Privacy Policy

Hesper AI handles personal information in two distinct capacities, and the rules differ for each. Read the one that applies to you.

This policy is published by Hesper PN, Inc., a Delaware corporation doing business as Hesper AI, of 680 2nd Street, San Francisco, CA 94107.

You give it to us

Name, work email address, phone number, company name, job title, and anything you choose to include in a message when you request a demo, contact us, subscribe to our newsletter, apply for a role or register for an account. If you start one of our request forms and leave before submitting it, we may keep the details you have already typed, such as your name and work email, to follow up on your request.

We collect it automatically

IP address, browser and device type, operating system, referring URL, pages viewed, and dates and times of access. We use cookies and similar technologies for essential site function, for analytics and for advertising.

Account and usage data

For platform users: account identifiers, authentication events, API usage metadata, request identifiers, timestamps, feature usage and audit logs. We use this to operate, secure and support the Services and to bill accurately.

• to provide, maintain, secure and improve the Services
• to respond to enquiries, demo requests and support tickets
• to send service, security and administrative messages
• to send marketing communications where permitted - you can unsubscribe at any time
• to measure our advertising and show our ads to people who have visited our website
• to process payments and manage our customer relationships
• to detect, investigate and prevent fraud, abuse and security incidents
• to comply with legal obligations and enforce our terms

Where the GDPR or UK GDPR applies, our lawful bases are performance of a contract, our legitimate interests in operating and marketing a B2B service, your consent where required, and compliance with legal obligations.

When an insurance organisation uses Hesper, it submits claim files to us for analysis. These can contain identifiers, claim and policy details, loss descriptions, financial information, photographs, recorded statements and correspondence. In bodily-injury, workers' compensation and disability claims they routinely contain medical bills, treatment records and diagnoses.

What we do with it

We ingest, extract, index, analyse and correlate the claim file, and we generate investigation output - findings, fraud indicators, evidence summaries, narratives and referral documentation. We do this only on our customer's documented instructions and only to provide the Services to them.

Where it is stored, and for how long

Claim file data and investigation output are stored in our systems, and are retained for the duration of the customer's subscription term unless the customer instructs us otherwise in writing.

A customer may at any time instruct us to apply a shorter retention period, to delete identified data, or to hold data for longer than the term - for example to match their own claim-file record-retention schedule. We give effect to that instruction within 30 days, subject only to a legal requirement or a litigation hold.

When a subscription ends, the customer has 30 days to export their data. We then delete it from production systems within 60 days, and from backups within a further 90 days, except where law or a litigation hold requires us to keep it - in which case we isolate it, keep only what is required, and continue to protect it until deletion is permitted. We certify deletion in writing on request.

Data is hosted in the United States on Amazon Web Services unless a customer's order form specifies otherwise.

Sensitive information

We treat medical, mental-health, substance-use, genetic and biometric information, government identifiers and financial account numbers as sensitive, and apply heightened access controls to them, whether or not HIPAA applies. Where our processing makes us a HIPAA business associate, a Business Associate Agreement governs. We do not use sensitive information to infer characteristics about anyone.

We flow the same prohibition down to every AI subprocessor by contract, and we disable training, improvement-retention and human-review-for-improvement features wherever a provider offers them. Our subprocessor page states the data-retention posture of each AI provider we use.

Where a customer's order form provides for tuning specific to that customer, the resulting artefacts stay logically segregated to their tenant and are never exposed to anyone else.

We generate aggregated, de-identified statistics about how the Services perform. Before we do, we strip all direct and indirect identifiers of any customer, claimant, insured, provider or other person, and all claim and policy numbers, and we aggregate across customers so no individual customer is identifiable. We do not publish statistics identifying a customer without their written consent.

We share personal information with the subprocessors listed on our subprocessors page - cloud infrastructure, AI model providers, monitoring, support and billing vendors - each bound by written obligations no less protective than ours.

We also disclose where required by law, subpoena or court order; to protect our rights, safety or property; to professional advisors under confidentiality; and, in a merger, acquisition or sale of assets, to the acquiring party, in which case we will notify affected customers.

