Privacy Policy

Last updated: 27 October 2026

Who we are: REMEDY LEGAL TECHNOLOGY LTD ("Remedy", "we", "us"), a company registered in England and Wales. Company number 16535799. Registered office: 41 Mitchell Street, London, England, EC1V 3QD. Contact: hello@remedylegal.ai. For privacy and data protection requests: legal@remedylegal.ai.

We are registered with the UK Information Commissioner's Office (ICO), registration reference ZC031343.

We are the data controller for personal data we collect and use through our public website (the Site), our logged-in web application (the Platform), and the messaging channels we offer (including WhatsApp and email). This policy explains what we collect, why, how long we keep it, who we share it with, and your rights.

We are UK-only and our services are intended for people aged 18+. If you are under 18, please do not use the Platform.

Plain-English summary (not a substitute for the full policy)

• We collect what we need to run Remedy: your account details, the content and documents you put into your matter, messages you exchange with our AI assistant and our team, and usage and device data.
• Some features are AI-powered. The content of your matter (including messages, uploaded documents, and any email you choose to connect) is processed by vetted third-party AI providers under contract so we can deliver those features.
• If you connect your email inbox (Google/Gmail) or message us on WhatsApp, we describe separately below exactly what we access and how it is used.
• People may read your matter. Our support team, and (where relevant) the vetted partner organisations we work with, can see matter content in order to help you.
• We do not sell your personal data and we do not use it to train third-party AI models.
• Non-essential cookies and analytics require your consent, which you control through our cookie banner. See our Cookie Policy.
• You have UK GDPR rights (access, erasure, objection, and others). Email legal@remedylegal.ai to exercise them or to complain. You can also complain to the ICO.

1) What this policy covers

This policy applies when you visit the Site, use the Platform, or interact with us over our WhatsApp or email channels. It does not cover third-party websites or services we link to, including the websites of any partner organisation that takes on your matter. Check their own privacy notices.

2) What we collect

Depending on how you use Remedy, we may collect the following:

A. Account and identity data: name, email address, and (if you sign in by phone) mobile phone number; password (stored only as a secure hash). If you sign in with Google or Apple, we receive the basic profile information they share (typically name and email) for authentication only. If you choose to give one, your contact preference: when and how you would like to be contacted, with an optional short note.

B. Contact and support data: messages you send us (including complaints) and the information needed to respond.

C. Matter data and documents: the information, facts, timelines, and files you upload or enter into the Platform to manage your housing matter. Because housing matters can involve sensitive circumstances, this content may contain special category or criminal-offence data (see section 3).

D. AI interaction data: the messages, questions, voice notes, and prompts you send to our AI assistant; the assistant's outputs; and any feedback you give on those outputs.

E. Connected email data (optional): if you choose to connect a Google/Gmail inbox, the email content and metadata we access on your instruction. See section 7 for the detail, including our Google "Limited Use" commitment.

F. Messaging data (WhatsApp/SMS): if you contact us or receive messages over WhatsApp or SMS, your phone number and the content of those messages. See section 8.

G. Usage and device data: IP address, device and browser type, app version, pages viewed, actions taken, diagnostics, and crash logs. Collected via our systems and, where you consent, analytics tools. See the Cookie Policy.

H. Marketing preferences: your communication preferences and opt-in/opt-out records (for example, newsletter subscriptions).

I. Marketing attribution data: if you first arrive at Remedy from an ad or a marketing link, the campaign parameters and advertising click identifiers (for example, a Google Ads or ChatGPT ads click ID) present on the page you landed on, together with the landing page address and referring site. We store this and link it to your account if you sign up, so we can measure which of our marketing works (legitimate interests). See section 9 for the limited way this is shared with the advertising platform.

J. Booking data: if you book a call or meeting with one of our team, through a booking page or from your matter: your name, email address and time zone, the time you chose, any note you add, and any place you suggest for an in-person meeting. If you are signed in, we take your email address from your account. For a call, we only call a verified number: the one on your account, or one you confirm by entering a code we text to it. If you book a call without an account, you give us that number instead of an email address, and we send your confirmation and reminders by text. A booking made from your matter is linked to that matter and its task. We record the meeting in the staff member's Google Calendar (see section 9). An online meeting is a Remedy Video call, which you join by a link in your booking messages, or, while Remedy Video calls are not available, a Google Meet, which you join by its Google Meet link. We also record when we send you a confirmation, a reminder or a notice of a change.

