Consumer Health Data Privacy Policy

1. Why This Policy Exists#

Prosei AI is a legal case management tool. It is not a healthcare provider, a health plan, or a health app. But legal cases routinely contain health information: a personal injury claim is built on medical records, a custody matter can involve psychological evaluations, a disability or employment case turns on diagnoses and treatment history.

When you upload those documents, we end up holding health information about you. Washington's My Health My Data Act and Nevada's SB 370 both require companies in that position to publish a separate, plain-language policy describing exactly what they do with it. This is that policy. It sits alongside our Privacy Policy, which continues to govern everything else.

It applies to every user, not only residents of Washington or Nevada. We did not think it made sense to give people in other states weaker protection over the same documents.

2. What Counts as Consumer Health Data#

Under these laws, consumer health data means information that is linked or reasonably linkable to you and that identifies your past, present, or future physical or mental health status. That is broader than most people expect. It includes:

• Conditions, diagnoses, symptoms, and diagnostic testing
• Treatment, procedures, surgeries, and medications
• Mental and behavioral health information, including counseling and evaluations
• Substance use treatment information
• Reproductive and sexual health information
• Gender-affirming care information
• Disability status and functional limitations
• Bodily functions and vital signs
• Information about your efforts to seek health care, including provider names and appointment records
• Health information a computer system infers or extracts from something that was not itself a health record

That last category matters for how our product works, and we describe it directly in section 3.1 rather than burying it.

3. What We Collect and Where It Comes From#

4. Why We Collect It and How We Use It#

One reason: to provide the service you asked us for. Concretely, we use it to:

• Store your documents and show them back to you
• Extract text so your case is searchable
• Generate summaries, timelines, key dates, and deadline reminders
• Answer your questions about your own case
• Draft legal documents that reference your records, when you ask for a draft
• Assemble filing packages and exhibits, when you choose to prepare a filing

We do not use consumer health data to advertise to you, to build a profile of you, to score you, or to train publicly available AI models.

5. Consent and How to Withdraw It#

When you create an account you are asked to consent to AI processing of your uploaded case files. That consent, plus the act of uploading a document, is what authorizes us to collect and process the health information inside it, for the purposes listed in section 4 and for nothing else.

You can withdraw that consent at any time by emailing privacy@prosei.ai. Withdrawal stops future processing. It does not by itself delete what we already hold, so if you want the data gone as well, ask us to delete it and we will treat that as a deletion request under section 9.

Withdrawing consent to AI processing will disable the features that depend on it. Your documents remain stored and downloadable.

6. Who We Share It With#

7. What We Never Do#

• We do not sell consumer health data. Not to anyone, for any consideration. Because we do not sell it, we never ask you for the signed authorization that a sale would require by law.
• We do not use it for advertising. No advertising or marketing tag runs on any page where your case documents appear. Our advertising pixel is restricted to public marketing pages, the login and signup pages, and the checkout confirmation page. It is never loaded on your dashboard or inside any case.
• We do not train public AI models on it, and our AI provider does not either.
• We do not use geofencing. We do not collect precise location data and we do not build any boundary around health care facilities.
• We do not share it with data brokers.

8. How Long We Keep It#

We keep consumer health data for as long as your account is active, because it is the substance of your case and you need it. When you delete a case or your account, we begin a 30 day grace period during which the data can still be restored if you deleted it by mistake. After that it is permanently deleted from our production systems.

Deletion is passed to our service providers so they delete their copies as well, including backups, on their own deletion schedules.

9. Your Rights#

Over your consumer health data, you have the right to:

• Know and access. Confirm whether we hold it, get a copy, and get a list of the third parties we have shared it with, with contact details for each.
• Withdraw consent to its collection and processing.
• Delete. Have it deleted from our systems and have that deletion passed on to our service providers.
• Appeal if we refuse a request. See section 11.

We will not discriminate against you for exercising any of these rights: no price change, no degraded service, no penalty.

10. How to Exercise Your Rights#

Email privacy@prosei.ai from the address on your account, and tell us what you want. You can also delete cases and export your data yourself at any time from Settings.

We respond within 45 days. If a request is genuinely complex we may take one further 45 day extension, and we will tell you within the first 45 days if that happens, along with the reason.

We may need to verify that the request really comes from you before acting on it, because the data in question is sensitive and we do not want to hand it to the wrong person.

11. If We Deny Your Request#

If we refuse to act on a request, we will tell you in writing, explain why, and give you instructions for appealing.

To appeal, reply to that decision or email privacy@prosei.aiwith the word "appeal" in the subject line. A person who was not involved in the original decision will review it, and we will respond in writing with the outcome and the reasoning.

If we deny the appeal, you may submit a complaint to the Washington State Attorney General at atg.wa.gov/file-complaint.

12. How We Protect It#

Consumer health data is encrypted in transit and at rest. Access is restricted to the account that owns it, enforced at the database rules layer rather than only in application code, so a request for someone else's documents is refused by the database itself.

Internal access by our staff is limited to the smallest number of people who need it to operate and support the service, and we offer two-factor authentication on your account, which we recommend turning on.

13. Relationship to HIPAA#

Prosei AI is not a HIPAA covered entity and is not a business associate of one. That is not a gap in our compliance: HIPAA governs providers, health plans, and clearinghouses, and it stops following your records once you hold them yourself. When you upload your own medical records to a tool you chose, HIPAA no longer applies to them.

This policy, and the laws behind it, are what protect that data instead. We say this plainly because "HIPAA compliant" is often used as marketing language by companies it does not apply to, and we would rather tell you what actually governs your information.

14. Changes to This Policy#

If we materially change how we collect, use, or share consumer health data, we will update this policy, change the effective date at the top, and notify you before the change takes effect. Where the change requires your consent, we will ask for it rather than assume it.

15. Contact#

Questions, requests, and appeals: privacy@prosei.ai

For everything outside consumer health data, see our Privacy Policy and Terms of Service.