Privacy Policy

MedAdmit is a trading name of Jayden Sammut, a sole trader ("we", "us"), and we are the data controller for the personal data described in this policy. Contact address: 128 Tiverton Road, Birmingham B29 6BT.

For anything about your data, including any of the rights in section 8, email hello@medadmit.co.uk. We do not have a Data Protection Officer; we are not required to appoint one, and that email reaches the person who decides these things.

This policy explains how we handle your personal data under UK GDPR and the Data Protection Act 2018.

Account and contact details: your name, email address, phone number where you give it, and a profile photo if you upload one.

Payment details: a Stripe payment reference, the amount, and any discount code you used. Payments are handled entirely by Stripe. We never see or store your card number.

Consent records: which version of our Terms you agreed to, what you agreed to, the time you agreed, and your IP address and browser user agent at that moment. We collect the last two deliberately, as corroboration that the person who ticked the box was you, because a refund dispute can turn on it.

Programme data: your mock scores, target score and test date, error log entries, revision plans and report cards, attendance and content-completion records, and anything you submit as part of your preparation.

Messages you send us: the contents of the programme chat, which is where support is provided.

Optional details when you create an account: your UCAT total (out of 2700, without Abstract Reasoning) and the course you are interested in, if you choose to enter them, and the campaign name in the link you first arrived from, for example a social media post. From your UCAT total we also store a band: low, mid or high.

Cut-off alerts and interview programme news, where you ask for them: your email address.

Personal statement reviews, where you buy one: the full text of your three UCAS answers, your name, the course and universities you are applying to, and any notes you add. Section 4 explains how we treat this, because personal statements often say more about you than the rest of this list put together.

UCAT result confirmation, where you make a Score Guarantee refund claim.

Seminar recordings, which may include your voice and image. See section 7.

To deliver your programme, build your revision plans, answer your messages, review your personal statement and operate the Score Guarantee. Lawful basis: performance of our contract with you.

To send you service messages about the programme you bought, such as your password link, your plans and your confirmation. Lawful basis: performance of our contract with you.

To keep records of what you agreed to and when. Lawful basis: our legitimate interest in being able to show what was agreed, and in defending a claim. We have weighed this against your interests and concluded that a short, factual record of a consent you gave is what a fair process looks like from both sides.

To send marketing, only where you have given consent, and only until you withdraw it.

For site analytics and advertising measurement, only where you accept in the cookie banner. Lawful basis: consent. Section 9 explains what runs and what does not.

To make the site and our emails relevant to you: to show you the schools and content that suit your course, and, only where you ticked the marketing box, to group the emails we send you by your optional UCAT band, course and the link you arrived from. Lawful basis: our legitimate interest in being relevant, and, for the emails themselves, your consent.

To send cut-off alerts, or to tell you when pre-booking opens for the interview programme, only where you ask for them and confirm by clicking the link in the confirmation email we send first. Lawful basis: consent.

To meet legal obligations, such as keeping financial records. Lawful basis: legal obligation.

We do not make any decision about you by automated means alone. Apart from grouping marketing emails as described above, we do not profile you.

A personal statement is not ordinary contact data. People write about illness, disability, bereavement, caring for a relative, their religion, their ethnicity and their family circumstances, because those are often the honest answer to why they want to study medicine. Some of that is special category data under Article 9 of the UK GDPR, which needs a stronger justification than the rest of this policy.

Where your statement contains special category data, our condition for processing it is your explicit consent, given when you send it to us to be reviewed. You do not have to include any of it. The review works on what you send, and nothing about the service requires you to disclose anything sensitive.

We use it only to write your review. We do not use personal statements to train anything, we do not use them as examples, and we do not show them to anyone outside MedAdmit.

You can withdraw your consent and ask us to delete your statement at any time, including after the review has been sent. Withdrawing does not affect the lawfulness of what we did before you withdrew, and it does not entitle you to a refund for a review already delivered.

The same applies to anything sensitive you tell us in the programme chat.

We use these processors to run the service: Stripe (payments), Supabase (your account, programme data and messages), Vercel (hosting), Brevo (email), Bunny (video delivery), and Medify or MedEntry where you choose to link your mock results.

