CounselX P.C.
Data Privacy & AI
Advice on the data your business collects, the terms your customers require, and the AI tools your team wants to use.
Umar Farooq leads every matter.
Nineteen years of practice. More than a thousand companies advised since 2012.
Get in touchOverview
Privacy advice grounded in your product.
A customer asks for a data processing agreement. Your team wants to use an AI tool with confidential information. A new product collects health or children’s data. CounselX reviews the contracts, notices, and policies behind those decisions, and identifies where specialist advice is needed.
How we help
How CounselX can help
01
Data processing agreements
DPAs, service-provider terms, subprocessor terms, and security provisions.
02
Privacy notices and consumer rights
Privacy notices, data-use disclosures, and consumer-rights response procedures.
03
AI vendor and customer terms
Inputs, outputs, training-data use, confidentiality, and risk allocation.
04
Generative AI use policies
Human review and protection of trade secrets and personal information in AI workflows.
05
AI copyright and ownership
AI-related copyright, licensing, and ownership questions, including the limits of protection for AI output.
06
Health-data agreements
Permitted uses, business associate terms where appropriate, and limits on training with patient data.
07
Children's-data and edtech agreements
Parental-consent responsibilities, school and vendor roles, retention, deletion, and advertising limits.
08
Incident preparedness
Breach-notification terms, vendor cooperation duties, and response roles allocated in contracts.
Foreign-law opinions, security audits, and specialist regulatory advice are provided separately.
The rules
Which rules apply?
That depends on the data, the people it concerns, and your business’s role. These are starting points, not a complete list. Foreign-law opinions and specialist regulatory advice are provided by separate counsel.
US state consumer privacy
CCPA, as amended by CPRA, and laws such as the Colorado Privacy Act, Virginia Consumer Data Protection Act, Connecticut Data Privacy Act, and Texas Data Privacy and Security Act, along with the growing number of other state comprehensive privacy laws. Which laws apply depends on where your users live and the thresholds each law sets. Coverage, exemptions, consumer rights, sensitive-data restrictions, and opt-out requirements vary.
California privacy guidanceEU & UK GDPR
Data processing, controller and processor responsibilities, individual rights, and cross-border transfers where applicable. EU GDPR and UK GDPR require separate analysis; foreign-law opinions are provided by qualified separate counsel.
UK GDPR guidanceHIPAA & consumer health data
HIPAA Privacy, Security, and Breach Notification Rules for covered entities and business associates. Outside HIPAA, the FTC Health Breach Notification Rule and laws such as Washington’s My Health My Data Act may be relevant.
HHS HIPAA guidanceChildren’s & student privacy
COPPA and its implementing rule for covered online services involving children under 13; state protections for minors and FERPA-related school and vendor requirements where relevant.
FTC COPPA guidanceSecurity, biometrics & financial data
State breach-notification and data-security laws, New York’s SHIELD Act, Illinois BIPA for qualifying biometric data, and GLBA privacy and safeguards obligations for covered financial activities. Applicability and specialist needs are assessed by use case.
FTC privacy and security guidanceAI & consumer protection
FTC Act prohibitions on unfair or deceptive practices, relevant state AI and automated-decision laws, and EU AI Act considerations for businesses with an EU nexus. AI obligations vary by role, use case, jurisdiction, and applicable implementation dates.
EU AI Act textWorking together
Working together
Project
A DPA, privacy notice, or AI policy can be handled as a project. A typical privacy project starts with a review of the product's data flows and any existing documents.
Get in touchIt then moves to a written analysis of which rules apply and revised or new documents. The client provides a description of what the product collects, who receives the information, and its current policies. The scope and fee are agreed first; technical assessments and specialist advice are separate.
Experience
Representative experience
DPAs and security terms
Data processing agreements and customer security terms negotiated alongside SaaS contracts.
AI vendor contracts
AI vendor agreements reviewed for training-data use, confidentiality, and output rights.
Privacy policies and notices
Privacy and cookie policies and terms of use under GDPR, UK GDPR, and US state privacy laws.
CounselX does not perform security audits or certify compliance.
Client matters are described without identifying details. Prior results do not guarantee a similar outcome.
See representative mattersQuestions
Common questions
Which privacy laws apply to our company?
It depends on where your customers are, what data you hold, your role, and any thresholds or exemptions. GDPR, HIPAA, and state privacy laws do not apply to every business. Start with the product and its data flows.
Can you help with HIPAA and health-data agreements?
Yes, on the contract and policy questions that follow once it is clear which rules apply. HIPAA covers covered entities and business associates, not every health app. Other rules may apply to consumer health data. Specialist healthcare advice is separate.
What if a customer asks for GDPR terms?
CounselX can review and negotiate data processing and transfer terms. EU and UK law opinions and jurisdiction-specific advice require qualified foreign counsel; EU GDPR and UK GDPR are separate regimes.
What should we check before using an AI vendor?
Whether the vendor can train on your inputs, how long it keeps data, who can access it, and what rights you have in the output. Confidentiality, infringement protection, liability, and human review also matter. Check the settings as well as the contract.
Can we use one privacy policy across US states?
Often a shared starting point helps, but state-specific rights, exemptions, sensitive-data rules, and opt-outs still need review. The policy must describe what the business actually does.
What changes if our product serves children or schools?
COPPA generally covers certain online services involving children under 13; state laws may protect older minors. School relationships can raise FERPA-related requirements. A school’s involvement is not permission for advertising or unrelated data use. Consent, use, retention, and deletion responsibilities need review.
Can we put patient information into an AI tool?
Do not assume a business associate agreement permits it. The data, parties’ roles, purpose, and vendor’s uses all matter, including whether data can be used for training. Clinical use, sensitive records, information blocking, and medical-device questions may require specialist advice.
Do you provide security audits or compliance certifications?
No. CounselX handles agreed legal contract and policy work, not security testing or certification. Technical assessments require qualified specialists, and no engagement guarantees compliance.