Privacy Policy
Last updated: 15 June 2026
Introduction
This Privacy Policy explains how HKO Consultants Ltd collects, uses, stores, shares and protects personal data when providing medico-legal administrative, expert coordination, report-flow, diagnostic arrangement, treatment referral and related support services.
HKO Consultants Ltd is committed to protecting and respecting your privacy. We handle personal data in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and other applicable data protection laws. We use appropriate technical and organisational measures to help protect personal data from unauthorised access, loss, misuse, alteration or disclosure.
This policy applies to personal data processed through our website, professional enquiries, medico-legal instructions, expert administration, treatment or diagnostic coordination, and related communications.
Who We Are
HKO Consultants Ltd is a company registered in England and Wales under company number 13490488. Our registered office is 3 Swain Mount, Bradford, BD2 1HJ.
In this policy, “HKO”, “we”, “us” and “our” refer to HKO Consultants Ltd. “You” and “your” refer to the person whose personal data we process, including claimants, injured parties, solicitors, medical experts, treatment providers, diagnostic providers, professional contacts and website users.
Questions, comments or requests about this Privacy Policy should be sent to our Data Protection Officer by post at HKO Consultants Ltd, 3 Swain Mount, Bradford, BD2 1HJ, or by email at [email protected].
Our Role As Controller Or Processor
When we process personal data, we may act as a data controller or a data processor depending on the circumstances of the instruction and the way the data is being used.
Where we decide why and how personal data is processed, we act as a data controller. Where we process personal data on behalf of another organisation, such as an instructing solicitor, medical reporting agency or other authorised instructing party, we act as a data processor and follow that data controller’s lawful instructions.
Where another organisation is the data controller, that organisation’s privacy policy may also apply to the processing of your personal data.
What Personal Data Means
Personal data means information that can identify a living individual, either directly or indirectly. This may include names, contact details, identification information, case information, professional details, financial information, online identifiers and correspondence.
Special category data means more sensitive personal data under data protection law. In the context of HKO’s services, this may include health information, medical records, medical history, examination details, diagnosis, prognosis, treatment information and other information connected to a medico-legal matter.
Personal Data We Process About Claimants And Injured Parties
Where we are involved in a medico-legal matter, we may process personal data and special category data about claimants or injured parties. This may include your name, address, contact details, date of birth, details of the claim or incident, information about any injury or damage suffered, work, education and lifestyle information, physical build, marital status, GP details, details of other treating professionals, medical records, medical history, medication information, test results, investigation results, examination details, diagnosis and prognosis information provided by an expert or health organisation.
We may also process your IP address where an electronic signature is required for a form of authority or another document connected to your case.
Where a matter involves a child or a person who requires assistance, we may process relevant personal data through their legal representative, parent, guardian, litigation friend or another authorised person where lawful and necessary.
Why We Process Claimant And Injured Party Data
We process claimant and injured party data to support medico-legal instructions and related administrative work. This may include arranging independent medical reports, coordinating expert appointments, assisting with diagnostic arrangements, arranging treatment referrals where instructed, supporting investigations connected to a legal case, managing correspondence, handling documents, supporting case administration, dealing with complaints and responding to lawful instructions from the relevant data controller.
HKO does not provide medical advice, legal advice, diagnosis or clinical opinion. Independent medical experts are responsible for their own professional opinions. HKO manages the administration, communication, coordination and report-flow around that work.
Personal Data We Process About Solicitors And Professional Contacts
When solicitors, law firms or other professional contacts contact us, instruct us or use our website, we may process business contact details and enquiry information. This may include your name, role, organisation, email address, telephone number, postal address, enquiry details, instruction details, correspondence, case type, urgency, claimant location, medical issue or injury details, and documents you choose to provide.
We ask professional contacts to avoid sending unnecessary sensitive information at the first enquiry stage. Where sensitive information is needed for a medico-legal matter, it should only be provided through an appropriate, authorised and secure route.
Personal Data We Process About Experts And Treatment Providers
Where medical experts, treatment providers, diagnostic providers or other professional service providers work with us, apply to work with us or engage with our services, we may process personal data for due diligence, onboarding, administration, payment, performance review and service management purposes.
This may include contact details, date of birth, professional registration numbers, DBS check information where lawful and necessary, criminal conviction data where lawful and necessary, passport or driving licence information, CV and employment history, qualification and accreditation certificates, indemnity insurance information, ICO registration information where relevant, performance records, bank details, VAT registration number, tax status, interview records or screenshots where needed to evidence a remote interview, recent utility bills where required for admin or secretarial support services, and gender where relevant to claimant preference or appointment suitability.
Where an expert is included in HKO’s expert network, we may share or publish limited professional profile information where appropriate and approved. This may include professional title, specialty, general location, consultation suitability, qualifications summary, expertise and medico-legal experience. We do not publish private contact details, private addresses, sensitive personal information, private insurance details, references or raw full CV information unless this has been specifically approved and is lawful.
Why We Process Expert And Provider Data
We process expert and provider data to assess suitability, carry out due diligence, manage professional engagement, coordinate instructions, arrange appointments, manage clinic or diary administration, process payments, maintain service records, support compliance checks, review service performance, handle complaints, meet legal obligations and protect the rights and interests of HKO, experts, providers, instructing parties and claimants.
We may share an expert’s name with a claimant before a consultation takes place. We may also share redacted CV or profile information with instructing parties so they can consider an expert’s suitability for a particular matter.