K. Meeting audio (optional): staff may record a conversation linked to your matter, whether in person or on a phone or video call, including the voices and information shared by participants. A phone or video call that staff record in their browser is recorded through their microphone, so the recording holds what their microphone hears, including anyone else on the call. For a recording staff start themselves, they must give the recording notice and check for objections before starting. You can ask staff not to record. Audio is available to authorised Remedy and partner staff working with the matter, and is kept separately from client-facing files. Once a recording is saved, it is sent to Google (Vertex AI) in the EU to be turned into a written transcript (see section 5). The transcript labels speakers neutrally ("Speaker 1", "Speaker 2"), and staff may then name each speaker, either as a person on the matter or the booking, or by typing a name. Staff of an organisation working on your matter can then ask for draft call notes, with follow-up actions: the transcript, with the speakers' names, whether each is one of that organisation's advisers, other staff or on the client's side, your name for the greeting, and the names of everyone on the client's side of your matter, so that each follow-up action goes to the right person, is sent to Anthropic (Claude) in the United States to draft them (see sections 5 and 10). The call notes are a draft only that organisation can see until a member of its staff checks and edits them and sends them to you. The follow-up actions are drafted as proposed tasks in the draft note: staff check them with the rest of the note, and they become tasks on your matter, for you or someone else on your side of the matter, or for an organisation working on your matter, only when staff send the note. Once sent, the note appears in your matter's files like any other note from them, and the note and its tasks are kept with your matter even if the recording is later erased. The transcript is available only to staff in the same way as the audio, and is deleted with the recording, as are any suggested follow-up actions that older drafts kept for staff only. Staff may also phone you from your matter through Twilio, in its Ireland region. These calls are recorded from when you answer, and the staff member tells you at the start of the call that it is being recorded. You can ask them not to record, and they will stop and discard the recording. Twilio carries the call and holds its record, which includes your number, and any recording only until we have copied the recording to your matter, or, if it cannot be copied or is not wanted, until our staff discard it. We then delete them at Twilio. A recorded call is handled like any other meeting audio. Staff may also hold a video call with you from your matter, on Remedy, through Amazon Web Services (AWS) in London. They invite you by a link sent by text to your verified phone number, or by email, or that they give you themselves. The link alone does not let anyone into the call: you must also be signed in to your Remedy account, and staff then let you in from a waiting room. The link works in one browser at a time. It stops working if staff withdraw it, 2 hours after it was sent if you have not used it, or when the call ends. We store only a scrambled (hashed) form of the link and of a secret your browser keeps for the call, and delete them once the call is over. The call's video and sound pass through AWS while the call is live. AWS also holds the IP address and call-quality data of each person on the call, as part of running it. We never record the video: the people on the call see you, and anything your camera shows, but none of it is kept. We do record the call's sound, from when staff first let you in. Before you ask to join, the page tells you that we record the call's sound and not its video, and everyone on the call sees when recording is on. Staff can pause, stop or discard the recording at any time, and you can ask them to. While it is paused, no sound is sent to be recorded. Each person's sound is recorded separately. AWS holds it for at most 24 hours, and after the call we copy it to your matter as one recording, with a separate track for each person, named from the Remedy account of the person speaking. A discarded recording is never copied, and its copy at AWS lapses within 24 hours. A recorded video call is then handled like any other meeting audio: each person's track is transcribed separately, and the tracks are deleted with the recording. A meeting you book with us on Remedy Video is a Remedy Video call too. The link in your booking messages opens it once the staff member has started it. For a booking from your matter, you join it the same way, signed in to your Remedy account. If the booking is not linked to a matter, anyone with its link can ask to join by typing a name, which the staff member sees and which we keep with the call's record, and the staff member decides whether to let each person in; such a call is never recorded. If you erase your account or your booking, we clear the names typed to join its calls.

