Terms of Service

Awaiting counsel. TODO(counsel): Identify the contracting entity and each class of user — the law firm, the intake operator acting on the firm’s behalf, and the individual claimant using the portal — and say which terms apply to which.

The platform is used by three distinct populations, and they do not have the same relationship with us:

• Law firms receiving a Qualified Lead Intake Summary package
• Intake operators working leads in the agent and admin surfaces
• Individual claimants using the client portal to verify identity, give consent and connect records

Awaiting counsel. TODO(counsel): State plainly that use of this platform does not create an attorney–client relationship with us, that we do not provide legal advice, and how a claimant’s relationship with a law firm is formed instead. This section is the one most likely to be read by a regulator.

Records reach TortOS because you connect a provider yourself and authorise the request. You sign in to that provider directly — TortOS never sees or stores the credentials you use there — and the provider, not TortOS, decides what to release.

• Every scope TortOS requests is read-only. There is no request in the codebase that writes to, amends or adds anything in your medical record.
• An authorisation covers one retrieval session, not standing access. TortOS requests no long-lived refresh token, so a connection cannot quietly keep pulling records later.
• Because of that, refreshing your records means connecting again. You will be asked each time.
• What is retrieved is the record the provider releases for the categories you approved, including records that provider received from other health systems.

Awaiting counsel. TODO(counsel): State what TortOS undertakes with respect to the accuracy and completeness of retrieved records, and disclaim any obligation to obtain records a provider declines to release.

The same notice shown in the footer of every page applies as a term of this agreement:

REQUEST-ONLY RECORDS ACCESS: TortOS does not provide bidirectional exchange. You can use TortOS to request a copy of your own health information from the providers you connect. You cannot use TortOS to send your health information to other organisations, and TortOS never answers another organisation’s request for your records. Records reach the law firm you have retained only because you separately authorise that disclosure, and you can withdraw that authorisation at any time.

Retrieved records are visible to TortOS staff working your intake, and are disclosed to the law firm you have retained. That disclosure is a separate, per-firm authorisation recorded against your file — connecting a provider does not by itself send anything to a firm, and authorising one firm does not authorise another.

TortOS does not sell your health information, use it for advertising, or use it to train models. The vendors that process data on our behalf are named in the Sub-processor Register, which is generated from configuration rather than maintained by hand.

You can withdraw a records authorisation from the portal. Withdrawal stops further retrieval immediately and takes effect going forward; it does not by itself erase records already delivered to a law firm, which are then held under that firm’s own obligations to you.

Awaiting counsel. TODO(counsel): Confirm the effect of withdrawal on records already disclosed to a firm, and on records subject to a legal hold — the deletion workflow can end in a blocked-by-law state, and this section must describe that outcome accurately rather than promising erasure that cannot be delivered.

There is no charge to you for connecting a provider, for retrieval, or for obtaining a copy of what TortOS holds about you.

Awaiting counsel. TODO(counsel): Determine and state whether TortOS is a Business Associate of any firm it serves. This turns on the actual signed contracts and on the source of each record; it is not answerable from the codebase, and stating it wrongly is worse than leaving it open. Until it is settled, this page makes no claim of Covered Entity or Business Associate status, and none should be added elsewhere on the site.

TortOS makes no claim to be a QHIN, a Participant, a Subparticipant, or a provider of Individual Access Services under TEFCA. Any code path that would require such a position is disabled in this build.

Awaiting counsel. TODO(counsel): Set out prohibited uses, including any restriction on submitting information about a person who has not authorised the submission.

Staff accounts use email sign-in with an idle session timeout and device binding for privileged roles. Claimant portal accounts use phone verification with a second factor; a static PIN is never sufficient on its own.

Awaiting counsel. TODO(counsel): Describe the user’s obligations for credential security and the consequences of shared or compromised accounts.

Awaiting counsel. TODO(counsel): Describe the commercial terms for firm and operator customers, or state that they are governed solely by a separate signed order form.

Awaiting counsel. TODO(counsel): Address ownership of case files and packages, the treatment of attorney work product, and what happens to data on termination.

Awaiting counsel. TODO(counsel): Draft the warranty disclaimer and liability cap, and confirm they are enforceable in every jurisdiction where the platform is offered.

Awaiting counsel. TODO(counsel): Choose the governing law and forum, and decide expressly whether an arbitration clause or class waiver is used — that decision interacts with the private right of action under WA MHMDA and with CIPA claims, so it is not a boilerplate choice.

Awaiting counsel. TODO(counsel): State how changes are notified and when they take effect. Material changes are versioned alongside the notice version shown at the top of this page.