Privacy Policy

This policy explains what Med-Legal does with personal data when you visit our website, create an account, and use our service to turn medical records into summaries and bundles. We’ve written it in plain English. It is a genuine description of how the service works — not boilerplate copied from another company.

1. Who we are

Med-Legal (“Med-Legal”, “we”, “us”, “our”) operates the website and service at med-legal.co.uk, providing cited medical-records summaries and indexed bundles to UK legal practices.

For any questions about this policy or your data — or to exercise your rights under it — contact us at info@med-legal.net.

2. Our two roles

It matters which “hat” we are wearing, because it determines who is responsible for what:

• For your account & billing data — name, work email, login, usage and payment records — we are the data controller. This policy is our promise to you about that data.
• For the medical records you upload — which contain personal data about your clients (claimants), not about you — we act as a data processor on behalf of your firm. Your firm is the controller of that data: it decides why the records are processed and is responsible for having a lawful basis (and, for health data, an Article 9 condition such as the establishment, exercise or defence of legal claims) and for telling claimants how their data is used. We only process those records on your firm’s instructions, to provide the service.

A separate Data Processing Agreement governing the records you upload is available on request and forms part of our Terms & Fees.

3. What we collect

4. How & why we use it, and our lawful bases

• To provide the service — create your account, process the records you upload, and generate summaries and bundles. Lawful basis: performance of our contract with you. For the health data in uploaded records, we process as your firm’s processor under its Article 9 condition.
• To take payment — charge for units and run optional automatic top-ups you have switched on. Lawful basis: performance of contract.
• To keep the service secure and working — authentication, fraud prevention, logging, diagnosing faults. Lawful basis: our legitimate interests in running a secure, reliable service.
• To communicate with you — service emails (welcome, receipts, important notices) and replying to enquiries. Lawful basis: performance of contract / legitimate interests.
• To meet legal obligations — tax, accounting and responding to lawful requests. Lawful basis: legal obligation.

We do not use your data, or your clients’ records, for advertising, and we do not sell personal data to anyone.

5. How AI is used on your records

Generating a summary or bundle means the text of your uploaded records is processed by a specialist third-party AI provider that acts as our sub-processor under contract. This is core to how the product works and we want to be straightforward about it.

Every fact in a generated output is traced back to its source page and quote-checked in our own code. Outputs are AI-assisted drafts: they must be reviewed and approved by a qualified counsel before they are relied upon, disclosed or filed (see our Terms & Fees).

6. Who we share data with (sub-processors)

We use a small number of trusted providers to run the service. Each is bound by a contract that limits them to processing data only on our instructions:

We may also disclose data where required by law, or to establish, exercise or defend legal claims. If our business is ever sold or restructured, data may transfer to the new owner under the same protections.

7. International transfers

Your account data and uploaded records are stored on servers in Germany (within the EEA). Some sub-processors above operate outside the UK, including in the United States. Where personal data is transferred outside the UK, we rely on an applicable UK adequacy decision (“data bridge”) or, where none applies, the UK International Data Transfer Agreement / Addendum and appropriate technical safeguards, so that your data keeps an equivalent level of protection.

8. How long we keep data

• Uploaded records & generated outputs — kept until you delete them or close your account. After deletion or account closure they are removed from our live systems within 30 days, and cycle out of encrypted backups within a further 90 days.
• Account & usage data — kept while your account is active and for a reasonable period afterwards.
• Billing records — kept for 6 years to meet UK tax and accounting requirements.

You can delete individual records and outputs at any time from within the app, and we act on account-deletion requests promptly.

9. How we protect data

Access is over encrypted (HTTPS/TLS) connections. Passwords are stored only as secure hashes, never in plain text. Access to live systems and stored records is restricted to authorised personnel, records are scoped to a single claim, and we keep an audit log of actions in the app. No system is perfectly secure, but we take appropriate technical and organisational measures to protect your data and will notify you and the ICO of a reportable breach as the law requires.

10. Your rights

Under UK data protection law you have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent where we rely on it. To exercise any of these, email info@med-legal.net.

If a claimant wants to exercise rights over the medical records in a matter, those requests should usually go to the instructing firm (the controller of that data); we will assist the firm in responding. You can also complain to the ICO at ico.org.uk, though we’d appreciate the chance to put things right first.

11. Cookies

We use only the cookies needed to sign you in and to keep payments secure — we do not use advertising or third-party tracking cookies. Full details are in our Cookie Policy.

12. Changes & contact

We may update this policy as the service evolves; we’ll change the “last updated” date above and, for material changes, tell account holders. Questions? Email info@med-legal.net.