Last updated: 27 July 2026
1. Introduction and Scope
1.1 We are GP PATHWAY LTD with Company number: 16830636 and registered office address at 1st Floor, 1-9 Castle Street, Hinckley, United Kingdom, LE10 1DA (hereinafter referred to as “GPPathway”). This Privacy Policy explains how GPPathway (“we“, “us“, or “our“) collects, uses, stores, and protects your personal data when you use our website located at https://gppathway.com (“Website“) and our online educational platform (“Platform“).
1.2 We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (“UK GDPR“) and the Data Protection Act 2018 (“DPA 2018“).
1.3 This Privacy Policy applies to all users of the Website and Platform, including visitors, registered users, and purchasers of our educational materials.
1.4 By using the Website or Platform, you acknowledge that you have read and understood this Privacy Policy. We process your personal data on the lawful bases set out in clause 5, principally performance of a contract and our legitimate interests. We do not rely on cookie consent, as we only use strictly necessary cookies (see clause 6). Where we do process any personal data on the basis of your consent, for example where you agree to a particular form of data sharing under clause 9.4(a), we will seek that consent separately and you may withdraw it at any time.
1.5 This Privacy Policy should be read in conjunction with our Website Terms and Conditions.
2. Who We Are (Data Controller)
2.1 For the purposes of the UK GDPR and DPA 2018, the data controller is:
GPPathway
Website: https://gppathway.com
2.2 As the data controller, we are responsible for deciding how and why your personal data is processed.
2.3 If you have any questions about this Privacy Policy or how we handle your personal data, please contact us using the details provided in clause 14.
3. What Personal Data We Collect
3.1 We may collect and process the following categories of personal data about you:
3.1(a) Identity and Contact Information, including:
(i) Full name;
(ii) Email address;
(iii) Phone number;
(iv) Professional role (e.g., GP trainee, educator, deanery lead, or other);
(v) Training programme details (where you choose to provide this information).
3.1(b) Account and Access Information, including:
(i) Username and password (encrypted);
(ii) Account preferences and settings;
(iii) Purchase history and payment status;
(iv) Access period and subscription status.
3.1(c) Platform Usage Data, including information about your use of the Platform such as:
(i) Educational materials accessed;
(ii) Questions attempted and progress tracking;
(iii) Time spent on the Platform;
(iv) Features used; and
(v) User interaction data.
3.1(d) Technical and Device Data, including:
(i) IP address;
(ii) Browser type and version;
(iii) Device type and operating system;
(iv) Time zone setting and location data (derived from IP address);
(v) Referring website or source;
(vi) Pages viewed and navigation paths;
(vii) Cookie identifiers associated with the strictly necessary cookies described in clause 6.
3.1(e) Communications Data, including:
(i) Records of correspondence if you contact us by email or through the Website;
(ii) Feedback, surveys, or reviews you provide;
(iii) Support queries and responses.
3.2 Special Category Data: We do not intentionally collect special category personal data as defined under Article 9 UK GDPR, including data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic data, biometric data, health data, or data concerning sex life or sexual orientation.
3.3 Children: Our services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child, we will delete it promptly.
4. How We Collect Personal Data
4.1 We collect personal data through the following methods:
4.1(a) Direct Interactions, including:
(i) When you create an account on the Platform;
(ii) When you make a purchase;
(iii) When you contact us for support or enquiries;
(iv) When you subscribe to newsletters or updates with your consent only;
(v) When you provide feedback or participate in surveys.
4.1(b) Automated Technologies, including:
(i) Through strictly necessary cookies when you browse the Website (see clause 6);
5. Purposes and Lawful Bases for Processing
5.1 We process your personal data only where we have a lawful basis to do so under Article 6 UK GDPR.
5.2 The following clauses set out the purposes for which we process your personal data and the corresponding lawful bases:
5.2(a) Account Creation and Management
Purpose: To create and maintain your user account, authenticate your identity, and provide access to the Platform.
Lawful Basis:
(i) Performance of a contract (Article 6(1)(b) UK GDPR) – processing is necessary to perform our contractual obligations to provide you with access to educational materials; and
(ii) Legitimate interests (Article 6(1)(f) UK GDPR) – maintaining secure user accounts and preventing unauthorised access.
