Privacy Policy

01Who we are and what this policy covers

ExpeditUsPro, LLC (“ExpeditUsPro,” “we,” “us”) is a Kentucky limited liability company. We provide a HIPAA-aware, AI-assisted case-management platform for workers' compensation, sold to organizations such as employers and third-party administrators (our “customers”).

This policy explains how we handle personal information in two different roles:

• On our own behalf — when you visit expeditus.app, request a demo, email us, or hold a user account. For this information, we decide how it is used, and this policy governs.
• On behalf of our customers — when an organization uses the platform to manage its workers' compensation claims. The case records, documents and health information in the platform (“Customer Data”) belong to the customer. We process them only to provide the service, under our agreement with that customer and, where the data includes protected health information, a Business Associate Agreement. See section 4.

If you are an injured worker or other individual whose claim is managed in the platform, the organization handling your claim — your employer, its claims administrator or insurer — is responsible for your information. Please direct requests about your claim to them. We will help them respond.

02Information we collect

When you request a demo

Our booking form asks for your name, company, work email address, phone number, role and any notes you choose to add. To prevent spam and abuse of the form, we also record a one-way hash of your IP address (not the address itself) and your browser's user-agent string.

When you contact us

If you email us, we receive your email address, your message and anything you attach.

When you use the platform

• Account information — your name, work email address, mobile phone number, organization and role, provided by you or by the customer that invited you. Accounts are created by invitation only.
• Sign-in information — the one-time codes we send you to sign in, and records of sign-in attempts.
• Activity and audit records — which records you viewed or changed, which AI recommendations you approved or declined, and when. The platform keeps a tamper-evident audit trail of these events for security and compliance.
• Technical information — IP address, browser and device type, and the date and time of requests, recorded in server and security logs.

When you visit our website

Our web servers record standard request information — IP address, browser type, the page requested, the referring page and the time of the request. We do not use analytics or advertising tools on the site (see section 7).

03How we use information

We use the information we collect on our own behalf to:

• respond to demo requests and enquiries, and schedule and hold demonstrations;
• create and secure user accounts, send sign-in codes, and provide, maintain and support the platform;
• send service messages, such as notifications that something in the platform needs your attention;
• detect, investigate and prevent fraud, abuse, security incidents and violations of our Terms of Use;
• keep records needed for security, auditing and compliance, and meet our legal obligations; and
• with your permission, or where the law allows, tell you about our products. You can opt out at any time.

We do not sell personal information, and we do not use it for targeted advertising.

04Customer data and health information

Customer Data can include protected health information (“PHI”) as defined by the Health Insurance Portability and Accountability Act (“HIPAA”) — for example, claimant details, injury and treatment information, work status and provider correspondence.

• Under the customer's instructions. When we process PHI for a customer that is a HIPAA covered entity or business associate, we do so as its business associate, under a Business Associate Agreement with that customer. The customer's agreement with us and that Business Associate Agreement govern how Customer Data is used and disclosed, and they prevail over this policy if the two differ.
• Only to provide the service. We use Customer Data to operate the platform for that customer, to secure it and to support it — not for our own marketing, and never to sell.
• Minimum necessary access. Within the platform, each user's access is limited by role. Protected fields are withheld on the server from people whose role does not permit them to see those fields.
• Notifications stay general. Our policy is to keep health information out of the body of emails and text messages. Those messages point you back into the platform, where access is authenticated and logged.
• Demonstrations use synthetic data. The public demonstrations of the platform run on synthetic, fictional data. They contain no real patient information.

05AI features

The platform uses AI agents to monitor claims and to prepare recommended actions — for example, a records request or a return-to-work plan — for a person to review. AI features are provided by Anthropic, whose Claude models process the relevant case information to produce each recommendation.

• Each customer controls whether AI features are enabled and how much autonomy they have. Consequential actions require a person's approval, and clinical, utilization-review, authorization, legal and settlement decisions are never automated.
• Customer Data containing PHI is sent only to AI providers that have agreed to protect it under a Business Associate Agreement.
• We do not use Customer Data to train AI models, and we do not permit our AI providers to do so.

06How we share information

We share personal information only as described here.

Service providers

We use a small number of providers to run the service. They may use the information only to provide their services to us, under contracts that require them to protect it.

Other sharing

• With our customers. Information in a customer's platform account, including audit records of user activity, is available to that customer.
• For legal reasons. When we believe in good faith that disclosure is required by law, subpoena or court order, or is necessary to protect the rights, property or safety of our users, our customers, the public or ExpeditUsPro.
• Business transfers. In connection with a merger, acquisition, financing or sale of assets, subject to this policy and to our customer agreements and Business Associate Agreements.
• With your consent or at your direction.

