# Legal & policy pages — Pedestal Health

Playbook for **privacy, cookies, and product terms** pages. Pedestal uses **root-level slugs** (not a `/policies-and-terms/` prefix).

## URL patterns

| Public path | CMS slug | Document |
|-------------|----------|----------|
| `/privacy-policy/` | `privacy-policy` | Site privacy policy |
| `/cookie-policy/` | `cookie-policy` | Cookie notice + OneTrust policy list |
| `/engage-terms-of-use/` | `engage-terms-of-use` | Engage™ app terms of use |

These pages are linked from the **footer legal row** (`navigation.entries[3]`). If slugs change, coordinate redirects — see repo `docs/REDIRECTS.md` / editor-managed redirect pattern.

## Editing rules

| Rule | Why |
|------|-----|
| **Legal/compliance sign-off** before publish on substantive changes | cms-edit saves drafts only |
| Prefer **`task-bulk-find-replace`** for global terminology (company name, product name) — legal must re-read the full rendered page after |
| Do **not** restructure numbered sections without legal approval | Section order may match regulatory expectations |
| Preserve effective dates, entity names (`Pedestal Health, Inc.`), and contact emails unless legal supplies replacements |
| Do not add marketing CTAs into policy body without approval |

## Typical content stack

### Privacy policy (`/privacy-policy/`)

| Region | Type | Notes |
|--------|------|-------|
| `topContent` | **Split hero** | Title + effective-date line in hero `body` RTF |
| `content` | **Legal rich text** | Full policy — long RTF, numbered sections |

### Cookie policy (`/cookie-policy/`)

| Region | Type | Notes |
|--------|------|-------|
| `content` | **Legal rich text** | Intro copy above the cookie table |
| `content` | **Cookie Policy List** external | Renders OneTrust `#ot-sdk-cookie-policy` — **do not edit cookie table in CMS** |

Set `featuredImage` before publish (required for OG). Page was draft as of 2026-05 — confirm status in Contentful before editing.

### Engage™ terms (`/engage-terms-of-use/`)

| Region | Type | Notes |
|--------|------|-------|
| `topContent` | **Split hero** | Product name + effective date (`Effective: June 14, 2023`) |
| `content` | **Legal rich text** | Single component with all sections (`I. Terms of Use`, medical disclaimer, etc.) |

Content originally mirrored from legacy Target RWE Engage terms with entity names updated to Pedestal Health.

## Legal rich text styling

Policy body uses **Legal rich text** component — typography class `rtf-legal` (compact spacing; headings map to smaller display sizes). See `docs/cms-guidelines/html-component-style-guide.md`.

Edit RTF:

```bash
cms-edit open /privacy-policy
cms-edit snapshot
printf 'Updated paragraph.\n\n' | cms-edit rtf @cN body --markdown -
```

Use `task-edit-rich-text` for multi-paragraph updates; keep heading hierarchy stable (H2 for main sections).

## Reference pages

| Path | Clone when |
|------|------------|
| `/privacy-policy/` | Privacy copy refresh |
| `/cookie-policy/` | Cookie intro text (not the OneTrust list) |
| `/engage-terms-of-use/` | Engage app terms revision |

Fetch markdown for legal review: `https://www.pedestalhealth.com/privacy-policy.md`

## Workflow

1. Obtain approved copy from legal (tracked doc or redlines)
2. Read `cms-edit://customer/pages` for save/preview rules
3. `cms-edit open --page-slug privacy-policy` (or `cookie-policy`, `engage-terms-of-use`)
4. Edit **Legal rich text** `body` — hero `heading`/`body` only when legal approves title/date changes
5. **Cookie policy:** edit intro RTF only; cookie categories come from OneTrust embed
6. For sitewide phrase replacement: `task-bulk-find-replace` with narrow scope — preview full page after
7. Set `description` and `featuredImage` when SEO/compliance requests it
8. `preview urls` on staging → `diff` → `save` → legal review → `task-publish-handoff`

## Cross-links

- Contact form body links to `/privacy-policy` — update in sync if privacy URL or anchor text changes
- Footer legal row — verify links after slug or label changes (`cms-edit-pedestal.md` § Footer navigation)

## Out of scope

- **OneTrust / cookie consent banner** configuration — platform/marketing ops, not CMS page content
- New legal page types without engineering (e.g. HIPAA NPP) — requires route + template work first
- **News** or **publications** — use article playbooks

## Publish handoff

`save` creates drafts only — publish in Contentful UI after legal approval.