Legal
Privacy Policy
We collect only what you type into our two forms, we never accept protected health information here, and we do not sell your information.
Effective August 27, 2026
Who we are
Physician Case Review is a physician-led medical-legal consulting practice serving attorneys, law firms, and insurers. This policy covers www.physiciancasereview.com and the two forms on it. It does not cover the separate, secure channel used to transfer case materials after an engagement begins. That channel is governed by your engagement agreement and, where applicable, a business associate agreement.
- Legal entity: Physician Case Review, LLC.
- Mailing address: PO Box 3115, Kennesaw, GA 30156, United States.
- Privacy contact: [email protected]. This address reaches the person accountable for privacy at Physician Case Review, and is the address to use for any request or complaint described in this policy.
This service is directed to users in the United States and Canada. Dr. Bansal is licensed to practice medicine in Georgia (USA) and British Columbia (Canada), and we accept matters in both countries.
The short version
- We collect what you type into the contact form or a resource form. Nothing more.
- Do not send protected health information through this website. We do not want it here and we are not set up to receive it here.
- We do not sell your information, and we do not share it for cross-context behavioral advertising.
- We use three service providers to run the site and deliver email. They are named below.
- One cookie is set, and only to remember your cookie choice.
- Your information is stored and processed in the United States, including if you are in Canada.
- You can ask us to access, correct, or delete what we hold, and you can unsubscribe from educational email at any time.
Information you give us
The consultation form at /contact/ collects your name, your firm, your email address, your phone number, a case type selected from a list, and a brief non-clinical description of the matter. Name and a valid email address are required. Everything else is optional.
The resource forms at /resources/ collect your name, your firm, your email address, and your phone number, along with a record of which resource you requested. Name and a valid email address are required.
Both forms include a hidden field that is never shown to you. It exists to catch automated submissions. If it is filled in, the submission is discarded and nothing is sent anywhere.
Information collected automatically
Your IP address is sent to Cloudflare Turnstile when you submit either form. Turnstile is the anti-spam check you complete before submitting. It uses your IP address to distinguish a person from an automated script. We do not store your IP address ourselves.
The site is hosted on Cloudflare Pages, and Cloudflare processes standard request information such as IP address, user agent, and requested URL in the ordinary course of serving and protecting the site.
We do not currently run any analytics, advertising pixels, or tracking scripts. If we add analytics in future, it will load only after you accept cookies, and this policy and the cookie table below will be updated first.
No protected health information
Please do not submit protected health information (PHI), patient identifiers, medical records, or privileged material through this website. The case description field is for a brief, non-clinical summary only.
If you send PHI through a website form anyway, it will pass through our email provider and reach our inbox, which is not the controlled channel we use for case materials. We will delete it from that inbox once the matter is either declined or moved onto the secure channel, and we will tell you it happened. Secure transfer of case materials is arranged separately, after intake and a conflict check, with appropriate controls in place.
How we use your information
We use what you submit to:
- respond to your inquiry and answer your questions;
- run a conflict-of-interest check before any substantive discussion of a matter;
- prepare and propose an engagement where appropriate;
- deliver the resource you requested and send you a copy by email;
- send occasional educational email, but only if you requested a resource (see below);
- maintain our own records of inquiries received and conflict checks performed.
We do not use your information to make automated decisions about you, and we do not profile you.
Who we share it with
We do not sell your personal information. We do not share it for cross-context behavioral advertising. We do not disclose it to anyone outside the operation of Physician Case Review, except where required by law or a valid legal process.
We use these service providers:
| Provider | What it does | What it receives |
|---|---|---|
| Cloudflare | Hosts the site, runs the form handlers, and provides the Turnstile anti-spam check | Standard request data including your IP address; your IP address and the Turnstile token at form submission |
| Resend | Delivers email: our internal notification, your confirmation, and resource delivery | The contents of those emails, which include the fields you submitted |
| HubSpot | Contact management. Not currently enabled. If we enable it, this policy stays accurate because the row describes what it would receive | Your name, firm, email, phone, and which form you used. It would not receive your case description |
Note that on the consultation form, your case description and case type are included only in the internal notification email. They are not sent to any contact-management system.
Where your information is processed
All three providers are based in the United States, and your information is stored and processed
there. Cloudflare serves the site and runs the form handlers from its United States infrastructure.
Resend delivers our email through Amazon Web Services in the us-east-1 region, in Northern Virginia.
HubSpot, if we enable it, is likewise United States based.
This applies to everyone, including visitors in Canada. If you are in Canada, your personal information is processed outside Canada. While it is in the United States it is subject to United States law, and may be accessible to United States courts, law enforcement, and regulatory authorities under lawful access powers, regardless of where you live.
We tell you this because you are entitled to know it before you decide what to send us, not because it is unusual. Almost any web form you fill in is handled this way.
Marketing email
The two forms are treated differently, deliberately.
- The consultation form does not sign you up for anything. We use it to reply to you. It carries no marketing consent and we will not add you to an educational email list from it.
- The resource forms do include consent to educational email. The form says so above the submit button: by requesting a resource, you agree to receive occasional educational emails from Physician Case Review.
Every marketing email includes an unsubscribe link. You can unsubscribe at any time, and doing so does not affect our ability to reply to a consultation request.
