MRC Terms and Conditions 2026

Definitions

The following definitions apply in these Conditions. The rules of interpretation are set out in clause 1.

1Definitions and interpretation

The defined terms used in these Conditions are set out in the Definitions list at the front of these Conditions and have the meanings given there. The following rules of interpretation apply.

1. 1.1
   Clause and Annex headings do not affect the interpretation of these Conditions.
2. 1.2
   References to clauses are to clauses of these Conditions, and references to paragraphs are to paragraphs of the Annex. The Annex forms part of these Conditions and, subject to the order of precedence in clause 2.6, has effect as if set out in full in the body of these Conditions.
3. 1.3
   A person includes a natural person, a corporate or unincorporated body (whether or not having separate legal personality), a partnership and a limited liability partnership. A reference to a party includes that party's personal representatives, successors and permitted assigns.
4. 1.4
   Any words following the terms including, include, in particular, for example or any similar expression are illustrative and do not limit the sense of the words, description, definition, phrase or term preceding those terms.
5. 1.5
   A reference to a statute or statutory provision is a reference to it as amended, extended or re-enacted from time to time, and includes all subordinate legislation made under it.
6. 1.6
   Writing and written include email but exclude any other form of electronic message, and a document signed by a party includes a document signed by electronic signature.
7. 1.7
   Words in the singular include the plural and words in the plural include the singular.
8. 1.8
   A reference to a right of termination is a reference to a right to terminate the Contract in question only, unless these Conditions expressly provide otherwise.
9. 1.9
   Where a period is expressed in Business Days, the period begins on the first Business Day after the event which starts it. Where a period is expressed in days, it means calendar days.
10. 1.10
    Periods of time are expressed in these Conditions in numerals, so that a reference to 6 months, to 2 Business Days or to 6 years is to be read accordingly.

2Introduction and status of the Contract

1. 2.1
   We are Medical Record Collation Limited trading as MRC Group, a company registered in England and Wales with company number 07212178 and VAT registration number 106051660, whose registered office is at Earle House, Atlantic Street, Altrincham, Cheshire, WA14 5DD.
2. 2.2
   These Conditions are the overarching agreement between us. They govern every instruction you place with us and every Contract formed under clause 4, whether or not the Proforma Order for a particular instruction repeats them. Each Approval of a Proforma Order creates a separate Contract in respect of the Case to which it relates, and every such Contract incorporates these Conditions in the version in force at the date of that Approval.
3. 2.3
   These Conditions apply to the exclusion of any other terms which you seek to impose or incorporate, and of any terms implied by trade, custom, practice or course of dealing. In particular, no terms contained in or referred to in any purchase order, panel or framework terms, order confirmation, acknowledgement, specification, portal terms or other document issued by you form part of the Contract or vary it, and any provision to the contrary in such a document has no effect, whether or not we acknowledge or sign it.
4. 2.4
   The Contract comprises, and only comprises, the following documents:

   1. (a)
      any Client-Specific Terms signed by an authorised representative of each of us and in force at the date of Approval;
   2. (b)
      these Conditions, including the Annex; and
   3. (c)
      the Contract Details set out in the Approved Proforma Order.
5. 2.5
   The MRC Privacy Notice is referred to in these Conditions for information only. It describes how we process personal data as controller, it may be updated by us from time to time, and it does not form part of the Contract and cannot vary it.
6. 2.6
   Order of precedence. If there is any conflict or inconsistency between the documents comprising the Contract, they take precedence in the following order:

   1. (a)
      first, any Client-Specific Terms;
   2. (b)
      second, the Contract Details, but only in respect of the following genuinely commercial matters: the Services selected, the Charges and rates, the Payment Scheme, any agreed turnaround, and the identity of the Case and of the parties;
   3. (c)
      third, the Annex, but only in relation to Payment Events, the rates applicable on a Payment Event and the time for payment; and
   4. (d)
      fourth, these Conditions, which prevail over the Contract Details on every matter other than those listed in paragraph (b), and over the Annex on every matter other than those listed in paragraph (c).
7. 2.7
   For the avoidance of doubt, and without limiting clause 2.6, the Contract Details cannot vary, disapply or add to any provision of these Conditions relating to data protection, retention or deletion of data, security, intellectual property, limitation of liability, confidentiality or termination. Any variation of those provisions is effective only if it is set out in Client-Specific Terms, or is expressly identified in the Contract Details as a variation of the identified clause of these Conditions and the Proforma Order recording it is signed by an authorised representative of each of us. This clause 2.7 does not prevent the Contract Details from recording that you are a Portal Client, and does not prevent the agreement of a Backstop under clause 13.6, which takes effect on written confirmation by each of us in accordance with that clause and which constitutes Client-Specific Terms for the purposes of this clause 2.7.
8. 2.8
   Subject to clause 2.7, no variation of the Contract is effective unless it is in writing and signed by an authorised representative of each of us. This clause 2.8 and clause 2.7 are the only routes by which the Contract may be varied, save that clause 15.3 sets an additional and stricter requirement for any variation of clause 15.1.
9. 2.9
   Version control, the issue of updated Conditions and the position of clients who hold signed Client-Specific Terms are dealt with in clause 19.
10. 2.10
    Where these Conditions confer a right on us which operates across more than one Contract with you, including any right of suspension under clause 10.7(b), that right is conferred at the level of these Conditions and applies to each Contract you enter into with us, subject to the limits stated in the clause conferring it.

3Client satisfaction and complaints

1. 3.1
   We operate documented client care and quality policies, and we will perform the Services in accordance with clause 5 and with the standards set out in these Conditions. Nothing in this clause 3 imposes on us a standard of performance higher than the standard set out in clause 5.2, and this clause 3 does not create any warranty or representation.
2. 3.2
   If you are dissatisfied with any aspect of the Services you may complain, and we will investigate promptly. You may contact our complaints handler at our registered office or at our monitored mailbox operations@mrcgroup.uk. A copy of our Complaints Handling Procedure is available on request.
3. 3.3
   Complaints and enquiries about the processing of personal data should instead be directed to our Data Protection Officer at dataprotection@mrcgroup.uk. This does not affect your right, or the right of any data subject, to complain to the Information Commissioner's Office.
4. 3.4
   We ask that you raise any concern with us in the first instance, and that you allow us a reasonable opportunity to investigate and, where appropriate, to correct or re-perform the affected Services under clause 5.9, before commencing proceedings. This clause 3.4 does not restrict your legal rights or prevent you from taking any step you consider necessary to protect your position, and does not extend or shorten the claims notice period in clause 16.11.

4Approval of the Proforma Order and formation of the Contract

1. 4.1
   When we receive Client Material from you together with a request for the Services, we will issue a Proforma Order to you setting out the Contract Details.
2. 4.2
   The Proforma Order sets out the Contract Details only. It is not a standalone agreement and it is not an offer capable of being varied by your acceptance on different terms. On Approval you enter into a Contract on these Conditions, of which the Contract Details form part.
3. 4.3
   A Contract is formed when we receive your Approval. Approval may be given by email. Once we have received Approval we may begin to perform the Services, and we are entitled to assume, without further enquiry, that the person giving Approval is authorised to do so. You warrant that any person giving Approval on your behalf has your authority to bind you to the Contract.
4. 4.4
   You must check the Proforma Order carefully before giving Approval, in particular the Services selected, the Charges and rates, and the Payment Scheme. We are not obliged to accommodate any request to change the Services or to move a Contract from one Payment Scheme to another after Approval, and any such change is effective only if we agree it in writing.
5. 4.5
   A Proforma Order remains open for Approval for 30 days from the date it is issued. If Approval is received after that period we are not obliged to proceed, and we may re-quote the Charges and rates and issue a replacement Proforma Order.
6. 4.6
   We will supply an Estimate only where you request one in your letter of instruction. An Estimate is an indication of the likely Charges based on the information available to us at the time. It is not a fixed price, it does not form part of the Contract, it is not binding on either of us and it does not vary the Contract, and the Invoice may be higher or lower. Where the volume, complexity or condition of the Client Material differs materially from the basis of the Estimate, we will tell you as soon as reasonably practicable.
7. 4.7
   Work carried out before Approval, or after withdrawal. If at your request we carry out work on the Client Material before a Contract is formed, and you then do not give Approval, we may charge you for the work reasonably carried out at your request, at the rates set out in the Proforma Order or, where no rate applies, at our then current rates as set out in, or notified under, the Contract Details. If, after Approval, you withdraw the Case or instruct us to stop work before Return, we may invoice you for the Services performed and the disbursements properly incurred up to the date we receive that instruction, and that invoice is payable within 30 days of its date irrespective of the Payment Scheme. Clause 17.10(b) applies to an invoice issued on termination.
8. 4.8
   We may decline any request for the Services, and may decline to issue a Proforma Order, at our discretion and without giving reasons, at any time before a Contract is formed.

5Supply of the Services

1. 5.1
   We will supply the Services to you in accordance with the Contract.
2. 5.2
   We will:

   1. (a)
      perform the Services with reasonable care and skill, using personnel who are suitably trained and, where the Services include a Professional Judgement Output, suitably qualified;
   2. (b)
      ensure that the Deliverables conform in all material respects to the Contract Details and to the description of the relevant service in clause 5.3;
   3. (c)
      organise, separate, index, paginate, label and present the Client Material without altering the content of the underlying records, so that the record as supplied to us remains the authoritative document; and
   4. (d)
      take reasonable care of the Client Material while it is in our possession or under our control, and deal with it on Return in accordance with clause 12 and, where hard copy or physical media have exceptionally been supplied, return it or destroy it as stated in the Contract Details.
3. 5.3
   The services we are able to supply are described in this clause 5.3 and comprise the following. Only those services selected in the Contract Details form part of the Services for a Contract.

   1. (a)
      AI-assisted sorting: automated splitting of large multi-record files, detection of record, form and letter types, identification of imaging, general practitioner records and hospital records, AI-assisted chronological ordering, preparation of the record set for pagination, screening or expert use, and enhancement of the record set for optical character recognition and text searching, in each case subject to Human Verification.
   2. (b)
      Pre-sort: a timeline view of the records, basic section ordering, identification of obvious issues, duplicates and apparently missing sections, and preparation of the record set for expert instruction or clinical screening.
   3. (c)
      Pagination and indexing: chronological sorting by date and medical category, removal of duplicates, court-standard pagination, a clickable hyperlinked digital index, and an OCR text-searchable output suitable for use by the court, counsel and experts.
   4. (d)
      Clinical chronology: a chronology summarising key events, treatments, gaps in the records and notable issues. Where the chronology is descriptive only we act as processor. Where the chronology applies medical interpretation it is a Professional Judgement Output and clause 11.5 applies to our role in respect of it.
   5. (e)
      General practitioner clinical screening reports: preparation of the sorted record set, clinical review by an experienced general practitioner, and a screening report on the clinical merit of the Case and the recommended next steps, including decision support on whether to proceed or to decline. Turnaround for a screening report is indicatively 24 to 48 hours from the record set being ready for clinical review.
   6. (f)
      Expert bundle assembly: assembly of the bundle for expert instruction, together with an expert memorandum recording clinician commentary, apparently missing records, concerns identified and recommendations as to expert evidence, and a radiology schedule of investigations, dates, modalities and providers.
   7. (g)
      Radiology viewing, structuring and matching: secure intake of discs and digital imaging files, extraction and conversion of DICOM and other radiology media, linking of imaging to the corresponding reports, identification of missing or mismatched studies, cross-referencing against the core records, secure online access to the imaging and reports, and a structured radiology summary.
   8. (h)
      Secure delivery: delivery, and where purchased hosting, of the Deliverables through the MRC Portal by encrypted link with a separately issued password, as described in clause 13.
4. 5.4
   A clinical screening report is a clinical opinion on the merit of the Case for litigation purposes only. It is not treatment advice, it does not create any clinician and patient relationship with your client or with any other individual, and no individual should rely on it for any clinical purpose.
5. 5.5
   We do not provide legal advice, and nothing in any Deliverable is legal advice. Responsibility for the conduct of the Case, for all legal decisions and for the use made of any Deliverable rests with you.
6. 5.6
   All processing, storage and hosting of Client Material and Deliverables in connection with the Services takes place in the United Kingdom, within the sub-processing chain set out in clause 11.17(a) and subject to the restriction in clause 11.18.
7. 5.7
   Timescales. Any turnaround stated in the Contract Details or in clause 5.3 is indicative only unless it is expressly agreed in writing to be a guaranteed date. We will use reasonable endeavours to meet indicative turnarounds. Time is not of the essence in relation to the performance of the Services, and we are not liable to you for any delay in providing the Deliverables or any part of them. Where we identify a material obstacle to delivery within an indicated turnaround, we will notify you as soon as reasonably practicable and notify you of a revised indicative timescale, which then applies in place of the timescale previously indicated.
8. 5.8
   Changes to the Services. We may from time to time refine the way in which the Services are delivered in order to improve accuracy, enhance security, comply with a legal or regulatory requirement or reflect client feedback. We will notify you of any material change to the scope of the Services or to the form of the Deliverables. We will not materially reduce the functionality or the scope of the Services during an active instruction without your consent.

Any change under this clause 5.8 which would alter the nature, means or location of the processing of the Customer Personal Data requires your prior written agreement. A change to the technical or organisational measures in clause 11.9 does not require your agreement provided it does not reduce the level of protection, and we will notify you of any such change. We will keep those measures under review and may improve them at any time.

1. 5.9
   Correction and re-performance. If any Deliverable does not conform to clause 5.2(b), you must notify us in writing, giving reasonable particulars, within 30 days of the date on which you become aware of the non-conformity and in any event no later than 12 months from Return. We will then, at our option and at no charge to you, correct the non-conformity or re-perform the affected part of the Services within a reasonable period. Where the relevant Client Material and Deliverables have been deleted under clause 12 before we receive that notice, our obligation under this clause 5.9 is conditional on your supplying us with the source material again at your cost, and clause 12.7 applies.2(b), except where we fail to correct or re-perform within a reasonable period, and except as provided in clause 16.4. This clause 5.9 does not extend the claims notice period in clause 16.11.

