QuoteVitalsPrivacy
The short version. Your quotes are yours. We use them to build your comparison and for nothing else. There is no advertising and no third-party analytics in the product. We never sell or trade your information, never train models on your documents, and never aggregate vendor pricing across customers. Your documents are read by Anthropic's Claude model to be extracted — that is stated in full below rather than buried.
1. What we hold
Everything below is scoped to your organization at the database level. No other customer can reach it.
- Your account — your name, email address, role and sign-in records, and how you sign in: a password you set, an emailed sign-in link, or Sign in with Google or Apple. From Google or Apple we keep only your name and email address (with Apple, that can be Apple's private relay address).
- Phone notifications — if you allow notifications in the iPhone app, that phone's notification token and its name as set on the phone. It is removed when you turn notifications off on that phone, sign out there, or delete your account.
- Lock Screen reading progress — when the iPhone app shows quotes being read on the Lock Screen, that activity's push token and which request it is for, kept until the reading ends (at most 8 hours) and removed two days later.
- Sign in with Apple token — if you sign in with Apple in the iPhone app, the token Apple issues to QuoteVitals and Apple's identifier for you, encrypted, kept only so that we can end QuoteVitals' access to your Apple Account when you delete your account.
- What you upload, or vendors send you — the vendor quotes, specifications, RFQ documents and vendors' MDS2 security disclosure forms you add, and any a vendor sends to your request's own email address or upload link, with the names, notes, corrections and approvals your team puts around them. When a vendor sends a quote that way we also keep their name and email address, the subject or company name, their cover note, and the names of the files, so your team knows who sent what. An owner can turn the request email address off; vendors then use the upload link only, and for email sent to the address anyway we record only the sender's name and address, the subject and that it was not added.
- Sign-off approvers — if your organization routes a request to people outside your team for approval (a department head, biomed, legal, finance), we keep the stage names and email addresses you set, and for each request sent for sign-off: each approver's email address, the name they typed to sign, their decision, their comment and when they answered, plus a one-way hash of their network address at that moment, used only to limit abuse of the link. Approvers need no account; their link is emailed to them and expires after 14 days. This is deleted with the request.
- Vendors you contact — the vendors your team keeps on a request to ask for a quote, typed in or suggested by a search of public vendor sites (company name, website, sales email address, the reason given and the page it came from), and the emails your team sends them from the request: requests for quote, requests to extend a quote, best-and-final requests, award notices and letters to vendors not chosen, each with its text as sent, when and by whom.
- Vendor contacts your team keeps — your organization's address book of vendor companies and the people at each (name, role, email address and phone number), filled in from requests for quote, the vendor upload link, emailed quotes and business cards, always as suggestions your team confirms. These are business contacts, not patient data, and they are kept until your team deletes them or your organization is deleted.
- Contract price lists — price lists an owner uploads from group purchasing or local agreements (catalog numbers, descriptions, prices, units and the dates in force), used only to check your own organization's quotes.
- What your team sets up — the criteria you score quotes against, the test menu and volumes for a lab reagent rental request, the capital books you build, a private calendar link each member can make for themselves, and any Slack or Microsoft Teams channel an owner connects (its webhook address and which notices it receives).
- What the product derives — extracted line items, terms, computed confidence scores, flags, the check for patient information, scorecard verdicts, price checks, cost per reportable, the vendor record, savings figures, and the total cost of ownership figures.
- Outputs — the Excel bid tab and PDF memo generated for each comparison.
- Committee packet links — when your team sends the committee packet, the memo and bid tab as built at that moment, kept in private storage for the link's 30 days (or until it is revoked or the request is deleted), the sender's email, the number of recipients, which files the link offers, and a record of each download (the file, not who downloaded it). We keep only a one-way hash of the link itself. Original quotes are not copied; they are served from your request while it exists.
- Billing — your plan and invoices. Card and bank account details are held by Stripe and never by us.
- Operational records — ordinary server logs and backups needed to run the service and restore it after a failure, and, when switched on, error reports sent to Sentry (section 4), which never contain document content, names or email addresses.
We do not ask for your hospital's address or your phone number unless you type them in somewhere.
