Privacy Policy

Last updated: August 15, 2026

1. Who we are and when this policy applies

TJA Development Ltd (company number 08850893), registered in England and Wales and trading as Claimsight ("we", "us", "our"), provides a claim-evidence submission and analysis service.

We act as a controller for personal data used to run our own website and business, including customer accounts, billing, support, service security and legal compliance.

For claim evidence submitted under a customer's instructions, the insurer, claims handler, managing general agent, law firm or other customer normally acts as the controller, and we act as its processor. In that situation, the customer's privacy notice explains why the claim data is used. We process it only under the customer's documented instructions and the applicable customer agreement.

Registered office: 24 Beechwood Road, Beechwood Road Easton-In-Gordano, Bristol, BS20 0NA
Email: privacy@claimsight.io

2. Personal data and where it comes from

Depending on how the service is used, we may receive:

account and business-contact information, including name, organisation, email, login, billing and support details;
claim and case references supplied by a customer;
evidence images and information within them, including people, property or other contextual information;
file, capture and device context associated with submitted evidence, which may include timestamps, location information and device identifiers where the device user has provided permission;
claimant invitation and submission records;
technical and security information, including IP address, browser or device information, timestamps, authentication events and audit records; and
payment status and invoice information. Payment-card details are handled by the relevant payment provider.

We obtain this information directly from customer users and claimants, from the customer that issued an invitation, automatically when the service is used, and from service providers acting on our behalf.

Evidence can contain sensitive information, such as health information visible in an injury image, information about children, or information relating to alleged offences. Analysis outputs linked to an identifiable person may also become criminal-offence data if a customer uses them to allege, prevent, detect or investigate fraud or another offence. Before that live use, the customer must document the applicable Article 6 basis, Article 10 and Data Protection Act 2018 condition and safeguards, or obtain an approved legal determination that the intended use does not involve criminal-offence data.

3. How we use personal data

Where we act as a processor, we use claim evidence to provide the customer-directed service: invitation, upload, storage, integrity and provenance checks, image manipulation analysis, result and report generation, evidence export, support, security, audit and agreed deletion or return.

Where we act as a controller, we use personal data to:

create and administer customer accounts and subscriptions;
provide support and service communications;
secure, monitor and maintain the service;
prevent and investigate misuse;
administer billing and business records; and
comply with legal, regulatory and law-enforcement obligations.

We do not use customer evidence or customer personal data to train or fine-tune a general-purpose or customer-independent model unless the customer has expressly agreed this in writing. We may use statistics that no longer identify a customer or individual to understand service reliability and usage.

4. Lawful bases

For processing where we are controller, our lawful bases may include:

contract, where processing is needed to provide an account or service;
legitimate interests, including service administration, security, fraud and abuse prevention, support and business operations, where those interests are not overridden by individual rights;
legal obligation, where the law requires processing or retention; and
consent, where we specifically request it and it can be withdrawn.

The customer controller determines and documents the lawful basis for its claim-handling purposes and any additional condition required for special-category or criminal-offence data. Contact the relevant customer for details of that basis.

5. Automated analysis and human review

The service performs automated technical analysis of submitted evidence and may produce manipulation-confidence indicators, evidence descriptions and limitations. These outputs can be incomplete or incorrect. They are not a finding of fraud, liability, coverage, settlement or legal outcome.

Claimsight does not make a solely automated adverse claim decision. The customer is responsible for meaningful human review and for any decision affecting a claimant. A claimant who wants an explanation, correction, human reconsideration or to challenge an outcome should contact the organisation handling the claim. We will assist that organisation under the applicable data-processing terms.

6. Who receives personal data

Personal data may be disclosed only as needed to:

the customer and its authorised users;
service providers supporting hosting, communications, billing, monitoring, support and evidence analysis;
professional advisers such as legal, accounting and insurance advisers; and
regulators, courts, law-enforcement or public authorities where disclosure is required or permitted by law.

Service providers are subject to appropriate confidentiality and data-protection obligations. The exact sub-processors, functions, locations and transfer arrangements applicable to a live customer are recorded in that customer's approved processing schedule. A summary is available at /sub-processors.

7. International transfers

The customer processing schedule identifies approved processing and remote-access locations. Where a restricted transfer is required, we use an applicable adequacy regulation or appropriate safeguard, such as the UK International Data Transfer Agreement or UK Addendum, and complete any required transfer assessment or data protection test.

8. Retention and deletion

We keep controller data only for as long as needed for the purposes above, including legal, accounting, dispute and security requirements.

Customer claim data is retained, returned and deleted under the customer's documented instructions and agreed processing schedule. Legal holds or legal obligations can require longer retention. Active and backup deletion periods may differ and are agreed before live claimant data is accepted. Our general retention summary is available at /retention.

9. Your data-protection rights

Depending on the circumstances, you may have rights to access, correct or erase personal data; restrict or object to processing; receive portable data; withdraw consent; and request safeguards relating to automated decisions.

For claim evidence, contact the insurer, claims handler, managing general agent, law firm or other organisation handling the claim. It is normally the controller and can identify the relevant claim and decide how the request applies. You may also contact privacy@claimsight.io; we will route or support the request without requiring you to identify internal systems.

For data we control directly, contact privacy@claimsight.io. We may need to verify identity and authority before responding. More information is available at /data-rights.

10. Complaints

Please contact privacy@claimsight.io first if you are unhappy with how we handle personal data. You may also complain to the Information Commissioner's Office:

Website: https://ico.org.uk
Helpline: 0303 123 1113

If another organisation controls the relevant claim data, you may also complain directly to that organisation.

11. Security

We use organisational and technical measures intended to protect personal data, including access controls, encryption, private evidence storage, audit records, resilience controls and incident procedures. No system is completely secure. Customer users are responsible for protecting their credentials and reporting suspected compromise promptly.

Our public security overview is available at /security.

12. Cookies, links and external services

We use essential cookies and similar storage needed for authentication, security and service operation. If we introduce non-essential cookies, we will request consent where required.

The service may link to external sites. Their privacy practices are governed by their own notices.

13. Changes to this policy

We may update this policy when the service, law or processing changes. We will update the date above and provide additional notice where a change materially affects individuals.