Privacy Policy

1. Information We Collect

We collect the following categories of information in connection with your use of the Platform:

1.1 User Account Data

• Full name, email address, phone number, and profile photo
• Bar admissions (state and bar number), office location, job title
• Years in practice, practice areas, law school, biography
• Timezone and notification preferences
• Account credentials (managed via Clerk; we do not store raw passwords)

1.2 Case and Matter Data

• Case names, matter numbers, parties, incident dates, and case statuses
• Insurance information and policy details
• Defense counsel information
• Settlement amounts and yield data
• Case timelines and complete audit trails of all case activity

1.3 Contact Data

• Names, phone numbers, email addresses, and mailing addresses
• Company affiliations and business relationships
• License numbers and bar admissions for attorney contacts
• Notes and custom relationship fields

1.4 Medical and Health Data (Protected Health Information)

When law firms use the Platform to manage personal injury cases, the Platform may process Protected Health Information (PHI) on behalf of the firm, including:

• Medical provider names and facility information
• Treatment dates, types, and medical conditions
• Diagnoses and clinical findings
• Medical record documents (uploaded by Users)
• Medical charges and billing codes
• Health insurance information and coverage details

PHI is handled in accordance with Section 9 of this Privacy Policy. If your Firm is a Covered Entity or Business Associate under HIPAA, a Business Associate Agreement (BAA) is required — please contact us at support@inTrial.com.

1.5 Financial Data

• Case expense amounts and categories
• Receipt images uploaded for expense tracking
• Settlement amounts and payment records
• Check images submitted for AI check analysis
• Fee arrangements and billing records

Payment card data is processed directly by Stripe. We do not store raw payment card numbers.

1.6 Communication Data

• Internal chat messages, direct messages, and channel communications
• Email content and attachments synced from Gmail and Outlook via OAuth
• SMS/MMS messages sent and received via Telnyx integration
• Fax documents sent and received via Telnyx integration
• Message timestamps, read receipts, reactions, and file attachments

1.7 Legal Documents and Work Product

• Uploaded legal documents (PDFs, Word, Excel, PowerPoint, images, videos)
• AI-generated and attorney-finalized demand letters and pleadings
• OCR-extracted text from documents
• E-signature records and signed documents
• Deposition transcripts and video recordings
• Discovery materials (interrogatories, requests for admission, document productions)

1.8 Intake and Lead Data

• Prospective client names, email addresses, and phone numbers
• Intake form responses (including conditional logic responses)
• Lead source attribution data
• Documents uploaded by prospective clients through intake portals

1.9 Audit and Administrative Data

• Complete audit logs of all user actions and Platform activity
• File access logs and download records
• API usage logs
• Role assignments and permission records
• Account configuration and settings data

1.10 Technical and Usage Data

• IP addresses, browser type and version, operating system
• Device identifiers
• Pages visited, features used, and interaction data (collected via Mixpanel)
• Access timestamps and session durations
• Error logs (collected via Sentry)

2. How We Collect Information

2.1 Directly from You

We collect information directly when you: create an account, enter case or contact data, upload documents, send messages, submit intake forms, configure settings, or contact our support team.

2.2 Automatically

We automatically collect technical and usage data through log files, cookies, and similar tracking technologies when you access and use the Platform. This includes IP addresses, browser data, usage patterns, and performance data. Mixpanel is used to collect product analytics. See Section 7 for details on cookies and tracking.

2.3 From Third-Party Integrations

When you connect third-party services (Gmail, Outlook, Google Calendar, QuickBooks Online, OneDrive), we receive data from those services in accordance with the OAuth permissions you grant. We collect only the data necessary to provide the relevant integration features.

2.4 Outbound Connections You Authorize (MCP Connector)

The Platform offers an optional Model Context Protocol (MCP) connector that lets you connect inTrial Manage as a data source to AI assistants such as Anthropic's Claude. Unlike the integrations above (where data flows into the Platform), the MCP connector allows an authorized external AI client to access your Platform data on your behalf. When you connect it, you authenticate through OAuth and grant the client access to read — and, depending on the scope you approve, create or modify — your Firm's case data, contacts, tasks, documents, and related records. The connector operates strictly within the organization and permission scope of the connecting User; it cannot access data belonging to other Firms. This connection is optional, User-initiated, and may be revoked at any time. See Section 4 for how data is handled once transmitted to Anthropic.

2.5 From External Parties

We may receive information about prospective clients through intake forms submitted externally, expert portals, and upload portals configured by your Firm.

