Privacy Policy

1. Who We Are & Data Controller Details

MedicToUK Ltd ("MedicToUK", "we", "us", or "our") is a company registered in England and Wales. We operate as the Data Controller responsible for your personal data when you interact with our website (medictouk.com), enroll in clinical preparatory courses, stream revision videos, utilize our digital timers, or book 1-to-1 advisory consultations.

We are committed to preserving the privacy of our candidates and ensuring transparent, lawful, and ethical data processing in strict adherence to the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Privacy and Electronic Communications Regulations (PECR).

2. The Personal Data We Collect

Personal data means any information relating to an identified or identifiable natural person. We collect and process the following categories of personal data:

3. Special Category Data

Under Article 9 of the UK GDPR, certain types of personal data (such as health, biometric, or ethnic origin data) are classified as special category data requiring higher protection.

MedicToUK Ltd does not actively collect special category data unless you voluntarily provide it:

• Health, Dietary & Accessibility Disclosures: If you request reasonable adjustments or disability accommodations for in-person hospital mock exams (e.g. wheelchair access, hearing loops, or pregnancy accommodations), or share dietary allergies for catered courses.
• Medical Exemption Evidence: Supporting documentation submitted in support of emergency cancellation or deferral requests on compassionate grounds under our Refund Policy.

Lawful Basis for Special Category Data: Explicit candidate consent (UK GDPR Art. 9(2)(a)) and, where relevant, compliance with legal and safeguarding obligations. You may withdraw consent for this specific processing at any time by contacting us.

4. How We Collect Your Personal Data

• Direct Interactions: When you purchase a course, create an account, fill in an enrollment form, subscribe to our newsletter, request 1-to-1 portfolio coaching, or communicate with our consultant faculty via email.
• Live Mock Sessions: When you present cases, engage with actor role-players, or undergo examination during Day 1 Zoom or Day 2 hospital circuit sessions, consultant examiners record scores and structured constructive feedback.
• Automated Technologies: As you navigate through our platform, technical logs and functional cookies automatically collect device data, session states, and diagnostic metrics.
• Third-Party Integrations: We receive transaction status updates and webhook verifications from Stripe Inc. to confirm booking settlements.

5. Lawful Bases for Processing (UK GDPR Art. 6)

We will only process your personal data when the law allows us to. Most commonly, we rely on the following lawful bases:

6. Data Sharing & Third-Party Service Providers

We do not sell, rent, or trade your personal data to third parties for commercial marketing purposes.

To deliver our training services reliably, we disclose data strictly on a need-to-know basis to selected processors who adhere to rigorous data protection standards:

• Stripe Inc: Payment gateway infrastructure. Handles payment validation and PCI-compliant financial settlements.
• Cloudflare Inc: Content delivery network, web hosting (Cloudflare Pages), and DDoS/bot protection infrastructure.
• Resend / Email Infrastructure: Secure API for dispatching course booking confirmations, zoom links, and scorecards.
• NHS Consultant Faculty & Senior Examiners: Senior clinical examiners and role-play facilitators receive candidate rosters and station marksheets strictly under signed confidentiality covenants.
• Regulatory & Legal Authorities: UK law enforcement, HMRC, the Information Commissioner's Office, or courts if strictly required by statutory duty.

7. International Data Transfers

Where cloud infrastructure providers (such as Stripe or Cloudflare) maintain servers outside the UK or European Economic Area (EEA), we ensure appropriate safeguards are implemented in compliance with Chapter V of the UK GDPR. These safeguards include the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses (SCCs), or adequacy regulations recognized by the UK government.

8. Data Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was gathered, including satisfying legal, accounting, tax, or professional compliance duties:

• Candidate Assessment Scorecards & Feedback: Retained for 3 years following course completion, enabling doctors to request past performance verification or reference transcripts for subsequent exam diets.
• Financial & Transaction Records: Retained for 6 years following the end of the relevant financial year to comply with statutory UK HMRC accounting requirements.
• General Inquiries & Advisory Submissions: Retained for 12 months following resolution of your query.
• Newsletter & Marketing Data: Retained until you unsubscribe or withdraw consent, which can be done immediately via any email footer link.

9. Your Statutory Rights Under UK GDPR

Under UK data protection legislation, you have significant rights regarding your personal information:

To exercise any of these rights, please contact our data team at datacontrol@medictouk.com. We will acknowledge and process your request within 30 calendar days without administrative fee, unless requests are demonstrably repetitive or manifestly unfounded.

10. Cookies and Tracking Technologies

Cookies are small text files placed on your device to ensure web functionality and personalize user sessions.

• Strictly Necessary Cookies: Essential for site navigation, secure Stripe checkout redirects, and authentication tokens.
• Functional Cookies: Remember candidate user preferences such as timer acoustic alerts or cookie banner acceptance.
• Aggregated Analytics: Privacy-friendly server telemetry to assess page load speeds and prevent denial-of-service attempts. We do not use cross-site behavioral tracking or intrusive third-party ad pixels.

You can configure your web browser to reject cookies or notify you when cookies are set. Please note that disabling essential cookies may impact checkout functionality.

11. Information Security & Storage Standards

MedicToUK Ltd enforces comprehensive technical and organizational safeguards designed to protect personal data against unauthorized disclosure, alteration, loss, or destructive breach:

• Data Encryption: All web traffic is strictly encrypted using Transport Layer Security (TLS 1.3 / HTTPS).
• Access Controls: Candidate assessment sheets and personal records are restricted to authorized clinical directors and examiners with multi-factor authentication.
• Incident Response: In the unlikely event of a personal data breach posing a risk to candidate rights, we maintain protocols to notify the UK Information Commissioner's Office (ICO) and affected individuals within 72 hours as mandated by UK GDPR.

12. Questions, Inquiries & Right to Complain to the ICO

If you have questions about this policy or our data management practices, please contact us first so we may resolve your concern promptly:

You also have the statutory right to lodge a formal complaint with the UK supervisory authority for data protection issues: