CounselX P.C.
Data Privacy & AI Counsel
Advice on the data your business collects, the terms your customers require, and the AI tools your team wants to use.
Umar Farooq leads every matter.
Get in touchPrivacy advice grounded in your product.
A customer asks for a data processing agreement. Your team wants to use an AI tool with confidential information. A new product collects health or children’s data. CounselX reviews the contracts, notices, and policies behind those decisions, and identifies where specialist advice is needed.
When to get advice
Get advice before sharing sensitive data, signing a customer’s privacy terms, or launching a product with new data or AI uses.
How CounselX can help
- Data processing agreements (DPAs), service-provider terms, subprocessors, and security provisions
- Privacy notices, data-use disclosures, and consumer-rights response procedures
- AI vendor and customer terms: inputs, outputs, training-data use, confidentiality, and risk allocation
- Generative AI use policies, human review, and protection of trade secrets and personal information
- AI-related copyright, licensing, and ownership questions; output ownership does not guarantee copyright protection
- Health-data sharing and AI vendor agreements: permitted uses, business associate terms where appropriate, and restrictions on training with patient data
- Children’s-data and edtech agreements: parental-consent responsibilities, school/vendor roles, retention, deletion, and limits on advertising uses where applicable
- Incident preparedness: breach-notification terms, vendor cooperation duties, and response roles allocated in contracts
Which rules apply?
That depends on the data, the people it concerns, and your business’s role. These are starting points, not a complete list. Foreign-law opinions and specialist regulatory advice are provided by separate counsel.
US state consumer privacy
CCPA, as amended by CPRA, and laws such as the Colorado Privacy Act, Virginia Consumer Data Protection Act, Connecticut Data Privacy Act, and Texas Data Privacy and Security Act. Coverage, exemptions, consumer rights, sensitive-data restrictions, and opt-out requirements vary.
California privacy guidanceEU & UK GDPR
Data processing, controller and processor responsibilities, individual rights, and cross-border transfers where applicable. EU GDPR and UK GDPR require separate analysis; foreign-law opinions are provided by qualified separate counsel.
UK GDPR guidanceHIPAA & consumer health data
HIPAA Privacy, Security, and Breach Notification Rules for covered entities and business associates. Outside HIPAA, the FTC Health Breach Notification Rule and laws such as Washington’s My Health My Data Act may be relevant.
HHS HIPAA guidanceChildren’s & student privacy
COPPA and its implementing rule for covered online services involving children under 13; state protections for minors and FERPA-related school and vendor requirements where relevant.
FTC COPPA guidanceSecurity, biometrics & financial data
State breach-notification and data-security laws, New York’s SHIELD Act, Illinois BIPA for qualifying biometric data, and GLBA privacy and safeguards obligations for covered financial activities. Applicability and specialist needs are assessed by use case.
FTC privacy and security guidanceAI & consumer protection
FTC Act prohibitions on unfair or deceptive practices, relevant state AI and automated-decision laws, and EU AI Act considerations for businesses with an EU nexus. AI obligations vary by role, use case, jurisdiction, and applicable implementation dates.
EU AI Act textWorking together
A DPA, privacy notice, or AI policy can be handled as a project. Recurring questions may fit Outside General Counsel. The scope and fee are agreed first; technical assessments and specialist advice are separate.
Relevant experience
The practice includes data processing agreements, customer security terms, and AI vendor contracts alongside the broader technology work. CounselX does not perform security audits or certify compliance.
Client matters are described without identifying details. Prior results do not guarantee a similar outcome.
Common questions
Which privacy laws apply to our company?
It depends on where your customers are, what data you hold, your role, and any thresholds or exemptions. GDPR, HIPAA, and state privacy laws do not apply to every business. Start with the product and its data flows.
Can you help with HIPAA and health-data agreements?
Yes, with contract questions such as business associate agreements where appropriate. HIPAA covers covered entities and business associates, not every health app. Other rules may apply to consumer health data. Specialist healthcare advice is separate.
What if a customer asks for GDPR terms?
CounselX can review and negotiate data processing and transfer terms. EU and UK law opinions and jurisdiction-specific advice require qualified foreign counsel; EU GDPR and UK GDPR are separate regimes.
What should we check before using an AI vendor?
Whether the vendor can train on your inputs, how long it keeps data, who can access it, and what rights you have in the output. Confidentiality, infringement protection, liability, and human review also matter. Check the settings as well as the contract.
Can we use one privacy policy across US states?
Often a shared starting point helps, but state-specific rights, exemptions, sensitive-data rules, and opt-outs still need review. The policy must describe what the business actually does.
What changes if our product serves children or schools?
COPPA generally covers certain online services involving children under 13; state laws may protect older minors. School relationships can raise FERPA-related requirements. A school’s involvement is not permission for advertising or unrelated data use. Consent, use, retention, and deletion responsibilities need review.
Can we put patient information into an AI tool?
Do not assume a business associate agreement permits it. The data, parties’ roles, purpose, and vendor’s uses all matter, including whether data can be used for training. Clinical use, sensitive records, information blocking, and medical-device questions may require specialist advice.
Do you provide security audits or compliance certifications?
No. CounselX handles agreed legal contract and policy work, not security testing or certification. Technical assessments require qualified specialists, and no engagement guarantees compliance.