6MRC AI and human review

1. 6.1
   We use MRC AI to assist in the delivery of the Services. MRC AI is used to split large multi-record files, to classify and label records, to sort records, to index them and to place them in chronological order, and to prepare the record set for optical character recognition and text searching. That activity is AI Processing.
2. 6.2
   MRC AI is operated by us and is delivered on the SORTAL platform, provided and hosted by Informed Solutions within a single-tenant environment running on Amazon Web Services cloud infrastructure in the Europe (London) region. The full sub-processing chain, including the identity of the Amazon Web Services contracting entity, is set out in clause 11.17(a). All AI Processing takes place in the United Kingdom.
3. 6.3
   Human Verification. Every output of MRC AI is reviewed and verified by a trained member of our team before it is finalised and before it is released to you. No output of MRC AI is released to you, to counsel, to an instructed expert, to any other party or to the court without that verification having been completed.
4. 6.4
   Human Verification is a documented review process designed to check, as applicable to the output in question and to the extent reasonably practicable having regard to the volume and condition of the Client Material, the following matters:

   1. (a)
      that the record set has been correctly split and separated and that no record has been omitted from the output;
   2. (b)
      that records have been correctly classified, labelled and attributed to the correct provider and episode of care;
   3. (c)
      that the chronological ordering is correct and that dates have been read correctly;
   4. (d)
      that pagination, bookmarking, hyperlinking and the index are accurate and internally consistent;
   5. (e)
      that duplicates have been correctly identified and that apparent gaps in the records are flagged to you;
   6. (f)
      that illegible, corrupted or unreadable material is identified and reported to you; and
   7. (g)
      in the case of a Professional Judgement Output, review by a suitably qualified clinician or other suitably qualified person of the clinical or expert content, followed by a final quality check before release.
5. 6.5
   Clause 6.4 describes the matters our verification process is designed to check. It is not a warranty that any of those matters is achieved in every case, and clause 6.7 prevails over clauses 6.3 and 6.4 to the extent of any inconsistency.
6. 6.6
   We do not use MRC AI, and we do not use any other solely automated means, to make any decision about your client, about the merits of the Case or about any individual named in the Client Material. No decision producing legal effects for, or otherwise significantly affecting, any individual is taken by automated means in the course of the Services.
7. 6.7
   Integrity of the records. MRC AI reorders, separates, indexes, labels and presents the Client Material. It does not, and cannot, alter the content of the underlying records. We will not alter the content of any record supplied to us. The source record as supplied to us remains the authoritative document. Where you instruct rectification of personal data, clause 11.12 sets out how that instruction is given effect.
8. 6.8
   Limitations. Notwithstanding clauses 6.3 and 6.4, you acknowledge that:

   1. (a)
      no system, whether operated by a human being or automated, can guarantee complete accuracy, and while every MRC AI output is subject to Human Verification we do not warrant that the Services or the Deliverables will be error-free;
   2. (b)
      the quality of any output depends heavily on the quality, completeness, legibility, structure and format of the Client Material supplied to us;
   3. (c)
      we do not warrant that every gap, anomaly, inconsistency or omission in the underlying records will be identified;
   4. (d)
      we do not warrant that records produced by a third party, including a general practice, hospital, NHS trust or other record holder, are complete, accurate or correctly collated by that third party; and
   5. (e)
      we do not warrant that radiology or other imaging media supplied to us will be readable, convertible or complete.
9. 6.9
   We do not use Client Material, Customer Personal Data or the Deliverables to train, fine-tune, evaluate, benchmark or otherwise develop any artificial intelligence or machine learning model, or for service improvement, product development, testing, demonstration, promotional or marketing purposes. Clause 15 sets out that commitment in full, including the flow-down to our Sub-Processors, the only route by which it may be varied and the limited aggregated metrics exception.
10. 6.10
    You must not, and must not permit any third party to, use MRC AI, any MRC AI output or any Deliverable to train, develop, test or benchmark any artificial intelligence or machine learning system, or to reverse engineer, decompile or attempt to replicate MRC AI or our formats, templates, index or chronology structures, processes, workflows or rule sets. Clause 14.4 sets out the licence on which you may use the Deliverables, and clause 14.6 sets out your corresponding restrictions.

7Your obligations

1. 7.1
   You will:

   1. (a)
      co-operate with us in all matters relating to the Services;
   2. (b)
      provide the Client Material and all information we reasonably require in a timely manner, and ensure that the information you give us is accurate and complete in all material respects;
   3. (c)
      supply the Client Material using the secure transfer methods we make available, and not by unencrypted email attachment;
   4. (d)
      give clear written instructions as to the Services required;
   5. (e)
      notify us of any Payment Event promptly and in any event within 5 Business Days of it occurring;
   6. (f)
      notify us of any circumstance which you know or reasonably believe gives us a right to terminate the Contract, promptly and in any event within 5 Business Days;
   7. (g)
      where a Deferred Payment Scheme applies, give us an update on the Case, and confirm whether a Payment Event has occurred, within 5 Business Days of our written request. We may make such a request at any time and as often as we reasonably require, and we do not have to wait any fixed period between requests;
   8. (h)
      notify us in writing of Case Completion within 20 Business Days of it occurring, so that we can apply the retention and deletion rules in clause 12. You acknowledge that Case Completion is an operative deletion trigger under clause 12.5 and that we are not in breach of the Contract or of Applicable Data Protection Laws by reason of a delay in deletion caused by your failure to give that notice;
   9. (i)
      notify us in writing before the Case is transferred to another firm, and as soon as reasonably practicable on becoming aware of any proposed change of control, merger, amalgamation, incorporation, reconstitution or other reorganisation affecting you; and
   10. (j)
       download and retain your own copy of the Deliverables and of any returned records within the availability window set out in clause 12, and manage your own retention of them.
2. 7.2
   Authority and lawful basis. You warrant, in respect of every Contract, that:

   1. (a)
      you are authorised to instruct us in relation to the Case and to supply the Client Material to us and to permit our use of it for the purposes of the Services;
   2. (b)
      you have a valid lawful basis under Article 6 of the UK GDPR, and a valid condition under Article 9 of the UK GDPR and Schedule 1 to the Data Protection Act 2018 in respect of any special category data, and, in respect of any personal data relating to criminal convictions and offences or related security measures, that the processing satisfies Article 10 of the UK GDPR and section 10(5) of, and a condition in Part 1, 2 or 3 of Schedule 1 to, the Data Protection Act 2018, for the processing you instruct;
   3. (c)
      all necessary transparency information has been given to the individuals concerned to enable the Client Material lawfully to be supplied to us and processed by us; and
   4. (d)
      the Client Material is not, to the best of your knowledge and belief, unlawful, defamatory, obscene or infringing of any third party's rights, and does not contain any virus, malware or other technically harmful material.
3. 7.3
   We do not determine your lawful basis and we do not advise you on it. Suggested privacy notice wording describing our involvement is available from us on request.
4. 7.4
   Acceptable use. You must not use the MRC Portal, MRC AI or any Deliverable for any unlawful purpose, must not introduce or permit the introduction of any virus, malware or other technically harmful material into our systems, must not permit any unauthorised person to access our systems or the Deliverables, and must not resell any Deliverable as a commercial product or reproduce our templates, formats or workflows for use outside the Case.
5. 7.5
   If our performance of any obligation under the Contract is prevented or delayed by any act or omission by you, or by your failure to perform any obligation in this clause 7, then without limiting our other rights or remedies we are not liable for any resulting cost, loss or delay, the timescales for the Services are extended by a corresponding period, and we may charge you for any additional work reasonably required as a result, at the rates in the Contract Details or, where no rate applies, at our then current rates as set out in, or notified under, the Contract Details and notified to you in advance.

8Dependencies and the quality of Client Material

1. 8.1
   Our performance of the Services depends on the timely receipt of the Client Material, on accurate written instructions from you, and on the availability, completeness and readability of the source material, including records, discs and radiology and other imaging media. Any delay caused by you or by a third party extends the timescales for the Services by a corresponding period.
2. 8.2
   We are not liable for any delay in, or defect in, the Services or the Deliverables, and no such delay or defect is a breach of the Contract by us, to the extent that it is caused by:

   1. (a)
      Client Material which is incomplete, illegible, corrupted, mislabelled, duplicated, out of sequence or supplied in a format which we have told you is unsuitable;
   2. (b)
      radiology or other imaging media which is encrypted or password protected and supplied to us without the necessary credentials, or which is unreadable, damaged or in a proprietary format we cannot convert;
   3. (c)
      delay by a general practice, hospital, NHS trust, other record holder or external radiology provider in producing or releasing records or imaging;
   4. (d)
      technical corruption of a file occurring before it is supplied to us;
   5. (e)
      your failure to give timely instructions or responses; or
   6. (f)
      any other act or omission of yours or of a third party outside our reasonable control.
3. 8.3
   Where we identify that Client Material falls within clause 8.2 we will notify you as soon as reasonably practicable, tell you what we need in order to proceed, and notify you of a revised indicative timescale, which then applies in place of the timescale previously indicated. Where the position requires additional work we may charge for that work in accordance with clause 7.5.
4. 8.4
   We have no obligation to obtain, chase or verify the completeness of records held by a third party, or to identify that a third party record holder has failed to disclose a record, except where obtaining or auditing those records is expressly included in the Services in the Contract Details.
5. 8.5
   Unresolved dependencies. Where we have notified you under clause 8.3 that we require credentials, replacement material, instructions or a response in order to proceed, and we have not received it within 30 days of that notification, we may by written notice either:

   1. (a)
      treat the Services as complete to the extent then performed, in which case Return occurs on the date of that notice and we may invoice for the Services performed and the disbursements properly incurred; or
   2. (b)
      terminate the Contract, in which case clause 17.8 applies. Either notice is given without liability to you, and neither affects the operation of clause 12.

9Security of communications

1. 9.1
   The MRC Portal is our standard method of receiving Client Material and of delivering the Deliverables. You must use the secure transfer methods we make available for the supply of Client Material and must download the Deliverables from the MRC Portal or from the encrypted link we provide.
2. 9.2
   We do not send Client Material or Deliverables as unencrypted email attachments. Where we deliver a file otherwise than through the MRC Portal, we do so by encrypted link with the password issued separately.
3. 9.3
   We may correspond with you by email in relation to the Services. You acknowledge that email is not a secure medium, that messages may be delayed, intercepted, corrupted or fail to arrive, and that you are responsible for the security, configuration and monitoring of your own email systems and for screening incoming messages and attachments for viruses and malware. We screen incoming and outgoing email for viruses and malware, and we expect you to do likewise.
4. 9.4
   Unless we know, or ought reasonably to know, otherwise, we are entitled to assume that an email which purports to come from you or from a person at your firm was in fact sent by that person, and that any instruction, Approval or authority contained in it was validly given.
5. 9.5
   Payment fraud. We will never notify a change to our bank account details by email. If you receive any communication purporting to change our bank details, whether by email, letter, telephone or any other means, you must not act on it. Before making any payment to us, and in any event before making any payment to account details which differ from those on the Invoice, you must verify the details with us by telephone on 0161 928 1636.
6. 9.6
   Formal notices under the Contract must be given in accordance with the notices provision in clause 18.9, and not by ordinary email correspondence under this clause 9.

10Charges and payment

1. 10.1
   The Charges are calculated at the rates set out in the Contract Details. The rate agreed at the point of sale is honoured for the life of the Case, and the Charges are not subject to any indexation, annual uplift or other increase, save for sums properly added under this clause 10. Where a Case runs on the Deferred 2 Year Payment Scheme and the Contract Details record an ATE Policy, and the Case is lost or abandoned within the 2 year period, the Charges are recalculated at the ATE Failed Rate and we will reissue the Invoice in accordance with the ATE Applicable Case provisions in Part 4 of the Annex.
2. 10.2
   The rates in the Contract Details are inclusive of all sundry items. We provide a fully digital service, and printing, photocopying, scanning of hard copy material and postage or courier are not provided as standard and are not charged as standard. Where such a step is exceptionally required in order to perform the Services and is expressly requested by you, we will tell you the reasonable cost before carrying it out, and we will charge for it only where you have agreed that cost in writing in advance, in which case it is added to the Invoice or Proforma Invoice.
3. 10.3
   All sums payable under the Contract are exclusive of VAT, which you must pay in addition at the applicable rate against a valid VAT invoice.
4. 10.4
   On Return we will submit an Invoice to you for the Charges plus VAT, or, where a Case runs on the Deferred 2 Year Payment Scheme and the Contract Details record an ATE Policy, a Proforma Invoice.
5. 10.5
   Unless the Additional Conditions for the applicable Payment Scheme provide otherwise, you must pay the Invoice or the Proforma Invoice in full and in cleared funds within 30 days of the relevant Payment Event, and that date is the due date. Where the Standard Payment Scheme applies, the Payment Event is determined by paragraph 2.2 of the Annex and the due date is calculated under paragraph 2.4 of the Annex. Payment must be made to the bank account nominated in writing by us and verified in accordance with clause 9.5.
6. 10.6
   Your obligation to pay is not affected by, and payment may not be delayed because of, the fact that you have not received funds from your client, from an insurer, from a funder, from a paying party or from any other third party.
7. 10.7
   If you fail to pay any sum due under the Contract by the due date then, without limiting our rights under clause 17:

   1. (a)
      interest accrues on the overdue sum from the due date until payment at the statutory rate provided for by the Late Payment of Commercial Debts (Interest) Act 1998, and we may also recover the fixed sum compensation and the reasonable costs of recovering the debt provided for by that Act. Interest does not accrue on any sum which you have disputed in writing, on reasonable grounds and in good faith, within 10 Business Days of the date of the Invoice, until the dispute is resolved, and we will not charge interest or the fixed sum where payment is received within 5 Business Days of the due date; and
   2. (b)
      we may, on not less than 3 Business Days' written notice, suspend all or part of the Services under that Contract, and all or part of the services we are providing to you under any other Contract, until all overdue sums and interest have been paid in full, whether or not we are yet entitled to terminate under clause 17.4(a).
8. 10.8
   The remedies in clause 10.7 are cumulative and may be exercised together or separately, so that interest under clause 10.7(a) and suspension under clause 10.7(b) may both be applied at the same time. Suspension under clause 10.7(b) may be applied to the unpaid Contract itself as well as to any other Contract, does not relieve you of any payment obligation, does not extend, suspend or otherwise affect the retention and deletion timetable in clause 12, and we will resume the affected Services within a reasonable period of payment being received in full. Our right to terminate for non-payment, and the notice we must give before exercising it, are set out in clause 17.
9. 10.9
   You must pay all sums due under the Contract in full without any set-off, counterclaim, deduction or withholding, except as required by law. We may at any time, without limiting our other rights or remedies, set off any amount owing to us by you against any amount payable by us to you.
10. 10.10
    Credit and payment on account. Where you have sums overdue to us under any Contract, or where we reasonably consider that your credit position or payment history so requires, we may require payment on account of the Charges before beginning or continuing work, may carry out a credit assessment, and may decline to accept further instructions from you until all overdue sums have been paid. Any sum paid on account is applied against the Invoice for the Contract concerned.
11. 10.11
    Deemed Payment Event: deferred Contracts. This clause 10.11 applies to the Deferred 6 Month Payment Scheme and the Deferred 2 Year Payment Scheme. If you do not provide a case update we have requested under clause 7.1(g), or notify us of a Payment Event, within 30 Business Days of our written request, the Payment Event is deemed to have occurred on the date of that request and the Invoice falls due for payment 30 days after that date. If you then evidence to our reasonable satisfaction that no Payment Event had in fact occurred, we will correct the position and credit or refund any sum you have paid on account of the deemed Payment Event which is not otherwise due.
12. 10.12
    VAT on deferred Contracts. Where a Deferred Payment Scheme applies, we may issue a request for payment on Return and issue the VAT invoice at the Payment Event, so that the tax point falls at the Payment Event. This clause 10.12 does not alter the amount payable or the due date calculated under clause 10.5.
13. 10.13
    Withholding for overdue sums. Deferred Charges which are not yet due do not entitle us to withhold anything. Where a sum is overdue under the Contract or under any other Contract with you, we may, on not less than 10 Business Days' written notice identifying the overdue sum, decline to Return completed Deliverables until it is paid. We will not exercise that right where doing so would cause you to miss a court deadline of which you have told us in writing. Nothing in this clause 10.13 suspends, extends or otherwise affects the retention and deletion timetable in clause 12 or any of our obligations under clause 11, and we have no lien or other security over the Client Material.
14. 10.14
    Transfer of a Case to a replacement firm. Where a Case is transferred to a replacement firm and we continue to be instructed or our Deliverables continue to be used in the Case, the terms of the Contract and the Invoice are unchanged and the Charges are neither reduced nor otherwise altered by reason of the transfer. A transfer does not release you from liability for the Charges unless we agree in writing to release you, and until we do so you and the replacement firm are jointly and severally liable for them. This clause 10.14 is subject to your notification duty under clause 7.1(i), and we are not obliged to continue the Services to a replacement firm until the party liable to pay the Charges has been established to our reasonable satisfaction.

