Privacy Policy
Draft — pending solicitor review before publication.
This page is a placeholder outline, not a finished policy. Sortica processes special-category data under UK GDPR (medical and legal records), so this document must be drafted and signed off by a solicitor before the site goes live — do not treat the text below as binding.
What this policy will need to cover
- Data controller / processor roles between Sortica and each firm
- Lawful basis for processing (Article 6) and special-category basis (Article 9) for medical records
- Data residency: all matter data stored in AWS eu-west-2 (London)
- Retention periods, and the process for a firm to export or delete matter data
- Sub-processors (AWS, MongoDB Atlas, llmapi.ai, Resend) and their own data-processing terms
- Rights of data subjects and how a request is handled
- Contact details for the Data Protection Officer / privacy contact
Questions in the meantime: hello@sortica.co.uk