Apart from the website advertising companies described under Cookies, we do not share personal information with third parties for their own marketing purposes.

Where a government authority requests customer data, we will notify the customer unless legally prohibited, challenge requests that are unlawful or overbroad, disclose only the minimum permissible, and direct the authority to the customer wherever legally possible.

Nonpublic personal information we receive from insurance customers under the Gramm-Leach-Bliley Act is used and redisclosed only for the purposes for which it was provided, consistent with the reuse and redisclosure limits that apply to service providers.

We encrypt data in transit using TLS 1.2 or higher and at rest using AES-256. We enforce multi-factor authentication for all personnel access to production, grant access on a least-privilege basis, log access to claim file data, segregate customer tenants, run automated vulnerability scanning, and commission an independent penetration test annually.

We have completed a SOC 2 Type I examination. The report is available to customers and prospects under NDA.

Full detail is on our security page. No system is perfectly secure, and we do not claim otherwise.

If we confirm a security incident affecting customer data, we notify the affected customer within 48 hours and give them what they need to meet their own regulatory notification deadlines. To report a vulnerability, write to security@gethesperai.com - we acknowledge within two business days.

United States

Depending on your state, you may have the right to know what personal information we hold, to access a copy, to correct it, to delete it, to opt out of sale, sharing or targeted advertising, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. We do not sell personal information for money. Our website advertising technologies may count as sharing or targeted advertising under these laws, and you can opt out as described under Cookies.

Europe and the United Kingdom

If you are in the EEA, UK or Switzerland you may have the right to access, rectify, erase, restrict or object to processing, to data portability, to withdraw consent, and to lodge a complaint with your supervisory authority.

How to exercise them

Write to privacy@gethesperai.com. We will verify your identity and respond within 30 days, or within the period your law requires. You may use an authorised agent where the law permits.

For claim file data, contact the insurer or administrator handling your claim. We will forward your request to them within five business days. Insurance regulation and open fraud investigations may permit or require them to defer or deny certain requests - that decision is theirs, not ours.

Customer claim data is stored and processed in the United States by default. Where our personnel outside the United States need access for support, engineering or security, that access is subject to the same least-privilege controls, logging and confidentiality obligations, and customers may require on their order form that access to unmasked claim data be restricted to United States personnel.

Where we transfer personal data out of the EEA, UK or Switzerland, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful mechanism, and we provide the information customers need to complete a transfer impact assessment.

We use strictly necessary cookies for site function and security, analytics cookies to understand how the site is used, and advertising cookies to measure our ads and show them to people who have visited the site. You can control cookies through your browser settings. Blocking essential cookies may break parts of the site.

We use Microsoft Clarity to see how visitors use our pages, through heatmaps and session recordings of clicks, scrolling and page movement. Clarity masks what you type into form fields. Microsoft processes this data under its own privacy statement.

Our public website uses advertising and marketing technologies from Meta (the Meta Pixel), Google, LinkedIn, LocaliQ and Instantly. They collect identifiers, your IP address and the pages you visit, and may combine this with other data they hold about you. We use them to measure our advertising, to show our ads on other sites and apps to people who have visited our website, and to understand which companies are interested in Hesper. These companies handle this data under their own privacy statements. They do not receive claim file data.

We honour Global Privacy Control and other recognised opt-out preference signals where applicable law requires. You can also limit advertising cookies in your browser settings and in your ad settings with each company above.

The Services are for insurance organisations and are not directed to children. We do not knowingly collect personal information from anyone under 18 through our website or account registration. Claim files submitted by our customers may contain information about minors - for example a child injured in an accident. We process that information only as our customer instructs, and treat it as sensitive.

We may update this policy. We will post the updated version here with a revised date. For material changes affecting customers, we will give at least 30 days' notice to the contact on file. Previous versions are available on request.

Privacy and data rights: privacy@gethesperai.com. Security: security@gethesperai.com. Legal: legal@gethesperai.com.

Hesper PN, Inc. (d/b/a Hesper AI), 680 2nd Street, San Francisco, CA 94107, United States.