Privacy Policy

1. Who is responsible for your information?
Revise Radiology Ltd is the controller responsible for the personal information covered by this policy. Our company number is 09134299 and our registered address is 13 Durleigh Road, Bridgwater, TA6 7HU, United Kingdom.

Contact info@reviseradiology.com for privacy questions or to exercise your rights. Our existing notice lists ICO registration ZA364628.

[VERIFY: company address, ICO registration and privacy contact. The existing notice names Maria Ana Guedes as DPO; confirm the current formal appointment before adding a named DPO here.]

2. What this policy covers
This policy explains how we handle personal information through our websites, member platform, courses and customer-support communications. It also covers information supplied when you apply for a support programme or contribute to our teaching, to the extent described below.

Independent third-party sites have their own privacy notices. Using our services does not mean that you consent to every form of processing; we identify the relevant lawful bases below.

[VERIFY: list the actual covered domains and services. The existing notice names reviseradiology.com and reviseradiology.courses; confirm the member platform and new website scope.]

3. Information we collect and where it comes from
Depending on how you use our services, the information may include:

• Identity and contact details, such as your name, email address, telephone number and country.

• Account and security information, such as login information, account activity and security events.

• Orders, billing details, payment status and transaction references provided by you or payment providers.

• Course enrolments, learning activity, answers, results, progress, teaching attendance and feedback.

• Information you choose to provide in support conversations, applications, surveys and submitted documents.

• Technical information such as IP address, browser, device, operating system and website interactions.

We collect information directly from you, through your use of our services and from providers involved in delivering those services, such as payment or teaching platforms.

[VERIFY: actual data fields and sources, including any group organiser, employer, teaching partner or external sign-in provider. Confirm whether we receive card data or only provider references. Do not publish unverified security/storage claims.]

4. Why we use information and our lawful bases
The following is a proposed purpose-to-basis mapping and must be checked against our processing records before publication.

• Creating accounts, providing purchased access, administering orders and delivering customer support: performance of our contract with you, or steps you request before entering that contract.

• Keeping legally required accounting and tax records: compliance with legal obligations.

• Protecting accounts, preventing fraud and investigating misuse: our legitimate interests in securing our services, subject to an assessment of your rights and reasonable expectations.

• Understanding and improving our services: our legitimate interests where appropriate; consent where required for the particular tracking or processing used.

• Sending optional promotional communications: consent, in line with our existing stated marketing approach.

• Handling complaints and legal claims: applicable legal obligations or our legitimate interests in resolving disputes and protecting legal rights.

Information needed to create an account, take payment or deliver a course may be necessary to provide the service you request. We will explain when requested information is optional.

[VERIFY: the lawful basis for each support/discount application, progress-based eligibility check, teaching recording and optional activity. Do not treat this list as a completed lawful-basis assessment.]

5. Supporting documents and sensitive information
Please provide only the information necessary for the request we are helping you with, and do not send passwords, full payment-card details or identifiable patient information through ordinary support messages.

Applications or exceptional-circumstances requests may involve exam results, training or financial documents, and sometimes information about health. Health information requires an additional legal condition as well as a general lawful basis.

[PUBLICATION BLOCKER: identify the actual sensitive data collected, the purpose, Article 6 basis and applicable Article 9 condition, access restrictions, secure submission route and retention period. Insert the approved explanation here; do not assume that sending a document equals valid consent for every use.]

6. Live teaching, recordings and support tools
Participation in online teaching may involve your display name, voice, image, chat messages and contributions being visible to other attendees. Where a session is recorded, the notice for that session must explain what is captured, why, who can view it and how long it is retained.

[PUBLICATION BLOCKER: confirm which sessions are recorded, the lawful basis, recording access/retention and any participation alternatives. Also identify any AI-assisted support, transcription or analysis in actual use, the data sent to it and the appropriate disclosures. Do not imply all sessions are recorded or that all suppliers handle data in the same way.]

7. Service messages and marketing
We distinguish messages needed to administer your account or purchase from optional marketing. Unsubscribing from marketing does not prevent us from sending necessary service messages.

You can withdraw marketing consent or object to direct marketing at any time by using the available unsubscribe option or emailing info@reviseradiology.com. Withdrawing consent does not affect the lawfulness of earlier processing based on that consent.

[VERIFY: the actual unsubscribe process for email, WhatsApp and other channels, and whether a minimal suppression record is retained to honour preferences.]

8. Who we share information with
We may share necessary information with organisations providing hosting, learning-platform services, payment processing, customer support, communications, teaching delivery and analytics, where those services are actually used.

We may also disclose information where required by law or where necessary and lawful for a legal claim. In a business transfer or reorganisation, any transfer of personal information must remain subject to applicable data-protection requirements.

[VERIFY: the recipient categories and the significant providers, their purposes and whether they act as processors or independent controllers. Include relevant teaching partners or course organisers where applicable. The old generic reference to affiliates is not evidence that such sharing occurs.]

9. International transfers
[PUBLICATION BLOCKER: specify where personal information is processed outside the UK, including remote provider access; identify any applicable adequacy regulations or appropriate safeguards, such as an approved transfer agreement/addendum; explain how a person can obtain information about those safeguards via info@reviseradiology.com.]

The existing notice refers to UK/EU storage and transfer safeguards, but the actual new-site arrangements must be verified before that statement is repeated.

10. How long we keep information
We keep personal information for no longer than necessary for the purpose for which it is held, taking account of legal obligations, disputes, security needs and the delivery of services.

[PUBLICATION BLOCKER: insert an approved category-specific retention schedule or sufficiently clear criteria. Cover accounts and learning records; payment/tax records; support conversations; eligibility documents; health information; teaching recordings; marketing preferences; security logs; and backups.]

The existing notice states up to six years after termination for general account and usage data. That is a source for review, not a blanket retention period to apply to every document or recording. Where information is no longer required, it should be securely deleted or irreversibly anonymised under the approved retention process.

11. Keeping information secure
We use appropriate technical and organisational measures to protect personal information, taking account of the information and risks involved. No online system can eliminate every risk.

If a personal-data breach occurs, we assess it and make notifications required by applicable law. We do not promise that every incident will be notified to every person.

[VERIFY: actual access controls, supplier checks, encryption, staff/device arrangements and incident-response process. The earlier notice’s claims about regular audits and server locations have not been assumed verified.]

12. Cookies and similar technologies
Our website may use cookies and similar technologies to support essential functions and, where enabled lawfully, measure use or provide optional features.

[PUBLICATION BLOCKER: audit the actual website and embed tools; state the cookie/technology categories, purposes, providers and durations, applicable consent or exception arrangements, and how preferences can be changed or consent withdrawn. Add the working cookie-settings link and approved cookie notice.]

Do not repeat the old statement “no third-party advertising cookies” or name a particular analytics provider until the deployed website has been checked.

13. Your rights and requests
Depending on the circumstances and lawful basis, you may have rights to access your personal information, correct it, ask for erasure, restrict processing, object to processing, and receive or transfer certain information in a portable format. Where we rely on consent, you can withdraw it.

You have the right to object to use of your personal information for direct marketing at any time.

Email info@reviseradiology.com to make a request. We may need proportionate information to verify your identity. We normally respond without undue delay and within one month, subject to lawful extensions or other applicable timing rules, which we will explain where relevant.

Rights are not absolute in every situation. For example, deleting an account does not necessarily require deletion of records we must lawfully retain. We will explain any applicable limitation.

You may complain to the UK Information Commissioner’s Office at https://ico.org.uk/. You do not need to contact us first, although we welcome the opportunity to resolve your concern.

14. Automated decisions and personalisation
[PUBLICATION BLOCKER: verify whether any automated decisions with legal or similarly significant effects occur. Review pricing eligibility, access/security restrictions and support decisions, not just marketing. Explain any relevant profiling, lawful basis, consequences and safeguards accurately.]

The previous notice states there are no solely automated significant decisions and describes limited location/training-level personalisation. These statements need confirmation for the new services before being republished.

15. Children, external sites and updates
Our services are intended for adults aged 18 and over. Contact us if you believe a child’s personal information has been provided so we can assess and take appropriate action.

External sites may have different privacy practices. We will update this notice when necessary and display its effective date. Material changes should be communicated as required; updating a notice is not a substitute for obtaining consent where consent is required.