L. Staff activity on Priorities: if you work for Remedy or a partner organisation and use Priorities, the list of what needs your organisation now, we record each time you snooze an item on it or bring one back early, except an invitation for you to join an organisation: who you are, the organisation whose list you were using, which item, until when, and when you did it.

Payments. Where you purchase a paid service, payment is handled by our payment processor, Stripe. Your card details are provided to and handled by Stripe and are not stored by us. We share with Stripe your account email address (if your account has one), the service you are buying and its price, and our own reference for the purchase. Stripe also uses payment information as an independent controller for its own purposes, such as preventing fraud and meeting its legal obligations, under its own privacy policy. We keep records of the transaction (amount, date, service purchased) to meet our accounting and tax obligations.

Children. Our services are for 18+. We do not knowingly collect data from children.

3) Special category and criminal-offence data

Remedy is not a law firm. Housing matters can nonetheless involve special category data (for example, information about health, disability, or vulnerability) and criminal-offence data (for example, allegations of anti-social behaviour). We ask you not to share such data unless it is genuinely necessary for your matter. If you give a health, disability or safety reason in the note on your contact preference, we treat that as special category data too.

Where this data is necessary, we rely on one or more of: your explicit consent; the condition for the establishment, exercise, or defence of legal claims; and the substantial-public-interest and related conditions in Schedule 1 to the Data Protection Act 2018. For criminal-offence data, we maintain an Appropriate Policy Document as required by that Act, which explains our basis, retention, and safeguards. You can request a copy from legal@remedylegal.ai.

4) How we use your data (purposes and lawful bases)

We only process personal data where we have a lawful basis under UK GDPR:

5) AI features, human involvement, and automated decision-making

Some features use third-party AI providers to process your content. The main categories are:

• Large language model (LLM) providers that power the assistant's reasoning and drafting: Google (Vertex AI / Gemini) and Anthropic (Claude). The content of your matter (messages, document extracts, matter context and, when staff ask for draft call notes, a meeting's transcript) is sent to these providers to generate responses. Depending on the feature and our configuration, this processing may take place in the EU or in the United States (see section 10, International transfers).
• AI tooling providers that the assistant uses to do research on your behalf, such as a web-search provider and a managed-browser provider. Search queries and page content the assistant handles for your matter may pass through these providers.
• A speech-to-text provider that transcribes meeting audio staff record (category K): Google (Vertex AI / Gemini), in the EU. Google receives the recording's audio to produce the transcript, under the same contract terms as our other AI providers, and does not use it to train its models.
• Where we have it switched on, an AI observability provider (Langfuse) that records the assistant's conversations — the messages in a conversation, the results of the tools it used, and the account and matter references that identify the conversation — so we can diagnose failures and improve how the assistant works.

We require all AI providers, by contract, to protect the confidentiality and security of your data and to act only on our instructions. We do not permit them to use your content to train their models, and we do not sell your data.

Human involvement. Our AI assistant responds to you directly within a conversation. It is a tool to help you, not a substitute for professional legal advice, and its output may be incorrect or incomplete, so you should review it before acting. Our team and (where relevant) partner organisations can review and take part in your matter. We do not make solely automated decisions that produce legal or similarly significant effects about you. If that ever changes, we will tell you and explain your rights.

6) Cookies and similar technologies

We use a small number of strictly necessary cookies to keep you signed in and secure, and (with your consent) analytics technologies to understand and improve the product. Non-essential analytics are off until you consent, and you can change your choice at any time through our cookie banner. For the full detail, including the specific tools we use, see our Cookie Policy.

7) Connected email (Google/Gmail)

If you choose to connect a Google/Gmail inbox, we ask Google for permission to read your messages and to send email on your behalf, so the assistant can find relevant correspondence for your matter and send letters or replies that you direct. We request only the scopes we need (gmail.readonly and gmail.send); we do not request permission to delete your email or manage your whole account.

When you ask the assistant to look at your inbox, the content of the relevant messages (including bodies and attachments) is processed by our AI providers under section 5 in order to help with your matter. We store your connection tokens securely on our servers and never expose them to your browser. You can disconnect at any time, which revokes our access with Google on a best-effort basis.

