Security and data protection
How we protect medical records and case data
Our platform holds confidential medical records and personal details. Protecting them is built into every part of how Probita works, from the first instruction to the day a record is deleted.
Our approach
Secure by default, at every layer
Access is denied unless it has been explicitly granted, and checked in more than one place.
Our secure portal is launching soon. Until then, instruct us by email and we’ll keep you updated on each case.
Hosted in London
Case details and documents are stored and processed in UK (London) data centres run by established cloud providers, including backups.
Encrypted throughout
Everything is encrypted in transit (HTTPS) and at rest. We use managed, widely trusted services for sign-in, encryption and file storage rather than building our own.
Two-step sign-in for everyone
Every account, for our team, solicitors and experts, must use two-step verification with an authenticator app. Sessions time out when left idle.
Role-based access
Each person sees only the cases and documents their role allows. These rules are enforced by the database and the server, not only by what the screen shows.
A secure records viewer
Experts read medical records in a secure, watermarked viewer. Downloading is allowed only where a case’s terms permit it, and an expert’s access ends when their work on the case is done.
Uploads checked for viruses
Every uploaded file is scanned for malware before anyone can open it. Documents are versioned, so nothing is silently overwritten.
A full audit trail
Every change to a case, document or payment is written to an audit trail that no one, including our own team, can edit. It records who did what and when, but never clinical content.
No medical details in emails or texts
Our emails and text messages carry a case reference and a link to sign in, never names, medical details or documents.
Nothing silently lost
Records are never deleted by individual users. Deletion happens only through our controlled retention process, and backups let us recover from mistakes.
AI and data
How AI handles case data
- AI runs inside our own cloud account, in UK (London) data centres.
- Under the AI provider’s commercial terms, it keeps no copy of what it processes, and nothing is used to train AI models.
- AI never forms or changes a medical opinion. It prepares records summaries and checks reports for completeness; people make every decision.
- We switch on each AI feature only once it has passed its own testing.
For law firms
We have a data protection impact assessment (DPIA) for the platform, and we can provide data processing terms on request. We are also happy to answer your firm’s information security questionnaire.
For claimants
If your solicitor has instructed us, we use your details only to arrange your medical report. You will not see reports or fees through Probita; your solicitor will discuss the report with you. See information for claimants and our privacy notice.
Where your data is held
All case data and documents, while stored and while being processed, are held in UK (London) data centres. A small number of operational services that never receive medical details, such as error reports that carry only a case reference, may be provided from outside the UK. Where that happens, it is under UK data protection transfer safeguards. Our privacy notice names the providers.
How long we keep records
Case records are kept for 7 years after a case closes, or until a claimant who was a child turns 25 if that is later, and are then reviewed for deletion. Records are kept longer only while a dispute, complaint or regulatory query is open. The full list of retention periods is in our privacy notice.
Independent testing
The platform will be independently penetration tested before launch. It holds no real case data until it has passed an independent code review and that penetration test.
Certifications
We’re working towards Cyber Essentials. We list a certification here only once it has been awarded.
Data protection lead
Our data protection lead is Henry Howe. Email enquiries@probitamedical.co.uk with any question about how we use personal information.
Report a security concern.
If you think you have found a security problem, please tell us at enquiries@probitamedical.co.uk.
Please never send medical records or claimant details by ordinary email.
Questions about data protection?
We are glad to explain how we protect your clients’ or patients’ information.