5.2(b) Processing Purchases and Payments
Purpose: To process your purchase of educational materials, verify payment, and grant access to content.
Lawful Basis: Performance of a contract (Article 6(1)(b) UK GDPR) – processing is necessary to complete the transaction and deliver the services you have purchased.
5.2(c) Delivering Educational Content
Purpose: To provide access to exam preparation materials, track your progress, save your work, and deliver a personalised learning experience.
Lawful Basis: Performance of a contract (Article 6(1)(b) UK GDPR) – processing is necessary to provide the educational services you have purchased.
5.2(d) Customer Support and Communications
Purpose: To respond to your enquiries, provide technical support, and communicate with you about your account or our services.
Lawful Basis:
(i) Performance of a contract (Article 6(1)(b) UK GDPR) – where support relates to services you have purchased; or
(ii) Legitimate interests (Article 6(1)(f) UK GDPR) – responding to enquiries and maintaining good customer relations.
5.2(e) Platform Security and Integrity
Purpose: To detect and prevent fraud, unauthorised access, security breaches, and misuse of the Platform; to enforce our Terms and Conditions.
Lawful Basis: Legitimate interests (Article 6(1)(f) UK GDPR) – protecting our systems, preventing fraud, and ensuring the security and integrity of our services.
5.2(f) Website Analytics and Improvement
Purpose: To analyse how users interact with the Website and Platform, understand usage patterns, and improve our services.
Lawful Basis: Legitimate interests (Article 6(1)(f) UK GDPR) – improving our services and user experience.
5.2(g) Legal Compliance and Regulatory Obligations
Purpose: To comply with legal obligations, respond to lawful requests from authorities, and establish or defend legal claims.
Lawful Basis:
(i) Legal obligation (Article 6(1)(c) UK GDPR) – where required by law; or
(ii) Legitimate interests (Article 6(1)(f) UK GDPR) – establishing, exercising, or defending legal rights.
5.3 Where we rely on legitimate interests as a lawful basis, we have carefully balanced our interests against your rights and freedoms and are satisfied that our processing does not override your interests or fundamental rights.
5.4 We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.
6. Cookies and Website Analytics
6.1 Our Website and Platform use only strictly necessary cookies. We do not use functional cookies, analytics cookies, advertising cookies, or any other non-essential cookies or similar tracking technologies.
6.2 What are cookies? Cookies are small text files stored on your device when you visit a website. They enable the website to remember your actions and preferences over time.
6.3 Strictly Necessary Cookies
We use only the following category of cookie:
6.3(a) Strictly Necessary Cookies: these cookies are essential for the Website and Platform to function properly. They enable core functionality such as user authentication, security, and access to secure areas. These cookies do not require your consent and cannot be disabled, as the Website and Platform cannot function properly without them.
6.4 WordPress and Platform Technologies: as our Website is hosted on WordPress and our Platform is built using Laravel, only the strictly necessary cookies and session management technologies associated with these platforms are used, and only to the extent required to enable core functionality such as authentication and security.
6.5 No Cookie Consent Required: as we only use strictly necessary cookies, which are exempt from the consent requirements of the Privacy and Electronic Communications Regulations 2003 (as amended) and do not require your consent under the UK GDPR, we do not operate a cookie consent banner. If we introduce any non-essential cookies in the future, we will update this Privacy Policy in accordance with clause 16 and obtain your consent before doing so.
6.6 Managing Cookies: most web browsers allow you to control cookies through browser settings, including refusing or deleting cookies already stored. However, because we only use strictly necessary cookies, disabling them is likely to prevent you from logging in or accessing secure areas of the Website and Platform.
6.7 For more information about cookies and how to manage them, visit www.aboutcookies.org or www.allaboutcookies.org.
7. Payment Processing (Stripe)
7.1 Payment transactions for purchases on the Website are processed by Stripe, a third-party payment service provider.
7.2 Independent Data Controller: Stripe acts as an independent data controller in respect of payment data. When you make a payment, Stripe collects and processes your payment card details and related payment information in accordance with its own privacy policy and terms of service.
7.3 What We Receive from Stripe: We do not receive or store your full payment card details. We receive only:
7.3(a) Confirmation that payment has been successfully processed;
7.3(b) A transaction reference or identifier;
7.3(c) Limited billing information necessary to fulfil your purchase and maintain our records.
