1Controller and contact
Edtrainit Ltd, registered in Scotland (SC887286), 21 Fleurs Place, Elgin, Moray, IV30 1ST, United Kingdom, is the controller for the personal data it decides to collect and use. ICO registration reference ZC152332. Privacy contact: hello@medtrainit.com. A school or consultancy that collects data for its own purposes may be a separate controller; the roles in any licence depend on what each party actually does.
2What we collect and why
| People / source | Information | Why |
|---|---|---|
| Adult enquiries / registrations | Adult enquirer name, verified email, whether they are the adult learner or a parent/guardian, country, programme interest; phone or WhatsApp only if they choose to give it | Respond, check availability, arrange follow-up, prevent duplicates and fraud |
| Students / academic forms | Student name when a place is taken forward, intended IMAT year, and — only if voluntarily given — current qualification and prior tests. Nationality only where it is needed for a specific eligibility check, with the reason explained | Assess suitability and give relevant guidance; optional academic detail is not needed for a simple seat enquiry |
| Purchasers / parents / guardians | Name, contact, eligibility and guardian declaration, order, invoice, Stripe reference, access entitlements and consent records | Sell, administer, support and give receipts for the service |
| Free trial / learner platform | Login and session data, question choices, correctness, rule-linked feedback, topics, progress, error patterns, technical data | Deliver the trial and platform, preserve progress, secure accounts |
| Live classes / support | Display name, attendance, booking, meeting identifiers, questions and responses, tutor and support messages | Arrange and deliver teaching and safe group interaction |
| Website visitors | IP address, minimal server and security logs, browser and device data, necessary session storage | Deliver and protect the website and platform |
We ask for only the adult enquirer’s contact details, country, programme interest and whether they are the learner or a guardian in order to answer a seat enquiry. We do not need a student’s name, nationality, WhatsApp number, date of birth, passport or exam history simply to answer that enquiry; we ask for a detail only when it is actually needed for a service you have requested, and we explain why at that point. Please do not submit sensitive documents through WhatsApp, group chat or a general form.
3Our lawful bases (UK)
- Adult purchase and service administration — contract (Article 6(1)(b)). Accounting and mandatory records — legal obligation (Article 6(1)(c)).
- Under-18 learner data where an adult purchases — legitimate interests (Article 6(1)(f)) in delivering the chosen educational service, under a recorded balancing assessment addressing the learner’s age, rights and best interests.
- Answer-linked learning analysis and feedback — contract for an adult learner, or our assessed legitimate interests for an under-18 learner. No advertising use.
- Enquiries, free trial, optional academic questions, partnership enquiries — steps requested before a contract and/or appropriate legitimate interests, keeping data to a minimum.
- Security and abuse prevention — legitimate interests, and legal obligations where relevant.
- Optional promotional messages — consent. Consent is never a condition of registering or purchasing, and is taken separately for each channel (see section 6).
4Educational profiling and automated decisions
medtrainit records the answers a learner selects, applies predefined feedback links and error categories, suggests follow-up practice, and calculates educational progress. This is educational profiling under UK law. No generative-AI or machine-learning model reads a learner’s answer and writes personalised feedback; each answer option is linked in advance to feedback written or approved by our subject specialists.
UK law (Articles 22A–22D of the UK GDPR, as amended) governs significant decisions made solely by automated means. medtrainit does not make such decisions. The analysis does not determine an IMAT result, a university admission, an official grade, eligibility to study medicine, a visa or any comparable outcome — it is educational guidance based only on activity on the platform. If a learner or purchaser thinks a result or progress figure is wrong, they can contact us and a person will review it. We do not sell or send answers, error patterns, subject weaknesses or progress to Meta, Google or anyone else for advertising or audience creation.
5Progress display and parents
A learner can expand or collapse their progress on their own screen; that control changes only the display, not the underlying processing, and cannot be locked by anyone else. The adult purchaser receives account, payment and service messages but does not automatically gain a separate private analytics dashboard by paying. A learner may choose to show or discuss their own progress with a parent or guardian. If we later introduce a dedicated parent-sharing function, we will describe it and control it before it is switched on.