Google "Limited Use" commitment. Remedy's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the features you ask for, we do not sell it, we do not use it for advertising, and we only allow humans to read it where you have given permission, it is necessary for security or to comply with law, or the data is aggregated and anonymised.

8) WhatsApp and SMS messaging

You can interact with Remedy over WhatsApp, and we may send you SMS messages (for example, one-time passcodes). These channels are delivered through our messaging provider. When you message us, we receive your phone number and the content of your messages, and we handle that content as matter and AI-interaction data under this policy. Standard message and data rates from your own carrier may apply.

9) Who can access your data, and who we share it with

Our team. Authorised Remedy staff can access your account and matter content to provide support, resolve issues, and operate the service. Administrative access is restricted and logged.

Partner organisations. Remedy works with vetted partner organisations (which may include advice services and law firms). Where a partner is helping with your matter, their authorised staff may access the relevant matter content within the Platform. Where we hand a matter over to a partner organisation so they can take it on, that organisation becomes an independent controller of the information they receive and will handle it under their own privacy notice. We share matter information with a partner on this basis only where it is necessary to help you and, where required, with your consent.

Service providers (processors). We use third-party providers to run Remedy under contracts that require them to protect your data and act on our instructions. Categories include:

• Hosting and infrastructure (application hosting, database, file storage, backups, content delivery)
• Authentication and security (sign-in, bot/abuse prevention, breached-password checking)
• AI providers (to power AI features and tooling, as described in section 5)
• Communications (transactional email, SMS and WhatsApp messaging, and phone and video calls)
• Scheduling (Google, whose Calendar holds our staff's calendars. When you book a meeting, Google receives your name, the time and your note, your email address if you gave one, the place for an in-person meeting, your phone number for a call we make to you and, for a booking from your matter, a link to that matter. This is written only to calendars in Remedy's own Google Workspace. If you book while signed in with a verified email address, we add you to that calendar event as a guest without Google emailing you, so if your email address is a Google account the meeting may also appear in your own Google Calendar.)
• Payments (card payment processing)
• Analytics and error monitoring
• Operational notifications (internal alerts to our team, for example when someone signs up)
• Professional advisers (legal, accounting) and authorities where required by law

We publish the current list of our sub-processors — what each one does, what it receives, and where it processes it — on our Data & Privacy page, and can also send it on request to legal@remedylegal.ai.

Advertising measurement. If you create an account after arriving from one of our ads, we may tell the advertising platform (currently Google Ads and OpenAI (ChatGPT) ads) that its ad led to an account being created, so we can measure whether our advertising works. Every upload carries the time the account was created and an opaque reference we use to prevent double counting, and none of them carries anything about your matter. Beyond that the two platforms differ. OpenAI receives only its own click identifier, the one it added to the link you clicked, and we send nothing at all where that identifier is absent. Google receives its click identifier where there is one, and additionally a hashed (irreversibly scrambled) form of your email address where your account has one, plus your mobile number in the same hashed form where you have verified one — Google matches these against its own account records, which also means an account created without any Google click identifier can still be uploaded and matched. We never send your name, an unhashed email address or phone number, or any matter content. Each advertising platform acts as an independent controller of this information. We upload nothing unless you have accepted the "marketing" category in our cookie banner — the check is made at the moment the account is created, and no choice, or a rejection, means no upload.

We do not sell your personal data, and beyond the advertising measurement described above we do not share it with third parties for their own marketing.

10) International transfers

We are UK-based, and we prefer providers that process data in the UK or EU. Some providers process data outside the UK (for example, in the United States). Where we make a restricted transfer, we put in place a valid safeguard, which may be: UK "adequacy" regulations (including the UK Extension to the EU-US Data Privacy Framework, the "UK-US Data Bridge", for certified US providers), the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment where appropriate. You can ask us for more detail about the safeguards for a specific provider.

