Privacy Policy · 6QD

This policy covers the 6QD Denial Playbook website at the6qd.com and the 6QD Denial Assistant Chrome extension. 6QD is operated by 6QD (a Delaware LLC). Questions? Email privacy@the6qd.com.

The short version

The Chrome extension does not read patient records, does not capture claim data from the pages you open it on, and does not send any protected health information (PHI) to 6QD or any third party. All you send us when you rate an SOP is which CARC/RARC combination you looked up and your optional written note.

What we collect

Website account

Your email address, name, and organization (from your invite).
A bcrypt hash of your password. We never see the plaintext password.
Your last sign-in timestamp, so we can help you diagnose lockouts.
Any API keys you mint (stored as SHA-256 hashes — we only see the tail).

Chrome extension

Locally in your browser only: the CARC and RARC codes you last selected, and your feedback records until they sync. This uses chrome.storage.local and never leaves your device unless you have configured an API key.
Sent to 6QD only if you configure an API key in the extension settings: the CARC/RARC combination you rated, whether you found it helpful, your optional written note, the hostname (not the full URL) of the page you were on, and the extension version. We use this to improve the SOPs. See the "What we never collect" section below.

Website analytics

Standard server logs (IP address, user agent, requested URL, timestamp). Retained for 30 days for security and abuse-monitoring purposes.
No third-party ad networks, no session replay, no cross-site tracking.

What we never collect

The Chrome extension does not — under any circumstances, whether an API key is configured or not — send:

Any patient identifier (name, MRN, DOB, SSN, member ID, claim number, account number)
Any clinical data (diagnoses, procedures, dates of service, provider notes)
The full URL of any page you visit — only the hostname (e.g., availity.com)
The contents of your worklist, denials queue, or any payer portal
Screenshots, keystrokes, or clipboard contents
Your location, contacts, cookies from other sites, or browsing history

The extension has the <all_urls> host permission so its floating panel can appear on any web-based EHR, payer portal, or worklist. It does not read the pages it is displayed on.

How we use what we collect

To authenticate you and gate access to subscriber content.
To send you password-reset emails and (opt-in) product announcements.
To rank the CARC/RARC combinations whose SOPs need improvement — this is why the feedback capture exists.
To diagnose and respond to security incidents.

We do not sell your data, and we do not share it with third-party marketers.

HIPAA

6QD is not a HIPAA covered entity or business associate for you unless we have signed a Business Associate Agreement (BAA) with your organization. Because the extension is designed to never collect PHI, no BAA is required for the standard use case. If your compliance team requires a BAA before installation, contact legal@the6qd.com.

Data storage & security

All data at rest is stored in a Postgres database (managed by Neon) with encryption enabled.
All traffic between your browser and the6qd.com is TLS 1.3.
Passwords are hashed with bcrypt (12 rounds). API keys are stored as SHA-256 hashes.
Session tokens are HMAC-SHA256 signed, HttpOnly cookies with a 30-day TTL.

Your rights

Access or export all data we hold about you: email privacy@the6qd.com.
Delete your account: email privacy@the6qd.com. We honor requests within 30 days.
Revoke an API key at any time from the admin panel.
Clear local extension data by right-clicking the extension icon → Options → Clear all data, or by uninstalling the extension.

Third-party services

The site relies on:

Vercel — hosting for the website.
Neon — Postgres database.
Amazon SES — transactional email (password resets, invitations).
Google Chrome Web Store — extension distribution.

Each of these providers has its own privacy practices. We use them under standard commercial terms; none of them receive PHI from us.

Changes to this policy

If we make material changes to this policy we will update the "Last updated" date at the top and, for account holders, send an email notice at least 14 days before the change takes effect.

Contact

6QD
privacy@the6qd.com