Last updated: 23 September 2026
1. Who we are
MedAid Ltd provides independent medico-legal assessment services. For the personal information we use for our own appointment, clinical, administrative and legal purposes, MedAid Ltd acts as a data controller under UK data protection law.
Where your assessment has been arranged by a solicitor, medical reporting organisation (MRO), insurer or another instructing organisation, that organisation may also be a separate controller of information it provides to us or receives from us. Its own privacy notice may therefore also apply.
For privacy enquiries, contact us at booking@medaid.uk.
2. Information we may collect
Depending on the service and how your appointment was arranged, we may use:
- your name, date of birth, address and contact details;
- appointment details, clinic location and MedAid/MRO/solicitor reference numbers;
- identity-check information;
- information about the accident, incident or claim;
- health information, including injuries, symptoms, treatment, medical history, recovery and ongoing effects;
- information about how your symptoms or injuries affect work, daily activities and social or functional life;
- pre-assessment questionnaire responses and, where applicable, an electronic signature or declaration;
- communications with you and with the organisation that instructed the assessment;
- technical and audit information used to keep our systems secure and to record events such as questionnaire access, completion and message delivery.
Health information is special category personal data and receives additional protection under data protection law.
3. Where we get your information
We may receive information directly from you and from organisations involved in arranging or managing your medico-legal assessment, including solicitors, MROs, insurers, the Official Injury Claim process and other authorised representatives. We may also receive relevant records or information from medical professionals or healthcare organisations where these have been lawfully supplied for the assessment.
4. Why we use your information
We use personal information where necessary to:
- identify you and arrange, confirm, change or manage appointments;
- provide venue, arrival and appointment information;
- collect relevant information before the assessment;
- carry out the independent medico-legal assessment and prepare a medico-legal report for your case;
- communicate with the instructing organisation and other authorised recipients;
- manage invoicing, administration, complaints, quality assurance and audit;
- protect our systems, prevent misuse and maintain appropriate security records;
- meet legal, regulatory, professional and insurance obligations and establish, exercise or defend legal claims.
5. Our lawful bases
Depending on the circumstances, our lawful bases under Article 6 UK GDPR may include:
- contract, where processing is necessary to provide a service requested by you or under arrangements involving you;
- legitimate interests, including the proper administration of independent medico-legal services, secure operation of our systems, communication with instructing organisations and management of claims-related work; and
- legal obligation, where we are required to retain, disclose or otherwise process information by law.
Where we process health or other special category information, we also rely on an appropriate Article 9 condition. For medico-legal work this will commonly include processing necessary for the establishment, exercise or defence of legal claims.
6. Pre-assessment questionnaire
Our appointment service may allow you to open, save and complete a pre-assessment questionnaire before your appointment. The questionnaire is used to collect relevant information in advance of the assessment.
Where our current workflow successfully transfers a completed questionnaire into Halaxy, the questionnaire information is added to the clinical record and the source questionnaire is then removed from the MedAid website questionnaire system. We may retain limited operational metadata, such as whether the questionnaire was opened, started or completed, relevant timestamps and identifiers needed for audit and troubleshooting.
7. Clinical systems and software-assisted tools
We use approved third-party systems to help us manage appointments, clinical information and medico-legal work. This includes Halaxy, which we use to manage appointments, patient details, clinical records and medico-legal administrative information, and Heidi, where used, to assist the medical expert with consultation documentation and preparation of clinical notes.
These systems process information on our behalf in accordance with our agreements with them and applicable data protection requirements. MedAid does not use these tools to make automated decisions about your medical assessment or medico-legal opinion.
8. Who we may share information with
Where necessary and authorised, information may be shared with:
- the medical expert carrying out the assessment;
- the solicitor, MRO, insurer, Official Injury Claim participant or other organisation that instructed or is authorised to receive the assessment;
- approved clinical, hosting, email, SMS, IT and administrative service providers acting under appropriate contractual and confidentiality arrangements;
- our professional advisers, insurers, regulators, courts, law-enforcement bodies or other authorities where disclosure is required or justified by law.
We do not sell personal information.
9. How long we keep information
We keep personal information only for as long as it is needed for the purpose for which it was collected and to meet legal, professional, contractual, insurance and medico-legal requirements. Different categories of information may therefore be kept for different periods.
As described above, questionnaire source content held on the MedAid website is intended to be deleted after successful transfer into Halaxy, while limited status and audit information may be retained. Clinical, medico-legal and administrative records held in our core systems are retained according to the requirements applicable to those records and are periodically reviewed.
10. Information accessed or processed outside the UK
Some of the organisations and individuals who support our services may access or process personal information from outside the United Kingdom. Where this occurs, we take appropriate steps to ensure that personal information continues to be protected in accordance with UK data protection law.
This may include using arrangements covered by UK adequacy regulations or putting appropriate contractual and other safeguards in place where required.
11. Security
We use technical and organisational measures appropriate to the sensitivity of the information we handle. These include access controls, authentication, secure systems, audit records and limiting access to people who need the information for authorised purposes.
12. Your data protection rights
Depending on the circumstances and the lawful basis being used, you may have rights to request:
- access to your personal information;
- correction of inaccurate or incomplete information;
- erasure of information in certain circumstances;
- restriction of processing in certain circumstances;
- transfer of information in a portable format where the right to data portability applies; and
- information about how your personal data is being used.
Your right to object: where we rely on legitimate interests, you may have the right to object to that processing. We will consider your objection in accordance with data protection law.
Some rights are not absolute. In particular, medico-legal or clinical information may need to be retained or processed where this is necessary for legal claims, legal obligations or other lawful reasons.
13. Cookies and website technology
Our patient appointment and questionnaire services may use strictly necessary session or security technology so that the service works safely. We do not use that technology for advertising. If we introduce non-essential analytics or tracking technologies, we will update this notice and obtain consent where required.
14. Complaints
If you have a concern about how we use your information, please contact us first at booking@medaid.uk so that we can investigate.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator. Information about making a complaint is available at ico.org.uk.
15. Changes to this notice
We review this Privacy Notice when our services, systems or legal requirements change. The date at the top of this page shows when it was last updated.