7.4 Stripe’s Privacy Practices: Stripe’s collection, use, and protection of your payment data is governed by Stripe’s privacy policy, which is available at https://stripe.com/gb/privacy.
7.5 Stripe is certified under relevant payment card industry security standards (PCI DSS) and employs industry-standard security measures to protect payment information.
7.6 If you have questions or concerns about how Stripe processes your payment data, please refer to Stripe’s privacy policy or contact Stripe directly.
8. Platform Hosting and Infrastructure (AWS and Laravel)
8.1 The Platform is hosted on infrastructure provided by Amazon Web Services (AWS), a cloud computing service provider.
8.2 AWS acts as a data processor on our behalf. We have entered into data processing agreements with AWS that require AWS to process your personal data only on our instructions and in accordance with UK GDPR requirements.
8.3 Platform Technology: Our Platform is built using Laravel, a PHP web application framework. Technical data relating to Platform performance, security, and functionality is processed through this framework as part of our service delivery.
8.4 Server Logs and Technical Data: AWS hosting infrastructure automatically generates server logs that may include IP addresses, access times, and technical request data. This information is used for:
8.4(a) Maintaining Platform performance and availability;
8.4(b) Identifying and resolving technical issues;
8.4(c) Detecting and preventing security threats;
8.4(d) Ensuring compliance with our Terms and Conditions.
8.5 AWS maintains high standards of data security and compliance, including ISO 27001 certification and adherence to industry-standard security practices.
8.6 For more information about AWS’s data protection practices, please refer to the AWS Privacy Notice at https://aws.amazon.com/privacy/.
9. Data Sharing and Third Parties
9.1 We do not sell, rent, or trade your personal data to third parties for marketing purposes.
9.2 We may share your personal data with the following categories of recipients:
9.2(a) Service Providers and Data Processors, comprising:
(i) AWS – for Platform hosting and infrastructure services (as described in clause 8);
(ii) Stripe – for payment processing (as described in clause 7, acting as independent controller);
(iii) WordPress hosting and maintenance providers – for Website hosting, maintenance, and security;
(iv) Email service providers – for sending transactional emails such as account confirmations and purchase receipts;
(v) IT security and support providers – for maintaining the security and functionality of our systems.
9.2(b) Legal and Regulatory Authorities: we may disclose your personal data to law enforcement agencies, regulatory bodies, courts, or other public authorities where:
(i) Required by law or legal process;
(ii) Necessary to respond to lawful requests or court orders;
(iii) Necessary to protect our rights, property, or safety, or that of our users or the public;
(iv) Required to detect, prevent, or investigate fraud, security breaches, or other unlawful activity.
9.2(c) Business Transfers: in the event of a merger, acquisition, reorganisation, sale of assets, or similar corporate transaction, your personal data may be transferred to the acquiring or successor entity, subject to the protections set out in this Privacy Policy.
9.3 All service providers acting as data processors are required to:
9.3(a) Process personal data only on our documented instructions;
9.3(b) Implement appropriate technical and organisational security measures;
9.3(c) Comply with UK GDPR and DPA 2018 requirements;
9.3(d) Enter into written data processing agreements with us.
9.4 We do not share your personal data with any other third parties unless:
9.4(a) You have given explicit consent to such sharing;
9.4(b) Sharing is necessary for the purposes set out in clause 5;
9.4(c) Required or permitted by law.
10. International Data Transfers
10.1 Your personal data is primarily processed and stored within the United Kingdom.
10.2 However, some of our service providers may process data outside the United Kingdom, including in the European Economic Area (EEA) or other jurisdictions.
10.3 AWS Hosting: AWS infrastructure may involve data processing in multiple geographic regions. Where data is transferred outside the UK, AWS provides appropriate safeguards including:
10.3(a) Standard Contractual Clauses approved by the UK authorities; and
10.3(b) Adherence to industry-standard security and compliance frameworks.
10.4 Stripe: Stripe may process payment data internationally. Stripe has implemented appropriate safeguards for international transfers, including Standard Contractual Clauses and adherence to recognised data protection frameworks.
