Privacy Notice
Version 3.0 · Effective date: 19 August 2026
This notice explains how Edtrainit Ltd collects and uses personal information when you visit our public websites or marketing pages, respond to an advertisement, submit an enquiry or lead form, buy medtrainit, or use medtrainit.
1. Who is responsible
Edtrainit Ltd is the data controller for the personal information described in this notice, except where a service provider acts as a separate controller under its own terms.
Edtrainit Ltd
Registered in Scotland · Company No. SC887286
Registered office: 21 Fleurs Place, Elgin, Scotland, IV30 1ST
Email: connect@medtrainit.com
ICO registration reference: ZC152332
Privacy contact: connect@medtrainit.com
2. Who this notice covers
This notice covers visitors to Edtrainit and medtrainit public websites and landing pages; people who submit an enquiry or lead form; parents and guardians who purchase medtrainit; adult students who hold or use accounts; students under 18 who use the platform; and people who contact support. Separate student-facing privacy information is published at /your-privacy.
3. The standards we apply to student accounts
medtrainit is likely to be accessed by students under 18. At registration, the account holder tells us whether the account is for an under-18 student or an adult student.
For an under-18 account we collect only the month and year in which the student is expected to turn 18. We do not collect the student's exact date of birth, and we do not require a identity document or facial scan solely for UK age assurance.
We use this limited information to apply the correct account controls and to stop automatic parent or guardian dashboard access from continuing after the student is expected to become an adult.
Because this information is self-declared and does not establish age with certainty, we design all student accounts using the relevant standards and principles of the ICO's Children's Code, including high-privacy defaults and safeguards appropriate to student users. We do not rely on a declaration of adult status to reduce the general privacy protections a student receives.
4. Information we collect
Account information
Account holder's name and email address; student's first name; country of residence; intended IMAT year; whether the account is for an under-18 or adult student; for an under-18 account, the month and year in which the student is expected to turn 18; the account holder's declaration that they are the student's parent or legal guardian and are authorised to purchase and administer the account; account status; access start and expiry dates; age-status confirmations; and dashboard-sharing choices where these apply.
Purchase information
Payment amount, date and currency; payment status; Stripe payment or transaction reference; and access start and expiry dates. Stripe handles complete payment-card details. Edtrainit Ltd does not receive or store the complete card number.
Learning information
Questions attempted; answers submitted; whether each answer was correct; the category of mistake identified for an incorrect answer; feedback provided; follow-up practice and its results; progress through the platform; progress indicators; and progress reports.
Lead-generation and enquiry information
When a person asks for information or submits a lead form, we may collect their name, email address, country, whether they are enquiring as a student or parent/guardian, the content of their enquiry, the date and source of the enquiry, and any separate marketing choice they make. We collect only the fields that are reasonably needed for the enquiry or campaign.
Public website advertising and measurement information
On public Edtrainit/medtrainit marketing pages, and only after any consent required for non-essential technologies has been obtained, we may process advertising or campaign information such as the advertisement or campaign that referred a visitor, page and conversion events, advertising identifiers, cookie or browser identifiers, and consent preferences. We use this information to understand whether public advertising is effective and, where enabled and consented to, to support advertising or remarketing.
Google advertising technologies are not used inside the logged-in medtrainit learning platform. Student answers, mistake categories, progress information, dashboards and learning behaviour are not sent to Google for advertising or audience-building.
Contract and declaration records
Evidence of acceptance of the Terms; the version of this notice provided; parent or guardian declarations; immediate-access requests; cancellation-right acknowledgements; marketing choices; cookie or advertising choices where recorded by us; and later changes or withdrawals. Where relevant we record the wording shown, its version, date and time, and the response given.
Technical and security information
IP address; browser and device type; login and session information; security events; and application-error information. This information is used to operate, maintain and protect the service. Technical information from the logged-in learning platform is not used to create advertising profiles.
5. Information required to provide medtrainit
Account, age-status, payment and student information is required to create and operate a medtrainit account. Without it we may be unable to process the purchase, create the account, provide educational feedback or operate the service. Information requested in a general lead or enquiry form is required only to the extent shown on that form. Optional marketing and optional advertising technologies are not required to purchase or use medtrainit.
