CaseChorus (Beta) — Data Processing Addendum

Last updated: September 18, 2026

This Addendum governs how CaseChorus handles personal information contained in the case materials you put into the product. It is part of the Beta Terms of Use and applies automatically when you use CaseChorus.

We wrote it because we understand that our user firms handle their own clients’ information, which they are professionally obligated to protect. This is the addendum that says what we do with it.

Capitalized terms not defined here have the meaning given in the Beta Terms of Use.

1. The roles

You control the case materials. You decide what goes into CaseChorus, whose information is in it, and why. We process that material only to provide the product to you.

In the language of privacy statutes: for personal information contained in Your Data, you are the business or controller and we are the service provider or processor. This distinction matters to you. It is what keeps our receipt of your client information from being treated as a sale of that information, and it preserves your own statutory protections.

2. What we process

Whose information. Whoever appears in the materials you upload. In personal injury matters that typically means your clients, opposing parties, witnesses, treating physicians, and experts.

What kinds. Whatever your files contain. This commonly includes names, contact details, dates of birth, medical and treatment records, employment and wage records, photographs, and occasionally government identification numbers.

For how long. For as long as you keep the material in the product, and then as described in Section 7.

For what purpose. To store your case materials, extract text from them, generate simulated juror responses and strategy reports at your direction, and support you in using the product. Nothing else.

3. Our commitments

We will:

• Process personal information in Your Data only for the purposes in Section 2, on your documented instructions, which include your use of the product and any written direction you give us.
• Not sell or share it, as those terms are defined under California law, and not use it for cross-context behavioral advertising.
• Not retain, use, or disclose it for any purpose other than performing the services, and not outside our direct business relationship with you, except where a law requires otherwise.
• Not combine it with personal information we receive from any other customer or from any other source, except as permitted by applicable privacy law.
• Provide the same level of privacy protection for it that applicable privacy law requires of you.
• Limit access to personnel who need it to perform the services, under confidentiality obligations.
• Tell you promptly if we determine that we can no longer meet our obligations under this Addendum.
• Let you take reasonable and appropriate steps, on notice, to stop and remediate any unauthorized use, and cooperate with your reasonable requests to verify our compliance.
• Help you respond to requests from individuals exercising privacy rights, and to your own obligations for security, risk assessments, and regulatory inquiries, taking into account the nature of our processing.

4. Improving the service

Internal use to improve quality. We may use personal information in Your Data internally to build and improve the quality of CaseChorus: diagnosing errors, testing changes, evaluating the quality of generated output, and improving how the product works. This is a permitted business purpose for a service provider under applicable privacy law. We do not use Your Data to build or improve products or services for anyone else, and we do not use it to perform services on behalf of another customer.

De-identified and aggregated information. We may create de-identified or aggregated information from Your Data and use it to operate and improve CaseChorus. De-identified means not reasonably capable of being associated with you, your firm, or any individual.

Where we do this, we commit to: maintaining that information in de-identified form; not attempting to re-identify it; and contractually requiring anyone who receives it from us to do the same. We do not disclose de-identified information in any form that identifies an individual.

We do not use Your Data to train AI models, and we do not permit our AI providers to do so.

These are the only uses we make of Your Data beyond providing the product to you.

5. Subprocessors

You authorize us to use subprocessors to provide the product. Each is bound by terms that are at least as protective as this Addendum, and we remain responsible for their performance.

Our current subprocessors, and what each receives, are listed in our Privacy Policy. We will update that list before any new subprocessor begins processing Your Data. If you object to a new subprocessor on reasonable data protection grounds, tell us within 30 days and we will work with you in good faith; if we cannot resolve it, you may stop using the product and ask us to delete Your Data.

6. Security

We maintain administrative, technical, and physical safeguards appropriate to the nature of the information and to the stage of our product, described in our security summary, which we keep current.

If we become aware of a security incident affecting Your Data, we will notify you without unreasonable delay and in any event within 72 hours of confirming it, give you the information you need to meet your own notification obligations, and keep you updated as we learn more.

Because CaseChorus is in beta, our security program is developing. The security summary describes what is in place and what is not, and we update it as that changes.

7. Return and deletion

You can delete cases and documents yourself in the product at any time.

On request, or when you stop using CaseChorus, we will delete Your Data. Deletion from our live systems completes within a reasonable time, generally within a few days. Backups age out on their ordinary cycle, currently seven days. We may retain information where a law requires it, and we retain de-identified information as described in Section 4.

Before deletion, you can export your case materials, or ask us to export them for you.

8. Individual rights requests

If someone whose information appears in Your Data contacts us directly, we will not respond substantively. We will tell them to contact you and, where we can identify the matter, let you know. You handle the request. We will give you what you need from our systems to respond.

9. Protected health information

If your firm is a business associate under HIPAA and intends to put protected health information into CaseChorus in that capacity, tell us before you do. A separate business associate agreement is required, and this Addendum does not serve as one.

Most plaintiff-side firms obtain medical records as counsel to the patient rather than as a business associate, in which case no such agreement is needed. If you are not sure which applies to you, ask us and we will work it out together.

10. General

This Addendum is part of the Beta Terms of Use and is governed by the same law and the same limitations of liability. Where it conflicts with those terms about the handling of personal information in Your Data, this Addendum governs.

We may update it as the product and the law change. If a change is material we will post it and tell you before it takes effect.

Questions: legal@casechorus.com