11Data protection

1. 11.1
   This clause 11 records the agreement between us required by Article 28(3) of the UK GDPR. In it you are the controller and we are the processor, except where clause 11.3, clause 11.5 or clause 11.19(f) provides otherwise. The terms controller, processor, data subject, personal data, special category data, Personal Data Breach, processing and appropriate technical and organisational measures have the meanings given to them in the UK GDPR, and related terms are construed accordingly. References to processing include the equivalent verbs and participles.
2. 11.2
   Each of us will comply with all applicable requirements of Applicable Data Protection Laws. This clause 11 is in addition to, and does not relieve, remove or replace, either party's own obligations or rights under Applicable Data Protection Laws. Each party will have regard to guidance and codes of practice published by the Information Commissioner's Office which are not statutory codes, but such guidance and codes do not themselves constitute terms of the Contract.
3. 11.3
   We process the personal data of your partners, members, employees and other representatives, being their names, job titles, business contact details and correspondence with us, as controller, for the purposes of providing the Services, administering the Contract, credit control and complying with our own legal obligations. Information about that processing, and about the rights of the individuals concerned, is set out in the MRC Privacy Notice at mrcgroup.uk. The MRC Privacy Notice is provided for information and does not vary these Conditions.
4. 11.4
   In respect of all receipt, handling, storage, sorting, splitting, classification, pagination, indexing, bookmarking, hyperlinking, optical character recognition, AI-assisted sorting and analysis, radiology processing and structuring, preparation of the Deliverables, delivery, return and deletion of the Client Material, you are the controller and we are the processor. Subject to clause 11.5, you are the controller of the Customer Personal Data throughout, including after delivery of the Deliverables to you.
5. 11.5
   In respect of Professional Judgement Outputs only, we act as a limited independent controller for the sole purpose of forming, recording and standing behind that professional judgement, because we determine the content of the opinion, the professional and clinical findings and the methodology used to reach them. That limited role:

   1. (a)
      is confined to the creation of the Professional Judgement Output and does not extend to any other processing of the Customer Personal Data;
   2. (b)
      does not entitle us to process the Client Material for any other purpose, and does not confer on us any right in or to the Client Material;
   3. (c)
      does not displace your role as controller for the Case or reduce any of our obligations as processor in respect of the underlying records;
   4. (d)
      does not extend the periods for which we retain any data beyond clause 12, including clause 12.4A;
   5. (e)
      in respect of that limited controller processing we rely on Article 6(1)(f) of the UK GDPR, being our legitimate interest, and the legitimate interests of the parties to the proceedings, in the production of an independent professional opinion that we can stand behind, on Article 9(2)(f) of the UK GDPR, being processing necessary for the establishment, exercise or defence of legal claims, and, where personal data relating to criminal convictions and offences is present, on paragraph 33 of Schedule 1 to the Data Protection Act 2018. We record that processing, and our legitimate interests assessment, in our record of processing activities, and we describe it in the MRC Privacy Notice. We undertake to maintain the MRC Privacy Notice so that it describes that processing and the rights of the data subjects concerned, and to make it publicly available at mrcgroup.uk;
   6. (f)
      the parties act as independent controllers in respect of a Professional Judgement Output and are not joint controllers. You will include in the privacy information you provide to the data subject a statement that a medical records and clinical review provider may be instructed to produce professional outputs in connection with the Case, and a reference to the MRC Privacy Notice. Where the exemption in Article 14(5)(b) of the UK GDPR, or an exemption in Schedule 2 to the Data Protection Act 2018, applies to our own transparency duty, we will record in writing the exemption relied on and our reasons. If a court or the Information Commissioner's Office determines that the parties are joint controllers in respect of any Professional Judgement Output, the parties will promptly enter into an arrangement satisfying Article 26(1) of the UK GDPR and will make the essence of it available to data subjects, and until they do, this clause 11.5 and clause 11.19 stand as that arrangement; and
   7. (g)
      we will state in the Contract Details, and on the face of each Deliverable, whether that Deliverable is a Professional Judgement Output. Where a chronology or other Deliverable is not identified as a Professional Judgement Output, we act as processor in respect of it and clause 11.4 applies. Where you ask us to confirm the status of any Deliverable we will do so in writing within 5 Business Days.

1. 11.5A
   Clauses 11.8 to 11.11, 11.14, 11.16, 11.18 and clause 12 apply to the MRC Controller Data as they apply to the Customer Personal Data, as if references to the Customer Personal Data included the MRC Controller Data, save that clause 11.7 (documented instructions) does not apply to the MRC Controller Data. We will notify you of any Personal Data Breach affecting the MRC Controller Data in accordance with clause 11.14 as if it were a Personal Data Breach affecting the Customer Personal Data.

1. 11.6
   You warrant that you have a valid lawful basis under Article 6 of the UK GDPR, and a valid condition under Article 9 of the UK GDPR and (where applicable) a condition in Schedule 1 to the Data Protection Act 2018, for the processing you instruct, in respect of any special category data, and, in respect of any personal data relating to criminal convictions and offences or related security measures, that the processing satisfies Article 10 of the UK GDPR and section 10(5) of, and a condition in Part 1, 2 or 3 of Schedule 1 to, the Data Protection Act 2018, and that all necessary transparency information has been provided to the data subjects concerned, and any authority, authorisation or, where it is in fact relied on, consent which is required has been obtained, to enable the lawful supply of the Client Material to us and the lawful processing of it by us and by our Sub-Processors for the duration and purposes of the Contract. The parties acknowledge that the processing is carried out in the context of, or in anticipation of, legal proceedings and that Article 9(2)(f) of the UK GDPR is expected to be the relevant condition for special category data. The parties do not expect consent under Article 6(1)(a) or Article 9(2)(a) of the UK GDPR to be the basis or condition relied on, and neither party's obligations under the Contract are conditional on any such consent. We do not determine your lawful basis. You will indemnify us against all liabilities, costs, expenses, damages and losses (including reasonable legal costs) suffered or incurred by us arising out of or in connection with any breach of this clause 11.6, except to the extent caused by our own breach of the Contract or our negligence.

1. 11.6A
   Your indemnity. You will indemnify us against all liabilities, costs, expenses, damages and losses, including reasonable legal costs and any fine or penalty imposed on us by a supervisory authority, suffered or incurred by us arising out of or in connection with: our processing of the Client Material in accordance with your instructions; your failure to comply with Applicable Data Protection Laws in your capacity as controller; any inaccuracy in or incompleteness of the Client Material you supply; and any disclosure or use by you of the Deliverables outside the licence in clause 14.4. This indemnity does not apply to the extent the liability is caused by our own breach of the Contract or our negligence, and your total liability under this clause 11.6A is subject to the same limits as apply to us under clause 16.5 and clause 16.6.

1. 11.7
   We will process the Customer Personal Data only on your documented instructions. Your documented instructions comprise the Contract Details, the Proforma Order, these Conditions and clause 11.19, together with any further written instructions you give us, unless we are required to process otherwise by law. Where we are required by law to process Customer Personal Data otherwise than on your instructions, we will inform you of that legal requirement before processing unless the law prohibits us from doing so. We will not process the Customer Personal Data for any purpose of our own, and we will inform you immediately if in our opinion an instruction infringes Applicable Data Protection Laws. We may suspend performance of the instruction concerned until the point is resolved between us, and no such suspension extends any retention period in clause 12. We will not suspend performance of an instruction where suspension would prevent you meeting a time limit imposed on you by Applicable Data Protection Laws, and will instead perform the instruction while recording our objection in writing.
2. 11.8
   We will ensure that every person authorised to process the Customer Personal Data, whether an employee, worker, contractor or the personnel of a Sub-Processor, is subject to a binding duty of confidentiality that survives the end of their engagement, has received data protection and information security training appropriate to their role, is subject to appropriate vetting, processes the Customer Personal Data only on our instructions, and has access only to the data necessary for their role on a least-privilege, need-to-know basis.
3. 11.9
   We will implement and maintain appropriate technical and organisational measures to ensure a level of security appropriate to the risk, having regard to the state of the art, the costs of implementation, the nature, scope, context and purposes of the processing and the special category nature of the data. Those measures include:

   1. (a)
      encryption of the Customer Personal Data in transit and at rest;
   2. (b)
      multi-factor authentication for access to systems holding the Customer Personal Data;
   3. (c)
      role-based access control on a least-privilege, need-to-know basis, with periodic access reviews;
   4. (d)
      audit logging of access to, and activity on, the Customer Personal Data;
   5. (e)
      a web application firewall and continuous threat monitoring at the hosted platform environment described in clause 11.17(a);
   6. (f)
      independent penetration testing and regular vulnerability scanning of the hosted platform environment described in clause 11.17(a);
   7. (g)
      malware scanning of all uploaded material, and controlled access to uploaded material;
   8. (h)
      a documented joiner, mover and leaver process, under which access rights are provisioned on role change and revoked on the leaving date or earlier where appropriate, with revocation recorded;
   9. (i)
      single-tenant, logically segregated hosting, with segregated environments for processing, delivery and backup, and encrypted and integrity-checked backup and recovery;
   10. (j)
       password policies meeting National Cyber Security Centre standards;
   11. (k)
       no persistent storage of the Customer Personal Data on local drives, removable media or personal devices, and no processing on personal devices. Transient local caching by managed endpoint applications used to view, convert or prepare records is permitted on encrypted, centrally managed MRC devices and is removed in the ordinary course;
   12. (l)
       documented and periodically tested incident response, business continuity and secure disposal procedures; and
   13. (m)
       Human Verification of every output of MRC AI before it is used in any further step or released to you.
4. 11.10
   We will not alter the content of the underlying records supplied by you. The Services organise, separate, index, label, paginate and present those records; they do not amend them, and the source record as supplied to us remains the authoritative document. No output of MRC AI is released to you, to counsel, to an expert, to another party or to a court without Human Verification, and MRC AI is not used to make any decision about a data subject or about the merits of the Case.
5. 11.11
   The Customer Personal Data is processed within a hosted platform environment provided by Informed Solutions Limited, which holds ISO 27001 certification and Cyber Essentials Plus certification, and your data is processed within that single-tenant environment. MRC AI is provided within that ISO 27001 and Cyber Essentials Plus certified environment. The MRC Portal is provided and hosted by Glasscubes Limited, whose information security management system is ISO/IEC 27001 certified by a UKAS-accredited body and which holds Cyber Essentials certification. We hold Cyber Essentials certification in our own name and operate to ISO 27001 aligned controls. Copies of the relevant certificates are available on request, where we are permitted to disclose them.
6. 11.12
   We will notify you without undue delay, and in any event within 2 Business Days, if we receive any request, complaint or communication from or on behalf of a data subject relating to the Customer Personal Data, or any communication from the Information Commissioner's Office, any other regulator, any court, any police force or any coroner relating to the Customer Personal Data. We will not respond to any such request or communication, other than to acknowledge receipt and to direct the person making it to you, unless you instruct us in writing to respond or we are required to respond by law. Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures, so far as possible, in enabling you to respond to and comply with requests from data subjects exercising their rights under Chapter III of the UK GDPR, including by locating, retrieving, extracting and providing the relevant Customer Personal Data in a commonly used electronic format and by effecting any rectification, restriction or erasure you instruct. Where you instruct rectification, we will give effect to it by appending a supplementary or correcting statement, by annotation or by substituting a corrected record which you supply, in each case without altering the content of the source record as supplied to us, and clause 11.10 and clause 6.6 are read accordingly. Where an instruction cannot be carried out without altering the content of a source record, we will tell you within 2 Business Days and will propose the alternative means by which the instruction can be given effect. Where we act as limited independent controller under clause 11.5, we are responsible for responding to requests relating to that Professional Judgement Output, and we will notify and consult you before doing so.
7. 11.13
   Taking into account the nature of the processing and the information available to us, we will assist you in ensuring compliance with your obligations under Articles 32 to 36 of the UK GDPR, including security of processing, notification of a Personal Data Breach to the Information Commissioner's Office and to data subjects, data protection impact assessments and prior consultation with the Information Commissioner's Office. On request we will provide our current data protection impact assessment, record of processing activities, sub-processor register, retention and disposal schedule, information security policy, a summary of the penetration testing of the hosted platform environment and completed security questionnaire responses for that purpose. We will provide the assistance in this clause 11.13 and in clause 11.12 at no charge where it is required as a result of our breach or that of a Sub-Processor, and otherwise for up to 2 hours of our time per Case. Beyond that, we may charge our reasonable costs at our then current rates notified to you in advance. We will not withhold assistance required within a statutory time limit that applies to you by reason only that our charges for it have not yet been paid, but you must pay those charges within 30 days of invoice.
8. 11.14
   We will notify you of any Personal Data Breach affecting the Customer Personal Data without undue delay and in any event within 48 hours of becoming aware of it. For the purposes of this clause 11.14, we become aware of a Personal Data Breach when any member of our personnel, or any Sub-Processor, has a reasonable degree of certainty that a security incident has occurred which has led to a Personal Data Breach, and awareness by a Sub-Processor is treated as our awareness. Each Sub-Processor is required by written contract to notify us of any Personal Data Breach without undue delay and in any event within 24 hours of its own awareness, and to require each further sub-processor in the chain to do the same. The notification will be sent to the address you specify for that purpose in the Contract Details or, where no such address is specified or notification to it fails, to your firm's data protection officer or nominated data protection contact and to the person who gave Approval, and in addition by telephone where reasonably practicable. The notification will include, so far as known at the time, the nature of the Personal Data Breach, the categories and approximate number of data subjects and personal data records concerned, the categories of personal data affected, the likely consequences, the measures taken or proposed to address it and to mitigate its adverse effects, and the name and contact details of our Data Protection Officer. Where the full information is not available within 48 hours we will provide an initial notification within that period and supplement it as further information becomes available. We will co-operate fully with you, take all reasonable steps you direct to assist in investigating, containing, mitigating and remediating the Personal Data Breach, preserve all relevant evidence and logs, and provide reasonable assistance with any resulting communication with the Information Commissioner's Office or with data subjects. We will not notify the Information Commissioner's Office, any data subject or any other third party of a Personal Data Breach in terms that name or identify you without first consulting you, unless we are required to do so by law or we act as controller in respect of the affected data. Our own costs of investigating, containing and remediating a Personal Data Breach caused by us or by a Sub-Processor are borne by us.
9. 11.15
   We will delete or return the Customer Personal Data in accordance with clause 12, which sets out your documented instruction for the purposes of Article 28(3)(g) of the UK GDPR. Termination or expiry of the Contract neither triggers nor defers deletion. Where the Contract terminates before Return, we will at your written direction return or delete the Client Material and all Customer Personal Data and delete all existing copies, except to the extent we are required by law to retain it and except for the Financial Records and the material described in clause 12.5(b). Where you give us no direction within 30 days of our written request, we will delete the Client Material and all Customer Personal Data. Where the Contract terminates after Return, the periods in clause 12 continue to apply.
10. 11.16
    We will maintain complete and accurate written records and information sufficient to demonstrate our compliance with this clause 11 and with Article 28 of the UK GDPR, including our record of processing activities, sub-processor register, retention and disposal schedule, data protection impact assessment, access and audit logs, training records and deletion logs, and we will make that information available to you on reasonable written request. The records in this clause 11.16 are retained in accordance with clause 12.5(b) and are not deleted on Case Completion. We will allow for and contribute to audits, including inspections, of our processing of the Customer Personal Data and of our compliance with this clause 11, conducted by you or by an auditor you mandate, on the following basis:

