Privacy

The paid-action-pack intake is intentionally limited. We collect a Stripe Checkout Session reference, delivery email, broad beneficiary category, plan and region selections, administrative task category, goal, priority, timing, progress, consent version, and system-generated intake ID, status, and creation time.

Stripe processes the payment and may collect payer or billing details under its own privacy terms. To prevent unpaid or misdirected requests, our server verifies the transaction directly with Stripe. This intake system retains limited transaction evidence such as Checkout Session and payment-intent identifiers, checkout email, Price and Product identifiers, amount, currency, payment state, and timestamps; it does not receive or store full payment-card numbers.

Before intake, a time-limited verification link is sent to the checkout email. The link's signed bearer stays in the URL fragment until you explicitly confirm, so it is not sent in the page request or stored in D1. The server retains an order-linked challenge, delivery state, limited provider-evidence hashes, verification/use timestamps, and an expiring browser-proof state. The browser proof is a Secure, HttpOnly, SameSite=Strict cookie; its signature is not stored in D1. An interrupted exact confirmation may return that same cookie during the original windows but cannot extend them. Refunds and disputes revoke unused proof.

For short-term checkout abuse control, the server converts the connecting network address into a secret-keyed, one-way digest and permits only one active unpaid checkout for that digest. The application does not store or log the raw address in its checkout database. The digest is retained with the checkout reservation for payment, capacity, abuse, refund, dispute, and audit handling, and access to the secret key is restricted.

The structured intake has no fields for names, phone numbers, street addresses, file uploads, SSNs, DoD IDs, beneficiary numbers, passwords, government-account credentials, medical records, diagnoses, prescriptions, symptoms, or clinical notes. Do not place those details in support messages.

Intake and transaction data is used to verify the purchase, prepare and deliver the requested pack, provide customer support, handle refunds or disputes, prevent checkout abuse, and meet accounting or legal obligations. It is not sold. Access is limited to people performing fulfillment and support. Records are retained for those operational and legal purposes; a production retention schedule must be approved before launch.

For a privacy question or data request, contact hello@tricare.com. Requests are reviewed against fulfillment, fraud-prevention, accounting, dispute, and legal retention requirements; deletion is not guaranteed.