Privacy Policy

MedPath-Wales ("MedPath-Wales", "we", "us" or "our") provides educational resources, revision materials and tutoring services designed for WJEC students and aspiring medicine applicants.

This Privacy Policy explains how we collect, use, store and protect personal information when you use the MedPath-Wales website, create an account, access educational resources, participate in webinars, book tutoring or otherwise interact with our services.

We are committed to protecting your privacy and handling personal information responsibly in accordance with UK GDPR and the Data Protection Act 2018.

MedPath-Wales is operated by Thomas Joyner.

For the purposes of applicable UK data protection law, Thomas Joyner is responsible for determining how and why personal information is processed through the MedPath-Wales website and services.

If you have any questions about how your personal information is collected, used or protected, or if you wish to exercise your data protection rights, please contact:

Email: Support@medpath-wales.co.uk

3.1 Information you provide to us

• Your name;
• Your email address;
• Your date of birth;
• Account credentials, including your password in securely protected form;
• Information you provide when contacting us;
• Information associated with your use of our educational services.

3.2 Information relating to bookings and purchases

• Your name and email address;
• Information relating to your booking and assigned tutor;
• Payment and transaction information;
• Your Stripe payment or Checkout reference;
• Information required to provide access to your tutoring session or digital resources.

3.3 Payment information

Payments for digital resources and tutoring are processed securely through Stripe. We do not receive or store full payment-card details on our servers. We receive payment status, transaction amount, payment reference, and Stripe Checkout information necessary to confirm and fulfill your order.

3.4 Information collected automatically

• IP address;
• Browser type and version;
• Device type and operating system;
• Pages visited and date and time of access;
• Website interaction, diagnostic, security and performance information.

• Creating and maintaining your account;
• Authenticating your account and allowing you to sign in;
• Providing access to digital educational resources and revision materials;
• Managing tutoring bookings and access to sessions;
• Providing webinars and other educational services;
• Processing and confirming payments;
• Communicating account-related emails, booking confirmations, and password resets;
• Protecting our platform, detecting fraud, and enforcing our terms.

Marketing communications: We may send marketing emails about resources, tutoring, webinars, and updates where we have a lawful basis to do so. You can unsubscribe at any time.

Depending on the circumstances, we rely on performance of a contract, consent, legitimate interests, and compliance with legal obligations as our lawful bases for processing personal information under UK GDPR.

MedPath-Wales is designed for students and may be used by individuals under the age of 18. We recognise that children and young people require particular consideration when their personal information is processed. If a user is under 13 years old, parental or guardian authorization is required before booking sessions, creating an account, or joining the mailing list.

We aim to collect only the information strictly necessary to provide our services. We do not profile students for advertising purposes or sell personal information.

Safeguarding & DBS Data Processing: We process tutor DBS verification records and safeguarding incident logs where necessary to comply with statutory legal obligations and protect the vital interests of students. Safeguarding notes or reports are restricted to authorized personnel (Thomas Joyner) and retained strictly in accordance with statutory safeguarding guidance.

1-to-1 tutoring sessions provided through MedPath-Wales are not routinely recorded. In exceptional circumstances where a recording is made for safeguarding or technical reasons, participants will be notified.

Some webinars or educational group sessions may be recorded for playback. Where a webinar is recorded, participants will receive appropriate information before recording begins.

We do not sell or rent your personal information.

We share information with trusted service providers strictly necessary to operate MedPath-Wales:

• Supabase — account authentication, database storage, and related technical infrastructure;
• Stripe — secure payment processing for digital products and tutoring;
• Google Meet — online tutoring sessions, meetings, and webinars;
• Brevo — transactional communications, password resets, booking confirmations, and marketing emails;
• Hosting, security, and technical providers where reasonably necessary.
• Independent Tutors & Subcontractors - relevant booking details (e.g., student name, academic topic, session time) are shared with assigned self-employed tutors solely for delivering tutoring services.

MedPath-Wales may operate social-media channels including YouTube, Instagram, and TikTok. If you interact with these accounts, the relevant platform processes your information under its own privacy policy.

Some of our service providers (e.g., Supabase, Stripe, Brevo) may process or store personal information outside the United Kingdom. Where this occurs, we ensure appropriate safeguards are in place (such as UK International Data Transfer Agreements or adequacy decisions) to protect your data.

We retain personal information only for as long as reasonably necessary:

• Account information is retained while your account is active and for a reasonable period thereafter;
• Financial, billing, and order transaction records are retained for 6 years post-transaction to comply with UK tax (HMRC) record-keeping obligations.
• Marketing preferences are retained to ensure opt-out choices are respected;
• Technical and security logs are retained for fraud prevention and system maintenance.

We implement reasonable technical and organisational measures—including access controls, encrypted connections, and restricted database permissions—to safeguard your personal data against unauthorised access, alteration, or loss.

MedPath-Wales uses essential cookies for account authentication, security, and session management (such as keeping you logged in via Supabase and processing payments securely via Stripe). Because these cookies are strictly necessary to deliver our services, they do not require consent. We do not use non-essential tracking or advertising cookies.

Under UK data protection law, you have the right to:

• Access the personal information we hold about you;
• Request correction of inaccurate or incomplete information;
• Request deletion or restriction of processing in certain circumstances;
• Object to processing based on legitimate interests;
• Withdraw consent at any time where processing is based on consent;

If you have concerns about how MedPath-Wales handles personal information, please contact us first so we can address your issue: