Privacy Policy

1. Introduction

ProvaLens ("we," "us," or "our") is a product of G.T. Laitano, LLC. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our AI-powered document intelligence platform at provalens.ai and app.provalens.ai (the "Service").

By using our Service, you agree to the collection and use of information as described in this policy.

2. Information We Collect

Account Information

• Name, email address, phone number
• Law firm name, city, and state
• Practice area and role within the firm
• Billing and payment information (processed securely via Stripe)

Document Data

• Legal documents you upload for processing (medical records, police reports, correspondence, etc.)
• Extracted text, metadata, and AI-generated analysis
• Search queries and research results

Usage Data

• Log data (IP address, browser type, pages visited)
• Platform usage metrics (documents processed, pages analyzed, AI queries)
• Feature usage patterns

3. How We Use Your Information

• Provide, operate, and maintain the document intelligence Service
• Process your documents, generate timelines, and detect contradictions
• Generate embeddings and enable intelligent search across your case files
• Process payments and manage your subscription
• Send transactional communications (confirmations, invoices)
• Provide customer support
• Improve and optimize the Service
• Comply with legal obligations

4. Data Protection & Security

We implement industry-standard security measures to protect your data:

• Encryption in Transit: All data transmitted using TLS 1.3
• Encryption at Rest: All stored data encrypted using AES-256
• Infrastructure: Hosted on Microsoft Azure with SOC 2 Type II certification
• Access Controls: Role-based access, multi-factor authentication support
• Audit Logging: All access to sensitive data is logged and monitored
• Firm Isolation: Every query against the database and the vector search index is scoped to a single firm, and that scope is enforced by the application on every read and write

5. HIPAA Compliance

ProvaLens is designed to be HIPAA compliant for law firms handling Protected Health Information (PHI):

• We offer Business Associate Agreements (BAA) to covered entities
• PHI is encrypted at rest and in transit
• Access to PHI is logged in append-only audit trails that the application never edits or deletes
• Documents containing PHI are automatically flagged and protected
• You may request deletion of a matter or your entire account at any time; confirmed deletions are processed within 30 days
• Microsoft maintains a BAA with us covering the HIPAA-eligible Azure services we use. Our HIPAA procedure for our other AI and vector search providers is under review. If your matter involves PHI, contact us before uploading and we will scope it with you.

6. Data Retention

We retain your data as follows:

• Account Data: Retained for the duration of your account, plus 30 days after deletion
• Documents & Embeddings: Retained as long as your account is active. There is no automatic purge. On a confirmed deletion request we remove them from the application database, blob storage, and the vector index; encrypted backups age out on their own 30-day rotation.
• AI Research Results: Retained as long as your account is active
• Audit Logs: Retained for a minimum of 6 years per HIPAA requirements

7. Third-Party Services

We use the following third-party services to operate ProvaLens:

• Microsoft Azure: Cloud infrastructure, document OCR, embedding generation, storage
• Anthropic (Claude): AI-powered document analysis, classification, and research synthesis. Called server-side under commercial API terms that prohibit training on our data.
• Qdrant Cloud: Vector search index used to retrieve relevant passages from your documents. Hosted on Google Cloud in the United States.
• Stripe: Payment processing (we do not store credit card numbers)
• Azure Communication Services: Transactional email delivery

We do not sell, rent, or share your personal information or document data with third parties for marketing purposes.

8. AI Processing

ProvaLens uses artificial intelligence to analyze your documents. Important details about AI processing:

• Your documents are processed by AI models to extract text, classify content, and generate analysis
• Document content is sent to AI providers (Anthropic, Azure OpenAI) for processing but is not used to train their models
• AI-generated results always include citations to source documents for verification
• You retain full ownership of your documents and any AI-generated analysis

9. Your Rights

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion of your data (documents, embeddings, and all associated records)
• Export your documents and research results
• Opt out of non-essential communications

To exercise these rights, contact us at privacy@provalens.ai.

10. Cookies & Tracking

We use the following categories of cookies and tracking technologies on this website:

Essential Cookies (no consent required)

• cookie_consent — Stores your cookie preference (accepted or declined). Set for 1 year. This is a first-party cookie and is the only cookie set before you give or decline consent.
• Session and authentication cookies set by the app at app.provalens.ai when you are logged in.

Analytics Cookies (consent required)

• Google Analytics (GA4) — _ga, _gid and related cookies: We use Google Analytics to measure website traffic and understand how visitors use our site. The _ga cookie persists for 2 years; _gid persists for 24 hours. Data is processed by Google in accordance with their privacy policy. Google Analytics is only loaded after you accept cookies.

Advertising & Conversion Cookies (consent required)

• LinkedIn Insight Tag — li_fat_id and related cookies: We use the LinkedIn Insight Tag (Partner ID: 512107109) for ad conversion tracking and retargeting on LinkedIn. LinkedIn may set cookies such as li_fat_id, UserMatchHistory, and bcookie. These are third-party cookies governed by LinkedIn's privacy policy. The LinkedIn tag is only loaded after you accept cookies.

First-Party Analytics Beacon (consent required)

• We run a lightweight first-party analytics script that sends usage data — including page URLs, referrer, UTM parameters, screen size, timezone, and browser language — to our own servers. This script sets no cookies. It is only loaded after you accept cookies.

Your Choices

When you first visit the site, a consent banner allows you to accept or decline non-essential cookies. If you decline, Google Analytics, the LinkedIn Insight Tag, and our analytics beacon will not be loaded. You can change your preference at any time by clearing the cookie_consent cookie in your browser settings, which will display the banner again on your next visit.

11. Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal information from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on our website. Your continued use of the Service after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy, contact us: