Privacy & Legal

This Data Processing Addendum applies when a ClaimScan Pro, firm, professional, or business customer uses ClaimScan under an order form, workspace agreement, pilot agreement, or other written agreement that incorporates this DPA.

For customer personal data processed on behalf of the customer, the customer is the controller or business, and ClaimScan is the processor, service provider, or contractor as those terms are used in applicable privacy laws. ClaimScan remains an independent controller for account administration, security, billing, product analytics, compliance, and service operations.

ClaimScan will process customer personal data only to provide the service, comply with documented customer instructions, maintain security, prevent abuse, support users, comply with law, and perform other processing permitted by the agreement.

The customer instructs ClaimScan to process customer personal data for scanner workflows, evidence preservation, source matching, OCR, AI-assisted extraction where enabled, saved searches, exports, attorney-review triage, candidate workflows, issue analytics, and support operations selected by the customer.

• The customer must have a lawful basis, notices, permissions, and consents needed to submit customer personal data to ClaimScan.
• The customer must not submit prohibited, unlawfully obtained, or unnecessary sensitive information.
• The customer must configure workspace access, exports, and user roles appropriately.
• The customer remains responsible for legal, professional, attorney advertising, conflicts, confidentiality, privilege, retention, and client-communication obligations that apply to the customer.

ClaimScan will maintain reasonable administrative, technical, and organizational measures designed to protect customer personal data against unauthorized access, disclosure, alteration, and destruction.

Personnel and contractors with access to customer personal data must be bound by confidentiality obligations. Access is limited based on role and operational need.

Customer authorizes ClaimScan to use subprocessors for hosting, database, object storage, authentication, email, logging, analytics, security, OCR, AI model access, customer support, and infrastructure operations.

ClaimScan will impose written obligations on subprocessors designed to protect customer personal data at a level materially consistent with this DPA. ClaimScan remains responsible for subprocessor performance as required by applicable law and the agreement.

• Current functional categories include cloud hosting, serverless compute, private blob storage, database hosting, authentication, AI Gateway or model routing, OCR or document extraction, email delivery, logging, monitoring, and security tooling.
• ClaimScan will provide subprocessor information on request or through the Legal Center when a public list is maintained.

ClaimScan is not designed to receive regulated health information, children's information, financial account credentials, Social Security numbers, government ID images, or attorney-client privileged materials unless the agreement expressly authorizes that data type and the customer has implemented appropriate controls.

ClaimScan does not agree to act as a HIPAA business associate unless a separate business associate agreement is signed by ClaimScan.

If AI-assisted extraction or classification is enabled, ClaimScan may route selected text, images, metadata, or derived facts to AI Gateway, model, or OCR providers for the limited purpose of providing the service. ClaimScan will record model identifiers and prompt versions where feasible.

Customer should not use AI output as legal advice or as the sole basis for decisions that produce legal or similarly significant effects. Human review is required for attorney-review, candidate routing, and public publication decisions.

Taking into account the nature of the processing and information available to ClaimScan, ClaimScan will provide reasonable assistance for verified access, deletion, correction, portability, opt-out, and similar privacy requests that relate to customer personal data.

If ClaimScan receives a request directly from an individual concerning customer personal data, ClaimScan may direct the individual to the customer unless applicable law requires another response.

ClaimScan will notify the customer without undue delay after confirming a security incident affecting customer personal data, unless legally prohibited. The notice will describe known facts, affected data categories, mitigation steps, and available support information where feasible.

Upon termination or written request, ClaimScan will delete or return customer personal data within a reasonable period unless retention is required for legal, security, audit, backup, dispute, fraud-prevention, professional, or platform-integrity purposes.

Backup and log deletion may occur on ordinary lifecycle schedules. Aggregated or anonymized data that no longer identifies an individual may be retained.

ClaimScan will make available reasonable information needed to demonstrate compliance with this DPA. Audits must be limited to once per year unless required by a confirmed security incident or law, must avoid disruption, and must protect ClaimScan confidential information and other customers' data.

If international transfer restrictions apply, the parties will use a lawful transfer mechanism appropriate to the data and jurisdiction, such as standard contractual clauses or another recognized mechanism where required.

If this DPA conflicts with the Terms or an order form regarding customer personal data processing, this DPA controls for that processing unless the later-signed agreement expressly states otherwise.