Privacy, without the fog
Your documents are personal. We treat them that way.
This notice explains, in clear language, how Clarity Companion handles information when you ask us to explain a letter, form, report, bill, policy, email or other document.
The short version
Five promises you should not need a lawyer to understand.
Your order, not advertising
We use document contents to provide the explanation you request. We do not sell them or use them to advertise to you.
Only what is needed
You may cover information that is not relevant before uploading. Please do not send more personal information than necessary.
Short document retention
Uploaded documents, completed explanations and audio files are normally deleted within 30 days after completion.
AI assists; people remain responsible
AI-assisted tools may help organise or simplify wording. They do not diagnose, advise or make decisions about you.
You have choices
You can ask about your information, request correction or deletion, and exercise applicable UK or US privacy rights.
Before you upload: remove names, addresses, reference numbers or other details that are not needed for the explanation. Only share another person’s document when you have authority to do so.
01
Who we are and when this notice applies
Clarity Companion provides plain-English explanations of documents. For personal customers, Clarity Companion is the organisation responsible for deciding why and how personal information is used—called the controller under UK data protection law and the business/controller under some US state laws.
This notice applies to our website, enquiry and order forms, document-explanation service, completed explanations and optional audio files. It does not cover third-party websites you choose to visit or a professional’s own handling of the original document.
If Clarity Companion provides a separately contracted service for a clinic, insurer, employer or other organisation, that organisation may be the controller/business and its own privacy notice may apply. Separate data-processing or business-associate terms must be agreed where legally required.
02
Information we collect and where it comes from
Identity and contact details
Name, email address and any details included in a message or order.
Documents and instructions
Uploaded letters, images, files, their contents, your questions and accessibility preferences.
Health and other sensitive details
Information a document reveals about health, disability, family life, finances or other protected matters.
Transaction information
Service purchased, amount, date, payment status and invoice details. We do not receive or store your full card number.
Website and device information
IP address, browser, device, security logs, cookie choices and basic page-use information.
Messages and requests
Emails, support history, feedback, consent records and privacy-rights requests.
We normally receive information directly from you. We may also receive it from someone you authorise, from the organisation purchasing the service for you, or from providers involved in payments, website security and order delivery.
03
How and why we use information
| What we do | Why | UK lawful basis |
|---|---|---|
| Receive and explain your document; create optional audio; deliver and support the order | Provide the service you requested | Contract; steps at your request before a contract |
| Process health or other special-category information in a document | Create the requested explanation | Contract plus your explicit consent under UK GDPR Article 9(2)(a), unless another documented condition applies |
| Take payment and keep tax, accounting and consent records | Run the service and comply with law | Contract; legal obligation; legitimate interests |
| Protect accounts, forms and systems; prevent fraud or misuse | Keep the service and its users secure | Legitimate interests; legal obligation where applicable |
| Answer enquiries, complaints and rights requests | Communicate and meet legal duties | Legitimate interests; legal obligation |
| Use optional analytics or marketing cookies | Understand and improve the website | Consent where UK law requires it |
Our legitimate interests are operating, securing and improving a document-explanation service in a proportionate way. We balance those interests against your rights and do not use document contents for unrelated advertising.
Where we rely on consent, you may withdraw it at any time by emailing us. Withdrawal does not make earlier lawful processing unlawful, but it may mean we cannot complete or retain the affected service.
04
Special-category and sensitive information
Your document may contain health information or reveal racial or ethnic origin, religious or philosophical beliefs, political opinions, trade-union membership, genetic or biometric information, sex life or sexual orientation. UK law calls much of this special-category data. US laws may call health, account, precise-location or similar details sensitive personal information.
What we ask you to do
- Upload only what is needed.
- Redact irrelevant identifiers where practical.
- Use the upload consent control before sending sensitive information.
- Do not send emergency information or ask us to assess urgency.
What we do
- Limit use to delivering, securing and administering the service.
- Restrict access to people and providers who need it.
- Apply the shorter document-retention period below.
- Do not use sensitive information to profile you or target advertising.
We do not intentionally infer new sensitive characteristics about you. Any plain-English explanation is based on the document supplied and is not an independent professional interpretation.