Lawful Bases For Processing
We only process personal data where we have a lawful basis to do so. Depending on the circumstances, we may rely on contract, legal obligation, legitimate interests, consent, explicit consent, and the establishment, exercise or defence of legal claims.
Our legitimate interests may include managing professional enquiries, coordinating medico-legal instructions, arranging expert appointments, supporting report-flow administration, communicating with solicitors, experts and providers, handling complaints, protecting our business, maintaining accurate records, improving administrative processes and ensuring secure service delivery.
Where special category data is processed, such as health data, we process it only where a lawful condition applies. This may include explicit consent, the establishment, exercise or defence of legal claims, the provision or arrangement of health-related services where applicable, compliance with legal obligations, or another lawful condition under data protection law.
Where we act as a data processor, the lawful basis may be determined by the relevant data controller, such as the instructing solicitor, medical reporting agency or other authorised instructing party.
Where We Get Personal Data From
We may receive personal data directly from you when you contact us, complete an enquiry, send documents, communicate with us or work with us.
We may also receive personal data from instructing solicitors, law firms, medical reporting agencies, independent medical experts, treatment providers, diagnostic providers, medical records providers, hospitals, GP practices, case management systems, document-signing platforms and other organisations involved in a medico-legal matter.
For experts and treatment providers, we may receive personal data directly from you or generate it during your engagement with HKO.
Sharing Personal Data
We only share personal data where necessary, lawful and appropriate for the purpose of providing our services, complying with legal obligations, following instructions from a data controller, managing a case or protecting legal rights.
For claimant and injured party matters, we may share relevant personal data with the instructing party, referring agency, independent medical experts, treatment providers, diagnostic providers, hospitals, medical records providers, the Ministry of Justice through MedCo where applicable, secure document or mobile application providers where applicable, debt recovery agencies where necessary, auditors, lawyers, third-party administration or secretarial providers, secure shredding providers and other support providers involved in the efficient and secure handling of the matter.
For experts and treatment providers, we may share relevant personal data with instructing parties, claimants before consultations, regulatory bodies, law enforcement bodies, government bodies, auditors, lawyers, payment providers, professional advisers and other third parties where there is a lawful reason to do so.
We require third-party service providers to handle personal data securely and only for the purposes for which it has been shared.
Storage And Security
We use third-party providers to store, host and manage personal data. These providers act as data processors where they process personal data on our behalf.
Personal data is handled with appropriate security measures, including access controls, secure systems, confidentiality procedures and encryption where appropriate. We take steps to reduce the risk of unauthorised access, accidental loss, disclosure, alteration or misuse.
Our service providers may process personal data within the United Kingdom and the European Economic Area. Where personal data is transferred outside the United Kingdom or European Economic Area, we will take steps to ensure appropriate safeguards are in place where required by data protection law.
How Long We Keep Personal Data
For claimant and injured party matters, we will usually keep personal data for at least seven years following completion of the case. We may keep limited information for longer where necessary for financial reasons, insurance requirements, legal claims, MedCo requirements where applicable, regulatory obligations or other legal obligations.
For experts and treatment providers, we will usually keep personal data for fifteen years from the later of the end of our contract with you or the conclusion of any investigation, claim or complaint concerning you.
For website enquiries and professional contact records, we keep personal data only for as long as necessary to respond to the enquiry, manage the professional relationship, keep appropriate business records, comply with legal obligations or protect our legitimate interests.
When personal data is no longer needed, it will be deleted, securely destroyed or anonymised where appropriate.
Marketing
We will not use your personal data for marketing purposes unless we have a lawful basis to do so. Where we rely on consent, you may withdraw that consent at any time.
If you have chosen to receive marketing or professional updates from us, you can ask us to stop sending them at any time by contacting [email protected].
Your Data Protection Rights
Under data protection law, you have rights in relation to your personal data. These may include the right to access your personal data, the right to ask us to correct inaccurate or incomplete information, the right to request deletion of your personal data, the right to restrict processing, the right to object to processing, the right to data portability, and the right to withdraw consent where processing is based on consent.
These rights are not absolute and may depend on the circumstances of the processing, our legal obligations, contractual requirements, the status of HKO as controller or processor, and whether the data is needed for the establishment, exercise or defence of legal claims.
To exercise your rights, please contact our Data Protection Officer at HKO Consultants Ltd, 3 Swain Mount, Bradford, BD2 1HJ, or by email at [email protected].
Complaints
If you have concerns about how we use your personal data, please contact us first so we can review and respond to your concern.
If you remain unhappy with how we have used your personal data, you have the right to complain to the Information Commissioner’s Office, which is the UK supervisory authority for data protection matters. You can find more information at www.ico.org.uk.
Cookies
Our website may use cookies and similar technologies to help the website function, understand how visitors use the site and improve the browsing experience.
Please read our separate Cookie Policy for more information about the cookies we use and how you can manage your preferences.
External Links
Our website may contain links to other websites. This Privacy Policy applies only to HKO’s website and services. If you follow a link to another website, you should read that website’s own privacy policy before providing any personal data.
Where you are directed to our website from another website, we may receive personal data from that website where lawful and relevant. The privacy policy of the other website may also apply to the information you provided there.
Changes To This Policy
We may update this Privacy Policy from time to time. When changes are made, we will place the updated version on this page and update the date shown at the top of the policy.
Contact Details
HKO Consultants Ltd
3 Swain Mount, Bradford, BD2 1HJ, UK.
Email: [email protected]