Where you have accepted analytics and advertising cookies, Google (Google Analytics) and Meta (the Meta Pixel) also receive data about your use of this site. If you have not accepted, Google Analytics runs without cookies or identifiers and the Meta Pixel does not load at all. See section 9.

We use a Google Sheets webhook to run our email sequences, which receives your name and email address.

We do not sell your data, and we do not share it for anyone else's marketing.

Some of these providers process data outside the UK. Where they do, we rely on UK adequacy regulations or on the International Data Transfer Addendum to the EU Standard Contractual Clauses.

We may also disclose data where the law requires it, or to establish or defend a legal claim.

Financial records: 6 years, as tax law requires.

Consent records, including the IP address and user agent attached to them: 6 years, to match the period in which a claim about a purchase could be brought.

Programme and Score Guarantee data: 5 years, so that a refund or Guarantee claim can be handled.

Personal statements and their reviews: 12 months after the review is sent, then deleted. They are kept that long because applicants come back after an unsuccessful cycle, and no longer because there is no reason to hold them.

Programme chat messages: for the duration of your programme and 5 years afterwards, on the same basis as programme data.

Seminar recordings: until the end of the testing window they belong to, then deleted.

Marketing contacts: until you withdraw consent or ask to be removed.

After these periods we delete the data or anonymise it so it can no longer identify you.

Live seminars are recorded so that students who miss a session can catch up, and the recordings are made available in the members area to students on that programme.

A recording may include your voice, your image if your camera is on, and anything you type in the session chat. Our lawful basis is performance of our contract with the students the recording is made available to, and our legitimate interest in providing a catch-up service.

You do not have to appear. Tell us before a session and we will keep you off camera and audio, and you can attend with your camera and microphone off at any time without telling us.

Our Terms prohibit students from recording, screenshotting or sharing any part of a session, which protects your privacy as much as our materials.

You have the right to ask us for a copy of your data, to correct it, to delete it, to restrict how we use it, to object to our use of it, and to receive it in a portable format.

Where we rely on your consent, including for marketing, for analytics cookies and for anything sensitive in a personal statement, you have the right to withdraw that consent at any time. Withdrawing is as easy as giving it: email us and we will act on it.

To exercise any of these, email hello@medadmit.co.uk. We will respond within one month. There is no charge.

You can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would rather you came to us first so we can put it right, but nothing here requires you to.

This site uses essential cookies required for it to function: your session, your login and security. These do not require consent and cannot be turned off without breaking the site.

It also uses Google Analytics (GA4). Until you accept in the cookie banner, Google Analytics runs in a consent-denied mode: it sets no cookies, stores no identifiers on your device, and reports only anonymous, aggregated traffic.

Where you accept analytics, we also measure a small number of actions on the site, such as that someone created an account, saved a school to a shortlist, or used the school checker. For the checker we record only the course and a band for your UCAT (low, mid or high), never the score itself and never your name or email address.

If you arrive through a campaign link, we remember the name of that campaign in your browser so it can be recorded when you create an account: for the length of your visit if you have not accepted analytics, and until you clear it if you have. If you choose to create an account from the school checker, your entries are held in your browser for the length of your visit so they are still there when you return, and are then deleted.

The Meta Pixel, which we use to measure advertising, sets cookies as soon as it loads and therefore does not load at all unless you accept.

You can change your choice at any time by clearing your browser's site data for medadmit.co.uk and reloading.

Most people preparing for the UCAT are 16 to 18, and we have built for that rather than pretending otherwise.

If you are under 18, section 4 of our Terms requires a parent or guardian to agree to them and to make the purchase, and we treat them as the person contracting with us. A parent or guardian can exercise any of the rights in section 8 on your behalf, and so can you.

We do not knowingly collect data from anyone under 13, and we do not offer our services to them.

We ask for no more than the service needs at any age, and nothing in a personal statement has to be sensitive for the review to be useful.

This policy carries a version number and a date, both shown at the top of the page, and they move together whenever it changes in substance.

Where a change materially affects how we use data we already hold about you, we will tell you by email rather than relying on you to re-read the page.