07Cookies and tracking

We use only the cookies needed to make the site and the platform work:

• Session cookie — keeps you signed in and remembers your session between pages.
• XSRF-TOKEN and a matching form token — protect you against cross-site request forgery.

Inside the platform, your browser's local storage remembers display preferences such as light or dark mode. That information stays on your device.

We do not use analytics, advertising, social-media or other third-party tracking cookies, pixels or scripts, and we do not track you across other websites. Because we do not sell or share personal information for targeted advertising, there is nothing to opt out of — but we treat a Global Privacy Control signal as a valid opt-out request all the same.

08Where data is stored

We store and process personal information and Customer Data in the United States. We do not transfer Customer Data outside the United States.

09Retention

• Demo requests and enquiries are kept for as long as we need them to respond and to pursue the conversation you started, and are deleted on request.
• Account information is kept while your account is active and for a reasonable period afterwards to meet security, audit and legal needs.
• Customer Data is kept for the period set out in the customer's agreement. When that agreement ends, we return or destroy it as that agreement and the Business Associate Agreement require.
• Audit records are kept for as long as required for security and compliance. Because they are tamper-evident, they are not edited after they are written.
• Server and security logs are kept for a limited period and then deleted, unless needed to investigate an incident.

10Security

We protect information with administrative, technical and physical safeguards designed for healthcare data, including:

• encrypted (HTTPS/TLS) connections to the site and the platform;
• passwordless sign-in with one-time codes, and invitation-only accounts;
• role-based access control with least-privilege permissions, enforced on the server;
• a tamper-evident audit trail of access and actions; and
• human approval of AI-prepared actions before they take effect.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your information, we will notify you, our affected customers or regulators as required by law and by our agreements.

11Your choices and rights

Wherever you live, you can ask us to:

• tell you what personal information we hold about you and give you a copy;
• correct information that is inaccurate;
• delete your information, subject to the exceptions the law allows (for example, records we must keep for security or legal reasons); and
• stop sending you marketing emails — or use the unsubscribe link in any such email.

To make a request, email contact@expeditus.app. We will confirm receipt, may need to verify your identity before acting, and will respond within the time the applicable law requires. You may use an authorized agent; we may ask for proof of their authority. We will not discriminate against you for exercising your rights.

If your request concerns Customer Data — for example, information about a workers' compensation claim — we will pass it to the customer responsible for that data and support them in responding, as our agreement with them requires. Your rights to that information under HIPAA are exercised through that organization.

12US state privacy rights

Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other states with comprehensive privacy laws may have some or all of the following rights over personal information we handle on our own behalf:

• Know and access — the categories and specific pieces of personal information we collected, where it came from, why we collected it and whom we disclosed it to;
• Correct inaccurate information;
• Delete information we collected from or about you;
• Portability — a copy in a readily usable format;
• Opt out of the sale or sharing of personal information, targeted advertising, and profiling that produces legal or similarly significant effects. We do none of these; and
• Limit the use of sensitive personal information. We use sensitive information only to provide the service you requested, as the law permits.

In the past twelve months we have collected these categories of personal information on our own behalf: identifiers (name, email address, phone number, hashed IP address); professional information (company and role); and internet activity (browser user agent, server logs and in-platform activity records). We collect them from you, from the customer that invites you, and from your device, for the purposes in section 3, and disclose them only to the service providers in section 6. We have not sold or shared personal information for targeted advertising.

Health information we process for customers under HIPAA, and information about you in your capacity as an employee or representative of a business, may be exempt from some of these laws. We will tell you if an exemption applies to your request.

Appeals. If we decline your request, you may appeal by replying to our decision or emailing contact@expeditus.app with “Privacy appeal” in the subject line. We will respond within the time the law requires. If you are not satisfied with the outcome, you may contact your state attorney general.

13Children

Our website and platform are business services for organizations. They are not directed to children, and we do not knowingly collect personal information from children under 16 on our own behalf. If you believe a child has given us personal information, contact us and we will delete it. Customer Data about any individual whose claim a customer manages is handled under that customer's agreement.

14Changes to this policy

We may update this policy as our service or the law changes. We will post the new version here and change the “Last updated” date at the top. If a change is material, we will give notice on this site or by email to our customers before it takes effect.

15Contact us

Questions about this policy or our privacy practices, and requests to exercise your rights, can be sent to: