Privacy Policy

Caseworth, CO. ("Caseworth," "we," "us," "our") respects your right to privacy and is dedicated to securing and protecting any information we have about you. This Privacy Policy describes the ways we collect, use, and share information that relates to an identifiable individual ("Personal Data") and also how you can exercise your rights under applicable privacy and data protection laws.

If you have any questions or concerns about our use of your Personal Data, or if you wish to exercise any of your privacy rights including the right to object (where applicable), please contact us using the contact details under 'How to Contact Us' at Section 12 below.

Caseworth is a technology platform available as a software-as-a-service ("SaaS") offering. We serve two audiences: (1) individual consumers who use our Lexstimate tool to obtain a case-value report based on their own injury and medical information, and (2) professional and business customers, including law firms, who use our platform for case intelligence, mass-tort analytics, and attorney referral services. Caseworth, CO. is a Delaware corporation and currently makes its Services available in approximately 13 U.S. states.

Our role differs by audience. When you use our consumer Lexstimate tool, Caseworth acts as the controller (or "business") of the Personal Data you provide, and this Privacy Policy governs that data directly. When we process case, client, or intake data on behalf of a law-firm customer, we generally act as a processor (or "service provider") handling that data under the firm's instructions and our written agreement with the firm; in that case, the firm's own privacy notice governs its clients' data and this Policy describes our practices as the firm's service provider. See Section 8A for more detail on this controller-versus-processor split.

We recommend that you read this Privacy Policy in full to ensure you are completely informed about Caseworth's collection and use of your Personal Data.

1. Applicability of the Privacy Policy

This Privacy Policy applies to all Personal Data collected and processed by Caseworth through our website, platform, and services (collectively, the "Services").

2. Personal Data We Collect and Process

We collect and process Personal Data in the following categories:

A. Information Provided Directly

This includes information you provide when you register for an account, use our Services, communicate with us, or participate in surveys. Examples include:

• Contact Data: Name, email address, phone number, and mailing address.
• Account Data: Username, password, and payment information.
• User Content: Non-sensitive information, data, and files you upload, submit, or transmit through the Services.
• Communication Data: Records of your correspondence with our support or sales teams.

A1. Sensitive and Consumer Health Data

To generate a Lexstimate case-value report, our consumer Services ask you to provide information that qualifies as sensitive data and, in some jurisdictions, as consumer health data under laws such as the Washington My Health My Data Act (MHMDA), the Colorado Privacy Act (CPA), and similar state laws. This category includes:

• Medical records and documents you upload (e.g., treatment records, bills, imaging reports).
• Injury and health facts you describe, including the nature, cause, and severity of an injury and the treatment received.
• Diagnosis and procedure codes (ICD, CPT, and similar codes) associated with your care.
• Case details that reveal your physical or mental health condition or health-care history.

We treat this category with special handling. We collect and use sensitive and consumer health data only as needed to deliver the specific Lexstimate report you request, together with the security, fraud-prevention, and legal-compliance purposes required to operate that service. Any collection or use of this data beyond delivering the report you requested — for example, using your medical content to train or improve our models or to build our knowledge graph — requires your separate, affirmative opt-in consent, which you may decline or later withdraw without losing access to the report you paid for. See Section 3 (use table), Section 3B (secondary use), and our Washington Consumer Health Data Privacy Policy for details.

B. Information Collected Automatically

When you use our Services, we automatically collect certain information about your device and usage. Examples include:

• Usage Data: Information about how you use the Services, such as access times, pages viewed, and features used.
• Device Data: IP address, operating system, browser type, and device identifiers.
• Location Data: General location information derived from your IP address.
• Cookies and Tracking Technologies: Data collected through cookies, web beacons, and similar technologies (see our Cookie Policy for more details).

C. Information Collected from Third Parties

We may receive Personal Data about you from third-party sources, such as:

• Service Providers: Data from payment processors, analytics providers, and marketing partners.
• Business Partners: Information from partners with whom we offer co-branded services or engage in joint marketing activities.
• Public Sources: Data from publicly available databases or social media platforms.

3. How We Use Personal Data

We use your Personal Data for the following purposes and based on the following legal grounds:

3B. Secondary Use of Sensitive and Consumer Health Data (Opt-In)

"Secondary use" means any use of your sensitive or consumer health data for a purpose other than delivering the Lexstimate report you requested and the operational, security, and legal-compliance functions necessary to provide it. This includes using your medical records, injury facts, diagnosis/procedure codes, or case details to train, fine-tune, or evaluate machine-learning models, or to build or enrich our knowledge graph.

We do not rely on "legitimate interests" as a basis for any secondary use of sensitive or consumer health data. Consistent with the Colorado Privacy Act and the Washington My Health My Data Act, we will only carry out such secondary use where you have given separate, affirmative opt-in consent that is specific to that purpose. Declining does not affect your ability to obtain the report you paid for, and you may withdraw your consent at any time by contacting us using the details in Section 12. Withdrawal is prospective and does not affect processing already performed while consent was in effect.

3A. SMS/Text Messaging

If you opt in to receive SMS or text messages from CaseWorth, we collect your mobile phone number for the purpose of sending you transactional account notifications, including new referral alerts and case status updates. Your phone number is collected during account registration when you provide express written consent by checking the SMS opt-in checkbox.

We do not sell, rent, or share your phone number or SMS opt-in consent information with third parties or affiliates for their own marketing purposes. Your phone number and consent data are used solely by CaseWorth to deliver the notifications you have requested.

You may revoke your consent to receive SMS messages at any time by replying STOP to any message or by contacting us at support@caseworth.io. Upon opt-out, we will cease sending SMS notifications but may retain your phone number in your account record for service purposes unless you request its deletion.

Message and data rates may apply. Message frequency varies based on your account activity. CaseWorth and mobile carriers are not liable for delayed or undelivered messages.

4. Who We Share Your Personal Data With

We may share your Personal Data with the following categories of recipients:

• Affiliates and Subsidiaries: For business and operational purposes.
• Service Providers: Third-party vendors and service providers who perform services on our behalf (e.g., hosting, payment processing, analytics).
• Business Partners: With your consent, or as necessary to provide a service you requested.
• Professional Advisors: Lawyers, bankers, auditors, and insurers who provide professional services to us.
• Law Enforcement and Authorities: When required by law or to protect our rights, property, or safety, and the rights, property, or safety of others.
• In Connection with a Business Transaction: In the event of a merger, acquisition, or sale of assets.

4A. Named Subprocessors, Tracking Technologies, and Analytics Services

This section names the specific third-party services Caseworth currently uses, their purpose, and the categories of data they receive. For cookie-specific detail and our consent model, see our Cookie Policy.

We operate an opt-in consent model for non-essential tracking. Analytics, session replay, and advertising tools are off by default and only activate after you accept via the cookie consent banner. Essential and functional services (authentication, payments, security, error monitoring) are necessary to operate the platform.

Analytics and Product Performance (consent-gated)

These services only run after you consent via the cookie banner.

Advertising (consent-gated)

Automated-Traffic Analytics (bots and AI crawlers only)

This service runs at our edge (server side) and measures automated traffic only — search-engine crawlers and AI/LLM bots (for example Googlebot, GPTBot, ClaudeBot, and PerplexityBot). It is limited to requests whose User-Agent identifies a known bot, so it does not track individual human visitors, and it is excluded from consumer medical-input pages. Because it does not process the Personal Data of human visitors, it is not gated by the cookie banner.

Essential Service Providers and Subprocessors

These services are required to operate the platform and run regardless of cookie consent.

5. How We Keep Your Personal Data Secure

We implement technical and organizational measures designed to protect your Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include encryption, access controls, and regular security assessments.

6. International Data Transfers

Caseworth is headquartered in the United States. Your Personal Data may be transferred to, and processed in, countries other than the country in which you are resident. We ensure that any such transfers comply with applicable data protection laws, for example, by using Standard Contractual Clauses (SCCs) or relying on adequacy decisions where applicable.

