Privacy Policy
Last Updated: June 5, 2026
This website is owned and operated by Clinicol Ltd, a company incorporated in England & Wales under company number 4439943, with its registered office at Suite A, 82 James Carter Road, Mildenhall, England, IP28 7DE. Clinicol Ltd (operating as “Clinical Expert Witness Chambers,” “we,” “us,” or “our”) is committed to protecting and respecting the privacy of our legal clients, instructing panels, and the patients whose clinical data we audit. This Privacy Policy details our practices concerning the collection, processing, security, and retention of personal data.
Table of Contents
1. General GDPR Commitment
We are registered with the Information Commissioner's Office (ICO) as a Data Controller and process all medical and personal data in strict compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA), and standard NHS Digital Security Protection Toolkit (DSPT) frameworks.
2. Lawful Basis for Processing
We process special category health data under the lawful basis of UK GDPR Article 9(2)(f), which permits processing necessary for the establishment, exercise, or defense of legal claims.
3. Confidentiality & GCP Airlock
Key Data Protection Clause:
“All records uploaded are securely airlocked inside encrypted UK GCP residency instances. Patient names must be fully anonymized using claimant initials only.”
We enforce strict compartmentalization of medical documents. All electronic medical records uploaded by legal practitioners are routed to isolated Google Cloud Platform (GCP) instances with residency limited exclusively to the United Kingdom. We mandate that solicitors sanitize files prior to upload by using claimant initials only.
4. Data We Collect
We collect and process the following information in relation to legal instructions:
- User Profile Data: Practitioner name, firm/chambers details, professional email address, telephone contacts, and secure account credentials.
- Instruction Details: Claimant initials, case reference number, specialty type, and solicitor's case brief notes.
- Clinical Files: Expert witness packages, GP history transcripts, audiograms, surgical history, and correspondence packages relevant to the case.
5. Data Security Measures
Our portal implements high-grade clinical security protocols:
- End-to-end SSL/TLS encryption for all data transit.
- Rest-encryption using AES-256 standard on UK-based Google Cloud Platform (GCP) Storage buckets.
- Authentication gateways utilizing cryptographic tokens for link validation.
- Role-based access controls restricting file access to authorized auditors and the instructing legal team.
6. Data Retention & Automated Purge
To prevent excessive storage of sensitive personal data, we enforce a strict data minimisation policy. Uploaded medical record packages and draft reports are automatically purged from our cloud servers after a set retention window following the completion of the instruction or formal case closure.
7. Your Rights
Under the UK GDPR, instructing legal firms and individuals have rights regarding their data, including the right to request access, rectification, portability, or restriction of processing. For clinical data processed under Article 9(2)(f) for legal defense, certain restrictions to rights of erasure may apply in accordance with statutory requirements.
8. Data Protection Officer (DPO)
If you have questions regarding this Privacy Policy or wish to exercise your data subject rights, please contact our Data Protection Officer: