Last Updated: 1 January 2025
MedoraGP ("we", "us", "our", or "the Platform") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our learning management system in compliance with the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and the Data Protection Act 2018.
Data Controller: MedoraGP is the data controller responsible for your personal data. Our contact details are provided in Section 13 of this Privacy Policy.
Please read this Privacy Policy carefully. By using the Platform, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described herein, where consent is the legal basis for processing.
We collect personal information that you provide directly to us, including:
We collect information related to your educational activities:
When you use the Platform, we automatically collect certain information:
We may receive information from third-party services:
Under UK GDPR and EU GDPR, we must have a legal basis for processing your personal data. We use the collected information for the following purposes and legal bases:
Where we rely on legitimate interest, we have balanced our interests against your rights and freedoms and determined that our legitimate interests do not override your fundamental rights. You have the right to object to processing based on legitimate interest (see Section 8).
We do not sell your personal information. We may share your information in the following circumstances:
We share information with trusted third-party service providers who assist in operations:
We may disclose information if required by law, court order, or government regulation, or to:
In the event of a merger, acquisition, or sale of assets, your information may be transferred to the acquiring entity.
We may share your information in other ways with your explicit consent.
We implement appropriate technical and organizational security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:
However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.
We use cookies and similar tracking technologies to enhance your experience on the Platform:
You can control cookies through your browser settings. However, disabling certain cookies may limit Platform functionality. We also use HTTP-only cookies for secure session management.
We retain your personal information for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law:
When data is no longer needed, we will securely delete or anonymize it in accordance with our data retention policies.
If you are located in the UK or European Economic Area (EEA), you have the following rights under UK GDPR and EU GDPR regarding your personal data:
You have the right to obtain confirmation as to whether we process your personal data and to access your personal data, including a copy of the data we hold about you.
You have the right to have inaccurate personal data corrected and incomplete personal data completed. You can update your personal information through your account settings or by contacting us.
You have the right to request deletion of your personal data in certain circumstances, including when the data is no longer necessary, you withdraw consent, or the data has been unlawfully processed. This right is subject to legal and operational requirements (e.g., we may need to retain certain data for legal compliance or to fulfill our contract with you).
You have the right to request restriction of processing in certain circumstances, such as when you contest the accuracy of data or object to processing.
You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another controller, where technically feasible.
You have the right to object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
You have the right to lodge a complaint with a supervisory authority if you believe we have violated data protection laws. In the UK, this is the Information Commissioner's Office (ICO) atico.org.uk. In the EU, you can contact your local data protection authority.
Exercising Your Rights:
To exercise any of these rights, please contact us using the information provided in Section 13. We will respond to your request within one month (this may be extended by two months for complex requests). We may need to verify your identity before processing your request. In most cases, there is no charge for exercising your rights, though we may charge a reasonable fee if requests are manifestly unfounded or excessive.
The Platform is not intended for users under the age of 16 in the UK and EEA (or the minimum age of digital consent in your jurisdiction, which may be 13-16 years depending on the country). We do not knowingly collect personal information from children without appropriate parental consent.
If you are under 16 (or the applicable minimum age in your jurisdiction), you must have your parent's or guardian's consent to use the Platform. If we become aware that we have collected personal data from a child without appropriate consent, we will take steps to delete that information promptly.
If you are a parent or guardian and believe we have collected information from your child without consent, please contact us immediately using the details provided in Section 13.
Your information may be transferred to and processed in countries outside the UK and European Economic Area (EEA). These countries may have data protection laws that differ from UK GDPR and EU GDPR.
10.1 Adequacy Decisions: We may transfer your data to countries that have been deemed to provide an adequate level of data protection by the UK government or European Commission (e.g., countries with adequacy decisions).
10.2 Appropriate Safeguards: Where we transfer data to countries without adequacy decisions, we implement appropriate safeguards as required by UK GDPR and EU GDPR, including:
10.3 Third-Party Processors: When we use third-party service providers (e.g., Stripe, cloud hosting providers) that process data outside the UK/EEA, we ensure they have appropriate safeguards in place and comply with UK GDPR and EU GDPR requirements.
10.4 Your Rights: You have the right to obtain information about the safeguards we have put in place for international transfers. Please contact us using the details in Section 13 if you would like more information.
The Platform may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to third-party websites or services. We encourage you to review the privacy policies of any third-party sites or services you access through our Platform.
Stripe: Payment processing is handled by Stripe. When you make a payment, Stripe collects and processes your payment information in accordance with their privacy policy. We do not store your complete payment card information on our servers.
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by posting the updated policy on the Platform and updating the "Last Updated" date. Your continued use of the Platform after such changes constitutes acceptance of the updated Privacy Policy. We encourage you to review this Privacy Policy periodically.
If you have questions, concerns, or requests regarding this Privacy Policy, our data practices, or wish to exercise your data protection rights, please contact us:
MedoraGP
Data Controller
Email: [email protected]
Address: Your UK Business Address
Phone: +44 XXXX XXXXXX
UK Supervisory Authority:
Information Commissioner's Office (ICO)
Website: ico.org.uk
Phone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom
This Privacy Policy is designed to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you are located in the UK, your rights are set out in Section 8 above. You have the right to lodge a complaint with the UK's supervisory authority, the Information Commissioner's Office (ICO), at ico.org.ukor by calling 0303 123 1113.
This Privacy Policy is designed to comply with the EU General Data Protection Regulation (EU GDPR). If you are located in the European Economic Area (EEA), your rights are set out in Section 8 above. You have the right to lodge a complaint with your local data protection authority. A list of EU data protection authorities can be found at edpb.europa.eu.
If we are required to appoint a Data Protection Officer (DPO) under GDPR, we will provide their contact details here. Currently, for data protection inquiries, please contact us using the details provided in Section 13.
We do not use automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you. If this changes, we will update this Privacy Policy and provide you with information about the logic involved and the significance and consequences of such processing.
We do not intentionally collect special categories of personal data (sensitive personal data) as defined in Article 9 of GDPR (e.g., health data, biometric data, data revealing racial or ethnic origin). If you provide such information voluntarily, we will process it only with your explicit consent or as otherwise permitted by law.
By using MedoraGP, you acknowledge that you have read and understood this Privacy Policy and consent to the collection, use, and disclosure of your information as described herein.