Usage Data Collection and Use

What it is

The agreement authorizes Harvey to collect Usage Data, defined as session, click-stream, frequency, duration, feature interaction, and derivative statistical data, for service development, improvement, support, and operation. Sharing of Usage Data containing Confidential Information with third parties is restricted to confidentiality-compliant disclosures or aggregated and anonymized forms.

Why it matters (compliance & governance perspective)

This provision authorizes ongoing collection and use of behavioral and interaction data for platform development purposes. The definition of Usage Data explicitly excludes Customer Data and Content, and the confidentiality restriction on third-party sharing provides a contractual boundary on how Usage Data that includes Confidential Information may be disclosed.

Consumer impact (what this means for users)

Under this clause, Harvey collects and uses information about how users access and interact with the Service, including session data, feature usage, and click-stream data. Usage Data that includes Confidential Information may not be shared with third parties except in anonymized and aggregated form or under confidentiality-compliant terms.

Institutional analysis (regulatory & governance intelligence)

(1) REGULATORY LANDSCAPE: Usage Data collection and use engages GDPR Articles 5 and 6 regarding lawful basis and purpose limitation where Usage Data includes personal data of EU-based users. CCPA may apply to California-based users' behavioral data. The definition of Usage Data, which includes derivative statistical analysis, may in some circumstances overlap with personal data depending on identifiability, which requires assessment under applicable data protection frameworks. (2) GOVERNANCE EXPOSURE: Low. The provision's restriction on sharing Confidential Information-containing Usage Data with third parties except in anonymized form is a protective limitation. However, the broad definition of Usage Data, which includes derivative works and statistical analysis based on user interactions, may require data mapping to confirm that no Customer Data or Content inadvertently enters the Usage Data category. (3) JURISDICTION FLAGS: EEA and UK customers should assess whether Usage Data, particularly session and interaction data linked to individual user accounts, constitutes personal data under GDPR, which would require a lawful basis for processing beyond contractual necessity. California customers may evaluate whether Usage Data falls within CCPA categories of personal information subject to disclosure and opt-out rights. (4) CONTRACT AND VENDOR IMPLICATIONS: The DPA should be reviewed to confirm how Usage Data is classified relative to Customer Data and Content, and whether processing of any personal data within Usage Data is governed by the DPA or solely by the main Agreement and Privacy Policy. (5) COMPLIANCE CONSIDERATIONS: Data mapping exercises should confirm the boundary between Usage Data, Customer Data, and Content as defined in the Agreement to ensure that legal privilege or client confidentiality obligations are not implicated by the collection of Usage Data derived from user interactions with legal research workflows.

Applicable agencies

Provision details

Other risks in this policy

• Customer Indemnifies Harvey for Input and Customer Data Claims high
• Customer Owns Its Content high
• Customer Right to Terminate After Adverse Update high
• Elevated Data Breach Cap at 2x Fees Paid or $500,000 high
• General Aggregate Liability Cap at Fees Paid or $250,000 high
• Harvey Indemnifies Customer for IP Infringement Claims high