This notice explains what SORTAL Limited, trading as Sortal, does with personal information. It is written in two parts because we handle personal information in two very different situations, and the rules that apply are not the same.
SORTAL Limited, trading as Sortal | Version 1.0 | 7 September 2026
People who visit our website, contact us, or work with us as clients, suppliers or professional contacts
We are the controller. We decide how the information is used.
Part B
Claimants, patients and other people named in the medical records we are instructed to handle
We are a processor acting on the instructions of the law firm handling the claim. That firm is the controller.
Part C
Everyone. Security, transfers, rights and complaints
Applies to both of the above.
Who we are and how to contact us
SORTAL Limited, trading as Sortal, is a company registered in England and Wales with company number 14385500. Our registered office and trading address is Earle House, Atlantic Street, Altrincham, Cheshire, WA14 5DD. Sortal is part of the MRC Group of companies and follows the same data protection standards.
We have appointed a Data Protection Officer. To contact the Data Protection Officer, to ask a question about this notice, or to exercise any of your rights:
Post: The Data Protection Officer, Sortal, Earle House, Atlantic Street, Altrincham, Cheshire, WA14 5DD
Telephone: 0161 928 1636
Part A: website visitors, enquirers and business contacts
This part applies when you visit sortal.com, contact us, ask us about our services, or deal with us as a client, supplier, expert or other professional contact. In these situations we are the controller of your information.
What we collect
Your name, job title and the organisation you work for.
Your business contact details, including email address, telephone number and postal address.
The content of your enquiries, correspondence and any forms you complete. For quote requests this includes the page count and service you selected and the estimate shown to you, and for every form it includes the consent choices you ticked and when.
Records of our dealings with you, including meeting notes, instructions received and services provided.
Information collected automatically when you visit the website: your IP address, browser type and version, operating system, the pages you view, the time and date of your visit, and the site you arrived from.
We do not ask website visitors or business contacts for information about their health, and you should not send us health information through the website contact form. If you need to send us medical records, contact us and we will give you a secure route.
Why we use it, and our lawful basis
What we do with it
Our lawful basis
Respond to your enquiry and provide information about our services
Legitimate interests: responding to someone who has contacted us. Where you are asking us to quote for work, performance of a contract or steps taken before entering into one.
Provide our services and manage the relationship with a client, supplier or expert
Performance of a contract with you or the organisation you represent, and our legitimate interests in running the business.
Invoicing, credit control and keeping accounting records
Performance of a contract, and compliance with our legal obligations under tax and company law.
Send you marketing about our services by email
Your consent, or where you have previously enquired about or used similar services, our legitimate interests. You can opt out at any time.
Understand how the website is used and improve it
Your consent for analytics cookies. Strictly necessary cookies are set on the basis of our legitimate interests in operating the site securely.
Keep records to protect our position if a complaint, claim or regulatory question arises
Legitimate interests in defending our legal position, and compliance with legal obligations.
Cookies
Our website uses a small number of cookies and similar technologies. Strictly necessary storage is needed for the site to work and is always set. Analytics cookies, which help us count visitors and see how the site is used, are only set if you agree through the banner shown on your first visit. We use Google Tag Manager to load Google Analytics; Tag Manager itself is loaded only after you allow analytics and sets no cookies of its own. You can change or withdraw your choice at any time using in the footer of every page, or by adjusting your browser settings. Turning off cookies may mean parts of the site do not work as intended.
Name
Purpose
Duration
sortal-consent
Remembers whether you accepted or rejected analytics cookies. Strictly necessary; stored in your browser's local storage rather than as a cookie.
Until you clear your browser data or change your choice
_ga
Google Analytics 4. Distinguishes visitors so that visits can be counted. Set only if you allow analytics.
2 years
_ga_QWRGL283GW
Google Analytics 4. Keeps the state of the current visit. Set only if you allow analytics.
2 years
We do not use advertising or social media tracking cookies. If that changes, the new category will appear in the cookie banner and this table will be updated.
Marketing
If we send you marketing emails, every message contains an unsubscribe link. You can also tell us to stop at any time by emailing dataprotection@mrcgroup.uk. We will act on that request without delay and will keep a minimal record of the fact you have opted out, so that we do not contact you again by mistake.
How long we keep it
Website analytics data: no more than 26 months. Website enquiries are emailed to our team and are not stored on the website itself.
Enquiries that do not lead to work: 12 months from our last contact with you.
