Linkedin

Privacy Policy

Effective Date 12 October 2026

uses, shares and protects your personal data, including health data. It applies when:

  • you use our services directly as a patient (“Patient“) — we are the data controller of your personal data (including health data);
  • we prepare medico-legal reports and medical record summaries for solicitors, insurers or other instructing parties (“Instructing Party“) — we act as data processor of the Patient’s data; and
  • we deal with you as a client (“Client“) or service provider such as a medical expert (“Service Provider“) — we are controller of the contact information we hold about you.

We comply with the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018 (“DPA 2018”).

1. Who we are and how to contact us

Medical Services Solutions Limited

Registered in England (company number 05628986), registered office Ground Floor, The Annexe, 3 Harman Close, London NW2 2EA. We are registered with the Information Commissioner’s Office (“ICO“) as a data controller (reference Z9439626).

Our Data Protection Officer (“DPO“) is Caroline Lueder, at generalcounsel@mssgroup.co.uk / info@mssgroup.co.uk or the registered office above. Contact the DPO about this notice, to exercise your rights, or to raise any concern about how we handle your data.

2. How we use your data and our legal basis

We collect personal data, including health data, only as necessary for the following purposes:

We collect personal data, including health data, only as necessary to: provide and improve our services; respond to your enquiries; comply with our legal and contractual obligations; and maintain the security of our systems.

Because the data includes special category data (health, genetic and biometric data), we rely both on a lawful basis under Article 6 UK GDPR and on a separate condition under Article 9 UK GDPR:

We may collect and process a wide range of health-related information, including but not limited to:

·         Medico-legal reports, summaries and chronologies for solicitors and insurers: our legitimate interests and those of the Instructing Party in providing these services and in the proper conduct of legal proceedings (Article 6(1)(f)), together with processing necessary for the establishment, exercise or defence of legal claims (Article 9(2)(f) and the “Legal claims” condition in Schedule 1, paragraph 33 DPA 2018).

·         Providing or managing health care, where applicable: our legitimate interests (Article 6(1)(f)), together with the health or social care purposes condition (Article 9(2)(h) and the condition in Schedule 1, paragraph 2 DPA 2018), where the data is handled by, or under the responsibility of, a person subject to a duty of confidentiality.

·         Legal obligations: where we are required by law to process your data (Article 6(1)(c)).

Consent (for example, to use your data to train AI models): your consent (Article 6(1)(a)) and explicit consent (Article 9(2)(a)). You can withdraw consent at any time.

This data is treated as sensitive and handled with heightened security and confidentiality.

When you interact with our services, including features powered by Artificial Intelligence (AI) and Large Language Models (LLMs), the data you provide—including all types of health data—may be processed by automated systems to generate responses, insights, summaries, or recommendations.

We may aggregate or de-identify personal data for research, analytics, and service improvement. De-identified data will not be re-identified except as required by law1.

3. The data we collect and where we obtain it

Depending on your relationship with us, we collect:

  • Clients, Patients and Service Providers: name and title; contact details (telephone, postal and email address); and information publicly available (for example on Companies House, LinkedIn, the SRA, ICO or FCA registers, or more generally online). For Service Providers we may also collect a CV and photo, evidence of right to work in the UK, indemnity insurance, consulting venues, and Medco and DBS certificates. Our phone conversations with you are recorded and transcribed by AI.
  • Website visitors: web usage information (such as IP address), information about your visit, and any information you enter on our forms.
  • Patients: Patient health data, which may include electronic health and medical records; demographic data (including NHS number); clinical, diagnostic, treatment and medication data; mental health information; genetic and biometric data; disability, pregnancy and other special category data; data from wearables and health apps; claims and billing data; lifestyle information relevant to health; and clinical notes, medical opinions and correspondence with healthcare professionals. This data is treated as sensitive and handled with heightened security and confidentiality.

In most cases we do not collect data directly from the Patient. We usually receive personal and health data from the Instructing Party (your solicitor or insurer) and from third parties such as GPs, hospitals, other treating clinicians and NHS bodies, and, where relevant, from publicly accessible sources.

