Privacy Policy

1. Introduction

VetJustice.ai (“we,” “us”) operates VetJustice Pro, an independent, AI-assisted claim-preparation tool for VA-accredited representatives: veterans service officers, claims agents and attorneys. Representatives use it on behalf of the veterans they serve; veterans do not use it directly. We are not affiliated with, endorsed by, or operated by the U.S. Department of Veterans Affairs. This Policy explains what information we collect, how we use it, who we share it with, and the choices you have.

2. Information We Collect

• Account information — for each representative: email address, a password hash, name, VA accreditation details (type, number, state, and whether they matched VA’s accreditation roster), the firm and role, and the dates (not times) you sign in.
• Two-step sign-in — if you turn it on, the secret your authenticator app uses, stored encrypted, and one-time backup codes, stored only as hashes.
• Client case data — what you enter or upload about a veteran you represent: name, date of birth, service dates and branch, VA file number, the last four digits of a Social Security number if you enter them, rated conditions, the records extracted from uploaded files, VA decisions found in them, and what the service drafts from them (analyses, nexus letter drafts, exam preparation, CUE screens).
• Uploaded files — read in memory to extract their records and decisions, then discarded. The files themselves are not kept.
• Firm and billing records — your firm’s members and invitations (the invited email address), who ran or drafted each piece of work, each approved job and its price, a prepaid balance, and monthly invoices.
• Technical data — IP address, browser, and request logs needed to operate and secure the service.

2.1 Social Security Numbers and Sensitive Identifiers

A veteran's Social Security Number is not required to analyze a claim. Our specialist analysis reasons only about conditions, dates, providers, and clinical findings — never an SSN.

• Automatic redaction. When you upload a document, any Social Security Number we detect is automatically masked before the record is saved or analyzed. We do not store SSNs from uploaded records.
• Spreadsheets are scrubbed on your device. Excel files are read in your browser, and any SSN is stripped locally — the number never leaves your device.
• Redaction is welcome. A Social Security Number can be blacked out before scanning — it is not needed for any analysis step.
• Last-four only, where required. The only place an identifier is used is the VA Form 21-526EZ itself, which asks for the last four digits of the veteran's SSN. That value is entered by the representative, stored only as part of the veteran's profile, and shown masked (XXX-XX-####) on generated forms.

2.2 Within a Firm

Everyone in a firm can see and work on all of the firm’s cases. The firm’s owner can also see its members’ names, email addresses, accreditation status, whether two-step sign-in is on, and the date each last signed in, and each piece of work shows who ran or drafted it. A member the owner removes loses access at once; the work they did stays with the firm’s cases, credited to them. No firm can see another firm’s data.

3. How We Use Your Information

• To provide the core service — identifying potential service-connected and secondary conditions, generating nexus analyses, preparing C&P documentation, and tracking appeal deadlines.
• To send our AI provider the records and case details each job needs (see §4 and §4.1). Social Security numbers we detect are masked first.
• To bill your firm for the jobs it approves.
• To secure the service, prevent abuse, and meet our legal obligations.
• To communicate with you about your account or material changes to the service.

We do not sell your information. We do not use your information to train AI models, and neither does our AI provider (see §4.1).

4. Third-Party Processors

We rely on a small number of vetted service providers to operate VetJustice.ai. Each acts as a data processor on our behalf, under contract.

4.1 — AI Processing: Anthropic API Terms

VetJustice.ai uses the Anthropic Claude API under commercial terms, which provide materially stronger protections than Anthropic’s consumer products:

• No training use: Anthropic does not use API inputs or outputs to train AI models. This applies by default to all commercial API customers and is not subject to opt-in or opt-out.
• Data Processing Agreement (DPA): VetJustice.ai operates under a formal DPA with Anthropic, establishing legal obligations for how your data is handled.
• 30-day retention: Under Anthropic’s commercial terms (effective July 1, 2026), API inputs and outputs are deleted within 30 days of receipt. Content flagged for a usage-policy violation may be kept longer, as Anthropic’s policy describes.
• Zero Data Retention (ZDR): Anthropic offers a ZDR arrangement, under which data is not stored at rest after the API response is returned (apart from Anthropic’s User Safety classifier results, kept solely to enforce its usage policy). VetJustice.ai has not adopted ZDR; until it does, the 30-day deletion above applies.
• TLS encryption in transit: All data transmitted to the Anthropic API travels over TLS 1.2+ encrypted connections. Anthropic’s infrastructure encrypts data at rest using AES-256.
• HIPAA pathway: For future HIPAA compliance, Anthropic offers a Business Associate Agreement (BAA) for API customers. VetJustice.ai is evaluating this pathway as the platform matures.

You own your data. Anthropic processes it as a data processor on VetJustice.ai’s behalf — not as an independent data controller with rights to your information.

5. Data Security

• All network traffic uses TLS 1.2 or higher.
• The database is encrypted at rest (AES-256, AWS KMS) and is not reachable from the public internet.
• Uploaded files are not kept (see §2).
• Passwords are stored only as salted hashes. Two-step sign-in with an authenticator app is available to every representative, and a firm’s owner can require it for the whole firm.
• Each firm’s data is isolated from every other firm’s, and every person needs their own account.
• Access to production systems is restricted, logged, and reviewed.

6. Your Rights

You may ask us to access, correct, export, or delete your account and your firm’s data at any time by contacting us at the address below. Within the service you can edit or delete a case’s records, and a firm’s owner can remove members. Depending on your jurisdiction, you may have additional rights under GDPR, CCPA/CPRA, or similar laws.

7. Retention & Deletion

We retain account and case data for as long as your firm’s account is active. When you delete your account, application data is removed from primary stores within 30 days and from encrypted backups within 90 days. Anonymized analytics and security logs may be retained longer.

8. Contact

Questions or requests: privacy@vetjustice.ai. We respond within 30 days.