05
AI-assisted processing and human responsibility
Clarity Companion may use approved AI-assisted tools to help extract structure, identify difficult wording, draft a plain-English explanation or prepare an audio version. This can involve sending relevant document content to a contracted technology provider.
AI is not used to diagnose, determine treatment, approve or reject a claim, assess legal rights, calculate credit, profile you, or make another decision producing legal or similarly significant effects. We do not make solely automated decisions about you.
We do not authorise providers to use document contents for their own advertising. Provider access, retention and model-training controls depend on the contracted service and settings in use; Clarity Companion is responsible for selecting appropriate settings and maintaining an up-to-date internal processor record.
06
Who receives information
We do not sell personal information. We do not share personal information for cross-context behavioural advertising, and we do not use document contents for targeted advertising.
Squarespace and form/hosting providers may process website, form, security and cookie information.
Stripe or another disclosed payment processor processes payment details and fraud checks. We receive transaction status, not full card details.
Email, file-storage and audio providers process only what is needed to create, store or deliver your order.
AI-assisted technology providers may process relevant document content under contractual and account controls.
Advisers, insurers and authorities receive information only where necessary to obtain advice, establish or defend claims, comply with law or protect people and systems.
A buyer or successor may receive necessary information during a genuine business restructuring, subject to confidentiality and applicable law.
Providers act under their own privacy terms where they are independent controllers and under data-processing terms where they process information for us. You may ask us for the current categories of providers relevant to your order.
International transfers
Some providers may process information in the United States, United Kingdom or another country. Where UK restricted-transfer rules apply, we use an available lawful safeguard—such as UK adequacy regulations, the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses—and assess supplementary protection where required.
US residents should understand that information may be processed in the UK and other countries whose privacy rules differ from those in their home state. We require providers to protect information consistently with applicable contracts and law.
07
How long we keep information
We keep information only for the purpose collected, considering legal duties, dispute periods, sensitivity and security. Our normal schedule is:
| Record | Normal retention |
|---|---|
| Uploaded document | Up to 30 days after the completed explanation is delivered |
| Completed explanation and optional audio | Up to 30 days after delivery |
| Unsuccessful or abandoned upload | Deleted or allowed to expire as soon as reasonably practical |
| General enquiry that does not become an order | Normally up to 12 months after the last contact |
| Order, invoice, payment-status and tax records | Normally 6 years, or longer if law or an active dispute requires |
| Consent, complaint, security and privacy-rights records | As long as reasonably needed to demonstrate compliance and resolve claims |
You may request earlier deletion. We will honour it unless retention is necessary for law, security, establishment or defence of legal claims, or another applicable exception. Provider backups may take additional time to cycle out and are not used for ordinary business after deletion.
08
Security and data breaches
We use proportionate technical and organisational safeguards designed to protect confidentiality, integrity and availability. These include access restriction, secure transmission where supported, account security, provider review, minimisation, retention controls and avoiding unnecessary printing.
No online service can promise absolute security. If a personal-data breach occurs, we will assess it, contain it, keep required records and notify affected people and regulators when applicable law requires. This may include UK GDPR notification duties and, where applicable, US state breach laws or the FTC Health Breach Notification Rule.
If you believe information has been sent to the wrong person or accessed improperly, email info@myclaritycompanion.com promptly with the subject “Privacy concern”. Do not include additional sensitive information in the first email.
09
Your UK privacy rights
Under UK data protection law, depending on the circumstances, you may ask us to:
- Give you access to personal information we hold about you.
- Correct inaccurate or incomplete information.
- Delete information when there is no lawful reason to keep it.
- Restrict how information is used while an issue is checked.
- Provide portability for certain information you supplied.
- Object to processing based on legitimate interests or direct marketing.
- Withdraw consent where consent is the basis used.
- Challenge solely automated decisions; we do not currently make them.
Email info@myclaritycompanion.com to exercise a right. We may request proportionate information to verify identity and authority, but never ask for more than needed. We normally respond within one month, subject to lawful extensions or exceptions.
You may complain to the UK Information Commissioner’s Office. We would appreciate the opportunity to address the concern first, but you do not have to contact us before approaching the ICO. Visit ico.org.uk/make-a-complaint.