Client, supplier and expert records: for the duration of the relationship and then 6 years, which matches the period in which a contractual claim can be brought.
Accounting and tax records: 6 years from the end of the accounting period, as required by law.
Marketing preferences and opt outs: kept for as long as we hold your contact details, so that we can honour your choice.
Part B: claimants, patients and people named in medical records
Our main business is organising medical records for law firms and their clients. If you are bringing a personal injury, clinical negligence or similar claim, your solicitor may send your medical records to us so that we can sort, index, paginate and summarise them, and in some cases prepare a chronology or a screening report.
Our role, and who is responsible
In this work we are a processor. We act only on the written instructions of the law firm handling your claim. That firm is the controller and decides what happens to your records, why they are needed and how long they are needed for. We do not decide those things and we do not use your records for our own purposes.
If you want to know why your records were sent to us, ask us to correct something in them, or ask for a copy, the right person to contact is your own solicitor, because they hold that decision. If you contact us directly we will tell your solicitor and help them respond, but we cannot act on your request without their instruction. If you do not know who to contact, we will tell you which firm instructed us.
There is one limited exception. Where our own clinically trained staff form a professional view, for example a screening opinion or an expert memorandum, we are responsible for that professional judgement in our own right. Even then, the underlying records remain the responsibility of the instructing firm.
What we handle
The records your solicitor sends us. That usually includes GP records, hospital and clinic notes, correspondence between clinicians, test results, imaging and radiology reports, prescribing and medication records, occupational health records, and sometimes records relating to mental health, sexual health or substance use. It also includes your name, date of birth, NHS number, address and the reference numbers used on your claim.
These are special category data under data protection law, and we treat them accordingly.
Our lawful basis
Because we are a processor, the lawful basis for handling your records is your solicitor's, and they will explain it in their own privacy notice. For completeness, the basis they will normally rely on is:
Article 6(1)(b) or Article 6(1)(f) of the UK GDPR, being performance of the contract with you or their legitimate interests in progressing your claim; and
Article 9(2)(f) of the UK GDPR, being that the information is necessary for the establishment, exercise or defence of legal claims.
Where we act in our own right in relation to a professional judgement, as described above, we rely on the same conditions.
How long we hold your records
We are a short term handler of your records, not a long term archive. Our standard timetable is:
Stage
What happens
While the work is in progress
Your records are held in a secure processing environment with access limited to the staff working on the file.
On delivery
We return the organised records and any reports to your solicitor. The processing environment is cleared once the work is complete.
For 90 days after delivery
Your solicitor can download the completed records from the secure link we provide. Access ends automatically at the end of the 90 days.
After that
We permanently delete your medical records and the organised bundle, including from our backups. We keep no copy of them.
If your case ends sooner
If your solicitor tells us the case has concluded, we delete the records at that point instead of waiting for the 90 days to run.
What we keep
Our own working record of the case. That includes the administrative record needed to show what work we did and to support our invoice, and, where we produced them, the chronology, the index and any screening opinion together with the clinical notes supporting it. We are responsible for that material in our own right. We keep it until the case is complete or our invoice is settled, whichever comes first, and in any event no longer than 2 years from delivery.
Deletion does not depend on anyone paying our invoice. If our fee is unpaid we pursue it through the instructing firm. We do not hold your records back as leverage and we have no right to keep them for that reason.
The only situation in which we hold records for longer is where we are told, in writing and before deletion falls due, that they are needed for a live dispute, a court or regulatory request, a complaint or an anticipated claim. In that case we hold only what is needed, for only as long as it is needed, and then delete it.
Part C: applies to everyone
Who we share information with
We do not sell personal information and we do not share it for anyone else's marketing.
We share information only where it is necessary, and only with:
The law firm that instructed us, and anyone they tell us to send the records to, such as a medical expert or a barrister.
Medical experts and clinical reviewers we instruct on the law firm's behalf, where the firm has asked us to.
Suppliers who help us run our business and who process information on our instructions under a written contract. These are Informed Solutions Limited, which provides and hosts the secure platform on which our software runs, and its cloud infrastructure provider, Amazon Web Services (Europe, London region); our IT, document and email providers; and, for this website only, Vercel Inc. (website hosting and the enquiry form service), Resend (delivery of enquiry and confirmation emails, processed in the European Union) and Google (Tag Manager and Analytics, only where you have allowed analytics cookies).
Our professional advisers, including accountants, insurers, insurance brokers and lawyers, where they need the information to advise us.