Cookies
We set exactly one cookie today.
| Cookie | Purpose | Set without consent? | Expires |
|---|---|---|---|
pcr_consent | Remembers whether you accepted or rejected non-essential cookies, so the banner does not reappear on every page | Yes. It is strictly necessary, and it exists only to record your choice | 12 months |
The banner offers “Accept all” and “Reject non-essential” with equal prominence, and you can change your choice at any time using Cookie settings in the footer.
Accepting today loads nothing extra. We have not yet added analytics or marketing scripts, so there is currently no non-essential cookie to accept or reject. The consent mechanism is in place ahead of time. If we add analytics later, accepting will load it and this table will be updated to list it before that happens.
Cloudflare Turnstile may set its own cookie or use local storage on the pages that carry a form, as part of the anti-spam check. This is a security function that must run before you can submit, so it is not gated behind the consent banner. It is not used to track you across sites, and it is not used for advertising.
We do not use cookies to collect protected health information.
How long we keep it
How long we hold information depends on what it is and why we hold it:
- Inquiries that do not become engagements: 24 months from last contact, then deleted.
- Conflict-check records: retained permanently, for as long as the practice operates. A conflicts log with a deletion date stops doing its job, because the matter you screened years ago is exactly the one you need to catch. These records are minimal, covering party names, dates, and the outcome of the check, not case materials.
- Engagement records: five years following the conclusion of the engagement, then securely destroyed, as set out in section 17 of the Terms of Use and Disclaimers. An engagement agreement, a litigation hold, or a professional or legal retention obligation can extend that.
- Educational email subscribers: until you unsubscribe, plus a suppression record afterwards so we do not email you again by mistake.
We hold no database of our own. Information lives in our email system and, if we enable it, our contact-management system. Their retention settings therefore also apply.
Security
We take the following concrete measures. We describe them plainly rather than claiming that any site is perfectly secure, because none is.
- The site is served only over HTTPS, with HSTS.
- A strict Content Security Policy is enforced, with no inline scripts permitted.
- API keys and provider tokens are held server-side only and are never exposed to the browser.
- Form input is length-capped and escaped before it is placed into an email.
- We do not accept PHI through this website, which is itself the most important control here.
- Case materials, once an engagement begins, are handled through a separate secure channel with access controls, not through this site.
No method of transmission over the internet is completely secure. If you have something sensitive to send, wait for the secure channel.
Your choices and rights
You can ask us to:
- tell you what personal information we hold about you;
- correct it if it is wrong;
- delete it, subject to any conflict-check or legal retention obligation we must honor;
- stop sending you educational email.
Use the privacy contact address in the first section. We will respond within a reasonable period and will verify your identity before acting on a request, in proportion to the sensitivity of what is being asked.
If you are a California resident, the California Consumer Privacy Act gives you rights to know, delete, correct, and opt out of sale or sharing, and a right not to be discriminated against for exercising them. We do not sell your personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of, but the rights to know, delete, and correct apply and you can exercise them at the address above. You may use an authorized agent.
Residents of other states with comparable privacy statutes may exercise equivalent rights the same way. We do not require you to be a resident of any particular state, province, or country to ask.
If you are in Canada
Dr. Bansal is licensed in British Columbia and we accept matters in Canada, so this policy is written to apply there as well as in the United States. The federal Personal Information Protection and Electronic Documents Act (PIPEDA) applies to our handling of your personal information, and in British Columbia the provincial Personal Information Protection Act (PIPA) applies.
Accountability. Physician Case Review, LLC is responsible for the personal information in its custody. The privacy contact address in the first section reaches the person accountable for it.
Consent. We collect only what you type into our two forms, and we use it for the purposes set out in “How we use your information” above. By submitting a form you consent to that use. You can withdraw your consent at any time by contacting us, subject to any legal or professional obligation we must still meet, such as retaining a conflict-check record. Withdrawing consent may mean we cannot continue to help you with an inquiry.
Access and correction. You may ask what personal information we hold about you, ask us to correct it, and ask us to delete it. Use the privacy contact address. We will verify your identity in proportion to the sensitivity of the request before acting on it.
Processing outside Canada. Your information is stored and processed in the United States and is subject to United States law while it is there. See “Where your information is processed” above, which sets out who holds it and where.
If you are not satisfied. Please raise it with us first, at the privacy contact address, so we have a chance to put it right. If you remain unsatisfied, you may complain to the Office of the Privacy Commissioner of Canada, and in British Columbia to the Office of the Information and Privacy Commissioner for British Columbia. Both publish their complaint procedures and current contact details on their own websites.
Children
This site is aimed at attorneys, law firms, and insurers. It is not directed to children, and we do not knowingly collect information from anyone under 18. If you believe a child has submitted information to us, contact us and we will delete it.
Links to other sites
The site links to external sources, studies, and professional organizations. We do not control those sites and this policy does not apply to them.
Changes to this policy
We will update this page when our practices change, and we will change the effective date at the top. If a change is significant, we will say what changed rather than quietly replacing the text.
Contact us
For any question about this policy or to exercise a right described above, contact us at [email protected], or write to us at PO Box 3115, Kennesaw, GA 30156, United States. You can also use the contact form, though please do not put personal information you want deleted into a form that creates a new record.