Privacy notice
1. Who is responsible for your data
The data controller is Speciality Exam Limited, trading as eMedico-Legal, a company registered in England and Wales with company number 10229917, registered office 27 Plas Y Coed, Bangor, Gwynedd LL57 4FL, United Kingdom. For any question about your data, or to exercise your rights, email enquiries@emedico-legal.com.
2. What we collect
- Enquiry details: your name, email address, role, the location of the case, the service needed and the summary you send us through the website form or by email.
- Case information: medical records, letters, statements and other documents sent to us for a review or report. These usually include health data, which is a special category of personal data, and may include information about other people, such as relatives or healthcare staff.
- Business details: contact, billing and correspondence details for clients, solicitors and organisations.
- Technical data: the website's hosting provider keeps standard server logs, such as IP addresses and the pages requested, for security.
Please do not send medical records or patient names through the website form or by ordinary email.
3. Why we use it, and our lawful basis
- To reply to your enquiry and to take steps you ask for before entering into a contract, and then to perform that contract (UK GDPR article 6(1)(b)).
- To carry out conflict of interest checks, keep proper business records, and protect our website and services (legitimate interests, article 6(1)(f)).
- To meet our legal, tax, accounting and regulatory obligations (article 6(1)(c)).
We process health data only where it is necessary for the establishment, exercise or defence of legal claims, or where courts are acting in their judicial capacity (article 9(2)(f)), or with your explicit consent, for example for a private advisory review (article 9(2)(a)). You can withdraw consent at any time, although this will not affect work already done.
4. Who we share it with
We share personal data only as needed for the work, for example with the solicitors or organisation instructing us, the court, coroner or tribunal, and other experts in the case where the court directs. We also use trusted service providers to run our business, including our website hosting provider, our email provider (Google Workspace) and our accountants. These providers act on our instructions and must keep the data secure. We never sell personal data, and we do not use it for advertising.
5. International transfers
Some of our service providers may store or process data outside the UK and the European Economic Area, for example in the United States. Where this happens, we rely on adequacy regulations or on approved safeguards, such as the UK International Data Transfer Agreement or the EU standard contractual clauses. If you instruct us from outside the UK, our reports and correspondence will be sent to you in that country.
6. How long we keep it
- Enquiries that do not lead to instructions: up to 12 months.
- Medical records and case documents: returned or securely deleted when the case is closed, unless the court or the law requires us to keep them for longer.
- Our reports, letters of engagement, correspondence and invoices: 6 years after the case is closed, so that we can respond to any later questions, complaints or claims and meet tax requirements.
7. Your rights
You have the right to ask for a copy of your personal data, to have inaccurate data corrected, to have data erased, to restrict or object to our use of it, to data portability, and to withdraw consent. Some rights are limited where we must keep data for legal claims or by law. We will respond within one month. To make a request, email us.
If you are unhappy with how we have handled your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ico.org.uk, telephone 0303 123 1113) or, if you live in Ireland, to the Data Protection Commission (dataprotection.ie).
8. Security
We keep personal data secure using encrypted connections, access controls and secure storage. Medical records should only be sent to us through the secure method we provide.
9. Cookies and browser storage
We do not use advertising or tracking cookies. The website stores your language choice (English or Arabic) in your browser so it is remembered on your next visit, and our hosting provider may set a short-lived security cookie to block automated traffic. Our pages load fonts from Google Fonts, which means your browser connects to Google's servers and shares your IP address with Google.
10. Changes to this notice
We may update this notice from time to time. The latest version will always be on this page.