Privacy Policy

This policy explains how we handle personal data when you visit Med-Legal, create an account or use our medical-records service.

1. Who we are

Med-Legal (“Med-Legal”, “we”, “us”, “our”) operates the website and service at med-legal.co.uk, providing cited medical-records summaries and indexed bundles to UK legal practices.

For any questions about this policy or your data — or to exercise your rights under it — contact us at info@med-legal.net.

2. Responsibility for your data

• Account and billing data: Med-Legal is the data controller.
• Uploaded medical records: your firm is the controller and Med-Legal processes records on your instructions. Your firm is responsible for its lawful basis, the appropriate condition for health data under Article 9, and informing the people whose records it uploads.

A separate Data Processing Agreement governing the records you upload is available on request and forms part of our Terms & Fees.

3. What we collect

Category	Examples
Account data	Your name, work email address, password (stored only as a secure hash), or — if you sign in with Google or Microsoft — the basic profile and email those services return.
Billing data	Your unit balance and purchase history, and a customer reference held with our payment provider. We never see or store your full card number — card details are handled directly by Stripe.
Uploaded content (special category)	The medical records you upload (GP, hospital, imaging, physiotherapy, etc.) and the summaries and bundles generated from them. These contain special-category health data about claimants.
Usage & technical data	Log records of actions in the app (claims created, outputs generated, sign-in events), your last-seen time, and standard server logs including IP address and browser type.
Communications	Messages you send us through the contact form, the live-chat widget, or by email.

4. How & why we use it, and our lawful bases

• To provide the service — create your account, process the records you upload, and generate summaries and bundles. Lawful basis: performance of our contract with you. For the health data in uploaded records, we process as your firm’s processor under its Article 9 condition.
• To take payment — charge for units and run optional automatic top-ups you have switched on. Lawful basis: performance of contract.
• To keep the service secure and working — authentication, fraud prevention, logging, diagnosing faults. Lawful basis: our legitimate interests in running a secure, reliable service.
• To communicate with you — service emails (welcome, receipts, important notices) and replying to enquiries. Lawful basis: performance of contract / legitimate interests.
• To meet legal obligations — tax, accounting and responding to lawful requests. Lawful basis: legal obligation.

We do not use your data, or your clients’ records, for advertising, and we do not sell personal data to anyone.

5. AI processing

We use an external AI provider to turn record text into summaries, chronologies and indexes. Med-Legal does not train its own models on uploaded records.

Verification of our active account’s terms and data-sharing settings is still pending. Please obtain written confirmation before uploading records that require these assurances.

Outputs include source references to support checking. A qualified professional must review and approve each AI-assisted draft before use.

6. Service providers

We use providers for hosting, AI document processing, payments, optional Google or Microsoft sign-in, service emails and customer support. They receive the information needed for their role. Provider details and processing documentation are available from info@med-legal.net.

Live-chat messages are relayed through our support messaging provider. Please keep medical records and patient details out of chat.

We may also disclose information to meet legal obligations, handle legal claims or transfer the business, subject to applicable data-protection requirements.

7. Storage and international processing

Live records are stored in Germany, with encrypted recovery copies in the UK. AI and other service providers may process data outside the UK and EEA, including in the USA. We have not yet verified the applicable international-transfer arrangement for our active AI account. Contact us for written confirmation before uploading records requiring that assurance.

8. How long we keep data

• Original uploads — scheduled for deletion 24 hours after upload. Active processing delays deletion until the job finishes; the cleanup runs periodically.
• Extracted page text, OCR text, claim data, source facts and generated outputs — retained with the claim so you can review and regenerate summaries. Deleting a claim removes these from live storage. A generated bundle may itself contain copies of the original record pages.
• Recovery backups — encrypted snapshots are kept separately from the live service. The server keeps the latest successful set; the backup computer normally keeps a seven-day history and removes expired sets when it next runs. Deletion from the app does not immediately erase an existing backup.
• Account & usage data — kept while your account is active and for a reasonable period afterwards.
• Billing records — kept for 6 years to meet UK tax and accounting requirements.

You can delete a whole claim and its records, or delete individual generated outputs, from the app when processing is not active. Contact us for account-deletion requests.

9. How we protect data

We use encrypted connections, securely hashed passwords and restricted access to records. Claims are separated by account, and key actions are logged. We notify affected customers and the ICO of reportable breaches as required by law. See Security & data.

10. Your rights

Under UK data protection law you have the right to access your data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent where we rely on it. To exercise any of these, email info@med-legal.net.

If a claimant wants to exercise rights over the medical records in a matter, those requests should usually go to the instructing firm (the controller of that data); we will assist the firm in responding. You can also complain to the ICO at ico.org.uk.

11. Cookies

We use only the cookies needed to sign you in and to keep payments secure — we do not use advertising or third-party tracking cookies. Full details are in our Cookie Policy.

12. Changes & contact

We may update this policy as the service evolves; we’ll change the “last updated” date above and, for material changes, tell account holders. Questions? Email info@med-legal.net.