Privacy Policy

Account information: If you create an account, we collect your name, email address, and a hashed version of your password. We never store passwords in plain text.

Claims data: Logged-in users may save claims, deadlines, saved analyses, and evidence files. This data is stored in our database and associated with your account.

Workspace data: The claims workspace keeps its data in your browser’s local storage (localStorage). It is never sent to our servers, whether or not you have an account, and it does not follow you to another device or browser.

Usage data: We maintain an audit log of actions taken within the platform (such as creating a claim or running an AI analysis) for security and feature-gate tracking purposes.

Files uploaded to the Evidence Vault are stored securely via Vercel Blob. Files are associated with your account and are accessible only to you. Accepted file types include PDFs, images, DOCX, and plain text files, subject to tier-based storage limits.

Authentication is handled via NextAuth.js using a JWT (JSON Web Token) strategy. We use session cookies to maintain your logged-in state. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

In addition to the AI providers listed above, we use the following third-party services:

Claim deadline reminders. If you use the Navigator, we email you when a deadline recorded on your claim is approaching — an intent-to-file window, an appeal window, a response VA is waiting on, a proposed rating reduction, or a records request that has gone unanswered. These emails contain the deadline date and the name of the record or issue it belongs to. They are not marketing, and we do not send them to anyone who is not running a claim in the Navigator.

They are on by default, because a missed VA deadline can cost you money or a claim. You can turn them off at any time in Settings, or with the unsubscribe link at the bottom of every one of these emails — that link needs no login. Turning them off stops the reminders only; it does not affect password resets or sign-in emails, which you need in order to use your account.

Your account data, claims, deadlines, saved analyses, and evidence files are retained for as long as your account is active. If you downgrade to a free tier, excess evidence files may be archived but are not immediately deleted.

Retention schedule:

Verification tokens

purged automatically after expiration

Security audit logs

retained for 2 years, then purged

AI usage metrics

retained for 1 year, then purged

AI observability traces (Langfuse)

pseudonymized (identified only by a one-way hash that cannot be linked to you without an internal secret) and retained for up to 30 days (our current Langfuse plan’s data-retention window), then purged

You can delete your account and all associated data directly from Settings > Data & Privacy. Account deletion is processed immediately and removes your profile, claims, evidence files, saved analyses, and associated data. AI observability traces are pseudonymized and cannot be linked back to you; where a linkable-deletion obligation applies, we will honor it using the provider’s deletion tools. You can also email support@legatusos.com.

For California Residents (CCPA/CPRA)

Under the California Consumer Privacy Act and the California Privacy Rights Act, California residents have the following rights:

• Right to Know — request the categories of personal information we have collected, the purposes for collection, and the categories of third parties with whom we share it
• Right to Delete — request deletion of your personal information (available in Settings > Data & Privacy or by emailing us)
• Right to Correct — request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing — we do not sell or share your personal information for cross-context behavioral advertising
• Right to Non-Discrimination — exercising your rights will not result in denial of service or different pricing
• Right to Limit Sensitive Personal Information Use — disability status and health-related claim data are sensitive personal information under CPRA and are used only to provide the Service

Categories of personal information collected: identifiers (name, email), health-adjacent information (claimed conditions, evidence descriptions, nexus letter text), usage data (audit logs, AI feature usage counts), and payment information (processed by Stripe; we do not store card numbers).

How to submit requests: use the self-service tools in Settings > Data & Privacy or email support@legatusos.com. We will verify your identity and respond within 45 days.

For EU/UK Residents (GDPR)

Under the General Data Protection Regulation, EU and UK residents have the following rights:

• Right of Access (Art. 15) — obtain a copy of your personal data
• Right to Rectification (Art. 16) — correct inaccurate data
• Right to Erasure (Art. 17) — request deletion of your data
• Right to Restriction (Art. 18) — limit processing of your data
• Right to Data Portability (Art. 20) — export your data in a machine-readable format (available in Settings > Data & Privacy)
• Right to Object (Art. 21) — object to processing based on legitimate interests

Legal bases for processing: contract performance (providing the Service you signed up for), legitimate interests (security, fraud prevention, product improvement), and consent (where specifically obtained).

Data controller: Legatus. Contact: support@legatusos.com.

International data transfers: your data is processed in the United States by our service providers (Anthropic, OpenAI, Vercel, Neon, Resend, Langfuse). These transfers are governed by standard contractual clauses or equivalent mechanisms. You have the right to lodge a complaint with your local supervisory authority.

For All Users

Regardless of your location, you can export your data or delete your account at any time from Settings > Data & Privacy. Data export provides a JSON download of your profile, claims, assessments, evidence metadata, saved outputs, deadlines, subscription details, and audit log.

We use the following sub-processors to provide the Service. For each, we describe the categories of data transmitted:

Legatus is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.

We may update this privacy policy from time to time. Material changes will be communicated via email or an in-app notice. Changes will also be reflected by updating the “Last updated” date at the top of this page. Continued use of the platform after changes are posted constitutes acceptance of the updated policy.

If you have questions about this privacy policy or how your data is handled, contact us at support@legatusos.com or visit our Contact page.