Privacy Policy

RMJ Labs, Inc. d/b/a Andco ("Andco," "we," "us," or "our") is committed to protecting the privacy of the individuals and organizations that use our platform. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website (useandco.com), use our platform, or interact with our Services.

Information You Provide

• Account information: Name, email address, firm name, phone number, and professional credentials
• Case data: Client names, case details, provider information, insurance details, and related records submitted through the platform
• Client portal submissions: Documents, medical authorizations, identification documents, and other files uploaded by your clients through the portal
• Protected Health Information (PHI): Medical records, billing records, and other health-related information processed through the platform on behalf of subscribing law firms
• Communications: Messages, emails, or other correspondence you send to us

Information Collected Automatically

• Usage data: Pages visited, features used, timestamps, and interaction patterns
• Device information: Browser type, operating system, device identifiers, and screen resolution
• Log data: IP address, access times, referring URLs, and error logs
• Cookies and similar technologies: We use cookies and similar tracking technologies to maintain session state, remember preferences, and analyze usage patterns. See Section 9 for more detail.

We use the information we collect to:

• Provide, maintain, and improve the Services
• Retrieve and process accident reports, medical records, and insurance information on behalf of subscribing law firms
• Facilitate document collection and medical authorization signing through the client portal
• Generate AI-powered case workups, medical chronologies, and related outputs
• Communicate with you about your account, updates, and support inquiries
• Monitor and analyze usage trends to improve the platform
• Detect, prevent, and address fraud, security issues, and technical problems
• Comply with legal obligations

We do not sell your personal information. We may share information in the following circumstances:

• Service providers: With third-party vendors who assist in delivering the Services (e.g., cloud infrastructure, fax delivery, document processing), subject to confidentiality obligations
• Case management integrations: With third-party case management systems at your direction and as necessary to provide the Services
• Medical providers and insurers: As directed by subscribing law firms and authorized by executed medical authorizations, to retrieve records and process claims
• Legal compliance: When required by law, regulation, legal process, or governmental request
• Business transfers: In connection with a merger, acquisition, reorganization, or sale of assets, in which case your information may be transferred to the successor entity
• With your consent: When you have given us explicit permission to share information

Andco operates an SMS program for clients of subscribing law firms, described in detail in our SMS Terms & Conditions. When you opt in to receive SMS messages from Andco, the information you provide (including your mobile phone number and the consent record associated with it) is used solely to deliver the messages you have agreed to receive and to maintain records of your consent.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Mobile opt-in data and SMS consent records are not shared with any third parties for any purpose.

All other categories of data may be shared with subprocessors as described in Section 4 (How We Share Information), but mobile opt-in data and SMS consent records are excluded from that sharing. This exclusion applies regardless of any other provision of this Privacy Policy.

You can opt out of the SMS program at any time by replying STOP to any message from Andco. Opt-outs are honored immediately.

Andco processes PHI as a Business Associate under HIPAA. Our handling of PHI is governed by Business Associate Agreements executed with subscribing law firms. We do not use PHI for marketing or any purpose unrelated to providing the Services. PHI is stored and transmitted using encryption and access controls consistent with HIPAA requirements.

We implement administrative, technical, and physical safeguards to protect your information, including:

• Encryption of data in transit and at rest
• Access controls and authentication requirements
• Regular security assessments and audits
• Dedicated, firm-exclusive infrastructure
• Employee training on data handling and privacy practices

While we strive to protect your information, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.

We retain your information for as long as your account is active or as needed to provide the Services. Case data and associated records are retained in accordance with your subscription agreement. Upon termination, data is made available for export for 30 days, after which it may be securely deleted. We may retain certain information as required by law or for legitimate business purposes such as resolving disputes.

We use cookies and similar technologies to:

• Maintain your session and authentication state
• Remember your preferences and settings
• Analyze how the Services are used
• Improve platform performance

You can control cookie settings through your browser. Disabling cookies may limit your ability to use certain features of the Services. We do not use cookies for third-party advertising.

The Services may contain links to or integrations with third-party websites and services. This Privacy Policy does not apply to third-party services. We encourage you to review the privacy policies of any third-party services you access through the platform.

The Services are not directed to individuals under the age of 18 and minors may not create accounts or use the platform directly. In the course of providing the Services, we may process information about minors that is submitted by their parent, legal guardian, or the subscribing law firm on their behalf. This information is handled with the same security and confidentiality protections applied to all case data and PHI.

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of your personal information
• Object to or restrict certain processing of your information
• Request portability of your data
• Withdraw consent where processing is based on consent

To exercise any of these rights, contact us at legal [at] useandco.com. We will respond within 30 days or as required by applicable law.

California Residents

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell personal information.

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the platform. Your continued use of the Services after any changes constitutes acceptance of the updated policy. The "Effective Date" at the top of this page indicates when this policy was last revised.

If you have questions or concerns about this Privacy Policy or our data practices, contact:

RMJ Labs, Inc. d/b/a Andco
Email: legal [at] useandco.com
Website: useandco.com