MedBrief Data Protection Policy
Last updated: 03 June 2026
Introduction
MedBrief’s mission is to support the fair and cost-effective resolution of medical or personal injury related claims and to promote and enhance access to justice and healthcare.
Consistent with our mission, and subject at all times to the provisions of this Data Protection Policy, we may process Personal Data, including Sensitive Data, in the course of our Data Processing Activities.
This Policy incorporates the provisions of our Records Retention and Archiving Policy, our Privacy Policy, our Website Terms and Conditions, our Cookie Policy and, where applicable, our Services Agreement, that describe how we process and use personal information that we collect and/or receive from End-Users and Clients of our Services, including our Website.
Interpretation
In this Data Protection Policy, the following words and phrases should be given the respective meanings set out below:
“Applicable Data Protection Laws” means the applicable data protection laws for the Client Regions specified at https://medbrief.com/Applicable-Data-Protection-Laws;
“Client Region” means the territory or jurisdiction in which a Client is located;
“Data Processing Activities” means medical, legal and/or medico-legal data analysis, processing and reporting services, including but not limited to medico-legal data classification, indexing and reporting services;
“Data Protection Agreement” means the terms and conditions of any binding data protection agreement entered into between MedBrief and a Client, whether separately or as an addendum or supplement to the MedBrief Services Agreement;
“MedBrief Approved Processing Environment” means a data hosting or data processing systems environment listed at https://medbrief.com/regions/ that has been identified by MedBrief as conforming to the MedBrief Minimum Data Protection Standards published from time to time at https://medbrief.com/data-protection-standards/;
“MedBrief Minimum Data Protection Standards” means the minimum information security, data privacy and data protection standards and certifications for third party cloud hosting and other purposes listed by MedBrief at https://medbrief.com/data-protection-standards/ and that MedBrief has determined to provide appropriate technical, organisational and contractual safeguards to protect the confidentiality of Personal Data including Sensitive Data;
“MedBrief Services Agreement” means the terms and conditions of a binding MedBrief Services Agreement entered into between MedBrief and a Client published at https://medbrief.com/services/; and
“UK GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (United Kingdom General Data Protection Regulation).
Capitalised words and phrases not specifically defined in this Policy should be given the meanings assigned to them in Article 4 of UK GDPR unless the context clearly indicates otherwise.
References in this Policy to any other MedBrief policy or webpage shall be deemed to include any updates thereto that may be published or made available from time to time subject at all times to the provisions of any such policy, the MedBrief Website Terms and Conditions, the MedBrief Services Agreement and/or any applicable Data Protection Agreement that may have been entered into between MedBrief and a Client or End-User.
Commitment to compliance with Applicable Data Protection Laws
MedBrief:
- will not process Personal Data unless lawful grounds for that processing exist in terms of Applicable Data Protection Laws, including in terms of Article 6(1) of UK GDPR where applicable;
- will always take into account reasonable and appropriate technical, organisational and contractual safeguards to protect the confidentiality of Personal Data;
- will not process Sensitive Data unless lawful grounds for that processing exist, including in terms of both Article 6(1) and Article 9(2) of UK GDPR where applicable;
- will not, where Personal Data transfer is subject to the approval of a regulatory authority, transfer any Personal Data to any country that has not been declared by that relevant authority to provide an adequate level of data protection, including by the UK Secretary of State where applicable;
- will not utilise the services of any processor who does not guarantee in terms of a written agreement to implement appropriate technical and organisational measures to ensure that the processing will meet the requirements of Applicable Data Protection Laws including the requirements of Article 28(1) of UK GDPR where applicable;
- will not utilise the services of any recipient processor to host or process Sensitive Data outside of the MedBrief Approved Processing Environment for the Client Region; and
- will always comply with the terms and conditions of any Data Processing Addendum entered into between MedBrief and a Client.
