Effective from April 2025

1. Overview and Purpose

This policy outlines the lawful basis for processing and handling personal and sensitive data by MEWS – Medicolegal Expert Witness Services. It applies to all personal data stored, processed, or shared in relation to our employees, associates, suppliers, clients, and the medical records of individuals for whom we provide services.

2. Definitions
  • MEWS – Medicolegal Expert Witness Services: The registered legal entity responsible for managing services and this website.
  • Head Office: The registered business address of MEWS.
  • Associates: Independent medical experts, working under contract with MEWS, providing expert witness reports.
  • Staff: Employees directly employed by MEWS.
  • GDPR: General Data Protection Regulation (EU) 2016/679.
  • DPA: Data Protection Act 1998 (as amended).
  • EU: The European Union and all member countries (past, current, or future).
  • Data Subject: The individual whose personal data is being processed.
  • Data Controller: Entity determining the purpose and means of processing personal data.
  • Data Processor: A third party processing personal data on behalf of the Data Controller.
  • Processing: Handling of personal data including collection, storage, access, or deletion.
  • Client: The individual undergoing expert assessment.
  • Customer: The entity commissioning the report (e.g., solicitor or agency).
  • PIA: Privacy Impact Assessment.
  • Breach: Any event leading to accidental or unlawful destruction, alteration, or access of data.
  • Individual Rights: The eight rights guaranteed under the GDPR.
  • Personal Data: Any information identifying an individual.
  • Sensitive Personal Data: Data defined under Article 9 of the GDPR.
3. Commitment to Data Protection

MEWS recognises its responsibilities under the DPA and GDPR and is committed to maintaining the confidentiality, integrity, and availability of all personal and sensitive information.

4. Privacy Statement

MEWS processes personal data lawfully, fairly, and transparently. Data is used only for the intended purpose and never shared for marketing, statistical or advertising use without explicit consent. All data is securely stored and protected using appropriate organisational and technical measures.

5. Scope of Data Processing

MEWS may process the following types of data:

  • Staff personal data
  • Supplier details
  • Associate professional and financial data
  • Customer business information
  • Client medical and legal records
  • Newsletter subscriber data
  • Website user data via cookies
6. Privacy Impact Assessments

Currently, MEWS does not require a full Privacy Impact Assessment for general client processing. This is reviewed periodically.

7. Staff Personal Information
  • Lawful Basis: Legal obligation (e.g. tax, payroll, pensions)
  • Data Includes: Contact details, NI number, bank info, work history, emergency contacts
  • Sharing: HMRC, HR providers, pension providers, senior staff (in emergencies only)
  • Retention: Duration of employment + 7 years
8. Supplier Personal Information
  • Lawful Basis: Contractual performance
  • Data Includes: Company and contact details, VAT and reg. number, bank details
  • Sharing: HMRC, accountants/auditors (as required)
  • Retention: Active relationship + 7 years
9. Associates Personal Information
  • Lawful Basis: Contractual fulfilment and compliance
  • Data Includes: Contact details, qualifications, professional membership, bank info
  • Sharing: Clients (as needed), HMRC, accounting teams
  • Retention: Active period with MEWS + 7 years
10. Customer Personal Information
  • Lawful Basis: Contractual performance
  • Data Includes: Contact information, company registration, bank info
  • Sharing: Associates (as needed), HMRC, auditors
  • Retention: Duration of service + 7 years
11. Client Personal Information
  • Lawful Basis: MEWS acts as Data Processor under contract with customer
  • Data Includes: Identity, contact, medical history, case documentation
  • Sharing: Assigned associate only (on a need-to-know basis)
  • Retention: Life of contract + 7 years
12. Newsletter Subscriber Personal Information
  • Lawful Basis: Consent
  • Data Includes: Name, email, job title (optional)
  • Sharing: None
  • Consent: Verified every 5 years; deleted if not renewed
  • Retention: While consent is valid; deleted within 28 days upon withdrawal
13. Transfer of Personal Information Outside the EU

MEWS does not transfer data outside the EU/UK unless required and compliant with GDPR. Any third-party service providers are vetted to ensure EU data residency and compliance.

14. Information Retention
  • Data is only held as long as necessary:
  • Standard retention: 7 years post-contract
  • Financial data: 6 years post-financial year (as per HMRC)
  • Archived backup data may be retained until deletion is feasible
15. Data Access

Data access is role-based and limited to essential personnel. All access is audited. Backups are securely stored and managed only by authorised IT staff.

16. Website Cookies

MEWS uses analytical cookies to:

  • Measure website traffic
  • Improve user navigation
  • Monitor content performance

Cookies do not collect personal data and are not shared with third parties. A cookie notice is shown on our homepage.

17. Data Protection Breaches
  • If MEWS is Data Controller: ICO will be notified within 24 hours
  • If MEWS is Data Processor: Customer will be notified within 12 hours
  • All breaches are logged and retained indefinitely
18. Individual Rights

MEWS supports all GDPR rights, including:

  • Right to be informed
  • Right of access (response within 28 days)
  • Right to rectification
  • Right to erasure (assessed case-by-case)
  • Right to restrict processing
  • Right to data portability
  • Right to object
  • Rights related to automated decision-making (not applicable – MEWS does not use profiling)
19. Accountability and Governance
  • MEWS maintains internal policies covering:
  • Privacy and data protection
  • Information security
  • Data retention and deletion
  • Breach response
  • Information sharing (Associate & Customer agreements)

A Data Protection Officer is appointed to ensure compliance.

Contact: enquiries@mewservices.org