2. No patient data
QuoteVitals handles commercial purchasing documents. It is not designed for, and must not be used for, protected health information, clinical records, or anything identifying a patient. We are not a HIPAA business associate for this product unless we have signed a business associate agreement with your organization. If something like that reaches us, tell us and we will purge it and confirm when it is done.
Each quote is checked automatically for signs of patient information when it is read, and your organization's owners are told if something is found so the file can be purged. The check keeps only the kind of detail found and where, never the detail itself. It can miss things; keeping patient data out remains your responsibility.
3. Your documents are read by an AI model
QuoteVitals extracts figures and terms using Claude, Anthropic's model, through Anthropic's commercial API. Your documents leave Fandonia's systems for the duration of that processing.
Sent to Anthropic: the document pages, the specification if attached, the relevant extracted figures and the open findings when you ask a question (an above-contract-price finding names the contract and its price for that line), the question itself, and, to score quotes or price them against a test menu, the criteria or menu your team entered. Not sent: your name, your email, your organization's name, or any other organization's material.
Vendors' MDS2 security disclosure forms are read by the same model when they arrive as a PDF, an image or a Word document. A spreadsheet form is read by our own code and is sent to the model only when that reading comes up short. Once a form is read, its answers and the vendor's notes are not sent to Anthropic. The MDS2 findings (the vendor's name, the question ids and counts, never the form's answers) travel with the request's other findings when a member asks a question about the request or uses Pulse on it. Push-back emails are built in code without a model call.
When a member asks Pulse, the helper inside the app, a question, it is sent with a summary read from the account at that moment: the member's role and the organization's plan, the names, status and counts of open requests and what needs the member's attention, and, when a request is open on screen, its quotes and findings and the names and status of its sign-off stages. It can also include vendor names and the names and roles of the contacts in your vendor address book, never a contact's email address or phone number. The organization's name, members' and approvers' names and email addresses, comments and team notes are never sent. Pulse reads only, and neither the question nor the answer is stored.
When a member presses Find vendors, the request name, the category and the team's criteria are sent to the same provider with web search on, so it can find companies that sell what the request describes; no document, price, note or person's name goes with that search. To run the search, Anthropic may pass those search terms to the web search service it uses.
Under Anthropic's commercial terms, content sent through the API is not used to train models, and Anthropic claims no rights in what we send or what comes back. As the Terms of Use say, all of it remains yours. Anthropic deletes API inputs and outputs within 30 days; content flagged for a usage-policy violation may be held longer. Fandonia does not train any model of its own on your documents and does not use one customer's documents to improve results for another. Corrections your team makes are reused only within your own organization.
4. Everyone who processes your data
Each of these companies processes your data only to deliver the part of the service named, under a written agreement with Fandonia LLC. Google, Apple and Stripe also act under their own terms and privacy policies for sign-in, notifications and payments.
| Provider | What it does | What it sees |
|---|---|---|
| Anthropic | Extraction and analysis of quotes, specs and MDS2 security disclosure forms; answers to your questions, in the product and in Pulse; the vendor search behind Find vendors | Document content and your questions, per request; for Pulse, your question and a summary read from your account, without members' or approvers' names or any email addresses; for Find vendors, only the request name, category and criteria |
| Supabase | Database, authentication, private file storage | Everything held in your account |
| Vercel | Application hosting | Requests in transit, short request logs |
| Inngest | Background jobs: extraction, rules, retention | Record identifiers, statuses, counts and names of requests and vendors; never document content or anything read from it |
| Resend | Outbound mail: invitations, notices, the committee packet email, and the emails your team sends vendors and approvers. Also receives email sent to a request's own quotes address (at quotes.quotevitals.app) and hands it to us | The messages we send (a committee packet email carries a private link, never the files) and, for a received message, the whole email with its attachments. Resend keeps email data for 30 days; we copy a received quote into your request's storage as soon as it arrives. If an owner turns the quotes address off, Resend still receives what is sent to it and we add nothing from it |
| Sign in with Google, if you choose it | Your name, email address and profile photo, at sign-in only | |
| Apple | Sign in with Apple in the iPhone app, if you choose it; delivers push notifications and the Lock Screen reading progress to iPhones; supplies the App Clip when an approver opens a sign-off link on an iPhone | Your name and email address (or Apple's private relay address) at sign-in; the notification text and the phone's notification token; for reading progress, the request's name and counts of quotes read and findings; when you delete your account after signing in with Apple, our request to revoke QuoteVitals' access |
| Expo | Passes push notifications to Apple for delivery to the iPhone app; delivers updates to the iPhone app's own code, which the app checks for each time it opens | The notification text and the phone's notification token; for updates, the phone's network address, a random identifier for that installation, the platform, app version and update channel, which update it runs, and the error text if the app's previous launch failed; never account details or document content |
| Sentry | Error reports, when switched on, so we can find and fix failures | The error, where it happened, record identifiers, and browser or device type; never document content, names or email addresses |
| Stripe | Billing and payments by card, ACH debit or bank transfer | Billing contact and card or bank account details |
If an owner connects a Slack or Microsoft Teams channel, notices naming a request, a vendor and what happened (never amounts or documents) are posted to it. That service is one your organization chose and contracts with; it is not our processor, and what it receives is held under your agreement with it.