4. Use of AI and automated decision-making

We use AI, including the Pro version of large language models (“LLMs”), to support our services — for example, to extract information from medical records to prepare summaries and synopses and to sort records chronologically, and to record and transcribe phone calls. These systems process inputs that may include health data to generate text, insights, summaries or recommendations.

AI is used strictly to assist and inform. It is not used to make decisions about your medical treatment or care, which remain the responsibility of qualified healthcare professionals.

We do not use your data to train AI models, or share it with third parties for their independent use or to train open-source models, without your explicit consent, which you may withdraw at any time.

We do not use AI or LLMs to make solely automated decisions that produce legal or similarly significant effects concerning you. A person always reviews AI output and remains responsible for it. If this changes, we will update this notice and give you meaningful information about the logic involved and the significance and likely consequences of the processing. Given the scale and sensitivity of the data involved, we carry out and keep under review a data protection impact assessment for this processing.

5. Sharing your data

We share personal data only where there is a lawful basis and limit it to what is necessary. We may share it with:

  • medical experts, to provide services to you or (where you are a solicitor or insurer) your client;
  • our processors — the systems, IT, hosting, cloud and AI/LLM providers we use to deliver and secure our services, each acting under a written contract; and
  • finance providers (including invoice finance providers and lenders). As part of the financing and administration of our business activities, we may enter into arrangements with finance providers. Where we use invoice finance or other financing arrangements, we may be required to provide information relating to our customers, invoices, receivables and supporting documentation to the relevant finance provider. We therefore take steps to minimise the personal information shared with finance providers and, where appropriate, redact information relating to individuals and medical information before documents are provided. Our finance providers are required to handle personal information in accordance with applicable data protection legislation and their own privacy and information-security requirements. Where appropriate, further information about how a particular finance provider processes personal data may be available in that provider’s own privacy notice

6. International transfers

Your data may be stored or processed outside the United Kingdom. Where we transfer data outside the UK, we do so only where: the destination benefits from UK adequacy regulations (a “data bridge”); or, for the United States, the recipient is certified under the EU-US Data Privacy Framework and the UK Extension (the “UK-US data bridge”) and the transfer falls within its scope; or we have put in place an appropriate safeguard (the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses) supported by a transfer risk assessment; or, in limited cases, an Article 49 UK GDPR derogation applies.

Because the Data Privacy Framework protects “sensitive data” more narrowly than UK law protects special category data, we separately assess whether transfers of your health data are adequately protected and, where they are not, put an appropriate safeguard in place instead. You can obtain a copy of the safeguards we rely on by contacting our DPO.

7. How long we keep your data

We keep your personal and health data only for as long as necessary for the purposes in this notice. We set retention periods by reference to the limitation periods for the underlying legal claim or proceedings; our professional, regulatory and insurance requirements; and our contractual obligations to the Instructing Party. As a general rule we retain records for the duration of the instruction and for 7 years after the matter concludes, after which they are securely deleted or anonymised, except for medical records as these are deleted once a case is concluded.  

8. Data security

We implement appropriate technical and organisational measures to protect your data — especially sensitive health data — in line with Article 32 UK GDPR, including encryption in transit and at rest, access controls and regular security testing.

9. Your rights

Under UK GDPR you have the right to:

  • access your personal and health data;
  • rectification of inaccurate data;
  • erasure;
  • restriction of processing;
  • data portability; and
  • object to processing.

The availability of each right depends on the lawful basis we rely on. Where we rely on consent, you may withdraw it at any time.

You can exercise these rights by contacting our DPO. We may need to verify your identity first, and you may appoint an authorised agent on production of proper documentation.

You can complain to us directly at any time, and we would welcome the chance to address your concerns first. You also have the right to complain to the ICO at ico.org.uk or on 0303 123 1113.

10. Changes to this notice

We may update this notice to reflect changes in technology, law or our practices. Updates will be posted on this page, and we encourage you to review it regularly.