Injury Docs carries medical records, itemised bills, balances, payoff figures and lien numbers between a law firm and a clinic. This policy says what passes through, who can see it, on whose authorisation, and how long it stays.
Last updated 11 September 2026A note on the status of this document. This policy is published ahead of general availability, so that the firms and clinics weighing up Injury Docs can read our intentions in the open rather than after signing. It has not yet been reviewed by counsel. It will be reviewed, and revised where counsel says so, before the service handles live matter data.
Nothing here claims a certification, an audit, a compliance status or a security framework badge — we hold none, and we would rather print that sentence than a logo. The points we have deliberately left open are listed at the end, marked as open, so you can see exactly what is unsettled.
Injury Docs is the exchange between personal-injury law firms and the medical providers who treat their clients. A firm raises a request — records, an itemised bill, a billing ledger, a balance, a final balance, a payoff figure, an affidavit, a certification, a status update, a no-liability-response letter, a MedPay or PIP figure — and the clinic answers it. Each request is an object with a status, an owner and a clock, readable by both sides.
This policy covers the information that moves through that exchange: the Injury Docs product, this website, and the support we give the organisations using them. It applies to the whole of it unless a written agreement with your organisation says otherwise, in which case that agreement governs and this policy explains it.
It is written in plain language on purpose. Where a sentence is a commitment we are making, it reads like one. Where something is not settled, it is listed at the end rather than dressed up.
Three kinds of party appear in almost every sentence below, and it matters which is which.
Account holders are organisations: firms, providers, records custodians and a small number of other case participants we admit. Individual people get access through the organisation that employs them, with a role that decides what they can see.
The categories below are what actually moves. We list them specifically because “personal information” as a single phrase would hide the point: most of this is health information about someone who is not our customer.
We do not ask for, and the product has no place to put, information about an injured person’s finances beyond what appears on a medical bill or a lien.
Almost none of this information comes from the person it is about. It reaches us from:
We hold matter material in order to carry a request from one organisation to the other, to show both sides the same state and the same figures, to derive the balances and outstanding amounts each side sees, to keep the record of what was asked and answered, to raise an exception when something is wrong, and to support the people using it when they ask us to.
On whose instruction matters more than the purpose. The firm decides what to ask for. The clinic decides what to release. For that material we act on their instruction — we hold and move it, we do not decide what it should be used for, and we do not take instructions about a matter from anyone who is not a party to it.
A narrower set of information is genuinely ours to decide about: the account, our invoices, sign-in and error records, and the operational figures described in section 8. We use those to run, secure, bill for and improve the service.
Every disclosure through Injury Docs rests on something the firm holds and the clinic accepts — usually an authorisation or release signed by the injured person or their legal representative, and sometimes a court order, a subpoena or another instrument.
The product treats that as a gate rather than a formality. A request will not send while the gate is unanswered, and it says which gate is missing. The authorisation attached to a request travels with it, so the clinic reads the ask and its authority together instead of hunting for the fax that came separately.
Categories that are protected separately in law — substance-use-disorder treatment, mental-health records, HIV-related information and genetic information among them — appear in no preset. Asking for one of those is a deliberate act, and it raises a finding on the record that the ask was made and by whom.
Two things this gate is not. It is not a legal judgement by us: we do not decide whether an authorisation is valid, sufficient or current, and we do not advise either side on that question. And it does not displace the clinic — the clinic remains the party that decides whether it may release a chart, and it can refuse a request that passed the gate.
Visibility follows the request. A request is visible to the firm that raised it and to the clinic it was sent to, each through its own people and their roles: an intake user and a settlement user at the same firm do not necessarily see the same thing, and your organisation sets that.
Some people at Omnis AI can see matter material. When our own operations desk works a retrieval, chases a custodian or resolves an exception, that is the job. That access is limited to the staff doing it, limited to what the task needs, and recorded. We would rather tell you this plainly than imply that a vendor never looks at anything.
Beyond that, commitments we are willing to be held to:
The provider directory tells a firm, before it sends anything, whether an order will actually arrive: how a location can be reached, what it charges, how long it has taken to answer, and how often requests to it went unanswered. Some of those figures are computed from request records across the service.
Those figures are about organisations — counts, timings and fees for a clinic or a firm. They carry no matter detail, no name, no chart and no health information, and we do not publish figures about the individual people who work at either side. Where a listing’s details have been checked with the clinic itself, we say so and we say when; where they have not, we do not imply otherwise.
Like any service of this kind, Injury Docs runs on infrastructure and tools built by other companies. The categories we use are:
Each is engaged under a written contract that limits it to acting on our instruction, and we do not permit any of them to use matter material for their own purposes. We have not published the named list on this page yet; that list, and a way to be told before it changes, is one of the open items below. Ask at contact@injurydocs.io and we will send you the current one.
Described as practices, because that is what we can honestly describe:
What we are not going to claim: we have not completed an external audit, we hold no certification, and we do not publish a service-level promise about availability. If and when any of that changes we will say so here, with its date and its scope. If your organisation needs to understand our practices in detail before it sends us a single chart, write to us and we will answer specific questions in writing rather than send a brochure.
If material is exposed in a way that affects an organisation using Injury Docs, we will tell that organisation. The wording and the timing of that commitment are on the open list — we would rather leave the number blank than print one counsel has not set.
While an account is open we keep the request record and the material it carried, because both sides rely on it: the firm needs the chart and the ledger for the file, and the clinic needs proof of what it released and to whom.
When an organisation closes its account it can export what belongs to it, after which we delete or return the material. The record of the request itself — who asked whom for what, and when — is kept longer than the material it carried, because it is the trail of a disclosure and both sides may need it years later.
The exact periods, per category, are not printed here yet. They are on the open list. A retention schedule that is wrong is worse than one that is honestly missing.
If you are the injured person, you do not have an account here and there is nothing for you to sign in to. That is deliberate: Injury Docs is a channel between the firm that represents you and the clinic that treated you, and both of them already owe you duties directly.
Start with them. Your law firm holds your file and the authorisation you signed; the clinic holds your chart and is the source of anything medical in it. A request to correct a medical record, for example, is one only the clinic can grant, because only the clinic can say what the record should say.
If you write to us at contact@injurydocs.io, here is exactly what we will do: confirm whether material about you is held in Injury Docs, tell you which organisations put it there, and pass your request to them. We will not alter or release a record on your instruction alone, because the authority to do that runs between your firm and your clinic and not through us. If you tell us to stop, we will tell your firm and your clinic, since they are the ones who can act on it.
Depending on where you live, the law may give you specific rights over this information. We are not going to list them until counsel has set that wording; that is on the open list, and until then the sentence above is what we will actually do.
Injured children are represented in this exchange too. Their records arrive the same way as anyone else’s: on an authorisation signed by a parent, a guardian or a legal representative, or under a court order. The product is sold to organisations, is not directed to children, and nobody under 18 holds an account. We do not knowingly collect anything from a child directly.
The organisations on either side of a request carry their own legal duties. Clinics, hospitals and many custodians are subject to health-privacy law in the United States, including HIPAA and often a stricter state statute as well. Law firms are bound by their duties of confidentiality to their clients and by whatever the authorisation itself permits.
Those duties stay where they are. We do not take them over, and nothing in this policy relieves either side of deciding whether a request is lawful and whether a release is permitted.
Where a provider needs a written agreement with us of the kind that health-privacy law requires of a company handling records on a covered organisation’s behalf, ask us for it before you send anything. We would rather have that in place first than argue about it afterwards. The form of that agreement, and whether we offer it as standard, is on the open list.
To be exact about what the previous paragraphs do and do not say: describing an obligation is not claiming a badge. We are describing obligations. We make no claim of compliance status, certification or audit anywhere on this site.
Injury Docs is built and operated from the United States, and the services it depends on are run from there. If your organisation needs material held or processed in a particular country, or is restricted about where it may go, raise it before you sign and we will give you a straight answer rather than a qualified one.
This policy will change — the next revision is the counsel review described at the top of the page. When we make a change that materially affects how we handle matter material, we will email the owner of each account-holding organisation before it takes effect and change the date at the top. We keep the superseded versions and will send you any of them on request.
One address, read by people who work on this product: contact@injurydocs.io. Write to it about anything in this policy — a question, a request about your own information, a complaint, or a document your organisation needs before it can use the service. Say “privacy” in the subject line and it will be routed to the person who handles these.
We are not publishing a postal address, a telephone number or the name of a designated privacy officer, because printing a channel nobody answers is worse than printing none. A named contact and an address for formal notices are on the open list below and will be here before general availability.
You can also reach us through the contact page.
These are deliberate gaps, listed so that nobody mistakes them for settled. Each will be closed with counsel before Injury Docs handles live matter data, and this page will be dated again when they are.
If one of these is the item standing between your firm or clinic and a decision, write to contact@injurydocs.io and say which one. It moves up the list.