Last updated: 31/10/2026
Who we are
Probita Medical (“we”, “us”) is Probita Medical Limited, a company registered in England and Wales with company number 17554498, whose registered office is at 92 Chiswick High Road, London, W4 1SH. We are the controller of the personal information described in this notice.
Our registered office is a legal address, not a contact address. Please do not send post, records or instructions there: email us, or use the portal if you have an account.
You can contact us about privacy at enquiries@probitamedical.co.uk. Our data protection lead is Henry Howe. We are not required by law to appoint a data protection officer (DPO), and have not done so; our data protection lead handles every privacy question and request.
Jump to the part of this notice that applies to you:
Visitors to this website
This website has no sign-in and no advertising, and sets no cookies (see our cookie notice). The contact form is not switched on and sends nothing.
Like any website, the company that hosts it, Vercel, receives technical information when your browser requests a page, such as your internet (IP) address, browser type and the page requested. This is used only to deliver the site and keep it secure, and is kept for a short period (up to 30 days). Vercel may process these logs outside the UK, under UK data protection transfer safeguards. Our lawful basis is our legitimate interest in running a secure website (UK GDPR Article 6(1)(f)).
Visitor statistics
We use Plausible Analytics to count visits in aggregate: the pages viewed, which website or search brought visitors here, their country and city, their type of device and browser, and clicks on our main buttons and email links. It uses no cookies and stores nothing on your device, and it does not identify you. Your IP address is used only to estimate your country and city and to make a code, changed every day, that lets a visit be counted once; the IP address is not stored. Plausible holds the data in the European Union, as our processor. We see only totals.
Our lawful basis is our legitimate interest in understanding how the website is used, so we can improve it (Article 6(1)(f)). You have the right to object. To stop your visits being counted, block plausible.io in your browser or use a browser or extension that blocks analytics, or follow Plausible’s instructions for excluding your visits. You can also email us to object. There is more in our cookie notice.
If you email us
We use your name, contact details and what you tell us to reply and, if you go on to work with us, to set up that relationship. If an enquiry does not lead to work with us, we keep it for 2 years. Our lawful basis is our legitimate interest in answering enquiries (Article 6(1)(f)). Please do not send claimant names, medical details or documents by ordinary email.
Law firms and their staff
We hold the names, work contact details and portal accounts of solicitors and staff at firms that instruct us, together with records of the work we do for the firm. We use them to provide our service, to bill the firm and to meet our legal and accounting obligations.
Our lawful bases are the contract with the firm (Article 6(1)(b)), our legitimate interests in running our business and managing the firm’s account (Article 6(1)(f)), and our legal obligations, for example to keep accounting records (Article 6(1)(c)). Firms can ask us for data processing terms.
Medical experts and their assistants
We hold experts’ contact details, professional registration, qualifications, CV, proof of identity, indemnity insurance details, availability, fees and payment details, and the work they do on each case. If an expert invites an assistant, we hold the assistant’s name, contact details and portal account. We use this to check that experts are suitable, to offer and manage instructions, to pay experts and to meet our legal and accounting obligations.
Our lawful bases are the contract with the expert (Article 6(1)(b)), our legitimate interests in checking experts’ suitability and running our panel (Article 6(1)(f)), and our legal obligations (Article 6(1)(c)).
Until our portal opens, applications to join our panel are made by email and held in our email account, which Microsoft provides. We use an application only to consider it. If an application is unsuccessful, withdrawn or put on hold, we delete it and the CV with it 12 months after the decision.
Claimants
If your solicitor instructs us, they send us the information we need to arrange an independent medical report for your claim: your name, contact details, date of birth, details of the claim and relevant medical and other records. Medical information is “special category” data, which has extra protection in law. See also our information for claimants.
We use it only to arrange and deliver the report, including sharing it with the medical expert who writes the report, booking any appointment with you, and handling questions about the report. We use your mobile number and email address only for appointment messages, and those messages never contain medical details.
Our lawful basis is our legitimate interest, and your solicitor’s, in obtaining medical evidence for your claim (Article 6(1)(f)). For your health information, the condition is that it is needed to establish, exercise or defend legal claims (Article 9(2)(f)).
Where we use AI to help prepare a records summary or check a report for completeness, it runs within our own systems in the UK, keeps no copy of your information and does not use it to train AI models. AI never makes a decision about you and never forms the medical opinion: the independent expert does.
Who we share information with
- The medical expert instructed on a case, and their assistant only where the expert allows it.
- The law firm that instructed us, for its own case.
- Our professional advisers, insurers and regulators, and others where the law requires it.
Service providers run our systems for us as processors, under contracts that require them to protect the data and use it only on our instructions:
| Provider | What it does for us | Where |
|---|---|---|
| Vercel | Hosts this website and runs the Probita platform’s application | UK (London); some of its own logs may be held outside the UK |
| Supabase | The platform’s database and sign-in | UK (London) |
| Amazon Web Services | Document storage, virus scanning, email sending and AI (Amazon Bedrock) | UK (London) |
| Microsoft | Our email, including enquiries and, until our portal opens, applications to join our panel | Microsoft’s data centres, with UK data protection transfer safeguards for anything held outside the UK |
| Plausible Analytics | Visitor statistics for this website, in aggregate, with no cookies (see “Visitors to this website”) | European Union |
| Sentry | Error reports, which carry a case reference only, never medical details | European Union (Germany) |
| A UK text message provider | Appointment text messages to claimants | UK |
We never sell personal information or use it for advertising.
Where information is held
Case data and documents are stored and processed in the UK (London). Some operational services that never receive medical details are provided from outside the UK, under UK data protection transfer safeguards. See security and data protection for more.
How long we keep information
| Information | How long we keep it |
|---|---|
| Case records, including reports and medical records | 7 years after the case closes; where the claimant was a child, until they turn 25 if that is later |
| Enquiries that never became cases or work with us | 2 years |
| Applications to join our expert panel that are unsuccessful, withdrawn or on hold, including CVs | 12 months after the decision |
| Invoices and accounting records | 6 years from the end of the financial year they relate to |
| Website access logs (held by Vercel) | A short period (up to 30 days) |
| Website visitor statistics (held by Plausible) | Totals only, which identify no one, for as long as we use Plausible; IP addresses are never stored |
| The platform’s audit trail (no clinical content) | As long as the case records it relates to |
At the end of each period, records are reviewed and deleted. We keep a record longer only while a dispute, complaint or regulatory query about it is open.
Your rights
You have the right to ask for a copy of your personal information, and to ask us to correct it, delete it, restrict how we use it, or move it to another organisation. You can also object to our using it on the basis of our legitimate interests. Some rights are limited where information is needed for legal claims. To use any of these rights, contact us at enquiries@probitamedical.co.uk.
If you are unhappy with how we have used your information, please tell us first so we can put it right (see complaints). You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint.
Changes to this notice
We will update this notice when how we use personal information changes, and show the date above.