Legal
Privacy Notice
This notice explains how [Company name] Ltd collects and uses personal information when you enquire about, book or buy meditmat UK services.
Version 2.0 · Effective [date]
1. Who is responsible
[Company name] Ltd, trading as meditmat UK, is the data controller.
- [Company name] Ltd, registered in England and Wales, Company No. [company number]
- Registered office: [registered office address]
- Correspondence office: 321–323 High Road, Chadwell Heath, Essex RM6 6AX
- ICO registration reference: [ICO registration reference]
- Privacy and safeguarding contact: [email protected]
meditmat UK is an independent consultancy. It is not part of, owned by or connected to any university, examination body or admissions authority.
2. Our online learning platform
We license the online IMAT learning platform included in our packages from a specialist education-technology supplier. The platform is provided to you as part of our service and under our name.
We remain the controller for your relationship with us and for the student’s account on that platform. The supplier acts as our processor under a written agreement, and may process student activity information only in order to run the platform for us.
We will tell you the name of the platform supplier if you ask. Write to [email protected].
3. Who this notice covers
This notice covers parents and guardians who enquire about or purchase our services; students aged 18 or over who deal with us directly; students under 18 who are named in an enquiry, who use the learning platform, or whose application we support; people who book a consultation; people who contact us; and visitors to this website.
Where the student is under 18, the parent or legal guardian is our client and holds the contract. The student is not a party to that contract, and we treat the student’s information separately. Section 7 explains the different legal bases that follow from this.
4. Students under 18
We do not ask a student under 18 to deal with us without a parent or guardian. First contact is made by, or copied to, the parent or guardian, and we tell the student what we hold about them in language they can understand.
A student may exercise their own data-protection rights in respect of their own information whenever they have sufficient understanding to do so. There is no fixed age at which this begins, and we do not apply one. Where a student makes a request, we consider their age, understanding, wishes, rights and best interests, together with the authority of anyone else involved.
We do not send marketing to a student under 18. We do not use information about a student for advertising, audience-building, or any profiling unrelated to their own learning.
Where a student and a parent want different things, we do not treat the parent’s wishes as automatically decisive. We consider the student’s best interests and tell both of them what we have decided and why.
5. Safeguarding, and how we work with students
These are operational commitments as well as privacy ones, and we apply them to every student under 18.
- Live teaching is delivered in group sessions. A one-to-one session with a student under 18 takes place only where a parent or guardian is present, or the session is recorded and the recording is available to the parent or guardian.
- Teachers and subject specialists see the student’s first name, their work and their questions. They do not see the student’s contact details, address, date of birth, passport or payment information.
- All contact goes through the learning platform or an address we monitor. Our advisers and teachers do not give students personal telephone numbers, personal email addresses or personal social-media accounts, and do not accept contact on them.
- Recordings of live sessions are kept for the remainder of the access period and are then deleted.
- Concerns are handled by our named safeguarding contact, [named safeguarding contact], who can be reached at [email protected]. A student may raise a concern privately, and we will not pass their message to the account holder without first considering the student’s wishes and best interests.
- Where a concern suggests that a child is at risk of harm, we will act on it, including by contacting the appropriate authority. We cannot promise to keep that kind of concern confidential, and we say so to the student at the time.
- Background checks on our teachers and advisers are carried out to the standard required for their role and the country in which they work. The appropriate check differs between England, Scotland and other countries, and we apply the one that applies to each person.
6. Information we collect
Enquiry information
When you use the message form on this website we collect the name, email address, message and any notes you provide, together with the page you sent it from and the date and time. The form is operated for us by Web3Forms, who pass the message to our mailbox and hold a copy for a limited period.
Booking information
When you book a free consultation we use Google Calendar appointment scheduling. Google collects the name, email address and anything you add when booking, and provides it to us. The booking takes place on a Google page, not on this website.
Consultation and report information
To advise on a route we collect the student’s first name, country of residence, school and qualifications taken or predicted, the intended IMAT year, nationality and immigration status where this determines the applicant category, university preferences, and the circumstances you choose to tell us about.
