Establishing secure connection…Loading editor…Preparing document…

Client Privacy Disclosure Statement

This template is fully customizable. Edit the text, fill out the fields, and send it for signature. Give it a try!

CLIENT PRIVACY DISCLOSURE STATEMENT

Client Name:     Service Provider:

Client Address:

RECITALS

WHEREAS, the Client engages the Service Provider to perform professional services that require the collection, storage, or processing of personal information and sensitive client data; and

WHEREAS, the Service Provider maintains policies and technical measures to protect personal information and must disclose to the Client the categories, purposes, and rights related to such information as required by applicable privacy obligations; and

NOW, THEREFORE, the parties set forth their respective disclosures, obligations, and acknowledgements in this Client Privacy Disclosure Statement, which is incorporated into and made part of any underlying services agreement between the parties.

SCOPE OF WORK

Describe the services, project scope, or categories of engagement that will involve Client personal information. Include deliverables, activities that process data, and expected outcomes.

DATA COLLECTION, USE, AND CATEGORIES

The Service Provider may collect and process the following categories of Client personal information for the purposes described below. The Client acknowledges receipt of this disclosure and understands the categories and purposes.

Name and identifiers (legal name, date of birth)
Contact information (email, phone, postal address)
Financial and billing information (payment account details, invoices)
Health or regulated data (only if applicable and with explicit consent)
Other (specify):

Purposes for collection and use: performance of services; billing and collections; quality assurance; regulatory compliance; security, fraud prevention and investigation; and other legitimate business purposes disclosed to the Client.

THIRD-PARTY SHARING AND DISCLOSURES

The Service Provider will not sell Client personal information. The Service Provider may share personal information with service providers, subcontractors, affiliates, professional advisors, or as required by law. Where permitted, such recipients will be contractually bound to protect privacy consistent with this disclosure.

Client expressly consents to sharing personal information with the categories of third parties described above.

RETENTION, DELETION, AND SECURITY

Retention: Personal information will be retained for the period necessary to fulfill the purposes set out in this disclosure, to satisfy legal obligations, resolve disputes, and enforce agreements. At the end of the retention period the Service Provider will securely delete or anonymize data unless retention is required by law.

Security measures: The Service Provider implements administrative, technical, and physical safeguards appropriate to the sensitivity of the information, including access controls, encryption where feasible, and personnel training. No method of transmission or storage is completely secure; in the event of an unauthorized disclosure the Service Provider will notify the Client in accordance with applicable law.

CLIENT RIGHTS

Subject to applicable law, the Client may have rights to access, correct, restrict processing, request portability, or request deletion of personal information. To exercise rights or raise privacy inquiries, contact the Service Provider privacy contact below.

PAYMENT TERMS

Fees for services that involve processing of personal information are set forth below. The Client agrees to pay invoices in accordance with the schedule herein.

If any amount is not paid when due, the Service Provider may suspend provision of services until payment is made, in addition to pursuing any other remedies available at law or equity.

TERM AND TERMINATION

Effective Date:

Termination Date (if applicable):

Either party may terminate for material breach if such breach is not cured within the notice period above. Termination shall be without prejudice to accrued rights and obligations. Confidentiality and data retention provisions survive termination.

CONFIDENTIALITY

Definition: "Confidential Information" means any non-public information disclosed by the Client to the Service Provider, whether oral, written, or electronic, including personal data, trade secrets, business information, and any other information designated as confidential.

Obligations: The Service Provider shall (i) use Confidential Information solely to perform its obligations under this Statement and any underlying agreement; (ii) implement industry-standard safeguards to prevent unauthorized access, use, or disclosure; and (iii) restrict access to personnel who have a legitimate need to know and who are bound by confidentiality obligations at least as protective as those contained herein.

Permitted Disclosures: Confidential Information may be disclosed to third parties only as required by law or with the Client's prior written consent. Where permitted, the Service Provider will require recipients to protect Confidential Information to a standard substantially similar to that required of the Service Provider.

