Privacy Policy

KNL Enterprises LLC ("KNL," "we," "us," or "our") operates the Medicare Laws Expert platform at medicarelaws.app (the "Service"). This Privacy Policy explains how we collect, use, disclose, and protect information about you when you visit our website or use our authenticated research application.

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy.

1. Information We Collect

1.1 Information You Provide Directly

• Account registration: Name, email address, organization name, job title, and password when you create an account.
• Contact and inquiry forms: Name, email, and message content submitted through any contact form on the public site. When you submit a contact or demo-request form, we send a one-time verification code to your email (via Twilio SendGrid) to confirm the address before processing your inquiry.
• Billing information: Payment card information and billing address, processed by our third-party payment processor. We do not store full payment card numbers.
• Research queries: Text and content you submit to the Application for AI-powered research. See Section 4 for AI provider data handling.

1.2 Information Collected Automatically

• Log data: IP address, browser type and version, pages visited, time and date of visits, time spent on pages, and referring URLs.
• Device information: Device type, operating system, and unique device identifiers.
• Usage data: Features used, queries submitted (metadata only, not content), session duration, and error logs within the Application.
• Cookies and tracking technologies: See Section 6 for full cookie disclosure.

1.3 Information We Do Not Collect

2. How We Use Your Information

We do not sell your personal information. We do not use your research query content for marketing purposes. We do not use your data to train AI models without your explicit consent.

3. Third-Party Service Providers

3.1 AI Model Providers

When you submit research queries through the Application, your query content is transmitted to one or more third-party AI providers for processing. Current providers and their privacy documentation:

Each provider processes data transmitted via their APIs according to their own privacy policies and any applicable data processing agreements maintained by KNL Enterprises LLC. Do not submit PHI or sensitive personal data in queries.

3.2 Service Providers

We may share information with trusted service providers who assist us in operating the Service, including:

• Payments: Stripe
• Hosting: OVH / Hetzner cloud infrastructure
• Authentication and access control: Cloudflare Zero Trust
• Email delivery — Twilio SendGrid (contact-form verification codes and inquiry email)
• Analytics — Google Analytics 4 (Google LLC), consent-gated; see Section 6

These providers are contractually bound to protect your data and use it only as directed by KNL Enterprises LLC.

3.3 Legal Requirements

We may disclose information if required by law, court order, or government authority, or to protect the rights, property, or safety of KNL Enterprises LLC, our users, or the public.

3.4 Business Transfers

If KNL Enterprises LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.

3.5 International Data Transfers

KNL is based in the United States and several processors (including Google, Cloudflare, Twilio SendGrid, and our AI providers) process data in the United States. Where personal data is transferred from the EEA or UK to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum), and, where applicable, a provider's EU–US Data Privacy Framework certification. Contact [email protected] for a copy of the relevant safeguards.

4. AI-Generated Content & Data Handling

Each AI provider's treatment of API input data varies. As of the effective date of this policy:

• Anthropic: API inputs are not used to train models by default under their API terms.
• Google (Gemini API / Vertex AI): Data handling depends on which API endpoint is used; review Google's Cloud data processing terms.

These policies are subject to change by each provider. We recommend reviewing each provider's current terms. If data processing commitments are material to your organization's use, contact us to discuss enterprise agreements.

5. Data Retention

6. Cookies and Tracking Technologies

We use the following categories of cookies and similar technologies:

You can manage cookie preferences through our Cookie Consent banner displayed on your first visit to the public site, or at any time via the persistent Cookie Preferences link in the site footer. You can also control cookies through your browser settings, though this may affect Service functionality.

We honor the Global Privacy Control (GPC) browser signal as a valid opt-out of analytics and of any sale or share of personal information. When a GPC signal is present and you have not made a prior cookie choice, analytics remain disabled.

7. Data Security

We implement commercially reasonable technical and organizational measures to protect your personal information, including:

• Zero Trust Network Access (ZTNA) for all authenticated application access
• TLS encryption for all data in transit
• Encryption at rest for sensitive stored data
• Access logging and monitoring
• Role-based access controls for KNL personnel
• Regular security assessments

No security system is perfect. In the event of a data breach affecting your rights and freedoms, we will notify you as required by applicable law.

8. Your Rights and Choices

EEA & UK Residents (GDPR / UK GDPR)

If you are in the EEA or UK, you have the right to access, rectify, erase, restrict, or object to processing of your personal data; to data portability; and, where processing is based on consent, to withdraw consent at any time. You may lodge a complaint with your supervisory authority (in the UK, the ICO, ico.org.uk).

California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, disclose, and sell;
• Delete personal information we hold about you (subject to exceptions);
• Correct inaccurate personal information;
• Opt out of the sale or sharing of personal information (we do not sell personal information);
• Non-discrimination for exercising your rights.

To exercise these rights, contact us at [email protected].

All Users

• Access: Request a copy of personal information we hold about you.
• Correction: Request correction of inaccurate information.
• Deletion: Request deletion of your account and associated data (subject to retention requirements above).
• Marketing opt-out: Unsubscribe from marketing emails at any time via the unsubscribe link or by contacting us.
• Cookie opt-out: Manage analytics cookies via the persistent Cookie Preferences link in the footer, your browser settings, or the Global Privacy Control (GPC) signal, which we honor.

9. Children's Privacy

The Service is intended for professionals and is not directed to persons under 18 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, contact us immediately.

10. Third-Party Links

The Service may contain links to government websites, regulatory agencies, and other third-party sites. This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party site you visit.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated policy on this page with a new effective date. For material changes, we will provide additional notice (such as email notification to registered users). Your continued use of the Service after any changes constitutes acceptance of the updated Privacy Policy.

12. Contact Us

For privacy-related questions, requests, or concerns:

KNL Enterprises LLC
Privacy/Legal Department
Email: [email protected]
Web: knl.enterprises

We will respond to privacy requests within 30 days of receipt.