Privacy Policy

Effective 2026-09-10. This policy covers the Service Member Entitlements web app at entitlements.vet and its companion browser extension together. It does not cover any other site. If you are looking for the consumer health data notice you agree to before entering health information, see the health information notice (version 2026-09-11b), which this policy summarizes but does not replace.

What we collect

On the web app: your email address, your state of residence, and the health and service information you choose to enter into your case file (conditions and diagnoses, symptoms, treatment and provider names, service history and exposures, evidence, claims, and any documents you upload). We also hold account security material: a password-derived key salt, a stored authentication hash (not your passphrase itself), and, if you turn it on, a sealed two-factor secret.

Information about other people.Some VA forms ask you for someone else’s details, and if you answer those questions here, that answer is in your case file too. The clearest example is VA Form 21-8940, for veterans who cannot work: it asks for your former employers’ names, addresses and phone numbers, and VA then writes to those employers itself on Form 21-4192. The same form asks which hospitals and doctors treated you in the past year, the 21-4142 asks the same about the doctors and clinics who treated you, and the 21-0781a asks which officials or authorities you reported an assault to. The people involved in an event are not asked for here at all; you give VA those yourself. We hold those answers on the same terms as the rest of your case file, which is to say encrypted in your browser, unreadable to us, and only ever sent where you send it. You never have to enter them here; you can leave those questions for va.gov.

In the browser extension: the same case file and an identity block (name, date of birth, contact and mailing details, and similar fields VA forms ask for), either built directly in the extension or handed off from the web app.

We never ask for your Social Security number, your bank details, or your va.gov password, anywhere.

What is encrypted, and where

Your case file, your identity block, and any documents you upload are encrypted before they leave your browser, with a key derived from your passphrase. On the web app that ciphertext is stored with our hosting and database providers (Vercel and Neon, both in the United States); in the extension it is stored only in this browser's local storage, on this device. Neither we nor anyone else can decrypt it. We hold no copy of your passphrase and no way to recover it if you lose it, along with any recovery code you saved.

One thing about uploaded documents you should know. Each document is stored as an object at its own web address, and that address is the only thing controlling who can fetch it: our storage provider does not check who is asking. The address is unguessable, being two random identifiers plus a random suffix the store adds, and we only ever hand it to your own signed-in browser. What anyone who obtained one would get is the encrypted bytes, which are useless without your passphrase. But the address does not expire and we cannot revoke it; the only way to make it stop working is to delete the document. So treat a document address like the document: if one reaches somewhere you did not intend, through your browser history, a screenshot of a network panel, or a synced clipboard, delete that document and upload it again.

What we can read, on the web app only, is account metadata: your email address, your state of residence, when your account was created, when you last synced, how large your encrypted file is, how many documents you have, and the event names in your own activity trail (for example, that a version was saved). No health content ever appears there.

What leaves the browser, and when

Your case file leaves your browser in two ways, and only two. It is sent to our own servers as encrypted ciphertext, so that it syncs between your sessions. And, if you ask for it, it is handed to the browser extension, which happens inside your browser and never passes through us. A third thing can leave your browser, and it is not your case file: whatever you type into the Report a problem box, if you choose to use it. All three are described below. Document extraction is described below too, and only so that you can see it is switched off:

Document extraction. This feature is not available, and no part of it is running. No document you upload is sent to any artificial-intelligence provider. Documents you upload leave your browser only as ciphertext we cannot read, stored with our hosting provider like the rest of your case file. If we ever offer extraction, it will be off until you turn it on, chosen one document at a time, and this policy will say where the document goes before anyone can choose it.

Reporting a problem. The Report a problem button sends us what you type into it, and only what you type. It leaves your encrypted case file, which is the part worth being clear about: we store it on our own servers, encrypted with a key we hold rather than one only you hold, and we can read it. One thing goes with it that you did not type: the page you were on when you opened the box, which is how we know where to look. Nothing else about that page is captured, no picture of the screen and nothing out of your claim file. Your email address is stored beside the report only if you tick the box asking us to reply, which starts unticked every time. We can read what you wrote, and once we have we cannot unsee it. So tell us what went wrong in your own words, medical details and all, if that is what it takes to describe it.