7. Data Retention

We retain Personal Data only for as long as needed for the purposes described in this Policy. Rather than an open-ended "as long as necessary" standard, we apply defined retention periods by data category, subject to any longer period required by law (e.g., tax, accounting, or litigation-hold obligations):

Firm-customer data (Caseworth as processor). Where we process case, client, or intake data on behalf of a law-firm customer, we retain that data for the duration of our agreement with the firm and, upon termination or expiration, we will delete or return the firm's data in accordance with that agreement, ordinarily within 30 days of termination, except for copies we are required by law to retain or that exist in routine backups pending deletion on our standard backup cycle.

To determine the appropriate retention period within these categories, we also consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure, and applicable legal requirements.

8. Jurisdiction Specific Provisions

Additional provisions may apply based on your jurisdiction. Please refer to our jurisdiction-specific addendums for more information.

Washington consumers. If you are a Washington resident or your consumer health data is collected in Washington, additional rights and disclosures apply under the My Health My Data Act. Please see our dedicated Washington Consumer Health Data Privacy Policy, which supplements this Policy for that data.

8A. Our Role: Controller vs. Processor

Consumers (Caseworth as controller / business). When you use the consumer Lexstimate tool, you provide your Personal Data — including sensitive and consumer health data — directly to Caseworth, and we determine the purposes and means of processing it to deliver your report. In that context Caseworth is the "controller" (GDPR terminology) or "business" (U.S. state-law terminology), and the rights and choices in Sections 9A and 10 apply to you directly against Caseworth.

Law-firm customers (Caseworth as processor / service provider). When a law firm or other professional customer uses our platform and we handle case, client, or intake data on that firm's behalf, the firm is the controller/business and Caseworth acts as its "processor" or "service provider." We process that data only to provide the contracted Services under the firm's documented instructions and our data-processing agreement, we do not sell it or use it for our own independent purposes, and we return or delete it on termination as described in Section 7. If you are an individual whose data a firm submitted to us, please direct privacy requests to that firm, which is the controller of that data; we will assist the firm in responding as required by law.

9. Minors' Data

Our Services are not directed to individuals under the age of 18, and we do not permit individuals under 18 to create an account or submit their own information to obtain a Lexstimate report. We do not knowingly collect Personal Data directly from minors. If we become aware that a minor has provided Personal Data to us as a user without parental consent, we will take steps to delete that information.

Minor intake-gate acknowledgement. Personal-injury matters frequently involve injured minors. Where an adult (such as a parent, legal guardian, or an attorney acting for a firm-customer) submits information about an injured minor as part of a case, our intake flow requires the submitting adult to affirmatively acknowledge that they are 18 or older and are authorized to provide that minor's information on the minor's behalf. In that situation the minor is the subject of the data, not the account user, and the adult submitting it is responsible for having the authority to do so.

9A. Your Choices: Do Not Sell or Share, Targeted Advertising, and Profiling

We do not sell your Personal Data for money, and we do not use sensitive or consumer health data for targeted (cross-context behavioral) advertising or to build advertising profiles. Certain analytics and advertising technologies described in Section 4A and in our Cookie Policy can, depending on how they are configured, constitute a "sale" or "share" of Personal Data or "targeted advertising" under some U.S. state privacy laws (for example, California, Colorado, and Virginia). Because these technologies are off by default and only run after you opt in through our cookie banner, they are not active unless and until you consent.

You may exercise the following opt-outs at any time:

• Do Not Sell or Share My Personal Information: You can opt out of any "sale" or "sharing" of your Personal Information by declining non-essential cookies in our banner, by clicking "Cookie Settings" in the site footer, or by contacting us at privacy@caseworth.io.
• Opt out of Targeted Advertising: You can opt out of processing of your Personal Data for targeted advertising through the same controls.
• Opt out of Profiling: Our Lexstimate tool profiles the likely value of a case based on the information you provide. You may opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. Note that profiling is intrinsic to generating a Lexstimate report, so opting out of it may mean we cannot provide that particular Service; opting out does not affect your other rights.

