Privacy Notice

1. Who is responsible for your information

Edtrainit Ltd is the data controller for medtrainit.

Data Protection Contact: Sony Mathew

Email: connect@medtrainit.com

2. Who this notice covers

This notice covers:

• parents and guardians purchasing medtrainit;
• adult students holding their own accounts;
• under-18 students using the platform;
• people contacting customer support; and
• visitors using medtrainit.com.

3. Information we collect

Account information

We may collect:

• the account holder's name and email address;
• the student's first name;
• country of residence;
• intended IMAT year;
• whether the account is for an under-18 or adult student;
• account status;
• access start and expiry dates;
• later age-status confirmations; and
• dashboard-sharing choices.

We do not routinely collect the student's date of birth or year of birth.

Purchase information

We retain:

• payment amount;
• date and currency;
• payment status;
• Stripe payment or transaction reference;
• access start date; and
• access expiry date.

Stripe handles the complete payment-card details.

Learning information

When the student uses medtrainit, we record:

• questions attempted;
• answers submitted;
• whether answers were correct or incorrect;
• educational feedback provided;
• follow-up practice;
• progress through the platform;
• progress indicators; and
• progress reports.

This information is necessary to provide the learning service.

Contract and declaration records

We record evidence of:

• acceptance of the Terms;
• the version of this Privacy Notice provided;
• parent or guardian declarations;
• immediate-access requests;
• cancellation-right acknowledgements;
• optional marketing choices; and
• later changes or withdrawals.

Technical and security information

We may process limited technical information, including:

• IP address;
• browser and device type;
• login and session information;
• security events; and
• application-error information.

This information is used to operate, maintain and protect medtrainit. It is not used to create advertising profiles.

4. Information required to provide medtrainit

Account, age-status, payment and student information is required to create and operate the account.

Without this information, we may be unable to:

• confirm the correct account arrangement;
• process the purchase;
• create the account;
• provide educational feedback; or
• operate the service.

Marketing is optional. Refusing marketing does not prevent anyone from purchasing or using medtrainit.

5. Why we use personal information

Account holders and adult students

We process account, payment and service information where necessary to enter into and perform the purchase contract.

Under-18 students

We process an under-18 student's learning information to provide the educational service requested and purchased for them.

For UK data-protection purposes, we rely on our legitimate interests in providing the requested educational service and operating the parent-dashboard arrangement.

When relying on legitimate interests, we consider:

• the student's age;
• their privacy;
• their rights;
• their reasonable expectations;
• the nature of the information; and
• their best interests.

Payments and legal records

We process purchase information to:

• complete payment;
• provide access;
• issue confirmations;
• prevent fraud; and
• comply with tax, accounting and company-law obligations.

Our legal bases are performance of the contract and compliance with legal obligations.

Security and service protection

We rely on legitimate interests to:

• protect accounts;
• detect misuse;
• prevent fraud;
• investigate faults;
• secure the platform; and
• protect our systems and content.

Service communications

We send necessary messages relating to:

• payment;
• account activation;
• access;
• account security;
• material service changes;
• support requests; and
• privacy or legal matters.

These are service messages, not marketing messages.

Marketing

Marketing is optional.

Where consent is required, the marketing choice is separate and unticked by default.

Consent may be withdrawn at any time by using the unsubscribe link or contacting us.

We do not use student answers, mistakes, progress information or dashboard information for advertising or marketing profiling.

6. Progress information and educational analysis

medtrainit uses predefined, rule-based processing to provide educational feedback and progress information based on submitted answers.

No generative AI reads or evaluates a student's submitted answer at the point it is submitted.

medtrainit does not make solely automated decisions that determine:

• an examination result;
• university admission;
• an official academic grade;
• eligibility to study medicine; or
• another legal or similarly significant outcome.

Progress information is educational guidance based only on activity within medtrainit.

7. Parent dashboard access

For an under-18 account:

• the parent or legal guardian holds the purchasing account;
• the parent or guardian can view the student's progress dashboard;
• the student is clearly informed that this access is active; and
• a continuing indicator is displayed while parent access remains active.

The indicator states:

Your progress dashboard is shared with your parent or guardian account holder.

The student may show or hide the detailed dashboard on their own screen.

This control affects only what is displayed to the student. It does not stop medtrainit from:

• recording submitted answers;
• providing educational feedback;
• calculating progress;
• creating reports;
• retaining information in accordance with this notice; or
• displaying the dashboard to the parent or guardian account holder.

The control is not a privacy, consent or tracking switch.

8. When an under-18 student becomes 18

We record whether the account was created for an under-18 or adult student.

We do not routinely collect the student's date of birth.

An under-18 student can confirm that they are now 18 through their account settings or by contacting us.

We may also ask once during the access period whether the student has become 18.

