Privacy Policy

Effective and last updated September 8, 2026

This policy explains how Cutiefi LLC ("Cutiefi," "we," "us," or "our") handles personal information when you use cutie.fi, our patient experience, our practice portal, and related services and communications.

Scope and other notices

Cutiefi provides underwriting and servicing platform services for participating medical practices. A participating practice, not Cutiefi, offers and owns any financing agreement with its patient.

This policy describes Cutiefi LLC's commercial privacy practices. It is not a HIPAA Notice of Privacy Practices. When we handle protected health information for a participating health care provider, we do so as that provider's service provider or business associate and under the provider's instructions and applicable agreement. The provider's Notice of Privacy Practices describes the provider's HIPAA duties and your HIPAA rights.

You may also receive a separate financial privacy notice when required. This policy does not replace any financial privacy notice that applies to a customer relationship. A third party's own notice governs information it handles for its independent purposes.

For disclosures specific to Washington consumer health data, read our separate Consumer Health Data Privacy Policy.

Information we collect

Information you provide

• Contact and identity information, such as your name, email address, telephone number, address, date of birth, Social Security number, account credentials, government identification, and signature.
• Application and account information, such as the requested care and amount, participating practice, application status, terms, signatures, payment and servicing history, and support requests.
• Credit and identity-risk information, such as consumer-report data, scores and score factors, tradelines, debts, inquiries, public records, estimated income and debt-to-income ratio, utilization, delinquencies, fraud or identity alerts, and sanctions-screening results.
• Bank and income information, such as financial institution, account-holder name, account type and last four digits, linked-account identifiers, balances, transaction history and descriptions, derived income and recurring outflows, manually entered routing and account numbers, and payment records.
• Documents, such as identity documents, voided checks, bank letters, signed agreements, paystubs, and other files you submit.
• Care-related information, such as the provider or practice you identify, the amount of care you want to finance, and any care or procedure context you choose to include in a message.
• Communications, including chat messages, support requests, consent choices, survey responses, and other information you send us.
• Practice information, such as a practice's name, specialty, state, professional identifiers, ownership and team information, business documents, and payout instructions.

Information from other sources

We may receive information from participating practices and their staff; a co-borrower or representative you authorize; consumer reporting agencies and resellers; identity, fraud, and business-verification providers; financial institutions and bank-data providers with your permission; public professional registries; and service providers that help us operate the services.

Information collected automatically

When you use our services, we and our service providers may collect an IP address, device and browser information, pages or features used, dates and times, referring pages, session and security identifiers, and diagnostic or error information. We use this information to operate, secure, debug, and understand the services.

AI-assisted conversations

Our conversational experience uses Anthropic as an artificial-intelligence service provider to respond, collect application information, and support account servicing. Conversation text may include provider, procedure, and financing details you enter. Enter only information requested for the financing process. Dedicated identity fields such as Social Security number and date of birth are collected through a separate form and are not inserted into the agent chat.

Stripe Financial Connections

Connecting a financial account is optional. If you choose to connect one, we use Stripe Financial Connections. In the Stripe connection flow, you can authorize access to balances, transactions, and account ownership information. Cutiefi may receive the institution and account name, account type, last four digits, ownership details, current and available balances, up to 180 days of transaction history, and information derived from those records, such as estimated income, recurring outflows, and liquidity indicators.

We retain a limited account snapshot that can include balances and transaction amounts, dates, and transaction descriptions. We do not receive your bank login credentials. Stripe and your financial institution separately process information under their own terms and privacy practices. Review Stripe's Financial Connections privacy information for details, including how to disconnect an account or make a request directly to Stripe.

Manual bank information and uploads

Stripe Financial Connections is separate from our payment setup. If you enter payment-account information manually, we collect the account-holder name, account type, routing number, and account number. If you upload a voided check, bank letter, identity document, paystub, or another file, we collect the file and the information visible in it for verification, authorized review, fraud prevention, and required recordkeeping.