6. Why we use personal information
| What we do | Lawful basis / rule |
|---|---|
| Create and operate an account; take payment; provide access to the account holder | Performance of a contract — Article 6(1)(b). |
| Analyse an under-18 student's answers to provide feedback and practice | Legitimate interests — Article 6(1)(f): providing the educational service purchased for the student. Assessment recorded. |
| Analyse an adult student's answers to provide feedback and practice | Performance of a contract — Article 6(1)(b), where the adult student is the contracting party; otherwise legitimate interests as necessary to provide the requested service. |
| Disclose an under-18 student's limited progress information to the parent or guardian account holder | Legitimate interests — Article 6(1)(f). Assessed separately; see section 8. |
| Respond to an enquiry or a person asking about buying medtrainit | Steps requested before entering a contract — Article 6(1)(b) — or legitimate interests for a general enquiry that is not yet contractual. |
| Send optional promotional email to a lead or subscriber | Consent — Article 6(1)(a) — and PECR. We use a separate marketing choice for leads. Where a lawful customer soft opt-in is used, its conditions must be met. |
| Use Google Ads or other non-essential advertising/measurement technologies on public marketing pages | Consent for non-essential storage/access technologies under PECR. Where those technologies process identifiable or profile-linked personal information for advertising, we rely on consent under Article 6(1)(a). |
| Maintain limited campaign administration, security and fraud-prevention records | Legitimate interests — Article 6(1)(f), limited to what is necessary and not used to override a visitor's advertising choice. |
| Accounting, tax and company-law records | Legal obligation — Article 6(1)(c). |
| Security, fraud prevention and platform protection | Legitimate interests — Article 6(1)(f). |
Where we rely on legitimate interests we assess necessity, proportionality and the individual's rights and reasonable expectations. For student processing we give particular weight to age, privacy and best interests.
Service communications
We send necessary messages about payment, activation, access, account security, material service changes, support requests and privacy or legal matters. These are service messages, not marketing.
Marketing
Marketing is optional. A lead is not added to a promotional mailing list merely because they submitted an enquiry. Where consent is required, the marketing choice is separate, clear and unticked by default and can be withdrawn at any time. Every marketing email provides an easy way to unsubscribe.
We do not use student answers, mistake categories, progress information, dashboard information or activity inside the logged-in learning platform for advertising, remarketing or marketing profiling.
7. How medtrainit analyses answers (profiling)
medtrainit carries out profiling for educational feedback. When a student submits an answer, medtrainit automatically records it and identifies whether it was correct; where it was incorrect, maps the selected option to one of a fixed set of predefined mistake categories; returns the explanation and follow-up practice linked to that option; calculates progress indicators from recorded activity; and generates progress reports at fixed points during the access period.
This is automated processing used to evaluate learning performance. No generative-AI or machine-learning model interprets the student's answer or generates personalised feedback. For the same question and content version, each answer option is linked in advance to predetermined feedback written or approved by subject specialists.
Why it cannot be switched off
This analysis is the learning service. Without it medtrainit cannot identify what a student got wrong, explain it or select suitable practice. We have assessed whether this educational profiling should be off by default for students under 18 and concluded that it should not because it exists solely to support learning, is confined to activity inside medtrainit, and is not used for advertising or unrelated purposes.
Automated decision-making
medtrainit does not make solely automated decisions that produce legal effects or similarly significant effects. It does not determine an examination result, university admission, official academic grade, eligibility to study medicine or any comparable outcome. Progress information is educational guidance based only on activity within medtrainit.
If a student or account holder believes a mistake has been classified wrongly or a progress indicator is inaccurate, they can contact connect@medtrainit.com. A person will review the issue and the record will be corrected where appropriate.
Advertising separation
Educational profiling is completely separate from public website advertising. Learning information is never used to create Google advertising audiences, optimise Google campaigns, personalise advertisements or measure advertising conversions.
8. Parent or guardian access to the dashboard
The parent or guardian who purchases an under-18 account holds the purchasing account. The student is a named user on that account. While the student is under 18, the account holder can view the limited progress dashboard described below. This is disclosed before purchase and directly to the student.
| The account holder can see | The account holder cannot |
|---|---|
| Topics the student has worked on | See individual answers the student submitted |
| Categories of mistake recorded | See anything about the student from outside medtrainit |
| Progress indicators | Change or delete the student's answers or progress record |
| Progress reports | Control what the student sees on their own screen |
The account holder has declared that they are the student's parent or legal guardian and are authorised to purchase and administer the account. We rely on legitimate interests for this limited disclosure and maintain a separate assessment considering the student's age, privacy, reasonable expectations and best interests.
The student is shown a continuing on-screen indicator whenever parent or guardian dashboard access is active and can open a plain-language explanation of exactly what the account holder can see. The student can always see their own progress information.
If a student is worried about this access, they can contact us privately at connect@medtrainit.com. A message sent through the confidential route is not shown to the account holder. We consider the request taking account of the student's age, wishes and best interests and can restrict or end parent/guardian access in appropriate circumstances.