Once adult status is confirmed:

• automatic parent dashboard access ends;
• the student controls future dashboard sharing;
• the status change and sharing choice are recorded; and
• the previous parent account holder is notified that automatic access has ended.

We use this information only to apply the appropriate account-control and dashboard-sharing arrangements.

9. Children's information

We do not:

• sell children's personal information;
• use learning information for advertising;
• create advertising audiences from student information;
• create public student profiles;
• use behavioural advertising trackers;
• pressure students to disclose unnecessary information; or
• use progress information for unrelated purposes.

We provide separate privacy information written for students.

10. Organisations that help us provide medtrainit

We use specialist service providers for:

• database hosting and authentication;
• application hosting;
• payment processing;
• transactional email;
• application-error monitoring;
• availability monitoring;
• platform development; and
• controlled technical support.

Our principal providers include:

• Supabase;
• Vercel;
• Stripe;
• Resend;
• Sentry;
• UptimeRobot; and
• Deepnetsoft Solutions Pvt Ltd.

These providers may process information only to provide services to Edtrainit and under applicable contractual, confidentiality and security requirements.

We do not sell personal information or provide it to another organisation for that organisation's marketing.

11. Development and technical support

Routine development and testing use fictional test accounts and synthetic information.

A fictional test account is created as test information from the beginning. It is not a real student account with the name removed.

Our engineering provider is not permitted routine access to live student information for ordinary development work.

Where a genuine fault cannot reasonably be reproduced using synthetic information, controlled access may be authorised only where:

• there is a documented reason;
• access is given to an authorised person;
• access is limited to what is necessary;
• access is time-limited;
• relevant activity is logged;
• unauthorised copying is prohibited; and
• the required contractual and international-transfer safeguards are in place.

Information labelled only with a user reference remains protected where it can still be connected to an individual.

12. International processing

The principal medtrainit database is hosted in a European Economic Area region.

Some service providers may process information or provide support from countries outside the United Kingdom.

Where this involves a restricted international transfer, we use an appropriate legal safeguard and complete any required transfer assessment.

Further information about relevant safeguards may be requested by emailing connect@medtrainit.com.

13. How long we keep information

Account and learning information

Normally kept during the 12-month access period and for up to 12 months after access expires.

Payment, purchase and contractual records

Kept for up to six years where required for accounting, tax, legal claims or compliance.

Guardian and immediate-access records

Kept for up to six years where needed to demonstrate the purchase and associated declarations.

Customer-support correspondence

Normally kept for up to 24 months after the matter is closed.

Security and application logs

Normally kept for up to 90 days, unless required for an active security, fraud or legal investigation.

Marketing information

Kept until consent is withdrawn or the information is no longer required.

A minimal suppression record may be retained to ensure that marketing is not sent after an opt-out.

Backups

Information in backups is removed through the normal encrypted backup-replacement cycle.

We review retained information and delete or anonymise it when it is no longer required.

14. Closing and deleting an account

Closing access and requesting deletion are different.

Account closure

Where an account is closed:

• access is stopped;
• active sessions are ended; and
• retained information remains subject to the periods described above.

Deletion request

Where a valid deletion request is made:

• we check the requester's identity and authority;
• account, profile and learning information is deleted or anonymised where applicable;
• access is stopped; and
• only the minimum information required for accounting, legal claims, contractual evidence, security or compliance is retained.

Deletion rights are not absolute. Where information must be retained, we will explain what remains and why.

Where a request concerns a student, we consider the student's age, understanding, wishes, rights and best interests, as well as the authority of the person making the request.

15. Security

We use technical and organisational safeguards appropriate to the service, including:

• encrypted connections;
• password hashing;
• individual accounts;
• role-based access controls;
• multi-factor authentication for administrative access;
• restricted technical-support access;
• synthetic test information;
• logging of important administrative actions; and
• procedures for security incidents.

No online service can guarantee complete security.

We assess personal-data breaches and notify regulators and affected individuals where required by law.

16. Your rights

Depending on the law that applies, you may have the right to:

• request access to your personal information;
• correct inaccurate information;
• request deletion;
• restrict processing;
• object to processing based on legitimate interests;
• receive eligible information in a portable format;
• withdraw marketing consent; and
• complain about how personal information has been used.

Requests should be sent to connect@medtrainit.com.

We normally respond within one calendar month under UK data-protection law.

Where information relates to a student, parent account ownership does not automatically remove the student's own data-protection rights.

17. Complaints

Please contact:

Sony Mathew — Data Protection Contact

connect@medtrainit.com

You may also complain to the UK Information Commissioner's Office.

People living outside the UK may also have the right to complain to the data-protection authority responsible in their country.

18. Changes to this Privacy Notice

We may update this notice when the platform, law or processing arrangements change.

The version and effective date show which notice is current.

We record which version was provided when an account was created or a purchase was made.

Where a material change affects existing users, we will provide appropriate notice.