🎉 Launch promo — Full Access £19.99/year (usually £49.99). Claim before 13 October 2026

Privacy

Privacy Policy.

Last updated: July 2026

1. Who we are (Data Controller)

IMG2NHS ("we", "us") is the data controller for personal data collected through this site, based in London, United Kingdom. Contact our privacy team at privacy@img2nhs.com. This policy is provided under the UK GDPR and Data Protection Act 2018.

2. What we collect

  • Account data: email address, hashed password, sign-in timestamps.
  • Profile data: name, country of training, exam status, visa status.
  • Quiz answers about medical training, exams and immigration.
  • Documents you upload (CV, certificates) to your private vault.
  • Payment metadata from Stripe (last 4 digits, country, status). We never see your full card number.
  • Technical data: IP address, browser, device, referrer, anonymous analytics.

3. How we use your data and lawful basis (UK GDPR Art. 6)

  • Performance of contract — to deliver the membership, your tracker, vault, AI assistant and emails you request.
  • Legitimate interests — to secure the service, prevent fraud, and improve features in aggregate.
  • Consent — for optional analytics cookies and marketing emails. You can withdraw at any time.
  • Legal obligation — to keep tax and accounting records.
We never sell your personal data. We do not share identifiable data with recruiters without your explicit instruction.

4. Processors we use

  • Supabase — database, authentication, file storage (EU region).
  • Stripe Payments UK Ltd — card payments and subscription billing.
  • Resend / our email provider — transactional and notification email delivery.
  • Vercel — hosting, CDN and anonymous analytics.
  • Lovable AI Gateway — large-language-model features in the AI assistant.
Each processor is bound by a data-processing agreement and UK-approved transfer mechanisms (UK IDTA / SCCs) where data leaves the UK or EEA.

5. International transfers

Some of our processors operate outside the UK/EEA (for example, in the United States). Where this happens, transfers are protected by the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or an adequacy decision.

6. Retention

  • Account and profile data: while your account is active, then deleted within 30 days of account deletion.
  • Documents in your vault: deleted immediately when you delete them or close your account.
  • Billing records: retained for 6 years to meet UK HMRC obligations.
  • Anonymous analytics: up to 24 months.

7. Your rights (UK GDPR)

You have the right to: be informed; access your data; rectify inaccurate data; erase your data; restrict processing; data portability; object to processing; and not be subject to solely automated decisions with legal effect. Email privacy@img2nhs.com and we'll respond within one calendar month.

8. Right to complain to the ICO

If you believe we have not handled your data correctly, you can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint or call 0303 123 1113. We'd appreciate the chance to resolve concerns first.

9. Cookies

See our separate Cookie Policy for details and consent controls.

10. Security

Data is encrypted in transit (TLS 1.2+) and at rest. Access is restricted to named team members on a need-to-know basis. Document storage uses signed, expiring URLs.

11. Children

IMG2NHS is intended for adults (18+) and we do not knowingly collect data from children.

12. Changes

We may update this policy. Material changes will be emailed to account holders at least 14 days before they take effect.

13. Contact

Questions? Reach us at privacy@img2nhs.com.