The short version
- We collect what you tell us (enquiries, account, bookings) and nothing more.
- Card details go to Stripe; we never see them.
- No advertising or tracking cookies. Visit counting is anonymous and cookie-free.
- We never sell your data or add you to marketing lists.
- You can ask for a copy, a correction or deletion any time: hello@cesrcoach.com.
- Questions about the sign-up or booking terms? See the Terms of Service.
1. Who we are
This policy explains how CESR Coach (“we”, “us”), trading as CESR Coach, looks after your personal data when you use cesrcoach.com and our member area. We are the “controller” of that data, which means we decide how and why it is used.
- Based in the United Kingdom
- Privacy contact: hello@cesrcoach.com
We follow the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). Where you are in the European Economic Area, the EU GDPR applies in the same way. We do not have a Data Protection Officer, because the law does not require one for an organisation of our kind; the contact above handles all data questions.
This policy covers this website only. Our sister app CESR Companion is a separate service with its own privacy notice.
2. What we collect
We collect only what we need, and only from the places listed here.
When you send us a question (the “Talk to us first” form)
- Your name, email address and your question.
- Optionally: phone number, specialty and where you are in the CESR process.
When you create an account
- Your name and email address, and a password.
- Your password is handled by our authentication provider and stored only in scrambled (hashed) form. We cannot read it.
- Optional profile details you choose to add: phone number, specialty, GMC number, a link to your portfolio, a note about it, and your planned GMC submission date.
When you book a session
- Which session you booked, its status, any notes you add, and the portfolio link you share with your reviewer.
- The written feedback your reviewer leaves for you, and private administrative notes our team keeps about the booking.
- Payment details: the amount, any discount code used, payment status and Stripe reference numbers. Your card details go straight to Stripe. We never see or store them.
When you simply visit
- Anonymous visit counting. We count visits without cookies. Each time a page loads, our server combines your IP address and browser details with a secret code that is replaced every day, and turns the result into a one-way code. The IP address and browser details are not stored, and because the secret changes daily, the code cannot be used to recognise you on another day. We keep the code, the date and the page visited, nothing else. We do not count visits made with Do Not Track or Global Privacy Control switched on, or by our own administrators when signed in.
- Our hosting provider keeps routine technical logs (such as IP address and browser type) for security and to keep the site running.
What we do not collect
We do not ask for health information, patient information, your immigration status, or any payment card number. Please see section 11 about what to leave out of portfolio material.
3. Why we use your data, and our legal basis
The law requires us to have a valid reason (a “lawful basis”) for each use of your data. These are ours:
| What we do | Data involved | Lawful basis |
|---|---|---|
| Answer your question before you book | Enquiry form details | Taking steps at your request before a contract (Art. 6(1)(b)); our legitimate interest in replying (Art. 6(1)(f)) |
| Create and run your account; give you access to videos, documents and your dashboard | Account and profile data | Performing our contract with you (Art. 6(1)(b)) |
| Take bookings and payment, run sessions, share reviewer feedback | Booking, portfolio link, payment and feedback data | Performing our contract with you (Art. 6(1)(b)) |
| Send service emails: sign-up confirmation, password reset, booking confirmations and changes | Name, email, booking details | Performing our contract with you (Art. 6(1)(b)) |
| Keep accounting and tax records | Payment and booking records | Legal obligation (Art. 6(1)(c)) |
| Keep the service secure, prevent spam and abuse, and fix faults | Technical logs, enquiry email address (to limit repeat messages) | Legitimate interests (Art. 6(1)(f)): running a safe service |
| Understand how many people use the site | Anonymous daily codes and page names | Legitimate interests (Art. 6(1)(f)). This does not involve cookies or information that identifies you. |
| Respond to legal claims or requests from authorities | Whatever is relevant | Legal obligation or legitimate interests |
We do not send marketing emails, we do not add anyone to a mailing list, and we do not sell or rent personal data. If that ever changes, we will ask for your consent first and you will be able to withdraw it at any time.
Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can object at any time (see section 9).
6. Transfers outside the UK
Our main database is in the EU, which the UK recognises as providing adequate protection. Some providers (for example Stripe) may process data in other countries, including the United States. When that happens we make sure a lawful safeguard applies, such as a UK adequacy decision, the UK's International Data Transfer Addendum or standard contractual clauses. You can ask us for details using the contact above.
7. How long we keep data
| Data | Kept for |
|---|---|
| Enquiries (name, email, question) | Up to 12 months after our last reply, unless you go on to create an account |
| Account, profile, portfolio link and reviewer feedback | While your account is open. If you ask us to delete it we do so within 30 days, except for records we must keep by law. |
| Payment and booking records | 6 years from the end of the financial year, as UK tax and accounting rules require |
| Anonymous visit counts | Kept as anonymous statistics; they cannot be linked back to you |
| Hosting and security logs | A short period set by our hosting provider |
After these periods we delete the data or remove everything that could identify you.
8. How we protect your data
- The whole site is served over HTTPS (encrypted in transit).
- Access rules in the database mean members can see only their own bookings and profile; administrator access is limited to our team.
- Passwords are never stored in readable form, and card details never reach our systems.
- Documents in the member library are shown in a protected viewer and are not available to the public.
No system is perfectly secure. If a breach is likely to put your rights at risk, we will tell you and the Information Commissioner's Office (ICO) without undue delay, as the law requires.
9. Your rights
You have the right to:
- be informed about how we use your data (this policy);
- access a copy of the personal data we hold about you;
- correct anything that is wrong or incomplete (you can edit most of it yourself in your profile);
- erase your data, in many cases;
- restrict how we use your data while a dispute is looked into;
- data portability: receive the data you gave us in a common, machine-readable format;
- object to uses based on legitimate interests;
- withdraw consent where we rely on it, at any time.
We do not make decisions about you using solely automated processing or profiling that has legal or similarly significant effects.
To use any of these rights, email hello@cesrcoach.com. There is no charge. We will reply within one month (we may extend this by up to two further months for complex requests, and will tell you if so). We may need to confirm your identity first, to avoid giving your data to someone else.
Complaints
We would like the chance to put things right first, so please contact us. You also have the right to complain to the UK Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113. If you are in the EU/EEA you can instead contact your local data protection authority.
10. Providing your data
You do not have to give us any personal data, but we cannot answer an enquiry without a name and email address, or run an account or booking without the details marked as required. Phone number, specialty, GMC number and portfolio notes are optional unless a particular session needs your portfolio link (our portfolio clinics do).
11. Portfolio material and patient information
Portfolios often contain case descriptions. Please make sure anything you share with us or a reviewer is fully anonymised: no patient names, dates of birth, NHS numbers, addresses, or details that could identify a patient, colleague or employer. You remain responsible for meeting your professional duties of confidentiality (for example under GMC guidance). If you accidentally share identifiable information, tell us straight away so that we can remove it.
The portfolio link you share is used only so your reviewer can read it for your session. We do not copy it or keep a copy of its contents.
12. Children
Our services are for doctors and other adults. We do not knowingly collect data from anyone under 18. If you think a child has given us personal data, contact us and we will delete it.
13. Changes to this policy
We will update this page when our practices change and show the date at the top. If a change affects how we use your data in a significant way, we will tell you by email or a notice on the site before it takes effect.
Questions about this page? Write to hello@cesrcoach.com or use our contact form. See also our Terms of Service.