1. Introduction

British Medical Experts Ltd (“BME”, “we”, “us”, “our”) is committed to protecting your personal data and handling it responsibly. We comply fully with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy explains what personal data we collect through our website (britishmedicalexperts.com) and in connection with our medico-legal services, how we use it, who we share it with, and what rights you have.

British Medical Experts Ltd is a trading name of Multiple Streams CH Limited.

2. Our Role in Data Processing

Depending on the context of our work, we act in one of two capacities:

• Data Controller – when we collect and manage personal data directly, for example through website enquiries, business operations, or when engaging medical experts. In this capacity, we determine the purpose and means of processing.
• Data Processor – when we process personal data on behalf of an instructing party (such as a solicitor, insurer, or organisation) in connection with the provision of medico-legal reports. In this capacity, the instructing party is the Data Controller and determines the purpose and lawful basis for processing.

Where we act as a processor, we do so only in accordance with written instructions from the relevant controller and in compliance with applicable data protection law.

3. Personal Data We Collect

We may collect and process the following categories of personal data:

• Contact and identity information — name, email address, telephone number, job title, and organisation name
• Communication data — information you provide when submitting a website enquiry, completing a contact form, or corresponding with us by email or telephone
• Case-related information — details provided as part of instructions for medico-legal reports, which may include health and medical information (special category data — see Section 5 below)
• Expert and professional data — CVs, qualifications, and practice details submitted by medical professionals applying to or working with our expert panel
• Technical and usage data — IP address, browser type, operating system, pages visited, and how you interact with our website (collected via cookies and similar technologies — see Section 11)

4. Special Category Data (Health Information)

Given the nature of our medico-legal services, we frequently handle health and medical information relating to claimants and patients. This is classified as special category data under UK GDPR and is afforded additional protection.

We process this data only where a specific condition under Article 9 UK GDPR applies, including:

• Article 9(2)(f) — processing is necessary for the establishment, exercise, or defence of legal claims
• Article 9(2)(h) — processing for medical purposes, carried out by or under the responsibility of a health professional
• Article 9(2)(j) — processing necessary for archiving, scientific or historical research, or statistical purposes in the public interest

We handle all health data with the utmost care, applying strict access controls and confidentiality obligations.

5. How We Use Personal Data

We use the personal data we collect for the following purposes:

• Responding to website enquiries and managing ongoing communications
• Providing medico-legal services, including the coordination and delivery of expert witness reports
• Allocating appropriate medical experts and managing our expert panel
• Administering contracts with instructing parties and expert witnesses
• Complying with legal, regulatory, and professional obligations
• Improving and maintaining our website and service offering
• Sending service-related communications and, where consent has been obtained, marketing updates

6. Lawful Bases for Processing

We rely on one or more of the following lawful bases under UK GDPR Article 6:

• Contract — Contract (Article 6(1)(b)) — where processing is necessary to fulfil a contract with you or an instructing party, or to take steps prior to entering into a contract
• Legal Obligation — Legal Obligation (Article 6(1)(c)) — where processing is required to comply with a legal or regulatory obligation, including court orders or statutory requirements
• Legitimate Interests — Legitimate Interests (Article 6(1)(f)) — where processing is necessary for our legitimate business interests, such as operating and improving our services, provided those interests are not overridden by your rights
• Consent — Consent (Article 6(1)(a)) — where you have given clear consent, for example to receive marketing communications or for certain website cookie interactions

7. Who We Share Personal Data With

We may share personal data with the following parties, where necessary and proportionate:

• Medical experts engaged to prepare or review reports
• Instructing solicitors, insurers, and organisations who have referred cases to us
• Courts, tribunals, regulatory bodies, and law enforcement authorities where required
• IT service providers, cloud hosting providers, and software platforms that support our operations — all subject to appropriate data processing agreements
• Professional advisers, such as lawyers, accountants, and auditors, under strict confidentiality obligations

We do not sell personal data to third parties. All data sharing is limited to what is strictly necessary and protected by appropriate contractual or legal safeguards.

8. Data Retention

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by law. Our retention periods are guided by:

• The duration of a case and any related legal proceedings
• Applicable legal limitation periods (typically 6 years for contractual matters, or longer where required by statute)
• Professional and regulatory obligations
• Our internal Data Retention Policy

When personal data is no longer required, it is securely deleted or anonymised in accordance with our retention schedule.

9. Data Security

We take the security of your personal data seriously. We implement appropriate technical and organisational measures to protect against unauthorised access, loss, destruction, or disclosure. These measures include:

• Role-based access controls and restricted user permissions
• Secure encrypted storage and transmission of personal data
• Confidentiality obligations applied to all staff and contractors
• Regular review of our security practices and policies

In the event of a personal data breach, we will notify the ICO and affected individuals in accordance with our legal obligations.

10. Individual Rights

Under UK data protection law, individuals have rights, including:

• Access to their personal data
• Correction of inaccurate data
• Erasure (where applicable)
• Restriction or objection to processing

Requests can be made in accordance with our Subject Access Request Procedure.

11. Contact and Complaints

If you have any questions about how we handle your personal data, or wish to make a data protection request, please contact us at:

Email: ops@britishmedicalexperts.com

Website: britishmedicalexperts.com

ICO Registration Number: ZA304527

If you are not satisfied with our response, or believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO).

12. Updates to This Policy

We may update this policy from time to time. The latest version will always be available on our website.