11) How long we keep data (retention)

Meeting audio: recordings, and their transcripts, are kept with your matter until staff erase them or the matter or your account is deleted. Call notes sent to you from a recording, and the tasks they create, are kept with your matter like any other note or task. Deletion is retried if storage is temporarily unavailable. Our storage provider retains recoverable deleted copies for a further seven days. Deleting a staff recorder’s account, or an account that does not own the matter, does not automatically delete audio held on the surviving matter; contact us to request its erasure. Pending audio in the recording tab is held only in memory and is cleared on reload or sign-out. For a video call, each person's sound is held by AWS for at most 24 hours and then lapses; the copy on your matter, with each person's track, is kept and deleted as above.

We keep personal data only as long as we need it for the purposes above and to meet legal and regulatory requirements. In summary:

• Account data: for the life of your account, then deleted (subject to short administrative and backup cycles) when you close your account.
• Matter data, documents, and AI conversation history: while your account is active. When you delete your account, this content is deleted from our live systems as part of the erasure process described in section 12.
• Connected-email tokens: until you disconnect or delete your account.
• Booking records: if you book without a Remedy account, we will clear your name, contact details, note and the meeting's place 12 months after the meeting, and keep the time and who you met. We are still building this automatic clearing, so until it is in place these details are kept, and you can ask us to clear them at any time. If you book with an account, we keep your bookings until you delete your account. We then remove your name, contact details, note and time zone from your bookings and cancel any that have not started. If you booked without an account, you can ask us to do the same. We also remove you from the copy of the meeting in our staff member's Google Calendar. When a booking is cancelled, we delete that copy, unless the staff member's calendar is no longer connected to Remedy. In that case the copy may stay in their calendar until you ask us to remove it.
• Support communications: typically up to 2 years after your query is resolved.
• Security, system, and diagnostic logs: typically up to 24 months.
• Staff activity on Priorities: for as long as we keep the record of the case the item relates to, then deleted with it. If you delete your account, we keep the record without your name or account.
• Transaction records (if you buy a paid service): retained for the period required by tax and accounting law (typically 6 years).

Backups may persist for a limited period after deletion and are overwritten on a rolling cycle. We may retain specific data for longer where we are required to by law or where it is necessary to establish, exercise, or defend legal claims. Our detailed internal retention schedule is available to partners and assessors on request.

12) Your rights

Under UK data protection law you have rights to: access your data; ask us to correct it; ask us to delete it; restrict or object to processing (including objecting to direct marketing); request portability; and withdraw consent where we rely on it. You also have rights in relation to automated decision-making.

To exercise any right, email legal@remedylegal.ai. We may ask for information to verify your identity, and we will respond within one month (extendable by two further months for complex requests, which we will tell you about). There is normally no charge.

You can delete your account from your settings in the Platform, or ask us to by emailing legal@remedylegal.ai. When your account is deleted, we erase it and its associated records (your matter content, documents, and AI conversation history) from our live database. Some data may persist for a limited period in encrypted backups before being overwritten, and some records may be retained where the law requires (see section 11). If you have connected a Google/Gmail inbox, you can revoke our access directly in your Google account at any time.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO):

ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Website: ico.org.uk. Helpline: 0303 123 1113.

13) Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls, secure password hashing, bot/abuse prevention, monitoring, and log sanitisation. No system is perfectly secure, but we work to prevent, detect, and respond to misuse and unauthorised access. If a breach affects your rights and freedoms, we will notify you and, where required, the ICO.

14) Direct marketing

We will only send marketing (for example, our newsletter) where you have consented or where a soft opt-in applies (our own similar services to existing users). You can opt out at any time using the unsubscribe link or by emailing legal@remedylegal.ai. We do not share your details with third parties for their own marketing.

15) Links and third parties

The Site and Platform may link to third-party sites or services, including partner organisations. Their privacy practices are their own; please read their privacy notices.

16) Changes to this policy

We may update this policy from time to time. We will post changes here and update the date above. If a change is significant, we will email you or notify you in the app.

17) Contact us

Questions or requests about this policy: legal@remedylegal.ai. General queries: hello@remedylegal.ai.

Related documents

• Cookie Policy
• Website Terms of Use & Platform Terms of Service