Remedies: Because monetary damages may be an inadequate remedy for breach of confidentiality obligations, the Client shall be entitled to injunctive relief in addition to any other remedies available at law or equity.

GOVERNING LAW AND ENTIRE AGREEMENT

This Client Privacy Disclosure Statement is governed by the laws of the jurisdiction set forth above without regard to conflicts of law principles. This Statement, together with any underlying services agreement, constitutes the entire agreement between the parties regarding privacy and supersedes all prior statements and understandings, whether written or oral, relating to the subject matter herein.

ACKNOWLEDGMENT

By signing below, the undersigned acknowledges receipt of this Client Privacy Disclosure Statement, confirms that they are authorized to consent on behalf of the Client or Service Provider as indicated, and agrees to be bound by its terms.

Client:

By:

Date:

Service Provider:

By:

Date:

Enter text✕

What a Client Privacy Disclosure Statement Is

A Client Privacy Disclosure Statement is a written notice provided to clients that explains how an organization collects, uses, stores, discloses, and protects personal information. It typically describes categories of personal data collected, legal bases for processing, data retention periods, third-party disclosures, and client rights such as access, correction, and deletion. The statement helps meet regulatory and contractual privacy obligations and supports informed consent when personal data is processed for services, billing, or marketing. Many organizations provide this disclosure at onboarding, before first data collection, or when privacy practices change.

Why a Clear Privacy Disclosure Matters

A clear Client Privacy Disclosure Statement promotes compliance with U.S. electronic transaction and privacy rules and builds client trust by documenting data uses and protections. It also defines client rights and provider responsibilities in a compact, reproducible record.

Why a Clear Privacy Disclosure Matters

Who Prepares and Receives This Statement

Use the statement when onboarding clients, updating privacy practices, or whenever legal changes or new processing activities occur.

  • Businesses and vendors that collect client data for services, billing, or support; often prepared by privacy, legal, or compliance teams.
  • Healthcare providers, where disclosures are aligned with HIPAA and may accompany patient intake or authorization forms.
  • Educational institutions and covered entities handling student records, aligning statements with FERPA obligations.

Essential Sections to Include

A professional Client Privacy Disclosure Statement is concise yet comprehensive; include clear headings and actionable guidance for clients.

Scope

Define whose data is covered, which services are included, and whether affiliates or subcontractors process data on your behalf.

Data Types

List categories of personal information collected (identifiers, contact, payment, health data if applicable), with examples to reduce ambiguity.

Purpose & Legal Basis

Explain why data is processed (performance of contract, legitimate interest, consent) and link processing activities to specific business functions.

Sharing & Disclosure

Identify categories of recipients (service providers, legal authorities) and whether data is sold or shared for marketing.

Retention & Deletion

State retention periods or criteria for deletion and describe how clients can request access, correction, or erasure.

Security & Contact

Describe technical and administrative safeguards, provide a contact for privacy inquiries, and explain dispute resolution options.

Required Data Elements to Collect or Display

Client Name: Full legal name
Contact Details: Email and mailing address
Data Categories: Types collected
Processing Purpose: Why data used
Retention Period: How long kept
Privacy Contact: Who to contact

Step-by-Step: Completing the Disclosure

Follow these sequential steps to prepare and deliver a Client Privacy Disclosure Statement consistently.

  • 01
    Draft content: Compile data categories, purposes, retention, and contacts.
  • 02
    Legal review: Confirm compliance with ESIGN, UETA, HIPAA as applicable.
  • 03
    Client delivery: Provide disclosure before first data collection or during onboarding.
  • 04
    Record retention: Store the executed disclosure with audit trail and version history.

How to Configure an Electronic Workflow

Set up a digital workflow that captures consent, signature, and an audit trail for enforcement and recordkeeping.

Field Configuration
Consent Disclosure Required before signature; include opt-out procedure
Signature Field Attach date and signer role
Authentication Email or SMS code verification
Audit Trail Capture IP, timestamp, and actions

Typical Delivery and Submission Flow

This illustrates common routing for issuing, signing, and storing privacy disclosures electronically.