Specific purposes for which we may process Sensitive Data
Without derogating from the generality of the aforegoing, you acknowledge and agree that we may process Sensitive Data,
- where the processing is reasonably necessary for the performance of our contract with you;
- where the processing is reasonably necessary for the purposes of obtaining a medical diagnosis or procuring or producing a medico-legal report;
- where the processing is reasonably necessary for the establishment, exercise or defence of legal claims where either: (i) a data subject has authorised us, or has authorised their legal representatives to request us, to process their data, for one or more specific purposes; or (ii) where the processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract, including where a data subject has authorised us, or has authorised their legal representatives to request us, to process their data, for the purposes of providing medico-legal claims support services, including as part of an early case assessment or early case screening exercise, before the data subject enters into a formal legal mandate agreement or after the event insurance contract providing for legal representation or legal expenditure insurance to be procured in the course of the establishment, exercise or defence of legal claims;
- where processing is reasonably necessary for compliance with a legal obligation to which we are subject, such as if we are obliged to process or produce data in response to a court order or to comply with any regulation to which we are subject, or where we are obliged in terms of health and safety legislation to process information relating to injuries sustained at work, or where we are required to process information regarding claims to statutory benefits for health or capacity reasons;
- where the processing is reasonably necessary in order to protect the vital interests of the data subject or of another natural person or is reasonably necessary to mitigate imminent threat to life or serious threat to wellbeing including where we may process or distribute health records for healthcare providers in urgent or emergency circumstances;
- where the processing is reasonably necessary for the purposes of a legitimate interest and processing relates to Sensitive Data which has been made public, such as when we process information contained in public judgments or tribunal reports, including for the purposes of organisational learning, risk mitigation and improvement in our Services;
- where the processing is reasonably necessary for the purposes of a recognised legitimate interest and reasonably necessary for the assessment of the working capacity of another person, including where we are requested or required to carry out an assessment of the working capacity of such a person following illness or injury in order to determine whether insurance or liability compensation or other benefits may be due to that person;
- where the processing is reasonably necessary for the performance of a task of the controller carried out in the public interest or a task carried out in the exercise of official authority vested in the controller, including where we may process or distribute health records for public healthcare providers performing a public healthcare function;
- where the processing is reasonably necessary to comply with our Records Retention and Archiving Policy or our insurance policies;
- where the processing is reasonably necessary for the purposes of a recognised legitimate interest and processing is necessary for reasons of public interest in the area of public health, such as ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of domestic law which provides for suitable and specific measures to safeguard the rights and freedoms of data subjects, including where we may process health records for public healthcare providers performing a public healthcare function;
- where the processing is reasonably necessary for any other further purpose that we deem to be reasonably compatible with the purposes outlined herein and our interests to provide or perform our Data Processing Activities, subject at all times to the provisions of Applicable Data Protection Laws, including Article 6(4) of UK GDPR where applicable; and/or
- where the processing is reasonably necessary in terms of other relevant law that we may be subject to, such as the Health and Safety at Work Act 1974, the Social Security Contributions Benefits Act 1992, the Employment Rights Act 1996 and the Equality Act 2010.
Proprietary Processing Workflows
You acknowledge and agree that MedBrief’s network architectures, including the specific processes, methodologies, logic and contractual arrangements associated with its network of Sub-Processors (the "Proprietary Processing Workflows"), constitute information of significant commercial value to MedBrief. Public or direct disclosure of the Proprietary Processing Workflows could cause irreparable commercial harm and prejudice MedBrief’s position in competitive markets.
Subject to the further provisions of this Policy, where any of MedBrief’s Proprietary Processing Workflows are disclosed to you, you agree to maintain the identities, descriptions, and details of MedBrief’s Sub-Processors in absolute confidence. You shall use such information strictly for the sole purpose of evaluating and verifying compliance with Data Protection Laws (the "Permitted Evaluation Purpose"). You shall not disclose, publish, reverse-engineer, leak, or distribute any information relating to MedBrief’s Proprietary Processing Workflows, including any Sub-Processor list or any part thereof to any third party including, without limitation, any competitors of MedBrief or market research entities, without the express prior written consent of MedBrief, unless such disclosure is strictly required to: (i) notify an upstream Data Controller in an applicable processing chain, provided that such upstream Data Controller is bound by confidentiality obligations no less restrictive than those set forth in this policy; (ii) comply with a valid, mandatory data subject access request made pursuant to Applicable Data Protection Laws, provided that the Client limits the disclosure strictly to the specific sub-processor identities legally required and utilizes any redaction allowances for business secrets permitted under applicable law; or (iii) comply with an explicit order by a competent regulatory authority or a final, non-appealable order of a court of competent jurisdiction.
Clients grant MedBrief a general written authorization to engage Sub-Processors to provide the Services. MedBrief shall maintain an up-to-date list of its Sub-Processors and make such lists of Sub-Processors available under cover of a confidentiality and non-disclosure agreement providing for protection of the confidentiality of MedBrief’s Proprietary Processing Workflows. To protect the technical and commercial security of MedBrief’s Proprietary Processing Workflows, MedBrief may maintain and update its list of Sub-Processors within a secure, authenticated client tenant dashboard, or via a secure, password-protected, or gated non-public portal accessible only to active customers. MedBrief shall notify active Clients of any intended additions or replacements of Sub-Processors by posting an update to such secure portal or via an automated electronic notification system, thereby providing the Client a reasonable opportunity to object to such changes solely on legitimate, documented data protection grounds.