Last updated: July 24, 2026
This policy explains what information State Rates Health, LLC ("State Rates," "we," "us") collects when you use our website (staterates.health) and API (api.staterates.health), how we use it, and the choices you have. It applies only to data collected through those services — not to information you provide to us offline or through a third-party site we link to.
By using the service you agree to this policy. If you don't, please don't use the service.
Information you give us when you sign up or request access. To create an account or receive an API key, we collect your email address, name, and the name of the organization you represent. Accounts are provisioned by us manually — there is no self-serve sign-up.
Information about how you use the product. We record that a request happened — which endpoint you called, for which state, when, whether it succeeded, and how long it took — along with which pages you visit. When you are signed in, this is tied to your account. When you are signed out, it is tied only to the random identifier described under Cookies below — we know that someone looked up a rate in Texas, not who. We use this to understand which parts of the product people use, to bill usage, and to improve the service.
We do not store the content of your requests. The values you submit — procedure codes, provider identifiers, dates of service, patient age indicators — are used to compute your result and are then discarded. They are not written to our databases, our server logs, or our error tracking.
Automatic technical information. When you visit the website or call the API, our servers log the request — including the IP address, the endpoint called, and the time of the request. For API traffic, we associate the request with your API key identifier so we can enforce rate limits and quotas. We do not log request headers or the raw API key itself.
Error and diagnostic data. When something in the product errors out, we collect a record of the error (stack trace, request path, user identifier) through our error-monitoring provider so we can fix it. Secrets, API keys, and authorization headers are stripped before this data leaves our servers, as are the values you submitted — query strings, request bodies, and the variables held in memory at the point of failure. We do not record browser sessions.
Cookies. We use three first-party cookies: a session cookie set by our authentication provider (Auth0) to keep you signed in; a counter that tracks how many free lookups you have used; and a randomly generated identifier that lets us count visitors and see how the site is used. That identifier is a random value — it is not derived from your name, email, or device, and it tells us nothing about who you are. Clearing your cookies resets all three. We do not use cookies for advertising or cross-site tracking, and we do not load third-party analytics or advertising scripts.
We do not sell your personal information, and we do not use it for advertising.
We share your information only in these situations:
We do not share, sell, rent, or trade your personal information with third parties for their own marketing purposes.
Aggregated or de-identified information that cannot reasonably be used to identify you may be shared without restriction.
We retain your personal information for as long as we need it to provide the service, comply with our legal obligations, resolve disputes, and enforce our agreements. When data is no longer needed for these purposes, we delete or anonymize it. Usage and diagnostic data is generally retained for shorter periods than account information, except where we need it longer to maintain the security or functionality of the service.
We will respond to verified requests within 30 days.
We take reasonable administrative and technical measures to protect your information, including encrypted connections (HTTPS), hashed storage of API keys, and scrubbing of secrets from error logs. No system is perfectly secure, and we cannot guarantee that unauthorized access will never occur. You are responsible for keeping your account credentials and API keys confidential.
Our website may contain links to third-party sites. This policy does not apply to those sites, and we are not responsible for their privacy practices. We encourage you to review the privacy policy of any site you visit.
Our service is intended for business use and is not directed to children under 13. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us and we will delete it.
We may update this policy from time to time. When we do, we will revise the "Last updated" date at the top. For material changes, we will notify account holders by email or through the service.
If you have questions about this policy or our privacy practices, email us at [email protected].