IMPORTANT INFORMATION
Privacy notice
Last updated 23 October 2026. This notice explains how CaseRight uses personal information when you visit the site, create an account, save a case, request an estimate, or use document extraction and AI-assisted case tools.
Who is responsible and how to contact us
CaseRight is responsible for deciding how personal information is used for this service. For privacy questions or requests, email updates@caseright.co.uk. Please include the email address on your account and, if relevant, a case reference. Do not send identity documents or sensitive case documents unless we ask for them through a secure route.
Information we use and why
We use account details such as your name and email; information and documents you choose to enter or upload; case notes, assessments, drafts, reminders and related activity; and technical and security information needed to operate the service. We use this information to create and manage your account and cases, extract document text, provide the estimate or case support you request, send service emails, maintain security, troubleshoot faults and meet legal obligations. We rely on steps needed to provide the service you request, our legitimate interests in operating and securing CaseRight, and legal obligations where applicable. We do not use case documents to send marketing emails.
AI assistance and OpenAI
When you use document extraction, case analysis, drafting or re-analysis, CaseRight sends relevant text or document content from our server to OpenAI’s API so the requested feature can be generated. OpenAI processes that content as our service provider under its Data Processing Addendum. OpenAI states that API data is not used to train or improve its models unless the customer explicitly opts in. CaseRight’s OpenAI Platform sharing controls are currently set to disabled, and our Responses API requests set store:false to prevent Responses application-state storage. These settings do not prevent all provider-side security or abuse monitoring; see Retention below. AI output is assistance for you to review. CaseRight provides decision-support information for you to consider; the AI does not itself submit a claim or decide what action you must take.
International transfers
OpenAI’s DPA names OpenAI OpCo, LLC in the United States for UK data. The DPA incorporates the UK International Data Transfer Addendum to the Standard Contractual Clauses as the transfer safeguard. OpenAI may also use sub-processors to provide the API; its current list is available at https://openai.com/policies/sub-processor-list/. You can request a copy of the transfer safeguard by emailing us. CaseRight does not rely on the Data Privacy Framework for this transfer. Supabase and other providers may process or store information in the locations described in their applicable service terms; we will identify relevant providers and locations in our transfer records.
How long information is kept
We keep account and case information while your account is active and while it is needed to provide the service, resolve support or security issues, and meet legal obligations. Archived cases remain stored and can be restored; archiving is not deletion. You can permanently delete an archived case using the Archive area. To request account deletion or deletion of information you cannot remove yourself, email us. We will remove information from active systems when the request is verified and deletion is legally permitted; limited copies may remain temporarily in provider backups or security records before their normal expiry or deletion cycle. Calculator estimate links expire after 7 days. For OpenAI API processing, store:false prevents Responses application-state storage, but OpenAI’s standard API abuse-monitoring logs may contain prompts or responses and are retained for up to 30 days, unless a longer period is required by law or reasonably necessary to protect its services or others. CaseRight has not enabled or verified Zero Data Retention for this account.
Who receives information
We share only what is needed with providers that host and operate CaseRight, including Supabase for authentication, database and file storage, OpenAI for the AI features you request, and email providers to deliver service messages. We may also disclose information where required by law or necessary to protect people, the service or legal rights. We do not sell case documents or use them for advertising.
Your privacy rights and requests
Depending on the circumstances, you may ask for access to your personal information, correction, deletion, restriction or objection to processing, or a portable copy. You may also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. Email updates@caseright.co.uk with “Privacy request” in the subject and tell us what you want. We may ask for proportionate information to verify your identity and protect your account. We normally respond within one month; if a request is complex or you make several requests, the law may allow an extension, and we will explain this. Some rights depend on the lawful basis and circumstances.
Please do not upload medical information
CaseRight is not designed to assess or manage medical information. Do not upload medical records, diagnoses, prescriptions, treatment details or other health information. If your dispute involves health information, leave those details out and seek an appropriate specialist service. Documents may contain health or other sensitive information unintentionally, so check files before uploading and redact irrelevant personal details where you can.
If you accidentally upload medical or other sensitive information
Stop using the document in CaseRight and do not upload it again or send it to us by ordinary email. If it is in a case, remove the document or permanently delete the archived case if that option is available. Then email updates@caseright.co.uk with “Accidental sensitive upload”, your account email and case reference, but do not attach the sensitive document. We will restrict access while we assess the report, remove the material and any related CaseRight extracts from active case records where possible, and request deletion from a provider where the provider offers a deletion control. If content was already sent to OpenAI, its standard abuse-monitoring logs may retain it for up to 30 days, subject to the exceptions described above; store:false prevents Responses application-state storage but does not erase abuse-monitoring logs. We will tell you if we need more information or cannot complete a deletion request.
Changes to this notice
We will update this notice when our processing changes. The date at the top shows when it was last revised.
CaseRight provides practical information, organisation and communication support. It does not provide legal advice, financial advice, or representation. If your matter is urgent, complex, high-value, or legally sensitive, consider seeking advice from a qualified professional.