it with advertisers, data brokers, or anyone assembling profiles. We do not use your medical information to market anything to you.
We do not submit anything to the VA on your behalf. The finished letter is released to your account and you decide what to do with it.
Who can see it
The physician assigned to your request, and the reviewers and administrators who manage cases. Nobody else.
That is enforced by the database rather than by the screens: the rules live with the data, so a request for someone else's case is refused at the lowest level, not merely hidden in the interface. Another customer cannot reach your case, and a physician who is not assigned to it cannot either.
Every time a document is opened, it is recorded — who, what, and when.
How your documents are stored
Uploads go to private storage that is not reachable from the open internet. There is no public link to a document, and one cannot be created by guessing.
When you or your physician open a document, the system issues a single link that expires after sixty seconds, and only after checking that you are entitled to it. Files are stored under randomised names rather than the name you uploaded, so nothing about the path reveals what it contains.
Data is encrypted in transit and at rest, and stored in the United States.
What we never put in an email
Anything medical. Our notifications tell you that something has changed and ask you to sign in — they do not name your condition, quote your records, or attach documents.
Email is not a secure channel and cannot be made into one, so we treat it as a doorbell rather than a delivery service. Please do the same: never email us your records. Upload them to your account instead.
Payment, and what we keep about your card
Card payments are handled on a page hosted by our payment processor. Your full card number, its expiry date and its security code never reach our systems, and we could not store them if we wanted to.
We do keep three things after a payment. The last four digits of the card, so you can tell one payment from another — and because our processor will not accept a refund without them, which means discarding them would leave us unable to refund you. The processor's transaction reference. And the processor's own record of the transaction: the amount, whether it succeeded, and when it settled.
That is the whole of it. Four digits identifies nothing on its own and cannot be used to charge anything; keeping it is expressly permitted by the card networks' own rules, and it is the minimum that still lets us give your money back.
In the other direction, the processor is told only what it needs to take a payment: an amount, a description of the tier, and an opaque request number. It is never told your condition, your diagnosis, or anything from your records.
How long we keep it
We retain your case and its documents while your account is open, and afterwards for as long as we are required to — a medical opinion may need to be produced again years later, and your physician has record-keeping obligations of their own.
You can ask us to delete your information. Where an obligation requires us to keep something, we will tell you what and why rather than refusing without explanation.
Your choices
You can see everything we hold about you from your account, and you can ask for a copy.
You can correct anything that is wrong — if a date or a detail is inaccurate, tell us and we will fix it.
You can withdraw consent and ask us to stop processing, though we will not be able to continue with your request if you do.
You can cancel a request before it is submitted, from your account, without contacting anyone.
Children
This service is for veterans and is not directed at children. We do not knowingly collect information from anyone under 18.
Changes to this policy
If we change how we handle your information, we will update this page and note when it changed. Material changes will be communicated to you through your account rather than buried here.
Questions about your data?
Sign in and contact us on your case, or use the contact page.