Privacy Policy

1. Introduction

This Privacy Policy explains how MHC Solutions Ltd collects, uses, and protects personal data in accordance with:

• UK General Data Protection Regulation (UK GDPR)
• EU GDPR (where applicable)
• Relevant United States data protection and healthcare privacy laws

2. Our Role

Depending on the engagement, we may act as:

• A Data Processor (when handling data on behalf of clients)
• A Data Controller (for our own business operations, e.g., enquiry, consultation and client communications)

We do not routinely store or process patient data or PHI.

3. Data We Collect

We may collect:

• Contact information (name, email, phone number)
• Business information
• Enquiry and consultation details (organisation, service interests, and notes you share with us)
• Technical data (IP address, browser type)

4. How We Use Your Data

We use data to:

• Provide compliance and advisory services
• Review systems where authorised
• Respond to enquiries and arrange consultations
• Communicate with clients and prospective clients
• Meet legal obligations

5. Enquiry and Consultation Data

• Enquiries submitted through our website are stored securely and used only to respond to your request
• Information you share about your organisation is used to prepare and deliver consultancy support
• We do not provide recruitment or staffing services, and we do not accept or process CVs

6. Legal Bases for Processing (GDPR)

We rely on:

• Consent
• Contractual necessity
• Legal obligation
• Legitimate interests

7. HIPAA Positioning

Where US healthcare data is involved:

• We aim to avoid direct handling of PHI
• If access is required during system reviews, it is incidental and controlled
• Appropriate safeguards and contractual protections will be implemented

8. Data Sharing

We may share data with:

• Clients (for service delivery)
• Trusted service providers
• Legal or regulatory authorities where required

We do not sell personal data.

9. International Transfers

Data may be transferred between the UK, EEA, and the United States. Appropriate safeguards (such as Standard Contractual Clauses) are used.

10. Data Retention

We retain personal data only as long as necessary. Enquiry and consultation records are kept only for as long as needed to manage our relationship with you and to meet legal obligations.

11. Data Security

We implement appropriate technical and organisational measures, including encrypted communications where applicable.

12. Your Rights (GDPR)

You have rights including:

• Access
• Rectification
• Erasure
• Restriction of processing
• Data portability
• Objection

13. US Privacy Rights

Depending on jurisdiction, individuals may have rights to access, delete, or restrict processing of their data.

14. Cookies

We do not currently use cookies or tracking technologies. This may change in the future, and this policy will be updated accordingly.

15. Changes to this Policy

We may update this Privacy Policy periodically.

16. Contact Us

MHC Solutions Ltd