What you write does not go to the company that runs our bug list. We keep our own list of bugs in Linear, and what we put there is a note: a reference number, a rough part of the site such as the claim file, the time, and whether you asked for a reply. None of your words are in it, neither is your address, and neither is the page you were on. That last one is deliberate: on a page like the one for stressor events, naming the page would say what you were there to describe, and a note in somebody else's bug list is not something we can erase later. The page stays with us, encrypted. Somebody here opens the report through this site to read it, on a page only the addresses we have listed can reach, and every opening is written down against your account. Deleting your account erases what you wrote and the page you were on, in the same step that erases the rest of it. The note does not go with it: it stays in our bug list, and deleting your account does not take it back.

Be clear about what an unticked box does and does not mean, because it would be easy to read more into it than is there. The note in our bug list names nobody. But the report itself is stored against your account, so anyone here who can open it knows whose it is, and sending one is an action on your account that we count to stop the button being hammered, so our own records show that your account sent a report and at what time. Those counting records hold no part of what you wrote, and they are erased with the rest of your account when you delete it. If you need to tell us something without it being traceable to you at all, this box is not the way; write to the address at the end of this page from an account of your choosing.

Extension hand-off. If you use the Send to extension button and have the browser extension installed, your case file and identity block are sent directly from the web page to the extension over Chrome's externally_connectable messaging channel, which only entitlements.vet can use. That transfer happens entirely inside your browser; it does not pass through our servers. The extension itself makes no network requests at all: once it has your case file, it never sends it anywhere, including back to us. See the extension's own README for its four operating rules.

Analytics

We run no analytics. There is no analytics service in this site, no tracking script, and nothing that records which pages you visit. The only record of activity is the trail described above, which is kept against your own account, holds event names and times and no health content, and which you can erase by deleting your account.

Email

We send email only for account actions you took: verifying your address, signing in, and account recovery. These emails never contain health information, and our email provider only ever sees your address and the text of these account messages.

Retention

Your encrypted case file and documents are retained until you delete your account or delete them individually. Your activity trail (the plaintext event names described above) and any problem reports you sent are retained for as long as your account exists, and no longer: deleting your account removes those rows in the same database transaction that removes the account itself. We keep nothing from your activity trail afterwards, and nothing of what you wrote in a problem report.

Your rights

You can export everything in your case file, decrypted, at any time from Settings. You can delete your account from the same page. Deleting runs as two steps in one request: your account is closed and every session signed out, and then your encrypted file, your documents, your keys and the account record are erased. It cannot be undone.

If our storage provider fails partway, the second step does not finish. The page tells you so and you press the button again there to complete it. Your account is already closed at that point and cannot be signed into again, so finish it before you leave that page; until it finishes, the encrypted bytes we cannot read are still stored. Deleting the extension's local vault (from its own Settings tab, or by uninstalling it) is separate and immediate, since that data never touches our servers at all.

Where data is processed

United States only for your case file, your documents, your account and any problem report you send, by us and by every provider that touches them. Nothing about your case file is processed anywhere else, by anyone, and no part of it is sent to an artificial-intelligence provider at all.

A problem report used to be the one exception to that, and it is not one any more. What you type into the box is stored on our own servers like everything else here; it is not sent to our bug list at all. What goes to Linear, the tool we track our own work in, is a note naming the report, and our Linear workspace stores its issues in the United States. So there is no exception to it. A report still leaves your encrypted file, and we can still read it, which is what the box tells you before you type.

Contact

Questions about this policy, or to report a security concern: security@entitlements.vet.

Disclaimer

This policy is a good-faith description of the product as it is built today. Where it differs from what the software actually does, the software is what governs your data, and we want to know: write to the address above and we will correct the page.

Service Member Entitlements is not VA accredited and does not represent you. Free help is available from accredited Veterans Service Organizations. No outcome is guaranteed.