Privacy Notice

Awaiting counsel. TODO(counsel): Identify the publishing entity, the surfaces this notice covers (marketing site, client portal, agent and admin surfaces), and the relationship between this notice and any firm-specific engagement terms.

Information about an injury, condition, medication or treatment is disclosed in a separate document with its own homepage link. This notice does not restate it and does not replace it.

Consumer Health Data Privacy Policy

Awaiting counsel. TODO(counsel): Describe each category of personal information, its source and the purpose it is used for. The engineering source of truth is the data inventory atcompliance/data-inventory.yaml; this section must agree with it and must be regenerated from it once the inventory carries published categories.

Broadly, the platform handles:

• Identity information used to verify that a person is who they say they are
• Contact information used to reach a claimant about their own matter
• Case information describing an incident and its consequences
• Medical records retrieved only with the individual’s authorisation
• Operational metadata — audit entries, request logs, consent records

Vendors that process data on our behalf are named in the sub-processor register, which is published rather than summarised. 7 vendors are listed there; 3 of them may receive consumer health data.

Sub-processor Register

Awaiting counsel. TODO(counsel): Describe each category of recipient beyond sub-processors, including the law firm a claimant has authorised and any compelled disclosure.

Choices that are live in this build:

• Tracking technologies are off until switched on. Change any choice at any time from the privacy control on this site.
• A Global Privacy Control signal is honoured as an opt-out, and suppresses every non-essential technology.
• 12 states are configured as requiring a universal opt-out mechanism.
• Signed-in claimants can withdraw consent from Settings → Privacy in the client portal.
• Requests by email: privacy@tortos.ai. Identity verification is required before we act on a request.

Awaiting counsel. TODO(counsel): State the statutory rights available by jurisdiction (access, deletion, correction, portability, appeal), the response deadlines, and the appeal route. Note that a legal hold can lawfully block a deletion request and that the individual is told when it does.

Awaiting counsel. TODO(counsel): State the retention period for each class of record and the event that starts the clock. Retention classes are defined in the data inventory.

Awaiting counsel. TODO(counsel): State the position on information about minors, including intake flows where a parent or guardian supplies information on a minor’s behalf.

Awaiting counsel. TODO(counsel): Name the accountable privacy owner and give the postal address, email address and, where required, the EU/UK representative.