Last updated 1 August 2026
Privacy policy
This policy explains what personal and health data MedReview 365 collects, why we process it, how long we keep it and the rights you can exercise. It is maintained by MedReview 365 and is not an independent certification.
Data we process
We process account data, the medical records you choose to upload, and the case metadata generated when a review is carried out.
- Account data: name, email address, authentication identifiers and sign-in events
- Health data you upload: radiology and pathology reports, laboratory results, clinic letters, discharge summaries and medication lists
- Case data: case reference, clinical specialty, urgency, status history and reviewer actions
Lawful basis
Health data is special category data. We process it on the basis of your explicit consent, given when you create a case and upload records, and for the provision of health-related services. You may withdraw consent at any time; withdrawal does not affect processing already carried out.
Access controls
Uploaded documents are held in private storage. Access is restricted by row-level security so that a patient account can reach only its own cases and files, and reviewing clinicians can reach only cases assigned to them. Every document access is written to an audit trail.
Retention and deletion
Case records are retained while your account is active so that you can revisit reports. You can request deletion of a case or of your entire account, and we will delete stored documents and case data except where a specific legal obligation requires retention.
Your rights
Depending on your jurisdiction you may have rights of access, rectification, erasure, restriction, portability and objection. Requests can be sent to the privacy contact below and are normally answered within one month.
Contact
Privacy requests and questions: privacy@medreview365.example. Security disclosures: security@medreview365.example.