Universal opt-out signals (Global Privacy Control). We honor recognized universal opt-out mechanisms, including the Global Privacy Control (GPC). Where required by law, when we detect a GPC signal from your browser or device, we will treat it as a valid request to opt out of the sale/sharing of Personal Data and of targeted advertising for that browser or device.

10. Your Data Protection Rights

Depending on your location and subject to applicable law, you may have the following rights regarding your Personal Data:

• Right of Access: The right to request copies of your Personal Data.
• Right to Rectification: The right to request that we correct any information you believe is inaccurate or complete information you believe is incomplete.
• Right to Erasure (Right to be Forgotten): The right to request that we erase your Personal Data, under certain conditions.
• Right to Restrict Processing: The right to request that we restrict the processing of your Personal Data, under certain conditions.
• Right to Object to Processing: The right to object to our processing of your Personal Data, under certain conditions.
• Right to Data Portability: The right to request that we transfer the data that we have collected to another organization, or directly to you, under certain conditions.
• Right to Withdraw Consent: Where we rely on your consent to process your Personal Data, you have the right to withdraw that consent at any time.

U.S. State Privacy Rights (California, Colorado, Virginia, Washington, and similar states)

If you are a resident of a U.S. state with a comprehensive consumer privacy law — including the California Consumer Privacy Act (CCPA/CPRA), the Colorado Privacy Act (CPA), the Virginia Consumer Data Protection Act (VCDPA), the Washington My Health My Data Act (MHMDA), and comparable laws — you may have the following additional rights:

• Right to Know / Access: The right to know what Personal Data we collect, use, disclose, and (where applicable) "sell" or "share," and to obtain a copy.
• Right to Delete: The right to request deletion of Personal Data we have collected from you, subject to legal exceptions.
• Right to Correct: The right to correct inaccurate Personal Data.
• Right to Opt Out of Sale/Sharing, Targeted Advertising, and Profiling: As described in Section 9A, including recognition of the Global Privacy Control.
• Right to Limit Use of Sensitive Data: The right to limit our use and disclosure of sensitive Personal Data (including consumer health data) to what is necessary to provide the Services you requested, consistent with our opt-in approach in Sections 3B and 9A.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights.
• Right to Appeal: If we decline to act on your request, you have the right to appeal that decision. To appeal, reply to our decision or contact us at privacy@caseworth.io with the subject line "Privacy Request Appeal." We will inform you in writing of our decision on the appeal and its reasons. If your appeal is denied, you may contact your state attorney general to submit a complaint.

Automated Decision-Making and Profiling (Lexstimate)

Lexstimate uses automated processing, including AI models, to profile and estimate the potential value of a case from the information you provide. This is intended as an informational estimate to help you and, where you choose, prospective attorneys; it is not legal advice and is not a solely-automated decision that produces a legal or similarly significant effect on you without human involvement. Where applicable law grants you the right, you may opt out of profiling in furtherance of such decisions (see Section 9A), request meaningful information about the logic involved, and request human review. Because profiling is core to how Lexstimate works, opting out may mean we cannot provide that specific report.

To exercise any of these rights, please contact us using the details in Section 12. We will verify your request as required by law and respond within the timeframes those laws provide. An authorized agent may submit a request on your behalf where permitted.

11. Updates to the Privacy Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this Policy indicates when it was last revised. We will notify you of any material changes by posting the new Privacy Policy on this page or by other means.

12. How to Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

Caseworth, CO. (a Delaware corporation)
131 Continental Drive, Suite 305
Newark, Delaware 19713
Email: privacy@caseworth.io
Support: support@caseworth.io
Phone: 850-732-8846

13. Terms of Service and Compliance References

This Privacy Policy is an integral part of our Services and should be read in conjunction with our Terms of Service and Cookie Policy.