Our bank and our invoice finance provider, in relation to unpaid invoices raised to law firms. This involves invoice and firm details, not medical records.
A regulator, court or other authority where we are required by law to provide the information.
A buyer, or a prospective buyer, if we sell part or all of the business. Any prospective buyer is bound by confidentiality before we disclose anything, and personal information is only transferred if the relevant part of the business transfers.
Every supplier who handles personal information for us is bound by a written contract that requires them to keep it secure, to use it only for the purpose we have given them, to hold it in the United Kingdom (or, for the website services described above, in the United Kingdom or the European Economic Area), to delete it on our instruction, and not to use it to train artificial intelligence models. A current list of the suppliers who handle medical records is available on request.
Where your information is held
Medical records and the other personal information we handle for our clients are stored and processed in the United Kingdom. We do not routinely transfer that information outside the United Kingdom, and if that position ever needs to change for a particular piece of work, we will not do it without the prior written agreement of the instructing firm and an approved transfer mechanism in place.
The one exception is this website. Enquiries made through sortal.com are processed in the United Kingdom and the European Economic Area, which the United Kingdom recognises as providing adequate protection. Analytics data, only where you have allowed it, is processed by Google, which may involve a transfer to the United States under the UK Extension to the EU-US Data Privacy Framework. Medical records are never handled through the website.
Artificial intelligence and automated processing
We use our own software, including artificial intelligence, to help sort, classify and index medical records. It speeds up a task that would otherwise be done entirely by hand.
Two things are worth saying plainly. First, a person always checks the result. The software proposes how a document should be classified and where it belongs; a trained member of our team reviews and corrects that before anything is delivered. No decision about you, your treatment or your claim is made by software alone. Second, we do not use your medical records to train our software. What we record when our staff review the software's suggestions is limited to whether a suggestion was right or wrong and which category it should have been, expressed as codes and numbers. It contains no medical content, no names, no identifiers and no link to you or your case, and it cannot be traced back to you.
If a law firm we work for specifically agrees in writing that record content may be used to improve the software, we will honour the scope of that agreement and nothing wider. Absent that written agreement, record content is never used for training.
How we keep information secure
The measures we apply include:
Encryption of information in transit and when stored.
Access limited to the staff who need it for the work in hand, controlled by individual named accounts and multi factor authentication.
Logging of access, downloads and deletions, attributable to a named individual.
Secure transfer routes for records, rather than ordinary email attachments.
Confidentiality obligations, pre employment screening and data protection training for our staff and contractors.
Independent penetration testing of the platform used to process records, and remediation tracking for anything found.
A documented breach procedure, so that an incident is investigated, contained, reported to the instructing firm quickly, and reported to the Information Commissioner's Office where the law requires it.
Written contracts with every supplier who handles personal information for us, on terms that match the ones we give our clients.
No set of measures removes risk entirely. If you think information held by us has been lost or accessed without permission, tell us immediately at dataprotection@mrcgroup.uk.
Your rights
You have the following rights over your personal information. They are not absolute and some of them only apply in particular circumstances.
Right
What it means
Access
Ask for a copy of the personal information we hold about you, and to be told how we use it.
Rectification
Ask us to correct information that is inaccurate, or complete information that is incomplete.
Erasure
Ask us to delete your information where there is no good reason for us to keep it.
Restriction
Ask us to pause our use of your information, for example while you dispute its accuracy.
Objection
Object to our use of your information where we rely on legitimate interests, and object at any time to direct marketing.
Portability
Ask us to transfer information you gave us to you or to another organisation, where we hold it on the basis of consent or a contract and by automated means.
Withdraw consent
Where we rely on your consent, withdraw it at any time. This does not affect anything done before you withdrew it.
Exercising any of these rights is free. Contact us using the details at the top of this notice. We will respond within one month. If your request is complex we may need up to a further two months, and we will tell you if that is the case and why. If we cannot do what you have asked, we will explain why and tell you how to complain.
If your request relates to medical records we hold for a law firm, please see Part B. We will pass your request to that firm without delay, tell you that we have done so, and help them answer it.
Complaints
If you are unhappy with how we have handled your personal information, please tell us first, using the contact details at the top of this notice. We would rather hear about it and put it right.
You also have the right to complain to the Information Commissioner's Office at any time. You do not have to come to us first.
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Changes to this notice
We review this notice at least once a year and whenever we change something material about how we handle personal information. The version number and date at the top of the notice tell you which version you are reading. If we make a significant change we will say so on the website.