We keep a limited record of dashboard access: the date of the most recent access and significant changes such as access starting, ending or being restricted. We do not keep a permanent record of every routine view.
9. The student's own progress panel
The detailed progress panel on the student's own screen starts collapsed so that a progress figure does not dominate the screen while the student is working. The student can expand or collapse it at any time. This changes only the student's display. It does not change what medtrainit records or analyses and does not change parent/guardian access.
10. When an under-18 student approaches 18
For an under-18 account we record the month and year in which the student is expected to turn 18. We do not collect the exact day. Automatic parent or guardian dashboard access ends at the beginning of that calendar month. Because we do not know the exact day, access may end shortly before the actual eighteenth birthday. This is deliberate so that automatic access stops early rather than continuing after adulthood.
The student or account holder can ask us to correct an inaccurate month or year. A student can also tell us at any time that they are already 18. Where no transition month and year was recorded for a legacy account, we may prompt the student periodically instead.
When automatic access ends, the student keeps the remainder of the access period, decides whether to share the dashboard in future and can stop sharing later. The previous account holder is told that automatic access has ended. The transition month and year is deleted once no longer required, while a limited record of the status change is retained.
11. Children's information and advertising
We do not:
- sell children's personal information
- use student learning information for advertising
- create advertising audiences from student answers or progress
- create public student profiles
- use learning behaviour for behavioural advertising
- use nudge techniques to encourage students to weaken privacy settings or provide unnecessary information
Google advertising technologies are restricted to public marketing pages and are not used inside the logged-in student learning environment. We do not intentionally upload known under-18 student records or learning records to Google Ads Customer Match or comparable advertising-audience services.
A person under 18 may still visit a public marketing page. Optional advertising technologies on that public page are controlled by the website consent mechanism and are not necessary to access general information or the learning service.
12. Organisations that help us
| Provider / category | What they do |
|---|---|
| Supabase | Database hosting and authentication |
| Vercel | Application hosting |
| Stripe | Payment processing |
| Resend | Transactional email and, only where configured, consented marketing email delivery |
| Sentry | Application-error monitoring |
| UptimeRobot | Availability monitoring |
| Deepnetsoft Solutions Pvt Ltd | Platform development and controlled technical support |
| Google Ads / Google | Public website advertising, lead generation where enabled, campaign attribution and consented conversion measurement |
| Consent-management technology | Records and applies website cookie and advertising choices; the live cookie-settings panel identifies the provider and technologies in use |
Some providers, including Google, may act as a processor for some activities and as a separate or independent controller for others under their applicable terms. We assess the role for the specific service used. We do not provide student learning information to another organisation for that organisation's own marketing.
13. Development and technical support
Routine development and testing use fictional test accounts and synthetic information. Our engineering provider is not permitted routine access to live student information for ordinary development work.
Where a genuine fault cannot reasonably be reproduced using synthetic information, controlled access may be authorised only where there is a documented reason; access is granted to a named authorised person; limited to what is necessary; time-limited and withdrawn afterwards; activity is logged; unauthorised copying is prohibited; and the required contractual and international-transfer safeguards are in place.
14. Security
We use safeguards appropriate to the service, including encrypted connections, password hashing, individual accounts, role-based access controls, multi-factor authentication for administrative access, restricted technical-support access, synthetic test information, logging of important administrative actions, and documented security-incident procedures. These statements must reflect the live configuration on the publication date.
Public advertising and lead-generation tags are technically separated from logged-in learning pages. The marketing configuration must not transmit student answers, mistake categories, progress information or dashboard content to advertising providers.
No online service can guarantee complete security. We assess personal-data breaches and notify regulators and affected individuals where required by law.
15. International processing
The principal medtrainit database is hosted in a European Economic Area region. Some service providers may process personal information from other countries or make it accessible to support personnel outside the UK or EEA.
Where Deepnetsoft Solutions Pvt Ltd is permitted controlled access from India to personal information subject to UK transfer restrictions, that access is authorised only after the applicable UK restricted-transfer safeguards, contractual controls and transfer assessment are in place.
Google and certain hosting, email and monitoring providers may process information internationally. Where UK law treats a transfer as restricted, we require an appropriate UK-recognised transfer mechanism or adequacy arrangement to be in place, such as an International Data Transfer Agreement, UK Addendum, or applicable UK adequacy framework. The precise mechanism depends on the provider and service enabled and is recorded in our supplier register.
Information about the relevant safeguard can be requested from connect@medtrainit.com.
