[LEGAL] Content must come from counsel, not the agency. The privacy policy must cover GDPR for EU visitors and the handling of volunteer and medical-applicant data. The accessibility statement is published as part of the WCAG 2.1 AA commitment in build plan §12.