    1. (a)
       we will satisfy your request in the first instance by providing Informed Solutions Ltd's current ISO 27001 certificate and Cyber Essentials Plus certificate, any equivalent certification held by another Sub-Processor, in each case where we are permitted to disclose it, together with our then current security documentation, policies, our summary of the penetration testing of the hosted platform environment, available third party assurance reports and written responses to your questionnaire;
    2. (b)
       you may proceed to a remote or on-site inspection where that material does not reasonably enable you to verify our compliance, and an on-site inspection may take place only where remote and documentary methods are demonstrably inadequate;
    3. (c)
       an inspection requires not less than 20 Business Days' written notice, must take place during normal business hours, must not unreasonably disrupt our business, and may take place no more than once in any 24 month period, and no more than once in any 24 month period in aggregate across all Contracts with you, except that you may audit more frequently and on shorter notice where we have notified a Personal Data Breach affecting the Customer Personal Data, where you are required to audit by the Information Commissioner's Office, by any other regulator or by your own professional or insurance obligations and you identify in writing the specific regulatory or insurance requirement relied on, or where a previous audit identified a material deficiency that has not been remedied. We may charge our reasonable costs of supporting more than one on-site inspection in any 12 month period at our then current rates;
    4. (d)
       the scope of any audit is limited to the processing we carry out for you, and no audit may require us to disclose information relating to any other customer, any commercially sensitive material not relevant to the audit, or any information the disclosure of which would compromise the security of our infrastructure or breach a duty owed to a third party. We will not withhold information under this paragraph (d) where it can reasonably be provided in redacted or summary form, or under a specific confidentiality undertaking, and where we withhold information we will tell you in writing what has been withheld and why, and will provide a written summary sufficient to enable you to assess our compliance;
    5. (e)
       the auditor must not be a competitor of ours, must comply with our reasonable site, security and confidentiality requirements and must be bound by obligations of confidentiality;
    6. (f)
       you bear the costs of an audit, except that where an audit reveals a material breach by us of this clause 11 we will bear your reasonable costs of that audit and of any follow-up audit, up to a maximum of £10,000 per audit;
    7. (g)
       nothing in this clause 11.16 limits the statutory powers of the Information Commissioner's Office; and
    8. (h)
       at your reasonable written request we will exercise our own audit, inspection and information rights against any Sub-Processor in respect of the processing of the Customer Personal Data, and will provide you with the results.
11. 11.17
    You give your general written authorisation, for the purposes of Articles 28(2) and 28(4) of the UK GDPR, for us to engage the Sub-Processors listed in clause 11.17(a) and clause 11.17(b). The following provisions apply to Sub-Processors:

    1. (a)
       the sub-processing chain for the hosted processing is: Medical Record Collation Limited trading as MRC Group (processor); then SORTAL Limited, company number 14385500, England and Wales (AI-assisted record sorting, indexing and analysis); then Informed Solutions Limited (provision, hosting, maintenance and support of the secure platform on which that processing runs); then Amazon Web Services, being Amazon Web Services EMEA SARL, or such other Amazon Web Services contracting entity as Informed Solutions Limited engages from time to time, as notified in our sub-processor register, providing the underlying cloud infrastructure in the Europe (London) region only, with all storage and processing of the Customer Personal Data taking place in the United Kingdom;
    2. (b)
       we also use Glasscubes Limited, company number 08630188, England and Wales (provision and hosting of the MRC Portal, through which Deliverables are made available to you), Nixaam LLC (provision and maintenance of the radiology imaging platform, with the imaging held in our own Amazon Web Services account in the Europe (London) region and under our control), Microsoft Corporation (Microsoft 365) and Adobe Inc. (Adobe Acrobat) as Sub-Processors, for the viewing, conversion, indexing, preparation and internal transmission of records on managed and encrypted MRC endpoints and tenants located in the United Kingdom. We have configured those services so that the Customer Personal Data is stored in the United Kingdom, and we have enabled all available data-residency, data-boundary and support-access controls. We do not permit either provider to access the Customer Personal Data from outside the United Kingdom. If we are at any time unable to maintain that position, we will notify you under clause 11.17(c), will record the position and the mechanism relied on in our sub-processor register together with a transfer risk assessment, and clause 11.18 applies. We maintain a current sub-processor register listing all Sub-Processors, which is available to you on request;
    3. (c)
       we may add, replace or remove a Sub-Processor at any time, provided the incoming Sub-Processor is bound by written contract to obligations that are the same as and no less protective as those in this clause 11. We maintain a current sub-processor register listing all Sub-Processors, published at mrcgroup.uk, and we will update it when a change is made. Updating the register is notice to you for the purposes of Article 28(2) of the UK GDPR;
    4. (d)
       you may object to a change on reasonable and documented data protection grounds. We will discuss the objection with you in good faith and may propose an alternative arrangement. If the objection cannot be resolved within 30 days, you may terminate the affected Services on written notice, without penalty, and you will pay for the Services properly performed up to the date of termination. On any termination under this paragraph (d), clause 11.15 and clause 12.9 apply;
    5. (e)
       we will impose, by written contract, the obligations set out in this clause 11 on each Sub-Processor we engage directly, and will require each such Sub-Processor to impose obligations that are the same as and no less protective on any further sub-processor it engages, so that those obligations, including the security measures in clause 11.9, the United Kingdom-only restriction in clause 11.18, the retention and deletion timetable in clause 12 and the exclusion of AI training and secondary use in clause 15, flow down the whole of the chain in clause 11.17(a) and clause 11.17(b). We will make the relevant contractual extracts or written confirmations available to you on request. We will carry out documented due diligence on each Sub-Processor before engagement and will review each Sub-Processor at least annually. No Sub-Processor may appoint a further processor without our prior written approval; and
    6. (f)
       we remain fully liable to you for the acts and omissions of every Sub-Processor and for the performance of the whole of the chain set out in clause 11.17(a) and clause 11.17(b), as if those acts and omissions were our own. Where a Sub-Processor fails to fulfil its data protection obligations, we remain fully liable to you for the performance of that Sub-Processor's obligations.
12. 11.18
    All processing and storage of the Customer Personal Data by us and by every Sub-Processor takes place within the United Kingdom. Hosting is within the Amazon Web Services Europe (London) region only. We will not transfer the Customer Personal Data outside the United Kingdom, and will not permit any Sub-Processor to do so, and we will not grant access to the Customer Personal Data from outside the United Kingdom. Where a supplier provides or maintains software or infrastructure used in the Services, maintenance may be carried out from outside the United Kingdom only where it involves no access to the Customer Personal Data, and we maintain technical controls which prevent such access. The parties acknowledge that remote access to the Customer Personal Data from outside the United Kingdom is a transfer for the purposes of this clause 11.18. There are no international transfers of the Customer Personal Data under the Contract. Any change to this position is effective only if agreed in Client-Specific Terms signed by an authorised representative of each of us.
13. 11.19
    The details of the processing required by Article 28(3) of the UK GDPR are as follows:

    1. (a)
       Subject matter: the collation, sorting, splitting, classification, pagination, indexing, bookmarking, hyperlinking, optical character recognition, AI-assisted sorting and analysis of medical and associated records, the processing and structuring of radiology media, and the preparation and delivery of the Deliverables, for use in legal proceedings.
    2. (b)
       Duration: the term of the Contract, together with the retention periods set out in clause 12, and no longer.
    3. (c)
       Nature and purpose: receipt, secure storage, organisation, splitting, classification, indexing, categorisation, bookmarking, hyperlinking, pagination, AI-assisted sorting and analysis with Human Verification, preparation of Professional Judgement Outputs where instructed, delivery of the Deliverables, and secure deletion, in each case on your documented instructions and for the purpose of providing the Services.
    4. (d)
       Type of personal data: name, address, date of birth, National Insurance number, NHS number, case and claim reference numbers, contact details, health and medical records and imaging (special category data), information relating to alleged or actual injuries and conditions, and, where present in the Client Material, personal data relating to criminal allegations, proceedings or convictions (Article 10 data). We do not process financial, marketing or behavioural tracking data except where it is incidentally present in the Client Material you supply.
    5. (e)
       Categories of data subject: your clients (claimants and patients); treating clinicians and hospital and other healthcare personnel; instructed experts; witnesses; and other third parties named in the records.
    6. (f)
       Your obligations and rights as controller: you are entitled to give and vary documented instructions, to receive the Deliverables and to require the return or deletion of the Customer Personal Data under clause 12, to object to Sub-Processors under clause 11.17, to receive information and to audit under clause 11.16, and to receive notification of a Personal Data Breach under clause 11.14. You are responsible for determining the lawful basis and the Article 9 condition for the processing you instruct, for the accuracy and lawfulness of the Client Material, for informing the data subject that we are engaged and of the nature of our processing, and for your own retention and management of the Deliverables after delivery. Where we are required by Applicable Laws, or by a court, regulator or our professional indemnity insurers, to process or retain personal data to satisfy our own legal obligation rather than on your instructions, including the Financial Records and the records described in clause 12.5(b), we act as controller in respect of that specific processing or retention and accept a controller's responsibilities for it, relying on Article 6(1)(c) or Article 6(1)(f) of the UK GDPR as applicable and, where the data is special category data, on Article 9(2)(f), and we will tell you what we retain and on what basis on request. In all other respects we act as processor on your behalf.
14. 11.20
    We are registered with the Information Commissioner's Office under registration reference Z323252X. Our Data Protection Officer is contactable at dataprotection@mrcgroup.uk or at our registered office, Earle House, Atlantic Street, Altrincham, Cheshire, WA14 5DD. We have assessed in writing whether we are required to appoint a Data Protection Officer under Article 37 of the UK GDPR and retain a record of that assessment. The MRC Privacy Notice is available at mrcgroup.uk.

12Retention, return and deletion

1. 12.1
   This clause 12 sets out your documented instruction to us for the purposes of Article 28(3)(g) of the UK GDPR, and the whole of the period for which we hold your data. Deletion is triggered by Return of the completed casework. Deletion is not conditional on, or deferred by, payment of the Charges, and it is not affected by the outcome of the Case, save that settlement in full of our Invoice brings forward deletion of the Operational Records under clause 12.4. Time runs from Return in every case.

1. 12.1A
   We will notify you of the calculated deletion date for the Case at the time of Return. You may download a further copy under clause 13.3, or give a notice under clause 12.8, at any time before that date.

1. 12.2
   The Client Material as supplied by you, the completed sorted bundle and all other Deliverables, including any Professional Judgement Output, radiology schedule and structured radiology output, are made available to you through the MRC Portal or by secure link for 90 days from Return, at the end of which your access to all of them ends. We then permanently delete the Client Material, the completed sorted bundle and the other record-based Deliverables in our next scheduled monthly deletion run, and in any event within 30 days after the end of that 90 day period. Where Case Completion occurs before the end of the 90 day period, deletion instead takes place in our next scheduled monthly deletion run following Case Completion. We carry out a single scheduled deletion run each calendar month rather than deleting continuously. We retain our own copy of the Operational Records only, which is held internally, is not accessible to you once the availability window has closed, and is retained and deleted in accordance with clause 12.4. The 90 day period is a maximum availability window and not a minimum guaranteed retention period. We keep no copy outside the accredited environment described in clause 11.17(a), and no local, offline or personal-device copy, save that transient local caching by managed endpoint applications used to view, convert or prepare records is permitted on encrypted, centrally managed MRC devices and is removed in the ordinary course.

1. 12.2A
   Radiology imaging. Where the Services include radiology, the imaging is made available to you through the radiology imaging platform for 2 years from the date on which we make it available to you. At the end of that period the access links are disabled and the imaging is deleted in our next scheduled monthly deletion run. We will tell you in writing before that period ends. You may ask us to extend it, and any extension is agreed in writing and charged at our then current rates. The platform is a delivery and hosting service and not a backup or an archive, and you are responsible for downloading and retaining your own copy of any imaging you need to keep. Our own working copies of the imaging are deleted in accordance with clause 12.2.

1. 12.3
   The Customer Personal Data held in the Processing Environment is purged within 10 Business Days of the Deliverables being produced, and in the ordinary course within approximately 7 days, and is not restored, accessed or used in the meantime except for disaster recovery. The Processing Environment is separate from the MRC Portal and from any secure delivery link, and the purge of the Processing Environment does not affect your ability to download the Deliverables during the availability window in clause 12.2.
2. 12.4
   We retain the Operational Records until our next scheduled monthly deletion run following settlement in full of our Invoice for the Case, or until 2 years from Return, whichever occurs first, after which they are securely deleted. Settlement of the Invoice may bring that deletion forward but never defers it.

1. 12.4A
   Each Professional Judgement Output, including any screening report, and the clinical or professional working papers supporting it, forms part of the Operational Records and is retained and deleted in accordance with clause 12.4. It is held by us as limited independent controller under clause 11.5. That material is held under the security measures in clause 11.9, is accessed only for the purpose of demonstrating our compliance under Article 5(2) of the UK GDPR and for the establishment, exercise or defence of legal claims, and is not used for any other purpose. We record that retention in our record of processing activities and in our retention and disposal schedule.

