Doxa Privacy

Privacy obligations don’t scale down. A 40-person company faces largely the same disclosure requirements as a large enterprise, usually without a privacy office or counsel on retainer. Most rely on a privacy policy generated once from a template, while their websites keep adding analytics, pixels and chat tools the notice never mentions. Doxa Privacy closes that gap with a structured, evidence-based process. Evidence before drafting. Template generators start by filling in a company name. Doxa starts by showing what a client’s current notice is missing, so every revision is tied to a documented gap rather than a guess. Website Screening. The free scanner reviews a live website privacy notice against ten standard disclosure elements, including categories of personal information, purposes of use, third-party recipients, sale and sharing, retention, consumer rights, and Do Not Track response. It returns a Disclosure Coverage Score with each gap explained in plain language. No account is required. Profile. A short Compliance Profile questionnaire identifies which regulations likely apply based on the organization’s industry, data practices and customer base. Document. Doxa generates regulation-specific Privacy Notices: Regulated sectors included. Doxa builds GLBA and HIPAA notices alongside state privacy notices (CCPA/CPRA, CalOPPA), which general-purpose policy generators often don’t cover. CCPA/CPRA notice at collection and privacy policy CalOPPA privacy policy GLBA privacy notice based on the Regulation P model form HIPAA Notice of Privacy Practices, with Part 2 and state-law modules A general multi-state privacy notice for organizations outside healthcare and financial services Assess. Privacy Impact Assessments include data mapping, a risk register, a mitigation plan and an executive summary. An optional module evaluates the privacy risks of an organization’s own AI systems and automated decision-making technology (ADMT). Method. Doxa’s analysis is grounded in contextual integrity, the framework developed by privacy scholar Helen Nissenbaum. Rather than asking only whether data is collected, it asks whether each information flow fits its context. That gives counsel a defensible, documented basis for the disclosures made. For legal and advisory practices. The Practitioner plan offers unlimited notices across all regimes with bulk client management. The Firm/Agency plan adds white-label delivery under the firm’s own brand, API access and a dedicated account manager. Attorneys stay the reviewer of record while Doxa handles structure and first drafts. Doxa provides privacy risk screening and documentation, not legal advice. Automated scan results are heuristic and point-in-time.