Legal

Privacy policy

This policy explains what we collect when you ask for a case review, why we collect it, who we pass it to, and what you can ask us to do with it. Because this site asks about an injury, most of what you tell us is information about your health, and this policy is written around that fact rather than around it.

The short version

We collect what you type into the case review form, plus the technical details of the submission itself.
What you tell us about your injury is health information. We treat it as the sensitive category it is, we ask for your explicit permission before we do anything with it, and that permission is the only thing that allows us to pass it on.
We pass your details to one or more independent attorneys or law firms who may be able to help you. That is the entire point of the form, and it is what your consent covers.
Attorneys pay us for that. We never pass your details to unrelated advertisers, data brokers, list buyers, insurers or employers, and you can tell us to stop at any time.
You can ask us to delete everything we hold about you at any time, by emailing contact@compensationguardians.com.

Who is responsible for your data

Compensation Guardians is the controller of the personal data described here. Our publisher details, including the registered company behind the brand, are on the legal notice. You can reach us about anything in this policy at contact@compensationguardians.com.

The company behind Compensation Guardians is established in France, so the EU General Data Protection Regulation applies to our processing wherever in the world the people concerned are located. If you are a United States resident, your state may give you additional rights, which are set out below.

What we collect

What you tell us

Your first and last name, phone number, email address, the state you were hurt in, what happened to you, roughly when it happened, and, on the form at the foot of the home page, where your claim currently stands with the insurer and anything you choose to write in the optional description.

Please do not send us medical records, imaging, social security numbers, bank details or copies of documents. The form does not ask for them and we do not need them. If an attorney needs documents they will ask you directly, through a channel they control.

Information about your health

The form asks what happened to you, and every answer to that question says something about your physical condition. Under article 9 GDPR that is a special category of personal data. Several United States privacy laws reach the same conclusion by a different route and call it sensitive personal information or consumer health data.

We process it only on the basis of the explicit consent you give when you tick the box and submit the form, and only for the purpose that box describes: connecting you with an attorney who may be able to help with your claim. There is no other lawful basis we rely on for it, which means withdrawing your consent stops the processing outright rather than moving it onto some other footing. You can withdraw it at any time by emailing us.

We are not a HIPAA covered entity. HIPAA applies to health plans, clearinghouses and healthcare providers, and we are none of those, so what you send us is not protected by it. That is a reason to send us less rather than more: the categories on the form are enough for an attorney to decide whether to call you, and the detail belongs in the conversation with them.

What the submission tells us

The time you submitted, the page you submitted from, the referring website, any campaign parameters in the link you arrived by, your IP address and your browser’s user agent. The last two are kept as evidence of the consent you gave, because a record of consent that cannot be tied to a submission is not a record of anything.

Why we process it, and on what basis

To connect you with an attorney. Basis: your consent, given by ticking the box on the form. For the health information specifically, your explicit consent under article 9(2)(a) GDPR.
To contact you about your submission, including to check a detail or to tell you nobody is able to take it on. Basis: your consent.
To keep a record of that consent, so we can show what you agreed to and when. Basis: our legal obligation and our legitimate interest in defending a claim.
To detect spam and abuse of the form. Basis: our legitimate interest in keeping the service working.
To measure which campaigns work. Basis: our legitimate interest in running the business. This uses the campaign parameters, not what you told us about your injury. We do not build advertising audiences out of health information and we do not hand it to an advertising platform.
To meet our legal, accounting and tax obligations. Basis: legal obligation.

Who we share it with

Independent attorneys and law firms. This is the purpose of the form. Your details go to one or more attorneys or firms who practice workers compensation law in the state you were hurt in and who handle the kind of claim you described. They are independent businesses and separate controllers of your data once they receive it: how they store it, how long they keep it and how they contact you is governed by their own privacy policy, not ours. We do not control whether any of them decides to contact you or take your case.

Never your employer or their insurer. We do not contact the employer you describe, we do not sell to insurance carriers or claims administrators, and we do not supply data to anything that screens or scores injured workers. Nothing you send us goes to the other side of your claim.

Our service providers. The three companies below process your data on our instructions, under a written agreement, and are not permitted to use it for anything else.

Vercel Inc.: Website hosting and server logs. United States. 440 N Barranca Avenue #4133, Covina, CA 91723.
Supabase Inc.: Database storage for everything you enter on the form. United States. Data is stored in the AWS US East (North Virginia) region.
Telegram: An alert telling us a submission has arrived, so somebody can act on it quickly. Telegram FZ-LLC, Dubai, United Arab Emirates. The alert carries your name, phone number, email address, state, which of the categories on the form you picked, how long ago it happened, and where your claim stands. Because one of those categories describes your injury, the alert does carry health information, in the coarse form the form offers and no finer. It does not carry what you wrote in your own words, only the fact that you wrote something.