1. 12.5
   On Case Completion, all remaining Case data is deleted in our next scheduled monthly deletion run, comprising the patient medical records, all Deliverables including Professional Judgement Outputs, and the Operational Records. The only material we then retain is:

   1. (a)
      the Financial Records, which we retain as controller for 6 years plus the current financial year, running from the end of the financial year in which the Invoice or Proforma Invoice for the Case is issued, in order to comply with our obligations under the Companies Act 2006 and the requirements of HM Revenue and Customs, after which they are securely deleted. The Financial Records are retained for financial, accounting and tax record-keeping only, and no patient medical records are attached to or retained with them; and
   2. (b)
      the security, access and audit logs, the deletion log and the Human Verification and quality control record for the Case, none of which contains any patient medical record or record content and each of which is limited to the Case reference, dates, user identifiers and the action taken. We retain the material in this paragraph (b) as controller, in reliance on Article 6(1)(c) and Article 6(1)(f) of the UK GDPR, for the purpose of demonstrating our compliance under Article 5(2) of the UK GDPR and clause 11.16, for information security purposes and for the establishment, exercise or defence of legal claims, for 24 months from Case Completion or such longer period as we are required by law to retain them, after which they are securely deleted. Where you have not given us notice of Case Completion, the material in this paragraph (b) is deleted at 30 months from Return, or on Case Completion if earlier, whichever occurs first.
2. 12.6
   The Payment Scheme shown in the Contract Details, whether the Standard 30 Day Payment Scheme, the Deferred 6 Month Payment Scheme or the Deferred 2 Year Payment Scheme, and whether or not the Case is an ATE Applicable Case to which an ATE Policy applies, determines only when the Invoice or Proforma Invoice falls due for payment. It does not defer or extend when data is deleted, and it does not affect the availability window in clause 12.2. Settlement of the Invoice may, however, bring forward deletion of the Operational Records under clause 12.4. A Case under a Deferred Payment Scheme, including an ATE Applicable Case run on the Deferred 2 Year Payment Scheme, is deleted on the same timetable as any other Case, and an unpaid Invoice does not entitle us to retain, or oblige us to retain, any Case data beyond the periods in this clause 12.
3. 12.7
   We are not obliged to retain the Customer Personal Data beyond the periods set out in this clause 12, and deletion in accordance with this clause 12 is not a breach of the Contract or a failure of the Services. A request to re-supply any record, bundle or Deliverable after deletion is a fresh request for Services, is chargeable at our then current rates as set out in, or notified under, the Contract Details and in force at the date of the request, and can be met only where we or you still lawfully hold the source material. We give no warranty that re-supply will be possible.
4. 12.8
   Where you notify us in writing before deletion is due that specified Customer Personal Data is subject to a legal hold, a live dispute, a pending or reasonably anticipated request from a data subject, a pending complaint, investigation or professional negligence claim, a request from a court, a regulator or another authority, or a retention obligation to which you are subject under your own regulatory, professional or insurance requirements, we will suspend deletion of that data and retain it securely until you release it in writing, at which point the applicable period in this clause 12 resumes. We may charge our reasonable costs of continued secure storage under a legal hold at our then current rates as set out in, or notified under, the Contract Details, agreed with you in advance. We log every suspension and every deletion exercise. Where a legal hold has been in place for 12 months we will ask you to reconfirm it in writing.
5. 12.9
   You may at any time instruct us in writing to delete the Customer Personal Data earlier than the periods in this clause 12, or to return a further copy of it before deletion, and we will comply without undue delay, subject to clause 12.5 and to any legal requirement to retain data. Termination or expiry of the Contract neither triggers nor defers deletion, and clause 11.15 applies where the Contract terminates before Return.
6. 12.10
   Deletion is effected by encrypted deletion within the platform, automated on expiry of the applicable period. Storage media are securely wiped or destroyed on decommission. Any paper or physical media, including discs and other removable media supplied by you, are destroyed by secure shredding on site or by a certified confidential waste provider, unless the Contract Details require their return, in which case they are returned by tracked and recorded delivery. Customer Personal Data persisting in encrypted backup media is overwritten in the ordinary backup rotation cycle and in any event within 90 days of the primary deletion, and is not restored, accessed or used in the meantime except for disaster recovery. Backup media are held only within the accredited United Kingdom environment described in clause 11.17(a).
7. 12.11
   We will confirm deletion to you in writing on request.
8. 12.12
   Where you are a Portal Client and a Backstop has been agreed and confirmed in writing under clause 13.6, clauses 12.2, 12.4 and 12.5 do not apply to Customer Personal Data hosted for you in the MRC Portal, which is retained and automatically deleted in accordance with that Backstop, and clauses 12.1, 12.1A, 12.3 and 12.6 to 12.11 apply to it. Clauses 12.2, 12.4 and 12.5 continue to apply in full to any Customer Personal Data held by us otherwise than in the MRC Portal, including in the Processing Environment, and our own working copies and Operational Records are deleted on the timetable in those clauses. Where no Backstop has been agreed and confirmed in writing, clauses 12.2 to 12.11 apply in full.

13The MRC Portal

1. 13.1
   The MRC Portal is the secure, United Kingdom hosted workspace through which we deliver the Deliverables to you. It is provided and hosted on our behalf by Glasscubes Limited, a Sub-Processor named in clause 11.17(b), and all content uploaded to it is stored in the United Kingdom. Completed bundles are uploaded to your dedicated workspace on Return and are accessed by encrypted link with a password issued separately. The MRC Portal provides labelled case folders, in-browser preview, individual and bulk download, expiring share links with access controls, and audit trails showing who has accessed or shared each file.
2. 13.2
   The MRC Portal is a delivery mechanism. It is not an archive, a backup service, a records management system or a document retention system, and it must not be relied on as any of those things. We give no undertaking that any file will remain available after the availability window that applies to it.
3. 13.3
   You are responsible for downloading and retaining your own copy of the Deliverables, and of the Client Material as returned to you, within the availability window in clause 12.2 or, where you are a Portal Client, within the period fixed by the Backstop. You are responsible for checking on receipt that the download is complete and readable, and for telling us promptly if it is not.
4. 13.4
   At the end of the availability window the access link expires, and our copy of the patient medical records, of the completed sorted bundle and of the other Deliverables is then permanently deleted in our next scheduled monthly deletion run in accordance with clause 12.2. We continue to hold the Operational Records for the period in clause 12.4 only, for internal use. From that point you hold the only copy of the records and of the bundle. As controller you are responsible for managing, securing and retaining the records and the Deliverables in accordance with your own retention policy and your own obligations under Applicable Data Protection Laws. Re-supply after deletion is dealt with by clause 12.7.
5. 13.5
   We will use reasonable endeavours to keep the MRC Portal available, but we do not warrant that access will be uninterrupted or error free, and we may suspend access for planned or emergency maintenance or for security reasons, giving you as much notice as is reasonably practicable. You are responsible for keeping access credentials issued to you secure, for ensuring that only your authorised personnel use them, for notifying us without delay if you believe a credential has been compromised, and for the acts and omissions of any person who accesses the MRC Portal using a credential issued to you. Where a suspension or maintenance period materially reduces your ability to download within the availability window, we will re-supply the affected Deliverables at no charge on request made before deletion under clause 12.2. The periods in clause 12 are not extended.
6. 13.6
   Where you pay for the MRC Portal as a chargeable hosted service and are a Portal Client, the following applies:

   1. (a)
      you manage your own retention. You are responsible for your own data retention rules, for deciding what is kept and for how long, and for downloading, retaining and managing your own copy of the Deliverables;
   2. (b)
      Backstop. At onboarding you will tell us in writing the maximum age after which hosted data for your workspace is to be deleted, being the Backstop. You set that period by reference to your own document retention policy and your own regulatory, professional and insurance obligations. We will configure it once you have confirmed it in writing in the MRC Portal onboarding and retention confirmation form signed by an authorised representative of your firm, and we will confirm the configured period back to you in writing. Hosted data is then deleted in the first monthly deletion run falling not less than 30 days after the data reaches the Backstop. Until a Backstop is confirmed in writing by both of us, the standard timetable in clause 12 applies and hosted data is deleted 90 days after Return. A Backstop agreed and confirmed under this paragraph (b) constitutes Client-Specific Terms for the purposes of clause 2.7;
   3. (c)
      you accept responsibility for the retention timescales you select, and for their compliance with your own regulatory, professional and data protection obligations. We do not advise on, and are not responsible for, the periods you choose. You acknowledge that where a Backstop exceeds the periods in clauses 12.2, 12.4 and 12.5, the resulting retention is on your documented instruction as controller and you are responsible for its compliance with Article 5(1)(e) of the UK GDPR;
   4. (d)
      you accept responsibility for retention timescales only. We do not waive, reduce or qualify any of our obligations under clause 11, and we remain fully responsible for the security of the data for as long as we host it. Clause 11 continues to apply in full to data hosted for a Portal Client; and
   5. (e)
      where you instruct earlier deletion of any item, clause 12.9 applies.
7. 13.7
   On expiry or termination of the Contract, or of your MRC Portal subscription, we will revoke all access credentials issued to you, and we will delete the hosted data in accordance with clause 12. We will give you not less than 30 days' written notice before revoking access on termination of a subscription, so that you can download your copy, and we will confirm deletion in writing on request.

14Title and intellectual property

1. 14.1
   We and our licensors retain title to and ownership of all MRC IPRs, being all Intellectual Property Rights subsisting in MRC AI, in the Deliverables (excluding the Client Material incorporated in them), and in our document formats, templates, index formats, chronology structures, screening and expert memorandum methodologies, radiology conversion workflows, sorting logic, rule sets, heuristics, data models, processes, workflows, tools, scripts and macros. Nothing in the Contract transfers any MRC IPRs to you.
2. 14.2
   You retain title to and ownership of all Intellectual Property Rights that you hold in the Client Material, including the source documents, records, radiology files, case materials, instructions and litigation data you supply to us. Nothing in the Contract transfers any of those rights to us.
3. 14.3
   You grant us a non-exclusive, royalty-free, non-transferable licence, with the right to sub-license to our Sub-Processors solely for the purpose of providing the Services, to copy, store, transmit, convert, split, index, paginate, hyperlink, analyse and otherwise modify the Client Material to the extent necessary to provide the Services and to comply with our obligations under the Contract. That licence begins on receipt of the Client Material and ends on the later of Return and deletion of the Client Material under clause 12, except that it continues for so long as, and to the extent that, we are required by law to retain any Client Material.
4. 14.4
   We grant you, and to the extent necessary your client, a perpetual, irrevocable, non-exclusive, royalty-free licence to use, copy, store and reproduce the Deliverables for the purpose of the Case and any related, consequent or subsequent proceedings, and to disclose and sub-license them for that purpose to counsel, instructed experts, any medical agency or records provider instructed in the Case solely for the purposes of the Case, other parties to the proceedings and their representatives, the court, any tribunal, any costs judge and your insurers, funders and auditors. That licence takes effect on delivery, is not conditional on payment, and survives expiry or termination of the Contract for any reason. It does not permit any use of the Deliverables outside the purposes set out in this clause 14.4, and in particular does not permit commercial resale of the Deliverables or reproduction of our formats, templates, index structures or workflows for use outside the Case. The licence in this clause 14.4 does not extend to, and no licence is granted in respect of, any use in breach of clause 14.6, and we may terminate the licence by written notice on any material breach of clause 14.6 which is not remedied within 14 days of notice. Termination of the licence does not affect your right to retain and use any Deliverable already served, filed or disclosed in the proceedings.
5. 14.5
   You warrant that you have the right to supply the Client Material to us and to grant the licence in clause 14.3, and that our use of the Client Material in accordance with the Contract will not infringe the Intellectual Property Rights or other rights of any third party. You will indemnify us against all liabilities, costs, expenses, damages and losses (including reasonable legal costs) suffered or incurred by us arising out of or in connection with any breach of this clause 14.5, except to the extent caused by our own breach of the Contract or our negligence.
6. 14.6
   You must not, and must not permit any third party to:

   1. (a)
      reverse engineer, decompile, disassemble or otherwise attempt to derive the source code, structure, logic, rule sets, models or training methods of MRC AI or of any of our systems, except to the extent that such an act cannot lawfully be prohibited;
   2. (b)
      access or attempt to access any of our systems, environments, accounts or data other than the parts of the MRC Portal made available to you, or test, probe or scan any of our systems without our prior written consent;
   3. (c)
      use the Deliverables, MRC AI or any output of MRC AI to train, fine-tune, evaluate or develop any artificial intelligence or machine learning model, or to build any competing service;
   4. (d)
      copy, adapt or reproduce our document formats, templates, index formats, chronology structures or workflows for use outside the Case; or
   5. (e)
      remove, obscure or alter any pagination, index reference, audit marking or ownership notice applied by us to a Deliverable, save where required for the proper conduct of the proceedings.
7. 14.7
   Except as expressly set out in the Contract, neither party grants the other any licence of, or other right in, its Intellectual Property Rights, and no licence is to be implied.

15Artificial intelligence: training, model development and service improvement

1. 15.1
   We do not use the Client Material, the Customer Personal Data or the Deliverables to train, fine-tune, evaluate, benchmark or otherwise develop any artificial intelligence or machine learning model, and we do not use them for service improvement, product development, testing, demonstration, promotional or marketing purposes. That applies whether the material is in identifiable, pseudonymised or anonymised form, and whether the model is ours, a Sub-Processor's or a third party's. We do not make the Client Material, the Customer Personal Data or the Deliverables available to any general purpose or third party artificial intelligence model or service for any of those purposes.
2. 15.2
   The exclusion in clause 15.1 applies across the whole of the sub-processing chain set out in clause 11.17(a) and clause 11.17(b), including SORTAL Limited, Informed Solutions Limited, Amazon Web Services, Microsoft Corporation and Adobe Inc. We will impose that exclusion by written contract on each Sub-Processor we engage directly, and will require each such Sub-Processor to impose obligations that are the same as and no less protective on any further sub-processor it engages, so that the exclusion flows down the whole of the chain. We will not permit any Sub-Processor to act inconsistently with it, and we will make the relevant contractual extracts or written confirmations available to you on request.
3. 15.3
   In addition to clauses 2.7 and 2.8, clause 15.1 may be varied only by a separate written agreement signed by an authorised representative of each of us, which must identify the material to be used, the purpose, the technique to be applied, the anonymisation or other safeguards to be used, the period of use, the prohibition on re-identification, your audit rights and your right to withdraw. No tick box, order form, Proforma Order or course of dealing operates as agreement for the purposes of this clause 15.3, and nothing in the Contract Details varies clause 15.1 unless the variation is expressly identified as a variation of this clause 15 and is signed by an authorised representative of each of us.
4. 15.4
   Model performance data. When our personnel carry out Human Verification we record information about how MRC AI performed. That information consists only of the category, field or value our system proposed, the correction our reviewer made, confidence scores, layout and positional characteristics, and the module and model version involved. It contains no part of the Client Material, no medical or other record content, no free text taken from any record, and no name, identifier, Case reference or Customer reference. It is not linked, and cannot be linked by us, to you, to your client, to any Case or to any data subject. It is therefore anonymous information about the operation of our own systems and is not personal data. We retain and use it to measure, correct and improve the accuracy of MRC AI, and clause 15.1 does not apply to it. We will not add any Case reference, Customer reference or record content to it.
5. 15.5
   We may generate and use aggregated operational metrics about our own performance, such as volumes processed, page counts, turnaround times, throughput and error and exception rates, provided that those metrics contain no personal data, no special category data, no Client Material and no content taken from any record or Deliverable, and cannot be used to identify you, your client or any data subject. Metrics of that kind are our own business records and clause 15.1 does not apply to them.
6. 15.6
   Your corresponding restriction on using the Deliverables and the outputs of MRC AI to train any model is set out in clause 14.6(c).