6Email, WhatsApp and marketing
We reply at the contact details you give, and send important contract, payment and timetable messages to the purchaser’s verified email. These service messages are not marketing. Promotional messages are optional and separate: we take a distinct, unticked opt-in for each channel, so giving us a WhatsApp number for administration does not authorise promotional WhatsApp messages, and giving an email does not authorise promotional email. You can withdraw either at any time using the unsubscribe link or by contacting us. Learner answers and progress are never used for marketing.
7Social ads and lead forms
Our adverts may appear on Facebook or Instagram, and we may receive details you submit through a Meta-hosted lead form; Meta independently controls its own platform. We use those details to answer your enquiry and administer any relationship you then request. We do not use the medtrainit learning dashboard for advertising and do not place advertising tags inside the logged-in platform. What storage our own website uses is set out in our Cookie Notice.
8Live teaching and immigration sessions
Where we use Google Meet or Zoom, the provider may process display names, identifiers, network and device data, join times and messages sent in the meeting. Participants can see or hear what a learner chooses to share. We do not routinely record sessions; any proposed recording is explained before it starts. Where a qualified legal professional leads a group immigration-information session, we do not ask learners to upload passports or other sensitive documents to the group. If individual legal advice or document review is offered, it comes with its own separate privacy and engagement information.
9Service providers and international transfers
Depending on the feature used, our providers include Supabase (database and authentication), Vercel (hosting), Stripe (payment), Resend (email), an authorised developer for controlled technical support, and Google Meet or Zoom (live sessions); we also use Meta where you contact us through a social lead form. Supplier roles, sub-processors, retention and locations vary by feature. The main learner database is hosted in a European Economic Area region.
Some support processing may take place outside the UK or EEA, including in India or the United States. Where we make a restricted transfer, we put in place an appropriate safeguard — such as the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses — and carry out a transfer risk assessment. You can ask us which safeguard applies to a particular provider by emailing hello@medtrainit.com, and we will tell you and provide a copy where we are able to.
10How long we keep information
| Information | Retention |
|---|---|
| Active learner account and learning records | During paid access and normally up to 12 months after expiry, then deleted or anonymised, unless a lawful dispute or obligation requires longer |
| Purchase, tax and contract records | Normally six years from the end of the relevant financial year |
| Enquiries not converted to a purchase | Normally no more than 24 months after the last meaningful interaction; optional academic detail reviewed for earlier deletion |
| Live-class attendance and support | Attendance normally 12 months after the cohort; support correspondence generally 24 months after the matter closes |
| Marketing preferences | Until withdrawn or superseded; a minimal suppression record is kept so opt-outs are respected |
| Security logs and backups | Security logs typically up to 90 days unless needed for an investigation; backups cleared on the encrypted backup cycle |
11Children and safeguarding
The service is used mainly by older teenagers. For under-18 users, a parent or legal guardian purchases, but the learner’s privacy rights remain personal to the learner. We keep high-privacy defaults, do not create public student profiles, do not use learning records for advertising, and do not provide open student-to-student messaging. Where local law requires stronger age or parental-authority verification, we apply it and will not rely on a simple adult-purchaser tick-box in its place.
12Your rights and how to use them
Depending on the law and the processing, you may ask us to give you access to your data; correct it; erase it; restrict or object to how we use it; or provide it in a portable form. You may withdraw consent (for example to marketing) at any time. To use any of these, email hello@medtrainit.com. We may ask for enough information to confirm your identity. We respond within one month (we will tell you if a complex request needs longer), and these requests are free unless they are manifestly unfounded or excessive. A student may contact us directly, even where a parent bought the account. Where we rely on legitimate interests, you can object and we will assess your objection individually.
13Complaints and changes
If you are concerned about how we handle your data, contact hello@medtrainit.com. We acknowledge privacy complaints within 30 days and investigate without undue delay; you may also complain to the ICO at ico.org.uk. Residents of India and the UAE may have additional local rights and complaint routes. We update this notice when the service, suppliers, marketing, data collected or the law changes; the version and effective date show which notice is current, and we record which version applied when an account was created or a purchase made.