Privacy Policy

1. Who We Are

MedWay is a UK-based medical and dental interview preparation platform. We are the data controller responsible for the personal data we process about you.

Contact Details

We are registered with the Information Commissioner's Office (ICO) as a data controller. If you have any questions about this Privacy Policy or how we handle your personal data, please contact us at the email address above.

2. What Personal Data We Collect

We collect different categories of personal data depending on how you interact with our platform. The table below summarises what we collect, why, the lawful basis we rely on, and how long we keep it.

3. Special Category Data – Voice Recordings

When you use MedWay's practice interview feature, your device microphone may record your voice. The following safeguards apply:

• Consent required: We will ask for your explicit consent before any recording begins. You may withdraw consent at any time by ending the practice session.
• Automated deletion: All voice recordings are automatically and permanently deleted within 24 hours of the recording being made. No manual intervention is required.
• No sharing: Voice recordings are never shared with third parties, sold, or used for any purpose other than allowing you to listen back during your practice session.
• No long-term storage: Voice recordings are not retained beyond the 24-hour automatic deletion window, even if your account remains active.
• Security in transit: All audio data is encrypted in transit using TLS. Recordings are stored temporarily on secure, access-controlled servers.
• Right to withdraw: You may request immediate deletion of a recording before the automated deletion window by contacting us at hello@med-way.uk.

4. How We Use Your Personal Data

We use the personal data we collect for the following purposes:

• Providing the platform: Creating and managing your account, giving you access to interview preparation materials, practice tools, and personalised content.
• Performance tracking: Recording your practice scores, tracking your progress over time, and displaying this information on your personal dashboard.
• Communications: Sending you account-related emails (e.g. registration confirmation, password reset, significant platform updates). We do not send marketing emails without your separate opt-in consent.
• Platform improvement: Analysing aggregated and anonymised usage data to improve the platform, identify bugs, and develop new features.
• Security and fraud prevention: Monitoring for suspicious activity, enforcing our Terms and Conditions, and protecting the integrity of the platform.
• Legal compliance: Meeting our obligations under applicable law, including financial record-keeping and responding to lawful requests from authorities.

5. Lawful Bases for Processing

UK GDPR requires that we identify a lawful basis for every type of processing we carry out. We rely on the following bases:

• Contract (Article 6(1)(b)):

  Processing your account data and performance data is necessary to fulfil our contract with you — providing you with access to the MedWay platform in exchange for the one-time access fee.

• Explicit Consent (Articles 6(1)(a) and 9(2)(a)):

  We rely on your explicit, freely given consent to record your voice. You have the right to withdraw this consent at any time without detriment.

• Legitimate Interests (Article 6(1)(f)):

  We rely on legitimate interests for processing technical and usage data to maintain platform security, diagnose errors, and improve the service. We have conducted a Legitimate Interests Assessment (LIA) to confirm that our interests are not overridden by your rights.

• Legal Obligation (Article 6(1)(c)):

  We are required by law to retain certain financial records (e.g. payment receipts) for a minimum of 7 years to comply with HMRC obligations.

6. Who We Share Your Data With

We do not sell, trade, or rent your personal data. We share data only with trusted third-party processors who assist us in running the platform. All processors are contractually bound by Data Processing Agreements (DPAs) and must process data only on our instructions.

We may also disclose your personal data to law enforcement, regulators, or courts if required to do so by law or a lawful order, or to protect the rights, property, or safety of MedWay, our users, or others.

7. International Data Transfers

We aim to store and process your personal data within the UK or EEA. Where any of our third-party processors are located outside the UK or EEA (for example, in the United States), we ensure that appropriate safeguards are in place, including:

• UK Adequacy Regulations (for transfers to countries the ICO has deemed adequate);
• International Data Transfer Agreements (IDTAs) — the UK equivalent of Standard Contractual Clauses; or
• Binding Corporate Rules (BCRs) where applicable.

Details of the specific safeguards in place for each international transfer are available on request by emailing hello@med-way.uk.

8. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes set out in this Policy, or as required by law. Our standard retention periods are:

• Voice recordings: Automatically deleted within 24 hours of recording.
• Account data (name, email): Retained for the duration of your account plus 2 years after deletion, to handle any post-cancellation queries.
• Performance and analytics data: Retained for the duration of your account plus 2 years after deletion.
• Payment records: Retained for 7 years to comply with HMRC financial record-keeping requirements.
• Communications / support data: Retained for 3 years.
• Usage / technical data (logs, IP addresses): Retained for up to 2 years.

When retention periods expire, data is securely deleted or anonymised. If you delete your account, we will action this promptly; however, certain data may be retained for the periods above where we have a legal obligation to do so.

9. Your Rights Under UK GDPR

You have the following rights in relation to your personal data. To exercise any of these rights, please contact us at hello@med-way.uk. We will respond within one calendar month, as required by UK GDPR.

• Right of access (Article 15):

  You have the right to request a copy of the personal data we hold about you and information about how we use it.

• Right to rectification (Article 16):

  You have the right to ask us to correct any inaccurate or incomplete personal data we hold about you.

• Right to erasure / 'right to be forgotten' (Article 17):

  You have the right to request deletion of your personal data where: it is no longer necessary for the purposes for which it was collected; you withdraw consent and there is no other lawful basis; you object to processing and we have no overriding legitimate grounds; or the data has been unlawfully processed. Note: some data may be retained where required by law.

• Right to restriction of processing (Article 18):

  You have the right to request that we restrict the processing of your data in certain circumstances, for example while accuracy is being contested.

• Right to data portability (Article 20):

  Where processing is based on your consent or a contract, and is carried out by automated means, you have the right to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller.

• Right to object (Article 21):

  You have the right to object to processing based on legitimate interests at any time. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

• Right to withdraw consent:

  Where we rely on your consent (including for voice recordings), you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

• Right not to be subject to automated decision-making:

  You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal or similarly significant effects. We do not currently use automated decision-making of this kind.

10. How We Protect Your Data

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, accidental loss, alteration, or disclosure. These include:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
• Encryption at rest: Sensitive data (including account credentials and any temporarily stored voice recordings) is encrypted at rest.
• Access controls: Access to personal data is restricted on a need-to-know basis and protected by strong authentication.
• Automatic deletion: Voice recordings are subject to automated deletion within 24 hours — a technical control, not a manual process.
• Secure payment handling: Payment card data is handled exclusively by our PCI DSS-compliant payment processor. We never store full card numbers.
• Regular reviews: We review our security practices regularly and update them in response to new threats and ICO guidance.

While we take every reasonable precaution, no method of transmission or storage over the internet is completely secure. If you believe your account has been compromised, please contact us immediately at hello@med-way.uk.

11. Data Breaches

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the ICO within 72 hours of becoming aware of the breach, as required by UK GDPR Article 33;
• Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, as required by Article 34;
• Take immediate steps to contain the breach and mitigate harm;
• Document all breaches in our internal breach register, regardless of whether notification is required.

12. Children's Privacy

Our Services are not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. Users aged 13–17 are able to use the platform but we recommend parental awareness of our data practices.

If you believe that a child under 13 has provided us with personal data without parental consent, please contact us at hello@med-way.uk and we will take immediate steps to delete that information.

13. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our Website. For full details of the cookies we use, the purposes they serve, and how to control them, please see our Cookie Policy, available at med-way.uk.

In summary: strictly necessary cookies are set automatically; analytics cookies require your prior consent through our Cookie Consent Manager. We do not use cookies for targeted advertising.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, legal obligations, or ICO guidance. When we make material changes, we will notify you by email and/or by displaying a prominent notice on our Website before the change takes effect.

The date at the top of this Policy indicates when it was last updated. We encourage you to review this Policy periodically. Continued use of our Services after a material change constitutes acceptance of the updated Policy.

15. How to Contact Us and Your Right to Complain

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will do our best to resolve any concerns promptly. However, if you are not satisfied with our response, or believe we are not processing your personal data in accordance with UK GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

You also have the right to apply to the courts for a remedy if you believe we have infringed your data protection rights.