10.5 Where we transfer your personal data outside the UK, we ensure that:
10.5(a) The transfer is to a country recognised by the UK government as providing an adequate level of data protection; or
10.5(b) Appropriate safeguards are in place, such as Standard Contractual Clauses approved under Article 46 UK GDPR; or
10.5(c) Another lawful transfer mechanism under UK GDPR applies.
10.6 You may request further information about the safeguards we use for international transfers by contacting us using the details in clause 14.
11. Data Retention
11.1 We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected and to comply with our legal and regulatory obligations.
11.2 Retention Periods:
11.2(a) Account and User Data:
(i) If you maintain an active account: we retain your account data for the duration of your account plus a reasonable period thereafter for customer service and legal purposes;
(ii) If you close your account or request deletion: we will delete your personal data within 30 days, subject to clause 11.3.
11.2(b) Purchase and Transaction Records: we retain purchase records and limited transaction data for:
(i) Six years from the end of the financial year in which the transaction occurred, in accordance with UK tax and accounting requirements;
(ii) Such records typically include transaction reference, date, amount, and payment status, but not full payment card details.
11.2(c) Platform Usage Data:
(i) Usage data and progress tracking: retained for the duration of your access period;
(ii) After this period, usage data may be anonymised for analytical purposes.
11.2(d) Technical and Security Logs:
(i) Server logs and security-related data: retained for up to 12 months for security monitoring and incident response purposes;
(ii) After this period, logs are deleted or anonymised.
11.2(e) Communications and Support Records:
(i) Email correspondence and support queries: retained for up to three years to maintain service quality and respond to follow-up enquiries;
(ii) After this period, records are deleted unless retention is required for legal purposes.
11.3 Legal and Regulatory Retention: We may retain personal data beyond the periods specified above where:
11.3(a) Required by law, regulation, or court order;
11.3(b) Necessary to establish, exercise, or defend legal claims;
11.3(c) Necessary to comply with regulatory investigations or requests from public authorities.
11.4 Where personal data is no longer required, we securely delete or anonymise it in accordance with industry-standard data destruction practices.
11.5 Anonymised data (data from which you cannot be identified) may be retained indefinitely for analytical and research purposes.
12. Data Security Measures
12.1 We take the security of your personal data seriously and implement appropriate technical and organisational measures to protect it against unauthorised or unlawful processing, accidental loss, destruction, or damage.
12.2 Security Measures include:
12.2(a) Encryption: User passwords are encrypted using industry-standard hashing algorithms. Data transmitted between your browser and our servers is encrypted using SSL/TLS protocols.
12.2(b) Access Controls: Access to personal data is restricted to authorised personnel only, on a need-to-know basis. Staff with access to personal data receive appropriate training on data protection obligations.
12.2(c) Secure Hosting: The Platform is hosted on AWS infrastructure, which maintains ISO 27001 certification and employs multiple layers of physical and logical security controls.
12.2(d) Regular Security Updates: We apply security patches and updates to the WordPress website and Laravel platform to protect against known vulnerabilities.
12.2(e) Monitoring and Logging: We monitor systems for suspicious activity, security incidents, and unauthorised access attempts.
12.2(f) Backup and Recovery: Regular backups are performed to enable data recovery in the event of system failure or data loss.
12.2(g) Incident Response: We have procedures in place to detect, respond to, and report data security breaches in accordance with UK GDPR requirements.
12.3 Your Responsibilities: While we implement robust security measures, you are responsible for:
12.3(a) Keeping your account password secure and confidential;
12.3(b) Not sharing your login credentials with others;
12.3(c) Notifying us immediately if you suspect unauthorised access to your account;
12.3(d) Using secure devices and networks when accessing the Platform.
12.4 No Absolute Security: Despite our security measures, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security of your personal data.
12.5 Data Breach Notification: In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay in accordance with UK GDPR requirements and will notify the Information Commissioner’s Office (ICO) where legally required.
13. Your Data Protection Rights
13.1 Under the UK GDPR and DPA 2018, you have the following rights in relation to your personal data:
13.1(a) Right of Access (Article 15 UK GDPR): you have the right to request a copy of the personal data we hold about you, together with information about how we process it.
13.1(b) Right to Rectification (Article 16 UK GDPR): you have the right to request that we correct any personal data that is inaccurate or incomplete. You can also update certain information directly through your account settings.
