Privacy Notice

1. Who we are

Baxter Medico-Legal Ltd is the controller of personal data covered by this Privacy Notice.

Company name: Baxter Medico-Legal Ltd
Registered office: 11 High Street, Ruddington, Nottingham, England, NG11 6DT
Company number: 16833843
VAT number: 507236801
ICO registration number: ZC044263
Website: www.baxtermedicolegal.co.uk
Email: contact@baxtermedicolegal.co.uk

2. The personal data we may collect

Depending on the nature of the enquiry or instruction, we may collect and use:

• names, contact details, and professional details of instructing solicitors, insurers, counsel, experts, and other professional contacts;
• patient or party identifiers, including name, date of birth, hospital or NHS identifiers, and case reference numbers;
• medical records, radiology, pathology, endoscopy reports, clinic letters, discharge summaries, operation notes, prescribing information, and other health information;
• letters of instruction, pleadings, witness statements, court documents, and related legal correspondence;
• billing, payment, and accounting information;
• email content, uploaded files, and records of professional communications; and
• limited technical information generated through use of the website or secure upload portal, such as server logs or submission metadata.

Medical information will often include special category personal data, particularly data concerning health.

3. Where we obtain personal data from

Personal data may be obtained directly from instructing parties, the individual concerned, legal representatives, courts, insurers, healthcare organisations, and from records or documents provided as part of a medico-legal instruction.

4. Why we use personal data

We use personal data for purposes including:

• responding to enquiries about potential instructions;
• conflict checking and deciding whether an instruction can be accepted;
• reviewing records and case papers;
• preparing medico-legal screening opinions and formal expert reports;
• communicating with instructing solicitors, counsel, insurers, courts, experts, and other relevant parties;
• maintaining professional records and audit trails;
• issuing invoices and managing accounts;
• meeting legal, regulatory, insurance, and professional obligations; and
• protecting and enforcing legal rights where necessary.

5. Lawful basis for processing

Depending on the context, we may rely on one or more of the following lawful bases under Article 6 UK GDPR:

• Article 6(1)(f) legitimate interests, including the legitimate interests of receiving, administering, and carrying out medico-legal instructions, communicating professionally, maintaining records, invoicing, and protecting legal rights;
• Article 6(1)(b) contract, where processing is necessary to take steps before entering into a contract with an instructing party, or to perform that contract; and
• Article 6(1)(c) legal obligation, where processing is necessary to comply with legal or regulatory obligations.

Where we process health data or other special category personal data in connection with medico-legal work, we expect in most cases to rely on:

• Article 9(2)(f), namely processing necessary for the establishment, exercise, or defence of legal claims, or where courts are acting in their judicial capacity.

If a different lawful basis or special category condition applies to a specific type of processing, it will be assessed according to the circumstances.

6. Who we may share personal data with

Personal data may be shared, where necessary and appropriate, with:

• instructing solicitors and their firms;
• claimants, defendants, patients, or their representatives, where appropriate to the instruction;
• counsel, courts, tribunals, and other participants in legal proceedings;
• insurers, indemnity providers, accountants, and professional advisers;
• trusted IT, hosting, document management, and secure file transfer providers; and
• regulators, law enforcement bodies, or other third parties where disclosure is required or permitted by law.

7. International transfers

We aim to keep personal data within the UK or countries recognised as providing adequate protection. If personal data are transferred outside the UK, we will seek to ensure that appropriate safeguards are in place.

8. How long we keep personal data

Personal data are kept only for as long as reasonably necessary for the relevant purpose, including the administration of the instruction, any related proceedings, professional record-keeping, limitation periods, complaints handling, insurance requirements, and legal or regulatory obligations.

Exact retention periods may vary depending on the nature of the instruction and the applicable professional, legal, and insurance requirements.

9. Security

We use appropriate technical and organisational measures intended to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. This includes the use of controlled-access systems, secure professional email and storage environments, and restricted handling of sensitive medico-legal material.

Cookies

We use Cloudflare to support the security and integrity of this website. Cloudflare may set a strictly necessary security cookie to help distinguish legitimate users from malicious or automated traffic and to confirm that a visitor has passed a security check.

Any cookies are used solely for security purposes and are considered strictly necessary for the operation of the website.

If our use of cookies changes in future, we will update this notice accordingly.

10. Your rights

Depending on the circumstances, individuals may have rights including:

• the right of access;
• the right to rectification;
• the right to erasure;
• the right to restriction of processing;
• the right to object; and
• the right to data portability.

These rights are not absolute and may be limited by applicable law, including exemptions relevant to legal proceedings, legal professional obligations, or the rights of others.

11. Right to object

Where processing is based on legitimate interests, you have the right to object to that processing in certain circumstances. We will consider any objection carefully and respond in accordance with applicable data protection law.

12. Complaints and contact

Questions about this Privacy Notice or requests relating to personal data should be sent to:

contact@baxtermedicolegal.co.uk

You also have the right to complain to the Information Commissioner's Office if you believe that personal data have been handled unlawfully.

Information Commissioner's Office
https://ico.org.uk/