Learning platform information
Where a package includes the learning platform we collect the student’s first name and a login email, questions attempted, answers submitted, whether each answer was correct, the category of mistake identified, the feedback given, follow-up practice and its results, and progress indicators. The account holder can see the student’s progress dashboard while the student is under 18, and the student is told this.
Application-support information
For the Standard and Premium packages we collect what each step you have instructed actually requires. Depending on the step this may include the student’s full name and date of birth, passport or identity-document details, school certificates and transcripts, and proof of address.
Payment information
Payment amount, date, currency and status, and the Stripe payment reference. Stripe handles the complete payment-card details. We do not receive or store the complete card number.
Correspondence and records
Emails, call notes, written summaries and reports, records of what was agreed, and records of deadlines and documents in progress.
Technical and security information
Our website host records IP address, browser and device type, and security events, in order to operate, protect and troubleshoot the site. This is not used to build advertising profiles.
7. Why we use personal information, and our lawful bases
The parent or guardian is our client. The student usually is not. We therefore treat the two separately, because we cannot rely on a contract to justify processing the information of someone who is not a party to it.
The account holder’s own information
| What we do | Lawful basis |
|---|---|
| Reply to an enquiry and arrange a consultation | Steps taken at your request before entering a contract |
| Provide the report or package you purchased | Performance of our contract with you |
| Take payment and keep accounting and tax records | Performance of our contract, and our legal obligations |
| Keep records of what we advised and agreed | Our legitimate interest in evidencing our advice and defending claims |
| Send optional updates about the IMAT and deadlines | Your consent, which you may withdraw at any time |
The student’s information
| What we do | Lawful basis |
|---|---|
| Assess the applicant category and advise on universities | Our legitimate interests in delivering the service the family asked for, and the student’s own interest in accurate advice |
| Provide the learning platform and educational feedback | Our legitimate interests in providing the education the student has been enrolled in |
| Prepare and progress the application documents instructed | Our legitimate interests in carrying out the instructed work accurately |
| Show the progress dashboard to the account holder while the student is under 18 | Our legitimate interests, assessed separately, and limited to progress information |
| Operate our safeguarding commitments | Our legitimate interests in protecting students, and our legal obligations where they apply |
For every legitimate interest above we have carried out and recorded an assessment weighing our interests against the rights of the person concerned, taking particular account of a student’s age, privacy, reasonable expectations and best interests. You may ask us for a summary of any of them.
You may object to any processing we carry out on the basis of legitimate interests, and a student may object in respect of their own information.
8. Sensitive information, and what not to send us
Please do not send health information, disability information, immigration documents or financial documents through the message form on this website. The form is for an initial enquiry. If any of that becomes relevant we will tell you a secure way to provide it.
Some of what we handle is sensitive even where the law does not classify it as a special category. Nationality and immigration status are an example: we record them because they determine which IMAT applicant quota a student competes in, and for no other purpose.
Where we need special category information — for example health information so that an examination access arrangement can be requested, or so that we can make a reasonable adjustment — we ask for explicit consent first, we tell you exactly what it will be used for, and that consent may be withdrawn at any time.
9. What we never do
- We do not sell personal information.
- We do not use enquiry, consultation, learning or application information for advertising, or to build advertising audiences.
- We do not pass your details to another organisation for that organisation’s own marketing.
- We do not submit anything to a university, consulate, examination body or other authority except on your instruction.
- We do not publish or share real students’ circumstances, results or documents. Any case example we use is invented.
10. Who else receives information, and in what role
Processors — acting only on our instructions
| Provider | What they do |
|---|---|
| Our learning platform supplier | Runs the online learning platform for us, under our name |
| Stripe | Payment processing |
| Web3Forms | Receives messages sent through the form on this website and passes them to us |
| Google (Workspace and Calendar) | Email, consultation bookings, documents |
| Cloudflare | Website hosting, delivery and security |
| Translators we instruct | Translation of documents you have asked us to arrange |
Separate controllers — acting under their own professional obligations
Some of the people involved in an application are not our processors. They decide for themselves how to handle your information, under their own professional rules, and they are responsible for it.
| Who | Their role |
|---|---|
| An Italian-qualified lawyer | Instructed independently. Gives their own advice, under their own professional and data-protection obligations, and is responsible for it |
| A notary public | Certifies documents under their own professional obligations |
| Consulates, CIMEA, the FCDO, universities and visa services | Receive documents submitted on your instruction, and act as controllers in their own right |
| Our accountants and professional advisers | Act under their own professional obligations |
Where we pass information to any of these, we provide what the step requires and nothing further.