13.1(c) Right to Erasure / “Right to be Forgotten” (Article 17 UK GDPR): you have the right to request that we delete your personal data in certain circumstances, including where:
(i) The data is no longer necessary for the purposes for which it was collected;
(ii) You withdraw consent (where processing is based on consent);
(iii) You object to processing and there are no overriding legitimate grounds;
(iv) The data has been unlawfully processed;
(v) Erasure is required to comply with a legal obligation.
This right is not absolute and may be limited where we have a legal obligation or legitimate interest to retain the data.
13.1(d) Right to Restriction of Processing (Article 18 UK GDPR): you have the right to request that we restrict processing of your personal data in certain circumstances, including where:
(i) You contest the accuracy of the data;
(ii) Processing is unlawful but you do not want the data erased;
(iii) We no longer need the data but you require it for legal claims;
(iv) You have objected to processing pending verification of our legitimate grounds.
13.1(e) Right to Data Portability (Article 20 UK GDPR): where processing is based on consent or performance of a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another data controller.
13.1(f) Right to Object (Article 21 UK GDPR):
(i) You have the right to object to processing of your personal data where we rely on legitimate interests as the lawful basis. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
(ii) You have an absolute right to object to processing for direct marketing purposes at any time.
13.1(g) Rights Related to Automated Decision-Making: you have the right not to be subject to decisions based solely on automated processing (including profiling) that produce legal or similarly significant effects. We do not currently engage in such processing.
13.2 Exercising Your Rights: To exercise any of these rights, please contact us using the details provided in clause 14.
13.3 Verification: For your security, we may need to verify your identity before responding to requests to exercise your rights. We will contact you if we need additional information.
13.4 Response Time: We will respond to requests without undue delay and in any event within one month of receipt. In complex cases, we may extend this period by a further two months and will inform you of the extension and reasons.
13.5 Free of Charge: Exercising your data protection rights is generally free of charge. However, we may charge a reasonable fee or refuse a request if it is manifestly unfounded, excessive, or repetitive.
13.6 Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
14. How to Exercise Your Rights
14.1 To exercise any of your data protection rights or if you have questions or concerns about how we handle your personal data, please contact us:
Via the Website: https://gppathway.com
Via email: support@gppathway.co.uk
14.2 When contacting us, please provide:
14.2(a) Your full name and the email address associated with your account;
14.2(b) A clear description of your request or the right you wish to exercise;
14.2(c) Any relevant supporting information.
14.3 We will respond to your request as promptly as possible and in accordance with the timescales required by UK GDPR.
15. Complaints to the Information Commissioner’s Office (ICO)
15.1 You have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) if you believe that we have not handled your personal data in accordance with UK GDPR or DPA 2018.
15.2 ICO Contact Details:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: https://ico.org.uk
Online Reporting: You can report concerns to the ICO online at https://ico.org.uk/make-a-complaint/
15.3 While you have the right to complain to the ICO at any time, we encourage you to contact us first so that we can attempt to resolve your concerns directly.
16. Changes to This Privacy Policy
16.1 We may update this Privacy Policy from time to time to reflect:
16.1(a) Changes in applicable data protection laws or regulatory guidance;
16.1(b) Changes to our data processing practices or technical infrastructure;
16.1(c) New features or services we offer;
16.1(d) Feedback from users or the ICO.
16.2 When we make changes to this Privacy Policy:
16.2(a) We will update the “Last updated” date at the top of this page;
16.2(b) If the changes are significant, we will notify you by email (where we have your email address) or by posting a prominent notice on the Website;
16.2(c) Continued use of the Website and Platform after changes take effect constitutes your acceptance of the updated Privacy Policy.
16.3 We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.
16.4 Previous versions of this Privacy Policy may be available upon request.
17. Contact Details and Data Protection Enquiries
17.1 If you have any questions, concerns, or requests relating to this Privacy Policy or our data protection practices, please contact us:
GPPathway
Website: https://gppathway.com
Email: support@gppathway.co.uk
17.2 Data Protection Enquiries: For specific data protection or privacy-related enquiries, please clearly mark your communication as “Data Protection Enquiry” to ensure it is directed to the appropriate person.
17.3 We aim to respond to all privacy and data protection enquiries within 5 business days for general enquiries and within the statutory timeframes for formal data subject rights requests.