2.6 Google Workspace Data — Limited Use

inTrial Manage connects to Google Workspace (Gmail and Google Calendar) with your authorization. The use and transfer of raw or derived user data received from Google Workspace APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. How We Use the Information We Collect

We use the information we collect for the following purposes:

• Platform Operation: To provide, operate, maintain, and improve all features of the Platform, including case management, document management, communications, and reporting.
• AI Features: To process documents and data through AI-powered features, including document analysis, drafting assistance, deadline extraction, and data classification, as further described in Section 4.
• Account Management: To create and manage user accounts, process subscriptions, and provide customer support.
• Billing: To process payments, manage subscriptions, and detect fraudulent transactions, in coordination with Stripe.
• Communications: To send service-related notifications, security alerts, billing notices, and administrative communications.
• Security and Compliance: To monitor for unauthorized access, detect and prevent fraud, maintain audit trails, and comply with legal obligations.
• Analytics and Improvement: To understand how the Platform is used and to develop new features and improve existing functionality (using anonymized and aggregated data where possible).
• Legal Obligations: To comply with applicable law, respond to legal process, or protect the rights and safety of Company, Users, or third parties.

4. AI Data Processing Disclosure

4.1 Transmission to Anthropic

The Platform uses AI features powered by Anthropic's Claude API. When you use AI-powered features, the following types of Client Data may be transmitted to Anthropic, Inc. for processing:

• Legal documents (demand letters, pleadings, discovery materials) — for AI Document Drafting
• Medical records and documents — for AI Medical Document Analysis
• Deposition transcripts — for AI Deposition Analysis
• Fax documents — for AI Fax Analysis
• Receipt images — for AI Expense Analysis
• Case data and context — for AI Case Assistant queries
• Contact information — for AI Contact Classification

4.2 Nature of Processing by Anthropic

Data transmitted to Anthropic is processed in accordance with Anthropic's API Terms of Service and Privacy Policy. By default, Anthropic does not use API-submitted data to train its models. We have implemented contractual protections with Anthropic to limit the use of Client Data. However, you should review Anthropic's current API data use policies, available at anthropic.com, before enabling AI Features.

4.3 User Consent and Control

AI Features are optional and user-initiated. You may choose not to use AI Features if you do not wish Client Data to be transmitted to Anthropic. Disabling specific AI Features can be done through account settings or by contacting support@inTrial.com.

4.4 Attorney Responsibility

As noted in the Terms and Conditions, all AI outputs are assistive only. Attorneys remain solely responsible for reviewing and approving all AI-generated content before use. Transmitting privileged or confidential information to Anthropic's API is subject to the same professional responsibility considerations as any other use of third-party services for legal work.

4.5 MCP Connector Data Access

If you enable the optional MCP connector described in Section 2.4, the AI assistant you connect (e.g., Anthropic's Claude) accesses your Platform data over an authenticated, organization-scoped connection in order to answer your prompts. The specific data accessed depends on what you ask the assistant to do and the permissions of the connecting User — for example, retrieving case details, searching documents, listing tasks, or, where you approve write access, creating or updating records. Data accessed through the connector is transmitted to and processed by Anthropic under the same terms and protections described in Sections 4.2 and 6.2; by default, Anthropic does not use this data to train its models. Because you control which prompts you send and which assistant you connect, you should apply the same professional-responsibility judgment described in Section 4.4 before exposing privileged or confidential matter to a connected assistant. You can disconnect the connector or revoke its access at any time through the connected assistant or by contacting support@inTrial.com.

5. Legal Basis for Processing

We process personal data on the following legal bases:

• Contractual Necessity: Processing necessary to provide the Platform under our Terms and Conditions (e.g., account management, case data storage, billing).
• Legitimate Interests: Processing for security monitoring, fraud prevention, platform improvement, and analytics, where such interests are not overridden by your rights.
• Legal Obligation: Processing required by applicable law, including audit trail retention and responses to legal process.
• Consent: Where we rely on consent (e.g., for AI Feature processing, optional analytics), you may withdraw consent at any time without affecting the lawfulness of prior processing.

For Users subject to GDPR or other data protection frameworks, additional rights and obligations may apply. See Section 15 for international data transfer disclosures.

6. Data Sharing with Third Parties

6.1 We Do Not Sell Your Data

We do not sell, rent, or trade your personal information or Client Data to third parties for their marketing or commercial purposes.

