PRIVACY · DATA GOVERNANCE
This public website is designed to minimize collection of sensitive information. General public channels are not intended for claim files, medical records, government identifiers, credentials, payment information, financial account data, or other protected evidence.
PRIVACY CONTROL MAP
Public-safe operating model only. Actual legal obligations depend on jurisdiction, contractual role, data handled, service scope, and production configuration.
Collection should begin with a defined business purpose, role, authority, and permitted use rather than collecting first and justifying later.
Business contact information submitted to MODLAN may be used to respond to inquiries, evaluate service requests, qualify confidential-briefing requests, and manage legitimate business communications. Public forms are intentionally scoped to business qualification rather than claim or evidence intake.
Hosting, security, and abuse-prevention systems may process limited technical information such as request timestamps, network/address information, user-agent data, request metadata, and security events. Production logging, retention, and monitoring must be configured to minimize data while supporting security, reliability, fraud/abuse prevention, and legal obligations.
When an authorized party enters MODLAN's Secure Disclosure Gateway, MODLAN may preserve technical execution evidence reasonably necessary to authenticate and defend the agreement record. Depending on the approved production configuration, this may include server timestamps, agreement and document hashes, authorization/session identifiers, source-IP-derived evidence, approximate IP-based geographic context, browser/user-agent information, language settings, and audit events. IP-based location is approximate and is not treated as precise physical location or independent proof of identity.
Provide only the information reasonably necessary to begin a business conversation. Sensitive case information should be exchanged only through an approved secure workflow. Where MODLAN performs claims, investigative, evidence, integration, or technology services, the permissible data scope depends on the customer's authority, the engagement, applicable law, contract, and the role MODLAN is performing.
Retention is not treated as a single universal period. Production retention should reflect the service, contractual requirements, evidentiary needs, legal hold, security obligations, and applicable law. Legal hold can suspend ordinary disposition. Final retention schedules remain subject to customer requirements and legal/privacy review.
Production vendors and service providers should be selected and configured according to the data they handle, the function they perform, contractual protections, security requirements, residency/transfer considerations, and any required business-associate or data-processing terms. Public architecture descriptions do not represent that every possible vendor configuration satisfies every regulatory regime.
MODLAN designs controls that can support obligations arising under frameworks and laws such as the Gramm-Leach-Bliley Act (GLBA), the Health Insurance Portability and Accountability Act (HIPAA), and the General Data Protection Regulation (GDPR) when they apply. Applicability and compliance depend on facts including jurisdiction, the parties' legal roles, the data processed, contracts, configuration, and actual operation of controls. This notice does not state that every MODLAN service or deployment is universally subject to—or certified compliant with—those regimes.
MODLAN's production data-handling architecture is designed around access control, encrypted transport/storage where applicable, auditability, document/evidence integrity, least privilege, controlled disclosure, and reviewable retention. Security and privacy controls must still be validated in the deployed environment; architecture alone is not an attestation or legal conclusion.
Privacy, security, contracting, and diligence questions can be raised through the public business-contact path without transmitting sensitive records. Matter data, protected evidence, credentials, and regulated personal information should only move through an approved secure workflow.