16Limitation of liability

1. 16.1
   This clause 16 sets out the whole of our financial responsibility to you. Please read it carefully. The limits and exclusions in it reflect the insurance we have arranged and the level of the Charges, and the Charges have been set on the basis that they apply. We maintain, with reputable insurers, professional indemnity insurance and cyber liability insurance appropriate to the Services, together with employers' liability insurance as required by law and public liability insurance, in each case subject to the terms, exclusions and sub-limits of the relevant policy. We will maintain cover at an equivalent or higher level for the term of the Contract and for so long afterwards as such cover remains available to us on commercially reasonable terms. Evidence of cover will be provided on your reasonable written request by way of a broker's letter or certificate of insurance, and we are not required to disclose the policy wording or the premium. You are responsible for insuring, or for accepting, any loss you may suffer above the limits set out in this clause 16.
2. 16.2
   In this clause 16, a reference to liability, and to loss, includes every kind of liability and loss arising under or in connection with the Contract, including liability in contract, in tort (including negligence and breach of statutory duty), for misrepresentation, in restitution and otherwise, and includes the liability of our employees, officers, agents, subcontractors and Sub-Processors as well as our own.
3. 16.3
   Nothing in this clause 16 limits or excludes your obligation to pay the Charges and any other sums properly due under the Contract, or your obligations and liabilities as controller under clause 11 (Data protection), or your liability under clause 11.6 or clause 14.5.
4. 16.4
   Neither party's liability is limited or excluded in any way in respect of:

   1. (a)
      death or personal injury caused by negligence;
   2. (b)
      fraud or fraudulent misrepresentation;
   3. (c)
      wilful misconduct, meaning a deliberate act or deliberate omission by a person who knew that act or omission would cause the loss in question;
   4. (d)
      breach of the terms implied by section 2 of the Supply of Goods and Services Act 1982 (title and quiet possession); and
   5. (e)
      any other liability which cannot lawfully be limited or excluded.
5. 16.5
   Subject to clause 16.3 and clause 16.4, our total liability to you is limited as follows:

   1. (a)
      for all loss arising out of or in connection with our failure to comply with clause 11 (Data protection), clause 12 (Retention, return and deletion) or clause 13 (The MRC Portal), or with Applicable Data Protection Laws, including any loss arising out of a Personal Data Breach or any other breach of security affecting personal data we hold or process for you, our total liability is limited to the greater of the Charges payable under the Contract and £100,000; and
   2. (b)
      for all other loss, our total liability is limited to the greater of the Charges payable under the Contract and £50,000.
6. 16.6
   Aggregate cap. The limits in clause 16.5 apply separately to each Contract. In addition, and notwithstanding clause 16.5, our total aggregate liability to you for all claims of every kind arising under or in connection with all Contracts between us, whether or not those claims are connected, in any period of 12 months is limited to £250,000. Where a single event, or a series of connected events, gives rise to liability under more than one Contract, our total liability for all Contracts affected is likewise limited to £250,000. In no circumstances does our total liability to you exceed £250,000 in any period of 12 months.
7. 16.7
   We will consider any request for a higher limit of liability. Where a higher limit is agreed, it is effective only if it is recorded in Client-Specific Terms, or in the Contract Details in accordance with clause 2.7 in terms which identify clause 16.5 as the clause varied, and is signed by an authorised representative of each of us. That higher limit then applies in place of the corresponding limit in clause 16.5 for the Contracts to which it is stated to apply, and clause 16.6 is read accordingly.
8. 16.8
   Subject to clause 16.4 and to clause 16.9, we are not liable for any of the following, whether direct or indirect:

   1. (a)
      loss of profits;
   2. (b)
      loss of sales or business;
   3. (c)
      loss of agreements or contracts;
   4. (d)
      loss of anticipated savings;
   5. (e)
      loss of use or corruption of software, data or information;
   6. (f)
      loss of or damage to goodwill; or
   7. (g)
      indirect or consequential loss.
9. 16.9
   Clause 16.8(e) does not apply to, and we do not exclude, loss arising out of a Personal Data Breach. Loss of that kind is recoverable, subject to the limit in clause 16.5(a). This clause 16.9 does not reinstate any liability excluded by clauses 16.8(a) to (d), 16.8(f) or 16.8(g), does not make us liable for indirect or consequential loss, and does not apply to any other breach of security or of clause 11.

1. 16.9A
   We are not liable for the loss of, or for any inability to access, any Client Material or Deliverable after expiry of the availability window in clause 12.2 or of the applicable Backstop, or where you have failed to download and retain your own copy as required by clause 7.1(j) and clause 13.3, and deletion in accordance with clause 12 is not a Personal Data Breach.

1. 16.10
   Given the commitments we give in clause 5 (Supply of the Services), in clause 11 (Data protection) and in clause 15 (Artificial intelligence), all warranties, representations, conditions and other terms implied by statute or common law are, to the fullest extent permitted by law, excluded from the Contract. Nothing in this clause 16.10 excludes or qualifies any express commitment we give in the Contract.
2. 16.11
   We are not liable for any claim unless you notify us of it in writing, identifying the event giving rise to the claim and the grounds on which you say we are liable, within 12 months beginning on:

   1. (a)
      the date you receive the Deliverable to which the claim relates; or
   2. (b)
      where the claim relates to a Deliverable that is not delivered, the date on which that Deliverable was due to be delivered under the Contract Details; or
   3. (c)
      where the claim relates to a Personal Data Breach, the earlier of the date on which we notify you of it under clause 11.14 and the date on which you become aware of it, and in any event no later than 3 years from Return under the Contract to which the claim relates.
3. 16.12
   Where Deliverables are delivered in parts, the period in clause 16.11 runs separately in respect of each part by reference to the date that part is received. Nothing in clause 16.11 extends any statutory limitation period. A claim notified within the 12 month period may be pursued after that period has expired.
4. 16.13
   You must take reasonable steps to mitigate any loss you suffer.

17Termination

1. 17.1
   Scope of this clause. This clause 17 sets out when the Contract may be terminated and what happens when it is. Nothing in this clause 17 affects clause 11 (data protection) or clause 12 (retention, return and deletion), each of which continues to apply for so long as we hold any personal data processed on your behalf, or clause 16 (limitation of liability), which continues to apply to any claim made after termination.
2. 17.2
   Termination by either party. Without affecting any other right or remedy available to it, either party may terminate the Contract with immediate effect by giving written notice to the other party if:

   1. (a)
      the other party commits a material breach of any term of the Contract and that breach is irremediable or, where the breach is capable of remedy, the other party fails to remedy it within 30 days after being given written notice specifying the breach and requiring it to be remedied;
   2. (b)
      an Insolvency Event occurs in relation to the other party; or
   3. (c)
      the other party suspends, or threatens to suspend, or ceases or threatens to cease to carry on all or a substantial part of its business.
3. 17.3
   Insolvency Event. For the purposes of clause 17.2(b), an Insolvency Event occurs in relation to a party if that party:

   1. (a)
      takes any step or action in connection with entering administration, provisional liquidation, or any composition, compromise or arrangement with its creditors, other than in relation to a solvent restructuring;
   2. (b)
      applies to court for, or obtains, a moratorium under Part A1 of the Insolvency Act 1986;
   3. (c)
      is wound up, whether voluntarily or by order of the court, other than for the purpose of a solvent restructuring;
   4. (d)
      has a receiver, administrative receiver, administrator, liquidator, provisional liquidator or similar officer appointed over it or over any of its assets;
   5. (e)
      being a limited liability partnership or partnership, is dissolved, is the subject of a determination or order for winding up, or takes any step or action analogous to any of paragraphs (a) to (d);
   6. (f)
      is unable to pay its debts within the meaning of section 123 of the Insolvency Act 1986, or admits in writing that it is unable to pay its debts as they fall due; or
   7. (g)
      takes any step or action in another jurisdiction analogous to any of paragraphs (a) to (f).
4. 17.4
   Our additional rights to terminate. Without affecting any other right or remedy available to us, we may terminate the Contract with immediate effect by giving written notice to you if:

   1. (a)
      you fail to pay any amount due under the Contract on or before the due date, and that amount remains unpaid 10 Business Days after we have given you written notice identifying the unpaid amount and requiring payment. Our rights to interest and to suspension under clause 10.7 arise on the due date and are not affected by this remedy period;
   2. (b)
      where a Deferred Payment Scheme applies, you fail to provide an update on the progress of the Case within 5 Business Days of our written request, as required by clause 7.1(g), and that failure continues for 10 Business Days after we have given you written notice requiring the update;
   3. (c)
      you fail to notify us of the occurrence of a Payment Event as required by clause 7.1(e);
   4. (d)
      the Case is transferred to a replacement firm without our prior written consent and without a deed of assignment, in a form reasonably acceptable to us, under which the replacement firm assumes your obligations under the Contract with effect from the date of transfer. We will not unreasonably withhold or delay consent where the replacement firm executes such a deed and is not the subject of an Insolvency Event. Where a Case transfers to a replacement firm in accordance with this paragraph, the terms of the Contract and the Invoice are unchanged and only the party liable to pay the Charges changes; the Charges are not reduced, adjusted or re-rated by reason of the transfer;
   5. (e)
      your financial position deteriorates to such an extent that, in our reasonable opinion, your ability to perform your obligations under the Contract has been placed in jeopardy; or
   6. (f)
      we have notified you under clause 8.3 that we require credentials, replacement material, instructions or a response in order to proceed and we have not received it within 30 days of that notification, and we have not elected instead to treat the Services as complete under clause 8.5(a).
5. 17.5
   Change of control of the Customer. We may not terminate the Contract or accelerate payment of the Charges solely by reason of a change of control, merger, amalgamation, incorporation, reconstitution or other reorganisation of the Customer, provided that nothing in this clause 17.5 limits our rights under clause 10.7 (interest and suspension), clause 10.10 (credit and payment on account), clause 17.2, clause 17.4 or clause 17.7, or affects your obligation to notify us under clause 7.1(i).

   1. (a)
      Control is acquired by a person who, or by a member of a group of which any member, carries on a business which competes with ours in the supply of medical records collation, sorting, indexing, chronology or AI-assisted record analysis services;
   2. (b)
      the change of control forms part of, or occurs in connection with, an Insolvency Event; or
   3. (c)
      the successor entity fails, within 20 Business Days of our written request, to confirm in writing that it assumes your obligations under the Contract.
6. 17.6
   Suspension for non-payment. Where any sum is overdue we may suspend performance of the Services under that Contract, and under any other Contract, in accordance with clause 10.7(b), whether or not we are yet entitled to terminate under clause 17.4(a). We will resume performance promptly on payment in full. Suspension does not extend, suspend or otherwise affect the retention and deletion timetable in clause 12, and does not extend any availability window.
7. 17.7
   Effect of termination on other Contracts. Each Contract stands separately, and:

   1. (a)
      termination of one Contract does not of itself terminate any other Contract between us, and does not entitle us to terminate, vary or accelerate payment under any other Contract which you are performing in accordance with its terms;
   2. (b)
      on termination of a Contract we may demand immediate payment of all sums outstanding under that Contract, including the Charges for Services performed under it but not yet invoiced, whether or not a Payment Event has occurred under that Contract;
   3. (c)
      we may suspend performance of any or all other Contracts in accordance with clause 10.7(b), and may terminate any other Contract only where a ground for termination has arisen under that other Contract or where an Insolvency Event has occurred in relation to you; and
   4. (d)
      no exercise of a right under this clause 17.7 is itself a material breach or a ground for termination under any other Contract, so that termination of one Contract cannot cascade through your other Contracts with us, but nothing in this clause 17.7 limits our right of suspension under clause 10.7(b) or our rights under clause 10.10.
8. 17.8
   Form of notice. A notice of termination must be given in accordance with clause 18.9, must identify the Contract terminated and the clause relied on, and takes effect on the date it is deemed received under clause 18.9(b) unless it states a later date.
9. 17.9
   Consequences of termination. Clauses 17.10 to 17.17 apply on termination of the Contract for any reason, and on expiry of the Contract.
10. 17.10
    Payment. On termination or expiry:

    1. (a)
       you must immediately pay all of our outstanding unpaid invoices under that Contract, together with any interest accrued under clause 10.7;
    2. (b)
       in respect of Services performed under that Contract for which no invoice has been submitted, we may submit an invoice for the Charges for those Services, calculated at the rates set out in the Contract Details, which is payable within 30 days of the date of the invoice; and
    3. (c)
       where you terminate the Contract under clause 17.2 because of our material breach, our Insolvency Event or our cessation of business, you are liable only for the Charges for Services properly performed up to the date of termination, no acceleration under paragraph (b) applies to Services not performed, and no Payment Event arises under the Annex by reason of that termination.
11. 17.11
    Deliverables and work in progress. Where you have paid, or remain liable to pay, for Services performed before termination, we will, before deleting the relevant data under clause 12, deliver to you the Deliverables produced and any completed work in progress in the form then existing, and your licence to use those Deliverables under clause 14.4 survives termination and is not conditional on payment. Work in progress delivered under this clause 17.11 has not been subject to Human Verification, is provided as it then stands and without any warranty as to accuracy, completeness, sequence or pagination, and clauses 5.2(b), 6.3 and 6.4 do not apply to it. You must not serve, file or provide it to counsel, to an expert or to any other party as a Deliverable. Where you ask us instead to complete Human Verification before delivery, we will do so within a reasonable period and may charge for that work at the rates set out in the Contract Details.
12. 17.12
    Personal data, return and deletion. We will return or delete personal data processed on your behalf in accordance with clause 12, and we will confirm deletion to you in writing on request. Deletion is triggered by Return of the completed casework and is not triggered or deferred by termination, by payment or non-payment of the Charges, or by the outcome of the Case. Where the Contract terminates before Return, we will, at your written direction under clause 12.9, return or delete the Client Material and all personal data contained in it, and delete all remaining copies, except to the extent we are required by law to retain them. Where the Contract terminates after Return, the periods in clause 12 continue to apply.
13. 17.13
    MRC Portal access. Revocation of MRC Portal access credentials on termination or expiry, and the notice we give before revoking access on termination of an MRC Portal subscription, are dealt with by clause 13.7. Your obligation to download and retain your own copy of the Deliverables and of any records made available to you is set out in clause 13.3, and a request to re-supply any file after deletion is a fresh chargeable request under clause 12.7.
14. 17.14
    Sums paid in advance. Where you have paid in advance for Services which we have not performed at the date of termination, and the Contract is terminated otherwise than because of your breach, we will refund those sums within 30 days of termination.
15. 17.15
    Survival. Any provision of the Contract which expressly or by implication is intended to come into or continue in force on or after termination or expiry remains in full force and effect. Without limiting that, the following survive termination or expiry: clause 11 (data protection), clause 12 (retention, return and deletion), clause 13 (the MRC Portal), clause 14 (title and intellectual property, including the licence granted to you by clause 14.4), clause 15 (artificial intelligence: training, model development and service improvement), clause 16 (limitation of liability), this clause 17, clause 18.3 (confidentiality), clause 18.4 (legal professional privilege), clause 18.9 (notices), clauses 18.15 and 18.16 (governing law and jurisdiction), clause 19 (version control, supersession and transitional provisions), and the Additional Conditions to the extent they govern the payment of sums accrued or accruing.
16. 17.16
    Survival of the data protection and retention provisions. Clause 11 (data protection) and clause 12 (retention, return and deletion) survive termination or expiry of the Contract in full and continue to apply for so long as we hold any personal data processed on your behalf, whether or not the Contract remains in force. In particular, our obligations as to the purposes for which we may process, security, personnel, confidentiality, sub-processors and liability for the whole of the sub-processing chain, United Kingdom only processing with no international transfers, breach notification, assistance with data subject rights, records and audit, the exclusion of AI training and secondary use, and retention and deletion, all continue to apply to that data after termination. Termination or expiry neither shortens nor extends any retention period in clause 12.
17. 17.17
    Accrued rights. Termination or expiry of the Contract does not affect any right, remedy, obligation or liability of either party which has accrued up to the date of termination or expiry, including the right to claim damages in respect of any breach of the Contract existing at or before that date.

