Privacy Policy
Last updated: October 18, 2026
This policy explains how PMLabs ("we") handles information on this website and in the internal tools we operate, including MedRefund, a private utility used by the PMLabs owner and family members to organize their own medical receipts for insurance reimbursement. MedRefund is not offered to the public.
This website
pmlabs.studio is a static website. It does not use cookies, analytics, or forms, and it does not collect personal information. Our hosting provider (Cloudflare) may process standard technical data, such as IP addresses, to deliver and protect the site.
MedRefund: Google user data we access
MedRefund only accesses the Google accounts of people who explicitly authorize it, and only with these permissions:
- Gmail, read-only (
gmail.readonly): to find emails from medical providers configured by the user and download their receipt attachments (PDF and invoice XML). MedRefund cannot send, delete, or modify email. - Google Sheets (
spreadsheets): to write a receipt tracker to a spreadsheet owned by the user and read back the user's corrections.
How the data is used
- Receipts are processed to extract the provider, patient name, service description, date, amount, and invoice number, solely to prepare the user's own insurance reimbursement claims.
- Downloaded receipts and extracted data are stored only on the user's own computer, with access restricted to that user, and in the user's own Google Sheet.
- To read receipts, their content is sent to the Google Gemini API (on a paid tier, under which Google does not use the content to improve its products). No other third party receives the data.
- MedRefund never sends email on the user's behalf. Claims are sent to insurers manually by the user.
What we do not do
- We do not sell, rent, or share Google user data.
- We do not use Google user data for advertising, profiling, or credit decisions.
- We do not use Google user data to train AI or machine-learning models.
- No person other than the authorizing user reads the data.
MedRefund's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Retention, deletion and revoking access
- Data is kept for as long as it is needed for reimbursement records, and the user can delete it at any time by removing the local data folder and the spreadsheet.
- Access can be revoked at any time at myaccount.google.com/permissions. After that, MedRefund can no longer access the account.
Security
Access tokens and data are stored locally with owner-only file permissions. Connections to Google services use encrypted HTTPS.
Changes
If this policy changes, we will update this page and its date.
Contact
Questions about this policy: [email protected]