Privacy Policy

1. Who We Are

Medical Second Opinion Ltd is a company registered in England and Wales under company number 11173981. Our registered office is at 3rd Floor, 86-90 Paul Street, London EC2A 4NE.

We are the data controller responsible for your personal data in connection with Medical Second Opinion services — the organisation legally responsible for deciding how and why it is used.

2. What Data We Collect

We collect the following categories of personal data, depending on how you use our site:

• Identity data — name, date of birth
• Contact data — email address, phone number
• Case and medical data — your condition, medical history, treating doctor, current medications, and any medical records, reports, or images you upload
• Payment data — processed securely by Stripe; we do not store your card details
• Collaboration applications — if you apply to join our specialist network, your professional details (specialty, role, institution, GMC number) and a summary of your background

3. Why We Collect It (Legal Basis)

We process your data on the following legal bases under UK GDPR:

• Contract — to fulfil the second opinion service you have paid for
• Explicit consent — for processing special category health data
• Consent — for optional cookies, such as analytics and live chat, which we only set if you accept them. You can withdraw this consent at any time (see section 8)

4. Special Category Data (Health Information)

Your medical records and information about your condition are special category data under UK GDPR, and receive the highest level of protection under data protection law. We only process it with your explicit consent, solely to facilitate your second opinion case. It is shared only with your matched consultant for that purpose, and is not used for any other purpose or retained longer than necessary.

5. Who We Share Your Data With

• Consultants — your case file is shared with the matched specialist to enable their review
• Stripe — payment processing
• Cloudflare — secure storage of uploaded medical documents
• Supabase — secure database hosting (EU-based)
• Resend — sending case and account-related emails
• tawk.to — live chat (only if you consent to optional cookies)
• Google — Google Analytics (only if you consent to optional cookies)

We do not sell your data to any third party.

6. How Long We Keep Your Data

We keep personal data only for as long as we need it, then securely delete it. We may keep data for longer where the law requires it, or where it is needed to establish, exercise, or defend a legal claim. Our retention periods are:

• Case data — including medical records and any uploaded documents — for 2 years after your case is completed, so we can handle any follow-up queries or disputes relating to it
• Collaboration applications — for 12 months after our decision if an application is declined or withdrawn
• Collaborator records, including bank details — for as long as you are part of our specialist network, and 2 years after you leave
• Contact form enquiries and live chat conversations — for 12 months after the conversation ends
• Payment and accounting records — for 6 years, as required by UK tax and company law

7. Your Rights

Under UK GDPR you have the right to:

• Access a copy of the personal data we hold about you
• Correct any inaccurate or incomplete data (rectification)
• Request erasure of your data in certain circumstances (the "right to be forgotten")
• Restrict how we use your data in certain circumstances
• Receive your data in a portable format, or have it transferred to another organisation
• Object to our use of your data for direct marketing or in certain other circumstances
• Withdraw consent at any time, where we rely on consent to process your data
• Lodge a complaint with the Information Commissioner's Office (ico.org.uk)

To exercise any of these rights, contact us at info@medicalsecondopinion.co.uk.

8. Cookies

Cookies are small text files stored on your device. We only set optional cookies if you accept them in our cookie banner. We use:

• Essential cookies — needed for the site to work, so they do not require your consent. These include a cookie that remembers your cookie choice for 12 months, and sign-in cookies used only by our staff when accessing our internal admin area.
• Live chat (optional) — our chat widget is provided by tawk.to. It loads, and sets its own cookies, only if you accept optional cookies. If you use the chat, the messages and any details you send are processed by tawk.to on our behalf.
• Analytics (optional) — we use Google Analytics to understand how visitors use our site, such as which pages are viewed and how long visits last, so we can improve it. It loads, and sets its cookies (such as _ga, kept for up to 2 years), only if you accept optional cookies. We do not use it to identify you, and we never send it the medical information you submit.
• No advertising cookies — we do not use cookies for advertising or to track you across other websites.

You can change your choice at any time using the button below, or the Cookie settings link at the bottom of every page. If you withdraw consent, the page reloads without the chat widget or analytics.

9. How to Complain

If you have any concerns about how we use your personal data, please contact us first — we will do our best to resolve it. You also have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk/make-a-complaint, or by calling 0303 123 1113.

10. Changes to This Policy

We may update this policy from time to time. The date at the top of this page indicates when it was last revised.

11. Contact

For any privacy-related queries, contact us at info@medicalsecondopinion.co.uk.