18General

1. 18.1
   Force majeure.

   1. (a)
      Neither party is in breach of the Contract, nor liable for any delay in performing or failure to perform any of its obligations under the Contract, to the extent that the delay or failure results from a Force Majeure Event.
   2. (b)
      A Force Majeure Event means any event beyond a party's reasonable control, including act of God, flood, drought, earthquake, fire, epidemic or pandemic, war, armed conflict, terrorist attack, civil commotion, riot, imposition of sanctions or embargo, any law or action taken by a government or public authority, collapse of buildings, failure of utilities or of telecommunications or third party networks, and any cyber attack, ransomware or denial of service attack affecting that party or its supply chain, in each case provided that the party could not have avoided or overcome its effects by taking reasonable precautions. A lack of funds is not a Force Majeure Event, and a Force Majeure Event does not relieve you of any obligation to pay the Charges for Services already performed.
   3. (c)
      The affected party must notify the other in writing as soon as reasonably practicable, giving reasonable detail of the event, its likely effect and the steps being taken, and must use reasonable endeavours to mitigate its effect and to resume performance.
   4. (d)
      If a Force Majeure Event prevents or materially delays performance of the Services for a continuous period of more than 60 days, either party may terminate the affected Contract by giving 10 Business Days' written notice to the other, and clauses 17.10 to 17.17 apply on that termination as if the Contract had been terminated under clause 17.2.
2. 18.2
   Assignment and other dealings.

   1. (a)
      You may not assign, transfer, charge, subcontract, declare a trust over or deal in any other manner with any or all of your rights and obligations under the Contract without our prior written consent, which we will not unreasonably withhold where the proposed transferee executes a deed of assignment under clause 17.4(d).
   2. (b)
      We may assign, transfer or novate the Contract as a whole, including our rights and obligations under it, to a successor to our business or to the relevant part of our business, whether by way of sale of shares, sale of assets, merger, reconstruction or intra-group reorganisation, provided that: (i) we give you not less than 30 days' written notice before the transfer takes effect, identifying the successor, its place of establishment and the place from which it will process the personal data we process on your behalf; (ii) the successor is established in the United Kingdom and assumes in writing all of our obligations under clause 11, clause 12 and clause 15, including the United Kingdom only restriction in clause 11.18 and the prohibition on AI training in clause 15.1; and (iii) you may object to the transfer within that 30 day period on reasonable and documented data protection grounds, in which case clause 11.17(d) applies as if the successor were a proposed replacement Sub-Processor. A transfer of the shares in our company which does not involve a change in the identity of the processor is not a transfer for the purposes of this clause 18.2(b).
   3. (c)
      Other than as permitted by paragraph (b) and paragraph (e), we may not assign, transfer, charge, declare a trust over or deal in any other manner with any or all of our rights or obligations under the Contract without your prior written consent. We may perform any of our obligations through Sub-Processors authorised under clause 11.17, and through clinicians, consultants, contractors and other suitably qualified or trained personnel engaged by us, and we remain fully liable to you for their acts and omissions as if they were our own.
   4. (d)
      We may not sub-contract the processing of any personal data processed on your behalf to any person other than a Sub-Processor authorised under clause 11.17, and any change to the authorised Sub-Processors is subject to the notification and objection procedure in clause 11.17(c). Nothing in this clause 18.2 permits any processing outside the United Kingdom, which remains prohibited by clause 11.18.
   5. (e)
      Nothing in this clause 18.2 prevents us from assigning, charging or otherwise dealing with our right to receive payment of the Charges, by way of security or under an invoice finance or receivables facility, provided that no personal data processed on your behalf and no Client Material is transferred, disclosed or made accessible as a result, and provided that any such dealing does not increase your obligations or reduce your rights under the Contract.
3. 18.3
   Confidentiality.

   1. (a)
      Confidential Information means all information of a confidential nature disclosed by one party to the other, or otherwise obtained by one party in connection with the Contract, whether or not marked as confidential. Your Confidential Information includes the Client Material, all personal data contained in it, the Deliverables, the identity of your client and the existence and subject matter of the Case. Our Confidential Information includes MRC AI and its sorting logic, rule sets and data models, our document formats, index and chronology structures, templates, processes, workflows and methodologies, our security documentation, our rates, pricing and commercial terms, and the ATE Failed Rate and failure scale agreed under our agreement with any ATE Insurer.
   2. (b)
      Each party undertakes that it will not, at any time during the Contract and for a period of 6 years after termination or expiry of the Contract, disclose to any person any Confidential Information of the other party, except as permitted by this clause 18.3. In respect of personal data, our obligations of confidentiality and security under clause 11 continue for so long as we hold that data and are not limited to 6 years.
   3. (c)
      Each party may disclose the other party's Confidential Information: (i) to its employees, officers, members, representatives, contractors, subcontractors, insurers, professional indemnity brokers and professional advisers who need to know it in order to perform that party's obligations or exercise its rights under the Contract, provided that the disclosing party ensures that each such recipient complies with this clause 18.3; and (ii) to the extent required by law, by a court of competent jurisdiction, by a governmental, regulatory or professional body, or by the Solicitors Regulation Authority or the Information Commissioner's Office, provided that, where lawful and practicable, the disclosing party first notifies the other party and takes reasonable steps to limit the extent of disclosure.
   4. (d)
      The obligations in this clause 18.3 do not apply to information which: (i) is or becomes generally available to the public other than as a result of a breach of the Contract; (ii) was lawfully in the receiving party's possession without an obligation of confidence before disclosure; (iii) is lawfully obtained from a third party who is free to disclose it; or (iv) is independently developed by the receiving party without access to the other party's Confidential Information. No exception in this paragraph (d) applies to personal data.
   5. (e)
      Neither party may use the other party's Confidential Information for any purpose other than to perform its obligations or exercise its rights under the Contract.
   6. (f)
      On written request following termination or expiry, each party will return or securely destroy the other party's Confidential Information in its possession or control, except that our return and deletion of personal data and Deliverables is governed exclusively by clause 12, and except to the extent a party is required by law, by its regulator or by its insurers to retain a copy.
   7. (g)
      Each party acknowledges that damages alone may not be an adequate remedy for breach of this clause 18.3, and that the other party is entitled to seek injunctive or other equitable relief.
4. 18.4
   Legal professional privilege. You remain the party entitled to assert legal professional privilege and litigation privilege in the Client Material and the Deliverables. We acknowledge that the Client Material is supplied to us, and the Deliverables are produced, for the dominant purpose of the conduct of the Case, that our receipt, storage, processing and delivery of them is not intended to and does not waive any privilege, and that we hold them subject to your privilege. We will not assert, waive or purport to waive privilege in any Client Material or Deliverable. We will notify you without undue delay, and in any event within 2 Business Days, of any request, demand, subpoena, order or other process for disclosure of Client Material or Deliverables received by us from any third party, court, tribunal, regulator, police force or coroner, and we will not disclose them unless you instruct us in writing to do so or we are compelled to do so by law, in which case we will disclose the minimum required and will tell you before doing so unless prohibited by law.
5. 18.5
   Entire agreement.

   1. (a)
      The Contract constitutes the entire agreement between the parties in relation to its subject matter and supersedes and extinguishes all previous agreements, promises, assurances, warranties, representations and understandings between them, whether written or oral, relating to that subject matter, save for any Client-Specific Terms which are expressly incorporated and which prevail to the extent stated in clause 2.6 (order of precedence).
   2. (b)
      Each party acknowledges that in entering into the Contract it does not rely on, and has no remedy in respect of, any statement, representation, assurance or warranty, whether made innocently or negligently, which is not set out in the Contract, and agrees that it has no claim for innocent or negligent misrepresentation or negligent misstatement based on any statement in the Contract.
   3. (c)
      Nothing in this clause 18.5 limits or excludes any liability for fraud or fraudulent misrepresentation.
6. 18.6
   Variation. Variation of the Contract is governed by clause 2.7 and clause 2.8, which are the only routes by which these Conditions may be varied, save that clause 15.3 imposes additional requirements for any variation of clause 15.1. Nothing in the Contract Details, or in any purchase order, panel terms, acknowledgement or other document issued by you, varies these Conditions except in accordance with clause 2.7 and clause 2.8.
7. 18.7
   Waiver.

   1. (a)
      A waiver of any right or remedy under the Contract or by law is effective only if given in writing, and is not a waiver of any subsequent right or remedy.
   2. (b)
      A failure or delay by a party in exercising any right or remedy provided under the Contract or by law does not constitute a waiver of that or any other right or remedy, nor does it prevent or restrict any further exercise of that or any other right or remedy. No single or partial exercise of any right or remedy prevents or restricts the further exercise of that or any other right or remedy.
8. 18.8
   Severance. If any provision or part-provision of the Contract is or becomes invalid, illegal or unenforceable, it is deemed modified to the minimum extent necessary to make it valid, legal and enforceable. If such modification is not possible, the relevant provision or part-provision is deemed deleted. Any modification to or deletion of a provision or part-provision under this clause 18.8 does not affect the validity and enforceability of the rest of the Contract.
9. 18.9
   Notices.

   1. (a)
      Any notice or other communication given to a party under or in connection with the Contract must be in writing and must be: (i) delivered by hand, or sent by pre-paid first class post or other next working day delivery service, to that party's registered office or, where the party has no registered office, its principal place of business, and in our case to Medical Record Collation Limited trading as MRC Group (company number 07212178), Earle House, Atlantic Street, Altrincham, Cheshire, WA14 5DD, marked for the attention of the Managing Director; or (ii) sent by email to the address identified for that party in the Contract Details as its address for notices and, in our case, if no address is identified, to the email address published for contractual notices at mrcgroup.uk.
   2. (b)
      A notice or other communication is deemed received: (i) if delivered by hand, at the time it is left at the proper address; (ii) if sent by pre-paid first class post or other next working day delivery service, at the time recorded by the delivery service; or (iii) if sent by email, at the time of transmission or, where the time of transmission falls outside business hours in the place of receipt, when business hours next resume. In this clause 18.9(b)(iii), business hours means 9.00am to 5.00pm on a Business Day.
   3. (c)
      A notice under clause 11.14 (Personal Data Breach) may in addition be given by any faster means reasonably available, including telephone followed by written confirmation, and must be sent to the data protection notification address identified in the Contract Details and, where no such address is identified, to the data protection notification address published at mrcgroup.uk.
   4. (d)
      This clause 18.9 does not apply to the service of any proceedings or other documents in any legal action or, where applicable, any arbitration or other method of dispute resolution.
10. 18.10
    Third party rights. Unless it expressly states otherwise, the Contract does not give rise to any rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of the Contract. We have no contractual relationship with your own client, and nothing in the Contract creates any duty owed by us to your own client or to any expert, counsel or other third party to whom you provide the Deliverables. This clause 18.10 does not affect any right or remedy a data subject has under Applicable Data Protection Laws.
11. 18.11
    No partnership or agency. Nothing in the Contract is intended to, or does, establish any partnership or joint venture between the parties, constitute either party the agent of the other, or authorise either party to make or enter into any commitment for or on behalf of the other. We do not act as your agent in obtaining, requesting or receiving records from any third party unless the Contract Details expressly say so.
12. 18.12
    Cumulative remedies. Except as expressly provided in the Contract, the rights and remedies provided under the Contract are in addition to, and not exclusive of, any rights or remedies provided by law.
13. 18.13
    Compliance with laws. Each party will comply with all applicable laws, statutes and regulations relating to anti-bribery and anti-corruption, including the Bribery Act 2010, to modern slavery and human trafficking, including the Modern Slavery Act 2015, and to the prevention of the facilitation of tax evasion, including Part 3 of the Criminal Finances Act 2017, and will maintain policies and procedures appropriate to its size and activities to ensure that compliance.
14. 18.14
    Complaints, escalation and dispute resolution. If a dispute arises out of or in connection with the Contract, the parties will first attempt to resolve it through the complaints procedure in clause 3, and each party will make a senior representative available, in our case the Managing Director, to meet in person or remotely within 15 Business Days of a written request. Neither party is prevented from commencing proceedings at any time, and nothing in this clause 18.14 restricts either party's right to seek urgent interim relief or to recover a debt.
15. 18.15
    Governing law. The Contract, and any dispute or claim, including a non-contractual dispute or claim, arising out of or in connection with it, its subject matter or its formation, is governed by and construed in accordance with the law of England and Wales.
16. 18.16
    Jurisdiction. Each party irrevocably agrees that the courts of England and Wales have exclusive jurisdiction to settle any dispute or claim, including a non-contractual dispute or claim, arising out of or in connection with the Contract, its subject matter or its formation.

