Privacy Policy — Medvancer

This Privacy Policy explains how Medvancer ("we", "us", "our") collects and uses personal data when you visit medvancer.com or use our mentorship services. Medvancer is operated as a sole trader under the trading name "Medvancer". We are the data controller for the personal data described below.

1. Who we are

Trading name: Medvancer
Contact email: medvancer@gmail.com
Postal address: available on request by email (a registered business address will be published here shortly).

2. What personal data we collect

Account & booking data: name, email address, and (where you create an account) your login credentials.
Programme data: the programme you booked, session dates, and any notes you provide.
Personal statement submissions: the document you upload for review, plus any related context you share.
Payment data: processed by Stripe. We receive confirmation of payment and the last 4 digits of your card — we never see or store your full card details.
Communications: emails you send to us and our replies.
Technical data: IP address, browser type and basic session data needed to keep the site secure and working.

3. How we use your data and our lawful basis

To deliver the service you booked (contract): scheduling sessions, reviewing your personal statement, sending confirmations and reminders.
To take payment (contract): via Stripe.
To manage your account (contract): login, subscription management, booking history.
To keep the site secure (legitimate interests): preventing abuse and fraud.
To comply with legal obligations: for example tax and accounting records.

We do not sell your data and we do not use it for advertising or profiling.

4. Who we share your data with

We only share data with the following processors, and only as needed to run the service:

Stripe — payment processing.
Lovable Cloud — hosting, database, authentication and file storage.
Email delivery provider — for transactional emails (booking confirmations, review notifications, magic links).

Some of these providers may process data outside the UK. Where they do, transfers are covered by appropriate safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum.

5. How long we keep your data

Account and booking records: for as long as your account is active, plus up to 7 years afterwards for tax and accounting purposes.
Personal statement uploads: kept for up to 12 months after the review is delivered, then deleted. You can request earlier deletion.
Email correspondence: up to 3 years.

6. Your rights

Under UK GDPR you have the right to:

Access the personal data we hold about you.
Correct data that is inaccurate or incomplete.
Ask us to delete your data (subject to legal retention obligations).
Restrict or object to certain processing.
Receive a copy of your data in a portable format.
Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email medvancer@gmail.com. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

7. Under 18s

Our services are aimed at students aged 16 and above. If you are under 18, please make sure a parent or guardian is aware you have signed up. We may ask for parental consent for certain activities, in particular one-to-one online sessions.

8. Cookies

We only use cookies that are strictly necessary for the site to work: keeping you logged in, remembering your booking during checkout, and enabling secure payment through Stripe. We do not use analytics, tracking, or advertising cookies, so no cookie banner is required.

9. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top will reflect any changes. Material changes will be communicated by email where appropriate.