  • Upload: Upload the disclosure to your eSignature platform
  • Assign: Place fields and assign signer email
  • Notify: Send signer link or email with disclosure
  • Store: Save signed PDF plus audit log

Digital Signing and Submission Requirements

Ensure the solution allows retention, searchable records, and the ability to reproduce disclosures on request for compliance.

  • Authentication Options: Email, SMS, or KBA
  • Audit Trail: IP, timestamp, action log
  • Document Formats: PDF and DOCX supported

Timing: When to Issue and Respond

Common timing rules ensure clients receive disclosures early and that organizations document acceptance or opt-out choices.

Initial Delivery:

Provide before first collection of personal data

Updated Policies:

Deliver revised disclosure before new processing begins

Consumer Response Window:

Allow reasonable time for questions; 30 days is common

Retention Start Date:

Effective date governs retention clocks

Record Requests:

Acknowledge access requests within 30–45 days if required

Common Preparation Mistakes to Avoid

  • Using vague language about data use that leaves obligations unclear and increases regulatory risk.
  • Failing to include a contact for privacy inquiries or a clear procedure for data access and deletion requests.
  • Delivering disclosures after data collection instead of before, which may negate informed consent under ESIGN rules.
  • Not preserving signed copies or audit trails, making it difficult to prove client consent and undermining enforceability.

Potential Consequences of an Incorrect Disclosure

Regulatory Fines: Civil penalties and corrective orders
HIPAA Violations: Monetary penalties and corrective action
Contractual Liability: Breach claims and indemnities
Reputational Harm: Client loss and negative publicity
Data Subject Claims: Access, deletion, or damages requests
Operational Delays: Service interruptions and remediation costs

eSignature Vendor Pricing Snapshot for Disclosures

Comparing entry-level costs and basic feature availability for eSignature platforms commonly used to deliver Client Privacy Disclosure Statements.

signNow DocuSign Adobe Sign PandaDoc HelloSign
Starting Price $8/user/mo $15/user/mo $14/user/mo $19/user/mo $15/user/mo
Free Trial Yes, 7-day free trial Varies Varies Varies Varies
Bulk Send Yes Yes Yes Yes No
Audit Trail Yes Yes Yes Yes Yes
HIPAA Compliant Yes Yes Yes No No

Real-World Examples of Use

These customer examples show how organizations implement privacy disclosures and capture client consent electronically.

Optica Ventures

Optica implemented an online disclosure to streamline onboarding and reduce paper handling.

  • Their team required mobile signing.
  • The platform produced consistent signed records and saved staff time while preserving audit logs and consent receipts.

Fertility Centers of Illinois

Fertility Centers digitized patient disclosures to align with clinical workflows.

  • Patient identity verification was critical.
  • They achieved reproducible signed disclosures and integrated records into clinical systems for secure long-term retention.

Practical Tips for Accurate Disclosures

Apply these practices to reduce risk and improve clarity for clients and auditors.

Keep language plain
Write disclosures in clear, non-technical language so clients understand what data is collected and how it will be used; avoid legalese that obscures core obligations.
Document versioning
Maintain version control and preservation of signed copies with timestamps and audit trails to demonstrate which disclosure applied at any given time.
Obtain explicit consent
When relying on consent as the legal basis, capture clear affirmative action and an ESIGN consumer disclosure where required by 15 U.S.C. §7001.
Limit retention
Set retention periods tied to business need and legal requirements, and implement automated deletion or archival processes.

Typical Signers and Their Authority

Client Signer

An individual or authorized representative who provides personal data or consents to processing; signature establishes intent and attribution under ESIGN and UETA.

Organization Representative

A company officer or delegated privacy officer who certifies the disclosure and provides contact details; their signature confirms organizational responsibility.

Frequently Asked Questions

Answers to common questions about validity, e-signatures, delivery methods, and recordkeeping for Client Privacy Disclosure Statements.


Need help? Contact support

be ready to get more
Join over 28 million airSlate SignNow users