6.2 Service Providers and Sub-Processors

We share data with the following categories of service providers who process data on our behalf under appropriate contractual obligations:

• Anthropic (Claude API): AI processing of documents and case data for AI Features. Data transmitted for API-based analysis.
• Clerk: User authentication, SSO, and MFA. User identity and credential management.
• Stripe: Payment processing and subscription management. Billing and payment data.
• Telnyx: SMS/MMS and fax delivery. Phone numbers, message content, and fax documents.
• Google (Gmail API, Calendar API): Email and calendar sync. Email content, attachments, and calendar events (when authorized by User).
• Microsoft (Outlook, Calendar): Email and calendar sync. Email content, attachments, and calendar events (when authorized by User).
• Cloudflare R2 / AWS S3: Cloud storage for uploaded documents and generated files.
• AWS Textract: OCR and text extraction from documents.
• QuickBooks Online: Accounting and expense synchronization. Expense and financial data (when authorized by User).
• OneDrive: File synchronization. Documents and files (when authorized by User).
• Resend: Transactional email delivery. Email addresses and message content.
• Sentry: Error monitoring. Error logs and technical diagnostics (anonymized where possible).
• Mixpanel: Product analytics. Usage behavior and interaction data (see Section 7).
• Axiom: Log aggregation. System and API logs.

6.3 Legal Disclosures

We may disclose information if required by law, subpoena, court order, or other governmental or legal process, or if we believe disclosure is necessary to: (a) comply with applicable law; (b) protect the rights, property, or safety of Company, Users, or the public; or (c) detect, investigate, or prevent fraud or security incidents. Where legally permitted, we will notify you before disclosing your information.

6.4 Business Transfers

In connection with a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of the transaction. We will notify you by email or Platform notice before your information becomes subject to a materially different privacy policy.

6.5 With Your Consent

We may share information in other ways with your explicit prior consent.

7. Cookies and Tracking Technologies

7.1 Types of Cookies Used

• Session Cookies: Used to authenticate Users and maintain login sessions. These are essential for Platform operation.
• Preference Cookies: Used to remember your settings and preferences.
• Analytics Cookies (Mixpanel): We use Mixpanel to collect data about how the Platform is used, including feature usage, navigation patterns, and session data. Mixpanel may set cookies or use other tracking technologies. Data collected by Mixpanel is subject to Mixpanel's Privacy Policy.

7.2 Managing Cookies

You may configure your browser to reject cookies. However, disabling essential session cookies will prevent you from accessing the Platform. You may opt out of Mixpanel analytics tracking by contacting us at support@inTrial.com.

8. Data Retention Practices

8.1 Active Accounts

We retain Client Data for the duration of your active subscription plus a reasonable post-termination period to facilitate data export and comply with legal obligations.

8.2 Post-Termination

Following the thirty (30) day post-termination data export period, Client Data is deleted from production systems within a commercially reasonable time. Backup copies may be retained for up to ninety (90) days.

8.3 Special Categories

• E-Signature Audit Trails: Retained as required by the E-SIGN Act and applicable state law, typically for the duration of the signed document's legal relevance.
• Communication Records (SMS, Fax): Retained for the period necessary to provide the communication features and as may be required for legal or regulatory purposes.
• Audit Logs: System audit logs may be retained for up to two (2) years for security and compliance purposes.
• Billing Records: Retained for a minimum of seven (7) years for tax and accounting purposes.

8.4 Legal Hold

Notwithstanding the above, we may retain data longer if required by applicable law, court order, or if necessary to resolve a pending dispute or enforce our agreements.

9. HIPAA Considerations and Protected Health Information

9.1 PHI on the Platform

Personal injury law firms using the Platform may upload, store, and process Protected Health Information (PHI) as defined under the Health Insurance Portability and Accountability Act of 1996 (HIPAA), including medical records, treatment information, and health insurance data related to their clients' cases.

9.2 Business Associate Agreement

If your Firm is a Covered Entity or Business Associate under HIPAA and uses the Platform to store or process PHI, a Business Associate Agreement (BAA) with inTrial, LLC is required before uploading any PHI. To obtain a BAA, please contact us at support@inTrial.com. Do not upload PHI to the Platform until a BAA is executed.

9.3 Company's Role

To the extent we process PHI on behalf of a law firm subject to HIPAA, we act as a Business Associate. We will handle PHI in accordance with the executed BAA and applicable HIPAA regulations.

9.4 Attorney-Client Privilege and PHI

PHI shared with a law firm for purposes of legal representation may be subject to both HIPAA protections and attorney-client privilege. Firms remain responsible for their own HIPAA compliance obligations and for ensuring that PHI is handled in accordance with applicable law and applicable authorizations or exceptions.

