Professional Medical International Ltd (company number 17258974), registered in England and Wales, registered office Riverview House Appleford Road, Sutton Courtenay, Abingdon, England, OX14 4NR, operates the diploma programmes offered at pmdiplomas.com. In this policy, PMI, we and our refer to Professional Medical International Ltd.

We are the data controller for the personal data described below. We are registered with the Information Commissioner's Office under registration number ZC167300. If you have any questions about this policy or how we handle your data, contact us at info@pmdiplomas.com.

1. The personal data we collect

• Identity and contact details: your name, email address, and any postal address or telephone number you give us.
• Professional details: information about your medical training, specialty and place of practice, where you provide it as part of enrolment or eligibility.
• Enrolment and payment data: the programme you enrol on, your fee tier, and records of your transactions. Card details are handled by our payment processor and are not stored by us.
• Learning data: your account and activity on our learning platform, including progress and completion.
• Communications: messages you send us and our correspondence with you.

2. How we collect it

We collect personal data when you make an enquiry, enrol on a programme, use our learning platform, or correspond with us.

If you are an author of a published paper, we may also collect your name, work email address and institution from the author details of papers indexed in PubMed. Section 4 explains how we use these details.

3. Why we use it and our lawful bases

• To provide the programme you enrol on and manage your account, on the basis of performing our contract with you.
• To process payments and keep financial records, on the basis of contract and our legal obligations.
• To respond to enquiries and provide support, on the basis of our legitimate interests in running our business.
• To send you information about future programmes, where you have consented or where we have a legitimate interest and you have not objected. You can opt out at any time.
• To meet legal and regulatory obligations.

4. Marketing

We will only send you marketing where we are permitted to do so. Every marketing email includes a way to unsubscribe, and you can also opt out at any time by emailing info@pmdiplomas.com.

Contact details from published research

If you are an author of a published paper, we may have found your name, work email address and institution in the author details of a paper indexed in PubMed. We use these details only to tell you about our postgraduate diplomas in your specialty, on the basis of our legitimate interest in letting clinicians know about relevant education. We do not buy email lists. The only others who handle these details are the email services we use to send our messages (Instantly and Google), acting on our instructions.

We keep these details for no longer than twelve months from when we found them. If you tell us you do not want to hear from us, by replying or using the unsubscribe link, we stop straight away and keep only your email address on a do-not-contact list, so that we never write to you again. You can ask us to delete your details, or use any of your other rights in section 9, by emailing info@pmdiplomas.com.

5. Who we share your data with

We do not sell your personal data. We share it only with service providers who process it on our behalf, and only as needed to run our programmes:

• Stripe, for payment processing.
• Supabase, for our delegate database, hosted in the United Kingdom.
• Resend, for sending transactional email.
• Instantly, for sending emails to authors of published research (see section 4).
• Google (Google Workspace), for email and document handling.
• Vercel, for website hosting.
• Our learning platform provider, for your course account.

We may also disclose personal data where required by law.

6. Analytics and cookies

When you first visit, a banner asks whether you accept analytics and marketing cookies. Your choice is saved in your browser's local storage (as “pmi-consent”) so we do not ask again.

• Vercel Web Analytics and Speed Insights (our hosting provider) count page views and measure page speed. They do not set cookies and record only aggregated, anonymous information, so they run for every visitor.
• Google Analytics 4 (Google) shows us how visitors use the site: pages viewed, how they arrived, and approximate location and device. It sets the cookies _ga and _ga_*. In the UK and the EEA it sets cookies only if you accept; until then it sends only cookieless signals. In other countries it runs unless you reject it. We do not use Google Analytics for advertising: its advertising features are switched off everywhere.
• Meta Pixel (Meta Platforms, which runs Facebook and Instagram) loads only if you accept, wherever you are. It tells Meta which pages you visit, with technical details of your browser and device, so we can measure our marketing on Facebook and Instagram. It sets the cookie _fbp. Meta may link this information to a Facebook or Instagram account and uses it under its own privacy policy. Meta processes data in the United States.
• If you arrive through a tagged link, for example in a partner's newsletter, your browser keeps a note of that campaign (as “pmi_attribution”) and passes it to Stripe if you enrol, so we know which partner referred you. It holds no personal details and is kept for that visit, or for 30 days if you accept cookies.
• Strictly necessary storage, such as your cookie choice and the cookies that keep you signed in to your course, is used without consent because the site cannot work without it. Payments are made on Stripe's checkout pages, which set Stripe's own cookies.

To change your choice, clear this site's cookies and stored data in your browser; the banner will then ask again.

7. International transfers

Your delegate data in our primary database is stored in the United Kingdom. Some of our service providers, including Stripe, Resend, Instantly, Vercel, Google and our learning platform provider, are based in or process data in the United States or other countries outside the UK. Where data is transferred outside the UK, we rely on appropriate safeguards recognised under UK data protection law, such as the UK International Data Transfer Agreement or Addendum, the UK extension to the EU-US Data Privacy Framework where the provider is certified, or transfers to countries the UK considers adequate.

8. How long we keep your data

• Enrolment, payment and contractual records: kept for six years after the end of our relationship, to meet legal, tax and accounting requirements.
• Marketing data: kept until you opt out or after a sustained period of inactivity.
• Enquiry data where you do not enrol: kept for up to twelve months.
• Contact details from published research: kept for up to twelve months from when we found them. If you opt out, we keep only your email address, on a do-not-contact list.

9. Your rights

Under UK data protection law you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, to data portability, and to withdraw consent where processing is based on consent. To exercise any of these rights, email info@pmdiplomas.com.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk if you are unhappy with how we have handled your data, although we would welcome the chance to address your concerns first.

10. Security

We take reasonable technical and organisational measures to protect your personal data against loss, misuse and unauthorised access.

11. Changes to this policy

We may update this policy from time to time. The current version is always available on this page.

12. Contact

For any privacy matter, contact info@pmdiplomas.com.

Last updated: 15 October 2026.