11. Documents and official portals
The Universitaly account, and any other official portal used in an application, is opened in the student’s name and remains the student’s. Where we help set one up we do so with you present, and the login details belong to you. We ask you not to share passwords with us.
We keep copies of documents only while the step they relate to is in progress, and for the period in section 13. We do not retain passport or identity-document copies beyond that period.
12. International transfers
Our records are held in the United Kingdom or the European Economic Area where the provider offers that option.
Some of our providers are located in, or provide support from, outside the United Kingdom. Where that is so, we check which transfer mechanism actually applies to the specific service we use, and we record it. Depending on the provider that may be UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where both the provider and the transfer qualify for it.
We do not claim a particular mechanism for a provider we have not verified. A current list of our providers, the country each operates from and the safeguard recorded for each may be requested by emailing [email protected].
Translators, notaries and lawyers instructed in Italy are in the European Economic Area, which is covered by UK adequacy regulations.
13. How long we keep information
| Information | Retention |
|---|---|
| Enquiries that do not lead to a consultation | 12 months from the last contact |
| Consultation notes and route reports | 3 years from the date of the report |
| Learning platform account and activity | For the access period, and 12 months afterwards |
| Recordings of live sessions | For the remainder of the access period, then deleted |
| Contract, package and correspondence records | 6 years from the end of the engagement |
| Payment and accounting records | 6 years after the end of the accounting period, as required by law |
| Copies of identity and qualification documents | Deleted within 6 months of the step being completed, or sooner on request |
| Safeguarding records | As long as necessary, and in line with the guidance that applies to the concern |
| Consent records and marketing preferences | For as long as the preference applies, and 2 years afterwards |
| Website and security logs | As set by our hosting provider, ordinarily no more than 12 months |
Where we anonymise information we do so irreversibly, so that neither we nor anyone else can reasonably identify the individual again. Replacing a name with a reference number is not anonymisation and we do not describe it as such.
14. Security
We use encrypted connections, individual accounts with multi-factor authentication, access limited to those who need it, restricted sharing settings on documents, and documented procedures for handling a security incident.
No online service can guarantee complete security. We assess personal-data breaches and notify the Information Commissioner’s Office and affected individuals where the law requires it.
15. Your rights
You may have the right to ask us for a copy of the personal information we hold about you; to correct information that is inaccurate; to ask us to delete information; to ask us to restrict how we use it; to object to processing we carry out on the basis of legitimate interests; to receive eligible information in a portable format; to withdraw consent where we rely on it; and to complain about how your information has been used.
A parent holding the contract does not remove the student’s own rights. A student may contact us directly about their own information.
Deletion rights are not absolute. Where we must keep information for accounting, legal claims, contractual evidence, safeguarding or compliance, we will tell you what remains and why.
Requests should be sent to [email protected]. We respond within the period required by law, normally one month. We may ask you to confirm your identity first.
16. Complaints
You can complain to us by emailing [email protected] with "Data Protection Complaint" in the subject line, or by writing to us at 321–323 High Road, Chadwell Heath, Essex RM6 6AX. We accept complaints however they reach us.
We will acknowledge your complaint within 30 days of receiving it, investigate without undue delay, and explain the outcome and our reasons.
If you are not satisfied you can complain to the UK Information Commissioner’s Office at ico.org.uk. People living outside the UK may also be able to complain to the data-protection authority in their own country.
17. Changes to this notice
We may update this notice when our services, the law or our processing arrangements change. The version number and effective date show which notice is current. Where a material change affects an existing client we will give appropriate notice.