# [Data Handling](https://trymumm.com/trust/data-handling)

_Last updated: 2026-09-10_

## Document storage

Uploaded documents are encrypted at rest and accessible to authorized accounts and service operations. You can download or delete your documents at any time.

## Voice recordings

- Calls placed on your behalf are recorded for quality and dispute resolution
- Stored encrypted
- Accessible to you and authorized Mumm staff for service and support
- You can request deletion any time after the negotiation closes
- Recording retention follows our seven-year policy. Contact privacy@mumm.com for a deletion request or retention inquiry.

## Email communications

Emails sent on your behalf and seller replies are linked to your negotiation. Messages are encrypted, access-controlled and retained for seven years after the negotiation closes.

## Protected health information (PHI)

- We handle PHI under HIPAA where applicable
- Medical documents and negotiation information use the access-controlled storage described above
- Access is restricted to the account and authorized service operations
- Processing protected health information requires applicable contractual coverage with the services involved
- We do not use PHI for analytics, marketing, or model training
- We do not share PHI with any third party except the merchant of the bill itself or with your explicit consent

## Payment data

Stripe processes card payments. We store payment references rather than card numbers or unencrypted bank account details.

## Analytics & telemetry

- We use PostHog for product analytics
- Product events include event names, properties and identifiers according to your analytics preferences
- PostHog processes browser and request information, including IP addresses; account identifiers can connect product activity to a signed-in user
- You can opt out of all non-essential analytics in your account settings

## Third-party sub-processors

Providers, their processing purposes and the advance-notice process are listed at /trust/sub-processors.

## Data export & deletion

- Request a data export in account settings or by emailing privacy@mumm.com. We provide the information covered by your request in a portable format.
- Request account deletion in account settings or by emailing privacy@mumm.com. Our deletion window is 30 days, with records retained where required for legal or financial obligations.
- Specific deletion requests (single document, single negotiation): contact privacy@mumm.com