Nobody else. We do not sell or rent your personal information to data brokers, list buyers or unrelated advertisers, and we do not use what you told us about your injury to target you with advertising for anything else.

Where required by law, including to respond to a lawful request from a court, a regulator or a law enforcement authority.

International transfers

We are established in France and the attorneys we work with are in the United States, so your data is transferred outside the European Economic Area. So are the services we use to run the site: what you submit is stored by Supabase in the United States, the site itself is hosted by Vercel in the United States, and the alert that tells us you have been in touch is delivered by Telegram in the United Arab Emirates. Your data therefore leaves the EEA from the moment you press the button, before any attorney has seen it.

Where that transfer involves personal data protected by the GDPR, we rely on the European Commission’s standard contractual clauses or on your explicit consent to the transfer, given when you submit the form knowing it is going to a United States attorney, and we check what safeguards are in place before transferring. The United Arab Emirates has no adequacy decision from the European Commission, which is why the Telegram alert is kept to the contact details and the shape of your claim and never carries your own description of your injury.

How long we keep it

Submissions: up to three years from the date you submitted, which is roughly the period during which a workers compensation claim and any appeal may still be live and an attorney may need to come back to it. Then deleted.
Consent records: five years, because that is longer than the period in which a claim about the contact you received could be brought against us.
Suppression lists: indefinitely. If you ask us never to contact you again, we have to keep enough of your details to honour that. A suppression record holds your phone number and email address and never anything about your injury. See our do not call policy.

Your rights

Wherever you are, you can ask us to give you a copy of what we hold, correct it, delete it, or stop using it. Email contact@compensationguardians.com and we will respond within one month. We will not charge you and we will not treat you differently for asking.

If the GDPR applies to you, you also have the right to object to processing based on legitimate interests, the right to data portability, the right to withdraw consent at any time without affecting what we did before you withdrew it, and the right to complain to a supervisory authority. In France that is the CNIL.

If you are a United States resident, your state may give you the right to know what is collected, to delete it, to correct it, to limit how sensitive information is used, to opt out of sale or sharing and of targeted advertising, and not to be discriminated against for exercising any of them.

Consumer health data laws. Washington’s My Health My Data Act and Nevada’s SB 370 give consumer health data its own regime, separate from the general privacy law in those states. If you are covered by one of them, you have the right to know what consumer health data we hold and who we have shared it with, the right to withdraw your consent to our collecting or sharing it, and the right to have it deleted, including from our backups and from anyone we passed it to. Those laws also require your separate, signed authorization before consumer health data may be sold. Email us and we will tell you what we hold, what we shared, and with whom.

About “sale”. Attorneys pay us when we pass them a submission. California and several other states define a sale broadly enough that this may count as one, even though we are doing exactly what you asked us to do and only what the form said we would. We would rather say that plainly than rely on a technicality. You can opt out at any time. Before you submit, opting out means not submitting. Afterwards, email us and we will stop passing your details on and tell you who already has them. We never disclose your information for cross-context behavioral advertising, and we do not knowingly sell or share the personal information of anyone under 16.

Once an attorney has your details they are a separate controller, so a deletion request to us does not reach their copy. We will tell you who we passed it to so you can ask them directly.

How we protect it

Submissions are transmitted over TLS and stored in a database that is not reachable from the public internet with the keys the website uses. Access is limited to the people who need it to run the service. No system is perfect, and we will tell you and the relevant authority without undue delay if a breach affects your data.

Cookies and tracking

This site sets no advertising or analytics cookies of its own. Where a campaign link carries parameters such as utm_source or a click identifier, we read them from the URL and store them with your submission so we know which campaign it came from. Fonts are served from the site’s own domain and no third party script runs on the page. There is no advertising pixel anywhere on this site, which is deliberate: a pixel on a page about workplace injuries reports something about your health to whoever owns it.

Children and changes to this policy

The service is for adults. We do not knowingly collect personal data from anyone under 16; if you believe a child has submitted the form, email us and we will delete it. Minors are injured at work and are entitled to workers compensation like anyone else, and a parent or guardian is welcome to use the form on their behalf.

If we change this policy we will update the date below. Material changes to how we share your data will not be applied retroactively to submissions made under an earlier version. Because our basis for handling health information is your consent, a material change to what we do with it means asking you again rather than announcing it here.

Last updated: 11 September 2026