How we use information

We use information to:

• provide, personalize, maintain, and support the services;
• respond to an inquiry, help locate or onboard a practice, and communicate about a request;
• process an application and support identity, income, bank-account ownership, fraud, credit, affordability, eligibility, cash-flow, and liquidity checks;
• prepare and manage agreements, service accounts on behalf of a practice, process payment instructions, and maintain transaction records;
• support practices, verify business and professional information, and administer practice accounts;
• detect, investigate, and prevent fraud, abuse, security incidents, and unlawful activity;
• audit and improve the reliability, accessibility, and performance of the services; and
• comply with law, enforce agreements, resolve disputes, and protect people, Cutiefi, practices, and the public.

How we disclose information

We may disclose information to the following categories of recipients:

• Participating or requested practices and providers. We disclose information needed to respond to your request, administer an application, prepare an agreement, and service an account. We do not give a practice your full raw credit report.
• Service providers and processors. These include providers of hosting and data storage, communications, artificial-intelligence support, identity and business verification, bank verification, credit reports, electronic signatures, security and bot protection, customer support, and error monitoring. Current material providers include Anthropic for conversation processing and iSoftpull for consumer-report access. They receive information needed to perform services for us and are subject to contractual restrictions where required.
• Stripe and financial institutions. We disclose information needed to connect an account, verify financial information, carry out your payment instructions, and reconcile transactions.
• Consumer reporting and verification providers. With a permissible purpose and any required consent, we disclose identifying information to obtain or verify credit, identity, and fraud information.
• Professional advisers and authorities. We may disclose information to auditors, insurers, lawyers, regulators, law enforcement, courts, or other parties when reasonably necessary to comply with law or protect rights and safety.
• Business transaction recipients. Information may be disclosed as part of a proposed or completed financing, merger, acquisition, reorganization, or transfer of assets, subject to appropriate safeguards.
• Recipients you direct. We disclose information when you ask us to or give us permission, including to a provider you identify.

We do not sell personal information or consumer health data. We do not disclose personal information for cross-context behavioral advertising.

Cookies and online signals

Our services use cookies and similar storage that are necessary for authentication, session continuity, preferences, bot protection, and security. We do not use advertising cookies. Services that deliver site fonts or protect and operate the site may receive ordinary request data such as an IP address and browser information.

We do not knowingly permit third parties to collect personal information through our services over time and across unrelated websites for targeted advertising.

Because there is no generally accepted standard for browser "Do Not Track" signals, our services do not respond to them. Where legally required, we treat a recognized opt-out preference signal, such as Global Privacy Control, as a request to opt out of sale or sharing. Because Cutiefi does not sell personal information or share it for cross-context behavioral advertising, such a signal does not change our current practices.

How long we keep information

We retain information for as long as reasonably necessary for the purposes described in this policy. The period depends on the type of information, whether an application or account remains active, the choices you make, and legal, regulatory, accounting, fraud-prevention, audit, and dispute-resolution requirements. When information is no longer needed, we delete it, de-identify it, or securely isolate it until deletion is possible. De-identified information may be kept where we maintain it in de-identified form.

Security

We use administrative, technical, and physical safeguards designed to protect personal information, including access controls, encryption where appropriate, monitoring, and vendor controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Your privacy choices and rights

Depending on where you live and subject to legal exceptions, you may ask us to confirm whether we handle your information; access or obtain a copy; correct inaccurate information; delete information; withdraw a consent; or appeal a decision on a privacy request. You may also unsubscribe using the link in a marketing email. We will not discriminate against you for exercising a privacy right.

Send a request to legal@cutie.fi with the subject "Privacy Request." You do not need to create an account. We may ask for information reasonably necessary to verify your identity and authority. An authorized agent may submit a request where permitted by law. We will explain if an exception prevents us from fulfilling all or part of a request.

If your request concerns information held independently by a participating practice, consumer reporting agency, financial institution, or Stripe, you may also need to contact that organization directly.

Children

Our services are not directed to children under 18, and we do not knowingly collect personal information directly from a child under 18. If you believe a child has provided information to us, contact us so we can review and address it.

Changes to this policy

We may update this policy to reflect changes in our services, practices, or legal obligations. We will post the updated policy here, change the effective date, and provide additional notice when required by law.

Contact us

For privacy questions or requests, email Cutiefi LLC at legal@cutie.fi.

Please do not send a Social Security number, bank login credential, or medical record by ordinary email.