10. Data Security

We implement industry-standard technical and organizational measures to protect Client Data against unauthorized access, disclosure, alteration, and destruction, including:

• HTTPS/TLS encryption for all data in transit
• Encryption of sensitive data at rest
• Role-based access control (RBAC) with 11+ distinct permission roles
• Organization-level data isolation
• Multi-factor authentication (MFA) support
• OAuth-based third-party authentication
• Time-limited presigned URLs for file access
• Webhook signature verification
• API rate limiting
• Complete audit trails for all user activity
• Regular security monitoring and vulnerability assessment

No security measure is infallible. We cannot guarantee absolute security of data transmitted over the internet or stored in our systems. You are responsible for maintaining the security of your account credentials and implementing appropriate security practices within your Firm.

11. Your Rights Regarding Your Data

Subject to applicable law, you have the following rights with respect to your personal information and Client Data:

• Access: You may request a copy of the personal information we hold about you.
• Correction: You may update or correct inaccurate account information directly within the Platform or by contacting us.
• Deletion: You may request deletion of your personal information or Client Data, subject to our legal retention obligations. Account closure initiates the data deletion process described in Section 8.
• Data Portability: You may export Client Data from the Platform in standard formats during your Subscription Term, as described in Section 10 of the Terms.
• Objection: You may object to certain processing activities, including direct marketing or processing based on legitimate interests.
• Restriction: In certain circumstances, you may request that we restrict processing of your personal information.
• Withdrawal of Consent: Where processing is based on consent (including for AI Features), you may withdraw consent at any time.

To exercise any of the above rights, please contact us at support@inTrial.com. We will respond to verified requests within a reasonable time period and in accordance with applicable law.

12. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights:

• Right to Know: You have the right to know the categories and specific pieces of personal information we collect, the sources of collection, the purposes for which we use it, and the categories of third parties with whom we share it.
• Right to Delete: You have the right to request deletion of personal information we have collected about you, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: We do not sell or share personal information as those terms are defined under the CCPA/CPRA.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information (including health data) for purposes other than those permitted under the CCPA/CPRA.
• Non-Discrimination: We will not discriminate against you for exercising your California privacy rights.

To exercise your California privacy rights, please contact us at support@inTrial.com. We do not discriminate based on the exercise of these rights.

13. Children's Privacy

The Platform is designed for and intended solely for use by licensed legal professionals and their authorized staff. The Platform is not directed to individuals under the age of 18. We do not knowingly collect personal information from anyone under the age of 18. If you become aware that a minor has provided personal information through the Platform, please contact us at support@inTrial.com and we will take steps to delete such information.

14. Confidentiality of Legal Information

We acknowledge that Client Data processed through the Platform may include attorney-client privileged communications, attorney work product, and other legally protected confidential information. We are committed to treating all Client Data with the highest level of confidentiality. Our access to Client Data is limited to what is necessary to provide the Platform, and all employees and contractors with access are bound by confidentiality obligations. However, we are not a law firm and cannot guarantee that information processed through third-party integrations (including AI features) is protected by attorney-client privilege. Firms are responsible for conducting their own privilege analysis when using third-party technology services.

15. International Data Transfers

The Platform is operated in the United States. If you access the Platform from outside the United States, your data will be transferred to, stored in, and processed in the United States, where data protection laws may differ from those in your jurisdiction.

To the extent we transfer personal data from the European Economic Area (EEA), United Kingdom, or Switzerland to the United States or other countries not recognized as providing an adequate level of data protection, we rely on appropriate safeguards, including Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms.

For inquiries regarding international data transfers or to request a copy of applicable transfer safeguards, please contact us at support@inTrial.com.

16. Data Breach Notification

In the event of a security incident or data breach affecting your Client Data, we will:

• Conduct a prompt investigation to assess the scope and nature of the incident;
• Notify affected Clients without undue delay and, where required by applicable law, within the timeframes specified by such law (e.g., within 72 hours under GDPR, or within applicable U.S. state data breach notification law timeframes);
• Provide notification including the nature of the breach, categories of data affected, likely consequences, and steps taken or planned to address the breach;
• Cooperate with your breach notification obligations to affected individuals, including your clients, to the extent we are able.

You are responsible for your own breach notification obligations to your clients, applicable bar authorities, and regulatory agencies. We will provide reasonable assistance to facilitate your compliance.

17. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time to reflect changes in our practices, the Platform, or applicable law. Material changes will be communicated by email to the address on file with your account, or by a prominent notice within the Platform, at least thirty (30) days before the change takes effect. Your continued use of the Platform following the effective date of changes constitutes acceptance of the revised Policy. If you do not agree to the revised Policy, you must discontinue use of the Platform.

18. Contact Information

For questions, requests, or concerns about this Privacy Policy or our data practices, please contact us:

inTrial, LLC
support@inTrial.com
Website: www.inTrial.com

For HIPAA Business Associate Agreement requests, please use the email above and include “BAA Request” in the subject line.