16. How long we keep information
| Information | Retention approach |
|---|---|
| Account and learning information, including mistake categories, progress indicators and reports | The 12-month access period and 12 months after access expires, then deleted or irreversibly anonymised. |
| Payment, purchase and contractual records | Six years from the end of the financial year in which the transaction took place. |
| Guardian declarations and immediate-access acknowledgements | Six years from the end of the access period. |
| Lead enquiries where no purchase follows | Up to 24 months after the last meaningful interaction, unless a shorter period is appropriate or a longer period is required for a legal claim. |
| Marketing consent evidence and preference records | While the marketing relationship is active and for a reasonable evidence period afterwards. A minimal suppression record may be retained so that an opt-out is respected. |
| Website advertising and conversion information controlled by Edtrainit | Only for as long as reasonably necessary for campaign measurement, consent evidence and fraud/security purposes, using the shortest practical platform settings. Google may retain information under its own applicable terms. |
| Cookie/advertising consent choices | For as long as needed to apply and evidence the current choice, with historic evidence retained only where necessary for compliance or a legal claim. |
| Records of parent/guardian dashboard access changes | Most recent access date and significant changes only, retained as for learning information. |
| Complaint records | Six years from closure. |
| Customer-support correspondence | 24 months after the matter is closed. |
| Security and application logs | 90 days unless required for an active security, fraud or legal investigation. |
| The month and year an under-18 student is expected to turn 18 | Deleted after automatic parent access has ended and the information is no longer required; a limited record of the status change is retained as for learning information. |
| Backups | Retained only through documented provider backup-replacement cycles. Backup information is not used for routine processing and is overwritten or deleted in accordance with those cycles. |
Where we anonymise information, we do so irreversibly so that neither we nor another reasonably likely party can identify the individual again. Replacing a name with a reference number is not anonymisation.
17. Closing and deleting an account
Closing access and requesting deletion are different. Where an account is closed, access stops and active sessions end; retained information remains subject to section 16.
Where a valid deletion request is made, we verify the requester's identity and authority as necessary, delete or anonymise account, profile and learning information where applicable, stop access, and retain only the minimum required for accounting, legal claims, contractual evidence, security or compliance. Deletion rights are not absolute; where information must be retained we explain what remains and why.
Where a request concerns a student, we consider the student's age, understanding, wishes, rights and best interests as well as the authority of the person making the request. A student may make a request about their own information even where a parent holds the purchasing account.
18. Your rights
Depending on the circumstances, you may have rights to request access to personal information, correct inaccurate information, request deletion, restrict processing, object to processing based on legitimate interests, receive eligible information in a portable format, withdraw consent, object to direct marketing, and complain about how personal information has been handled.
You can withdraw optional advertising consent through the website cookie settings and withdraw marketing email consent using the unsubscribe link or by contacting us. Withdrawal does not affect processing that was lawful before withdrawal.
Objecting, and what happens next
| If you object to… | What happens |
|---|---|
| The educational analysis of answers itself | The learning service cannot operate without this analysis. If an objection is upheld, we close the account and refund the unused part of the access period on a pro-rata monthly basis after explaining the consequence. |
| The account holder seeing an under-18 student's dashboard | This does not automatically end the student's access. We consider the objection separately and may restrict or end the disclosure. |
| A specific result believed to be wrong | A person reviews the issue and we correct the record where appropriate. |
| Direct marketing | We stop marketing. This has no effect on the learning service. |
| Optional advertising technologies | Use the cookie settings to reject or withdraw consent. Necessary technologies remain where required to operate the site. |
| Processing while a dispute is investigated | We consider whether processing should be restricted during the investigation. |
Requests should be sent to connect@medtrainit.com. We respond within the period required by law, normally one month for data-protection rights requests.
19. Complaints about how we handle your information
You have the right to complain to us about how we have handled personal information. You can complain by emailing connect@medtrainit.comwith "Data Protection Complaint" in the subject line, by using any data-protection complaint form we make available, or by writing to our registered office. We accept a complaint however it reaches us.
We will acknowledge a data-protection complaint within 30 days of receiving it unless we provide a full response within that period. We will investigate without undue delay, keep the complainant appropriately informed and explain the outcome and reasons.
If you are not satisfied with the outcome you can complain to the UK Information Commissioner's Office. People living outside the UK may also have rights to complain to the regulator responsible in their country.
20. Data protection impact assessment
Because medtrainit is used by children and analyses learning performance, we maintain a Data Protection Impact Assessment. The DPIA covers educational profiling, parent/guardian dashboard disclosure, age-status handling, retention, international transfers, controlled technical support, and the separation of public website advertising/lead generation from the logged-in learning environment. We review the DPIA when the platform or processing changes materially.
21. Changes to this notice
We may update this notice when the platform, public website, advertising arrangements, law or processing activities change. The version and effective date identify the current notice. Where a material change affects existing users, we provide appropriate notice.