You probably didn’t read the legal billing privacy policy when you signed up for your practice management software. Nobody does. That’s what they’re counting on.
But you need to.
I did read them. All of them. And what I found should make every attorney very, very uncomfortable.
You may be asking, how are they getting away with this? Well, it starts with massive consolidation. Keith Porcaro wrote a very good article covering this recently on Bloomberg Law.
TL/DR: These privacy policies, price hikes, and worsening of quality and support will continue. Because if they’re all the same company, they’re betting on lawyers having nowhere else to go. But you and I know that’s not the case. TimeNet Law is, and always will be, 100% independent.
Now, back to these privacy policies. Strap in, it’s gonna get ugly.
Let’s start with the worst one.
MyCase’s Legal Billing Privacy Policy: “We Collect Your Medical Information”
This is a direct quote from MyCase’s privacy policy, buried in their California supplement:
“In addition, we may collect… including insurance policy number, education, employment history, and medical information.”
Medical information. From your legal billing software. Let that sink in.
But it gets worse. Here’s what they admit about your clients’ data:
“Inputs you submit to our AI-powered tools… Such information may include Sensitive Personal Information, including information relating to the cases or financial information of our Customers’ clients.”
Your clients’ confidential case information. Their financial data. Sent to third-party AI models. The LLM providers powering “MyCase IQ” are processing your attorney-client privileged communications.
And here’s how they describe the psychological profiles they’re building on you:
“Inferences: drawn from the information collected, including preferences, characteristics, behavior, attitudes, and aptitudes.”
They’re not just tracking what you do. They’re analyzing who you are.
My personal favorite admission:
“We do not have actual knowledge that we have sold or shared the personal information of children under the age of 16.”
“To our knowledge.” That’s lawyer-speak for: we ARE selling data, we just don’t track ages.
And about that data sharing:
“We share information with advertising partners and other third parties, including through the use of cookies, pixels and other similar technologies, to support our advertising activities, including for ‘cross-context behavioral advertising.’“
Translation: Your activity in MyCase follows you around the internet so advertisers can target you.
Clio’s Legal Billing Privacy Policy: Building Psychological Profiles
Clio’s privacy policy includes this gem about the “profiles” they build:
“Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.”
Psychological trends. Predispositions. Intelligence. Aptitudes.
This isn’t practice management. This is surveillance capitalism wearing a legal tech costume.
Their data collection table in Annex 2 is remarkably candid:
“Geolocation information, Inferences about personal preferences and attributes drawn from profiling, Internet activity“
They know where you are, what you’re doing online, and they’re drawing inferences about your personality from it.
Here’s what happens with their tracking cookies:
“Targeting cookies record your visit to our Website, the pages you have visited and the links you have followed. We will use this information to make our Service and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose.”
Your browsing behavior gets shared with advertising networks. From your legal billing software.
And they’re refreshingly honest about who controls those third-party trackers:
“Please note that third parties (including, for example, advertising networks and providers of external services like web traffic analysis services) may also use cookies, over which we have no control.”
They don’t even know what their advertising partners are doing with your data.
CosmoLex’s Legal Billing Privacy Policy: Eight Years Outdated
CosmoLex’s privacy policy was last updated May 24, 2018.
Let that sink in. Eight years old. Written before ChatGPT. Before most modern data protection laws. Before anyone was talking about AI training on user data.
But the real horror is what’s IN the policy. Like this admission about “Flash cookies”:
“Flash cookies are also accompanied by a browser cookie. If you delete the browser cookie, the Flash cookie may automatically create (or re-spawn) a replacement for the browser cookie.”
Zombie cookies. Tracking that regenerates after you delete it. Technology so outdated most security experts thought it died years ago. But CosmoLex is still using it. In 2026.
And their stance on your privacy preferences:
“We do not respond to ‘Do Not Track’ signals at this time.”
At least they’re honest about ignoring you.
But here’s the kicker — their data sharing with “marketing partners”:
“We may share your Usage Data with our marketing partners including third party service providers, advertisers, advertising networks and platforms, and advertising agencies to serve and offer personalized ads. We may share Personal Information with our marketing partners to correlate and match our list with our marketing partners’ lists for purposes of creating an ‘audience’ for serving personalized ads.”
They’re literally matching your information against advertising databases to build targeting profiles.
The ProfitSolv Problem: One Empire, Five “Competitors”
Here’s something most attorneys don’t realize: CosmoLex, TimeSolv, Rocket Matter, and Tabs3 are all owned by the same company — ProfitSolv.
From TimeSolv’s privacy policy:
“We may share your information with other companies in the ProfitSolv organization. Other ProfitSolv companies may reach out to you for marketing purposes.”
Think you’re comparison shopping? You’re comparing products designed to funnel revenue — and data — to the same private equity investors.
TimeSolv’s legal billing privacy policy also admits to psychological profiling:
“Inferences drawn from other Personal Information: Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.”
The exact same language as Clio. Almost like they’re all copying from the same playbook.
The 8am Empire: MyCase, LawPay, and Friends
MyCase isn’t a standalone company either. It’s part of 8am (formerly AffiniPay), which operates:
- MyCase
- LawPay
- CasePeer
- DocketWise
- CPACharge
- ClientPay
From their privacy policy:
“8am operates the website www.8am.com and various websites for our branded practice management and payment solutions, including… 8am AffiniPay, 8am CasePeer, 8am ClientPay, 8am CPACharge, 8am DocketWise, 8am LawPay, and 8am MyCase.”
All the same company. Your data flows between all of them.
What Every Legal Billing Privacy Policy Reveals
Here’s the summary:
| Company | AI Training | Psych Profiling | Ad Sharing | Policy Age |
|---|---|---|---|---|
| MyCase | ⚠️ EXPLICIT | ✅ | ✅ | Dec 2025 |
| Clio | ❓ | ✅ | ✅ | Oct 2025 |
| CosmoLex | ❓ | ✅ | ✅ | 8 YRS OLD |
| TimeSolv | ❓ | ✅ | ✅ | 3.5 yrs old |
| Rocket Matter | ❓ | ⚠️ | ✅ | 6 YRS OLD |
Every single one shares data with advertising networks. Every single one builds psychological profiles. And most haven’t updated their policies to account for modern AI capabilities — which means we have no idea what they’re actually doing with your data now.
What This Means for Your Practice
If you’re using any of these platforms, here’s what’s happening:
- Your client data may be training AI models. MyCase explicitly admits this. Others are suspiciously silent.
- Advertising networks know you’re an attorney. And they know your browsing habits, your location, and your “psychological trends.”
- “Anonymized” data isn’t safe. These policies all include language about sharing “anonymized” or “aggregated” data freely. Research consistently shows this data can be re-identified.
- The “competition” is an illusion. ProfitSolv and 8am control most of the market. Switching between their products doesn’t protect your data.
- Your privacy preferences are ignored. Multiple policies explicitly state they don’t honor “Do Not Track” requests.
There’s Another Way
TimeNet Law stores your data locally on your Mac. We don’t have servers. We don’t have advertising partners. We don’t build psychological profiles.
We literally cannot see your data. It never leaves your computer unless you choose to sync it with your own cloud service.
Our privacy policy is one paragraph: Your data is yours. We never see it. Period.
That’s not a marketing angle. It’s architecture. When your software runs locally, privacy isn’t a policy — it’s physics.