10
United States state privacy disclosures
Residents of California and other states with applicable comprehensive privacy laws may have rights to know or access, correct, delete and obtain a portable copy of personal information; opt out of sale, targeted advertising or qualifying sharing; limit certain uses of sensitive information; and appeal a refusal. We will not discriminate against you for exercising an applicable right.
| Category collected in the previous 12 months | Examples and disclosure purpose |
|---|---|
| Identifiers | Name, email, IP address and order reference; disclosed to website, security, delivery and payment providers |
| Customer and commercial records | Service purchased, invoice, payment status and correspondence; disclosed for payment, accounting and support |
| Internet or electronic activity | Browser, device, website use, cookie choice and security logs; disclosed for hosting, security and consented analytics |
| Audio/electronic information | Uploaded files, images, document contents and generated audio; disclosed only for service creation, storage and delivery |
| Professional or education information | Only when it appears in a document you choose to provide; disclosed only to providers needed for the service |
| Sensitive personal information | Health, disability, financial-account or other sensitive details in a document; used and disclosed only for permitted service, security and legal purposes |
| Inferences | We do not intentionally build advertising profiles or infer new sensitive characteristics from your document |
To make a request, email info@myclaritycompanion.com with your state of residence and the right you wish to exercise. We may verify identity and authority. An authorised agent may submit a request where law permits; we may require proof of authority and direct verification with you. If we deny an appealable request, our response will explain how to appeal.
California consumers can read official information at the California Attorney General’s CCPA page. Because we do not sell or share personal information for targeted advertising, an opt-out link is not currently required for those activities. If our practices change, we will update this notice and provide legally required controls, including recognition of qualifying browser preference signals.
11
US health information: HIPAA and consumer-health laws
Clarity Companion is a document-explanation service, not a health plan, healthcare clearinghouse or healthcare provider. Information sent directly by an individual is therefore generally not protected by HIPAA merely because it concerns health. We still protect it under this notice, our contracts and other applicable privacy and consumer-protection laws.
For US healthcare organisations: do not send protected health information on behalf of a HIPAA-covered entity unless Clarity Companion has first confirmed the service is appropriate and signed any required Business Associate Agreement. A consumer’s direct use of the public service is different from processing on behalf of a covered entity.
Some non-HIPAA health technologies may be subject to the Federal Trade Commission’s Health Breach Notification Rule or state consumer-health laws. We assess those duties according to the service’s actual design, data sources and affected residents, and provide notices if a qualifying breach occurs.
12
Children, vulnerable people and another person’s document
The public ordering service is intended for adults aged 18 or over and is not directed to children under 13. We do not knowingly collect personal information online directly from a child under 13. If you believe a child has submitted information, contact us so we can investigate and delete it where required.
An adult may submit a document about a child, relative, patient or another person only when authorised by consent, parental responsibility, guardianship, contract or law. You are responsible for checking that authority and sharing no more than necessary. We may refuse or delete a document if authority is unclear or the risk is disproportionate.
13
Cookies, analytics and communications
Essential cookies may be used for website operation, security, forms, payment flow and remembering privacy choices. In the UK, non-essential analytics, advertising or similar cookies are used only after consent where required. You can change choices through the website’s cookie control or browser settings.
Service emails—such as payment confirmation, delivery and replies—are necessary to fulfil an order. We do not add you to marketing merely because you purchased a service. If optional marketing is introduced, it will use a lawful permission or other permitted basis and include a simple unsubscribe method.
The privacy practices of third-party payment pages and linked websites are explained in their own notices. We encourage you to review them before providing information.
14
Contact, complaints and changes
Use the subject “Privacy request” and tell us the country or US state you live in. Please do not attach identity documents or sensitive letters unless we ask for a proportionate verification method.
We may update this notice when the service, providers or law changes. Material changes will be highlighted on this page and, where required, communicated before a new use begins. The “last updated” date shows the current version.
This notice describes privacy practices; it does not alter rights that cannot legally be waived. If a translated version conflicts with the English version, the English version governs only to the extent permitted by law.
If anything here feels uncertain, ask us in ordinary language. We will answer in the same way.