We will email organization owners at least 30 days before adding a processor that would handle document content.
5. The documents are yours, and so is what is inside them
A vendor quote carries that vendor's pricing, discount structure and commercial terms — material they gave to your organization, not to us. We hold those documents on your behalf. In the language of privacy law you are the controller of that material and we are your processor.
We will never aggregate vendor pricing across customers into a benchmark, an index or a market report, and never show one customer's figures to another in any form, anonymized or otherwise.
Your obligations to your vendors stay yours. Where a quote is subject to a confidentiality term, that term runs between you and them, and we will help you honor it rather than stand in the way.
6. How it is protected
Files are encrypted in transit and at rest. Every record carries an organization identifier and row-level security keeps one organization's data out of another's reach. Access is limited to what is needed to operate the service. All data is stored in the United States.
We will not read your documents except under a support-access grant an owner gives in the product (for 1 to 30 days, revocable at any time, and recorded in your audit trail), or where we are compelled by law. If we ever suffer a breach affecting your files, we will tell you what happened, what was affected and what we are doing about it — promptly, in plain language, whether or not a law requires it.
7. Getting your data out, and getting rid of it
You can download the bid tab and the memo for any comparison at any time, and your original documents remain downloadable from the comparison they belong to. Deleting a comparison removes every document, extraction and flag belonging to it. Deleting your account takes effect immediately, from Settings, with no email to us. If you signed in with Apple, we also ask Apple to end QuoteVitals' access to your Apple Account. The full mechanics are on the retention and deletion page.
8. Purchases
Billing is processed by Stripe under its own terms and privacy policy. We never receive your full card or bank account numbers.
9. If you email us
We receive your email address and whatever you include in the message. We use it only to reply and to keep a record of the conversation, and we delete it on request.
10. Your rights
Privacy laws in many places give you rights to access, correct, export or delete personal information a company holds about you. The self-service tools in the product are how we honor those rights; writing to us is the fallback, not a prerequisite. We do not charge for this and we do not make it difficult.
If you are a vendor who sent a quote, or an approver who signed by link, the organization that asked you holds your information and decides what happens to it. Ask that organization first. If you write to us, we will pass your request to them and help them answer it.
11. This website
quotevitals.app is a set of static pages. It sets no cookies and loads no third-party analytics, fonts or advertising. Cloudflare, which hosts it, keeps short server logs (such as IP address and page requested) for security and reliability.
Pulse, the helper in the corner of this site, answers questions about QuoteVitals. What you type is sent to our server and to Anthropic's Claude to produce the answer, and is not stored by Fandonia; Anthropic deletes API inputs and outputs within 30 days and does not train on them. Pulse sets no cookies and keeps no record of who asked what; it stores one flag in your browser so its greeting shows once. To limit abuse, a hash of your network address is counted for an hour, and the count is deleted within two days.
12. Changes
If any of this changes we will update this page with a new effective date, and for anything material we will say so in the product. We do not make that kind of change quietly.
13. Contact
Privacy questions and data requests: privacy@quotevitals.app. General support: support@quotevitals.app. QuoteVitals is operated by Fandonia LLC; postal correspondence can be addressed care of our registered agent — please email first so we can give you the current address.