19Version control, supersession and transitional provisions

1. 19.1
   These Conditions are the MRC Terms and Conditions 2026, version 3.3, and take effect on 1 September 2026 (the Effective Date). Each Proforma Order will identify the version number and Effective Date of the Conditions which apply to that Contract, and the Conditions which apply to a Contract are those identified in the Proforma Order Approved for that Contract.
2. 19.2
   These Conditions are owned and maintained by the Managing Director of Medical Record Collation Limited trading as MRC Group (company number 07212178), Earle House, Atlantic Street, Altrincham WA14 5DD. Questions about how we process personal data may be addressed to our Data Protection Officer at dataprotection@mrcgroup.uk. These Conditions are reviewed at least annually, and on any material change to the Services, to the sub-processing chain or to Applicable Data Protection Laws.
3. 19.3
   Subject to clause 19.4, for engagements entered into on or after the Effective Date these Conditions supersede and replace in their entirety all previous MRC terms and conditions, howsoever described or dated, and also supersede and replace the MRC AI Terms of Service and the MRC Data Sharing Agreement, the subject matter of which is now dealt with in these Conditions. No previous version of any of those documents applies to a Contract formed on or after the Effective Date.
4. 19.4
   Where you and we have signed Client-Specific Terms before the Effective Date, those terms continue to apply on their agreed terms to the Contracts they govern until they are migrated to these Conditions by written agreement between us, and they prevail over these Conditions to the extent of any inconsistency. This clause 19.4 applies only to Client-Specific Terms, being a client-specific agreement, data processing agreement, variation letter or negotiated schedule signed by an authorised representative of each of us. No email, quotation, tender response, panel document or course of dealing constitutes Client-Specific Terms for this purpose.
5. 19.5
   We will offer migration to these Conditions at the next annual review of your arrangements with us, or earlier by agreement. On migration we will record in writing any Client-Specific Terms which are to survive, including any higher limit of liability agreed under clause 16.7, any disapplied clause and any agreed sub-processor objection period.
6. 19.6
   We maintain a dated archive of superseded versions of the Conditions, of the Annex and of the Proforma Order template, and will provide any superseded version to you on written request.
7. 19.7
   The current version of these Conditions, and the MRC Privacy Notice, are published at mrcgroup.uk. Clause 2.9 governs the effect of any updated version we issue.

Annex 1Additional Conditions for the Payment Schemes, application and interpretation

This Annex contains the Additional Conditions for each Payment Scheme. We offer exactly three Payment Schemes: the Standard Payment Scheme in Part 2, the Deferred 6 Month Payment Scheme in Part 3, and the Deferred 2 Year Payment Scheme in Part 4. The Deferred 6 Month Payment Scheme and the Deferred 2 Year Payment Scheme are together the Deferred Payment Schemes, and each is a Deferred Payment Scheme. An ATE Policy is not a separate Payment Scheme: an ATE Applicable Case runs on the Deferred 2 Year Payment Scheme, subject to the ATE overlay in paragraphs 4.8 to 4.16.

1. 1.1
   These Additional Conditions form part of the Contract and apply in addition to these Conditions. In this Annex, references to paragraphs are to paragraphs of this Annex and references to clauses are to clauses of these Conditions.
2. 1.2
   Exactly one Payment Scheme applies to each Contract, being the Payment Scheme identified in the Contract Details. If the Contract Details do not identify a Payment Scheme, or identify more than one, the Standard Payment Scheme in Part 2 applies.
3. 1.3
   Precedence between this Annex and the rest of these Conditions is governed by clause 2.6.
4. 1.4
   You must notify us of the occurrence of a Payment Event promptly and in any event within 5 Business Days of it occurring, as required by clause 7.1(e). Where a Deferred Payment Scheme applies, you must also provide an update on the progress of the Case within 5 Business Days of our written request, which we may make at any time and as often as we reasonably require, as required by clause 7.1(g). Where more than one Payment Event occurs, the first to occur is the operative Payment Event.
5. 1.5
   Where a Payment Event occurs before Return, we may invoice for the Services performed to the date of that Payment Event, and may invoice the balance of the Charges, if any, on Return.
6. 1.6
   The Payment Scheme determines only when the Charges fall due for payment. It has no effect on when we delete personal data, which is governed exclusively by clause 12 and is triggered by Return of the completed casework. A Case under the Deferred 6 Month Payment Scheme or the Deferred 2 Year Payment Scheme, including an ATE Applicable Case under paragraphs 4.8 to 4.16, is deleted on the same timetable as any other Case, and deletion is not deferred until the Charges are paid or until the Case concludes. You must download and retain your own copy of the Deliverables within the applicable availability window notwithstanding that the Charges are not yet due.
7. 1.7
   Nothing in this Annex limits clause 10.7 (interest and suspension on late payment), clause 16 (limitation of liability) or clause 17 (termination).

Annex 2Standard Payment Scheme

1. 2.1
   This Part 2 applies where the Contract Details identify the Standard Payment Scheme, or standard 30 day terms, as the applicable Payment Scheme, or where paragraph 1.2 applies.
2. 2.2
   A Payment Event under this Standard Payment Scheme means the earlier occurrence of:

   1. (a)
      the issue of the Invoice on Return; and
   2. (b)
      the date of a Termination Event.
3. 2.3
   We will issue the Invoice for the Charges plus VAT, where applicable, on or as soon as reasonably practicable after Return.
4. 2.4
   The Invoice must be paid in full and in cleared funds within 30 days of the date of the Invoice, and that date is the due date for the purposes of clause 10.5.
5. 2.5
   Payment under this Standard Payment Scheme is not conditional on you being in funds from your client or from any third party, on the recovery of costs or disbursements from any other party, on the receipt of any insurance payment, or on the outcome of the Case.
6. 2.6
   Where the Contract terminates before Return, the Payment Event is the date of termination and we may invoice for the Services performed to that date, which invoice is payable within 30 days of its date, subject to clause 17.10(c) where you terminate for our default.
7. 2.7
   No rate reduction or rate adjustment applies under this Standard Payment Scheme, and the Charges remain payable at the rates set out in the Contract Details whatever the outcome of the Case.

Annex 3Deferred 6 Month Payment Scheme

This Part 3 sets out the Additional Conditions for the Deferred 6 Month Payment Scheme, under which payment of the Charges is deferred until the earlier of a Payment Event and a longstop of 6 months from the Deferral Start Date.

1. 3.1
   This Part 3 applies where the Contract Details identify the Deferred 6 Month Payment Scheme as the applicable Payment Scheme.
2. 3.2
   The Deferral Start Date is the date of the Invoice or, where we issue a request for payment on Return under paragraph 3.7, the date of that request for payment. The Invoice, or the request for payment, is issued on Return in accordance with clause 10.4.
3. 3.3
   A Payment Event under this Deferred 6 Month Payment Scheme means the earlier occurrence of:

   1. (a)
      the date a decision to settle the Case is made, whether or not costs have been agreed;
   2. (b)
      the date the Case is won by your client at trial, irrespective of any leave to appeal;
   3. (c)
      the date the Case is abandoned by your client or by any relevant third party;
   4. (d)
      the date the Case is lost by your client at trial, irrespective of any leave to appeal;
   5. (e)
      the date your client withdraws instructions from you;
   6. (f)
      the date you withdraw from the Case under your terms of engagement with your client;
   7. (g)
      the date of a Termination Event;
   8. (h)
      the date of a notice given by us under clause 8.5(a) treating the Services as complete because a dependency has not been supplied; or
   9. (i)
      the date 6 months after the Deferral Start Date.
4. 3.4
   The Invoice must be paid in full and in cleared funds within 30 days of the Payment Event in accordance with clause 10.5, and that date is the due date.
5. 3.5
   The full Charges at the rates set out in the Contract Details remain payable under this Deferred 6 Month Payment Scheme whatever the outcome of the Case. No rate reduction applies by reason of the Case being lost, abandoned, discontinued or withdrawn. The rate agreed at the point of sale is honoured for the life of the Case, and the Charges are not subject to any indexation, annual uplift or other increase.
6. 3.6
   Deemed Payment Event. Where we make a written request for an update on the progress of the Case, or for confirmation whether a Payment Event has occurred, and you do not provide the requested update or notify us of a Payment Event within 30 Business Days of that request, a Payment Event is deemed to have occurred on the date of our request and the Invoice falls due 30 days after that date. Where you subsequently evidence to our reasonable satisfaction that no Payment Event had in fact occurred, we will correct the position and withdraw or credit any Invoice raised on the deemed Payment Event, and the Case continues on this Deferred 6 Month Payment Scheme.
7. 3.7
   Where required for VAT purposes, we may issue a request for payment on Return and issue the VAT invoice on or after the Payment Event, and in that event the Deferral Start Date is the date of the request for payment.
8. 3.8
   ATE Applicable Cases. Where the Contract Details record an ATE Policy, paragraphs 4.8 to 4.16 of Part 4 apply to this Deferred 6 Month Payment Scheme as if set out in this Part 3, and a reference in those paragraphs to the 2 year period is read as a reference to the 6 month period in paragraph 3.3.

Annex 4Deferred 2 Year Payment Scheme

This Part 4 sets out the Additional Conditions for the Deferred 2 Year Payment Scheme, under which payment of the Charges is deferred until the earlier of a Payment Event and a longstop of 2 years from the Deferral Start Date. Paragraphs 4.8 to 4.16 contain the ATE overlay, which applies in addition to the rest of this Part 4 where the Contract Details record an ATE Policy number.

1. 4.1
   This Part 4 applies where the Contract Details identify the Deferred 2 Year Payment Scheme as the applicable Payment Scheme.
2. 4.2
   The Deferral Start Date is the date of the Invoice or, where we issue a request for payment on Return under paragraph 4.7, the date of that request for payment. The Invoice, or the request for payment, is issued on Return in accordance with clause 10.4.
3. 4.3
   A Payment Event under this Deferred 2 Year Payment Scheme means the earlier occurrence of:

   1. (a)
      the date a decision to settle the Case is made, whether or not costs have been agreed;
   2. (b)
      the date the Case is won by your client at trial, irrespective of any leave to appeal;
   3. (c)
      the date the Case is abandoned by your client or by any relevant third party;
   4. (d)
      the date the Case is lost by your client at trial, irrespective of any leave to appeal;
   5. (e)
      the date your client withdraws instructions from you;
   6. (f)
      the date you withdraw from the Case under your terms of engagement with your client;
   7. (g)
      the date of a Termination Event;
   8. (h)
      the date of a notice given by us under clause 8.5(a) treating the Services as complete because a dependency has not been supplied; or
   9. (i)
      the date 2 years after the Deferral Start Date.
4. 4.4
   The Invoice must be paid in full and in cleared funds within 30 days of the Payment Event in accordance with clause 10.5, and that date is the due date.
5. 4.5
   The full Charges at the rates set out in the Contract Details remain payable under this Deferred 2 Year Payment Scheme whatever the outcome of the Case. No rate reduction applies by reason of the Case being lost, abandoned, discontinued or withdrawn, except that the ATE Failed Rate applies to an ATE Applicable Case which is lost or abandoned, under paragraphs 4.8 to 4.16. The rate agreed at the point of sale is honoured for the life of the Case, and the Charges are not subject to any indexation, annual uplift or other increase.
6. 4.6
   Deemed Payment Event. Where we make a written request for an update on the progress of the Case, or for confirmation whether a Payment Event has occurred, and you do not provide the requested update or notify us of a Payment Event within 30 Business Days of that request, a Payment Event is deemed to have occurred on the date of our request and the Invoice falls due 30 days after that date. Where you subsequently evidence to our reasonable satisfaction that no Payment Event had in fact occurred, we will correct the position and withdraw or credit any Invoice raised on the deemed Payment Event, and the Case continues on this Deferred 2 Year Payment Scheme.
7. 4.7
   Where required for VAT purposes, we may issue a request for payment on Return and issue the VAT invoice on or after the Payment Event, and in that event the Deferral Start Date is the date of the request for payment.
8. 4.8
   ATE Applicable Cases: application. Paragraphs 4.8 to 4.16 apply in addition to the rest of this Part 4 where the Case runs on this Deferred 2 Year Payment Scheme and the Contract Details record an ATE Policy number. An ATE Policy is not a separate Payment Scheme: an ATE Applicable Case runs on this Deferred 2 Year Payment Scheme in the normal way, subject to this ATE overlay. You must have an ATE Policy in place for the Case and provide proof of that policy to us before or on Approval. An ATE Failed Rate applies under paragraph 4.10 only where we have a written agreement setting such a rate with the ATE Insurer recorded in the Contract Details. Where we have no such agreement with that insurer, paragraph 4.10 does not apply, and the full Charges at the rates set out in the Contract Details remain payable whatever the outcome of the Case. You remain liable for the Charges at all times. We have no claim against the ATE Insurer, the ATE Policy does not transfer liability for the Charges away from you, and whether you recover any part of the Charges under the ATE Policy is a matter between you and your insurer.
9. 4.9
   ATE Applicable Cases: Case won. If the Case is won, the full Invoice at the rates set out in the Contract Details is payable on the Payment Event in the normal way under this Part 4.
10. 4.10
    ATE Applicable Cases: Case lost or abandoned within the 2 year period. If the Case is lost or abandoned within the 2 year period ending on the longstop in paragraph 4.3(i), that outcome is a Payment Event and the Charges are recalculated at the ATE Failed Rate. Settlement is not optional and you do not wait for the 2 year longstop. We will reissue the Invoice at the ATE Failed Rate and notify you in writing of the amount payable, and that amount must be paid in full and in cleared funds within 30 days of the date of our notification. The recalculated Invoice is payable by you in the normal way.
11. 4.11
    ATE Applicable Cases: Case not concluded by the longstop. If the Case has not concluded by the 2 year longstop in paragraph 4.3(i), the full Invoice at the rates set out in the Contract Details is payable at 2 years in the normal way under this Part 4.
12. 4.12
    ATE Applicable Cases: Case lost or abandoned after the longstop. If the Case is lost or abandoned after the 2 year longstop, the Invoice has already been settled in full at 2 years and is not reduced or refunded.
13. 4.13
    ATE Applicable Cases: the ATE Failed Rate. The ATE Failed Rate is the rate agreed in writing between us and the ATE Insurer for Cases which are lost or abandoned, as in force at the relevant date. It exists to give the ATE Insurer certainty as to its liability per Case and is not a discount, and it may be higher or lower than the Invoice. The ATE Failed Rate and the associated failure scale are confidential under our agreement with the ATE Insurer concerned and are not reproduced in these Conditions. We will notify you of the amount payable at the ATE Failed Rate on an early settlement under paragraph 4.10.
14. 4.14
    ATE Applicable Cases: no ATE Policy in place. If no ATE Policy is in place, or if at any time the ATE Policy is avoided, cancelled, rescinded or lapses, or the ATE Insurer declines or withdraws cover for the Case, the ATE Failed Rate in paragraph 4.10 does not apply, and the Case continues on this Deferred 2 Year Payment Scheme in the normal way with the full Invoice at the rates set out in the Contract Details payable on the Payment Event.
15. 4.15
    ATE Applicable Cases: contact with the ATE Insurer. Where this ATE overlay applies you authorise us to contact the ATE Insurer directly for updates on the Case and on the status of the ATE Policy, and you authorise the ATE Insurer to provide that information to us.
16. 4.16
    ATE Applicable Cases: legacy end of case arrangement. We formerly offered an end of case arrangement with an ATE Insurer with no fixed end date. That arrangement is no longer offered and, because it was not fundable, we stopped offering it to new instructions about 2.5 years ago. Cases placed on those terms before then continue to be honoured on those terms. All ATE Applicable Cases accepted since then run on this Deferred 2 Year Payment Scheme, and no end of case arrangement is available to new instructions.