Last updated: August 2026
1. Who We Are
Professional Medical Education Ltd (“PME”, “we”, “us” or “our”) provides medical education courses and related educational services, including courses operated under the JBJS MRC Oxford name.
For the purposes of UK data protection law, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018, Professional Medical Education Ltd is the data controller for the personal information described in this Privacy Policy, unless we tell you otherwise.
Our contact details are:
Professional Medical Education Ltd
Riverview
Sutton Courtenay
Oxfordshire
OX14 4NR
United Kingdom
Email: info@professionalmedical.co.uk
This Privacy Policy explains what personal information we collect, why we use it, who we may share it with, how long we keep it and the rights you have in relation to it.
2. Personal Information We Collect
The information we collect depends on how you interact with us.
We may collect information including:
- your name and contact details, including email address, telephone number and postal address;
- your professional details, such as your profession, grade, place of work or training institution;
- information you provide when registering for a course, diploma, event or other educational activity;
- billing details, order information and payment or transaction information;
- information relating to your attendance, participation and completion of our courses;
- where applicable, assessment submissions, results and certification records;
- information about forthcoming professional examinations where relevant to the course you are attending;
- information contained in enquiries, emails or other correspondence you send to us;
- marketing preferences and records of communications we send you;
- account and login information where you create an online account;
- technical information relating to your use of our website, such as device, browser, IP address, website activity and cookie information; and
- photographs or video recordings taken at our courses or events.
We may occasionally need information concerning dietary, accessibility or other requirements in order to facilitate your attendance at an event. Some of this information may constitute special category personal data, for example where it reveals information about your health. We will only collect and use such information where necessary and where we have an appropriate lawful basis and, where required, an additional condition under Article 9 UK GDPR, such as your explicit consent.
We will seek to collect only the personal information reasonably necessary for the relevant purpose.
3. How We Obtain Your Information
Most personal information is provided directly by you, for example when you:
- register or pay for a course;
- create an online account;
- complete a form;
- join our mailing list;
- submit an assessment;
- contact us by email, telephone or through our website; or
- attend one of our courses or events.
We may also receive your information from another person or organisation where they arrange or pay for a course on your behalf, for example your employer, training organisation or another delegate.
We may generate additional information through our relationship with you, such as records of bookings, attendance, course completion, communications and payments.
4. How and Why We Use Your Information
We only use personal information where we have a lawful basis for doing so.
We may process your personal information:
To provide a service or perform our contract with you.
This includes processing registrations and bookings, taking payment, delivering courses and online educational content, administering your account, communicating important course information, managing assessments and issuing certificates.
To comply with legal obligations.
This includes maintaining financial and accounting records, responding to lawful requests and complying with applicable tax, regulatory and data protection requirements.
For our legitimate interests.
We may process information where reasonably necessary to operate and improve our organisation and services, provided those interests are not overridden by your rights and interests. This may include customer support, maintaining appropriate course and attendance records, preventing fraud, maintaining website and information security, understanding how our services are used and establishing or defending legal claims.
With your consent.
Where we rely on consent, for example for certain marketing activities or the processing of particular sensitive information, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
5. Course Administration, Assessments and Certification
Where you register for one of our courses, we use your information to administer your participation. This may include sending joining instructions, providing access to educational materials, communicating timetable or programme changes and recording attendance.
Where a course includes assessments, we may also process assessment submissions, marks, results and completion information in order to administer the assessment and determine whether the relevant course or diploma requirements have been met.
We may retain appropriate records of attendance, assessment and certification where reasonably necessary to verify that an individual attended or completed a course or received a qualification or certificate.
6. Online Bookings, WooCommerce and Stripe
We use WooCommerce to provide the e-commerce and booking functionality on our website. When you place an order, information such as your name, contact details, billing details, items purchased and order history may be stored within our website and WooCommerce systems.
Online card payments are processed using Stripe.
When you make a payment, payment information is transmitted securely to Stripe so that Stripe can process the transaction and carry out activities such as fraud prevention and regulatory compliance.
PME does not ordinarily receive or store your full payment card number or card security code for online Stripe transactions. We receive information necessary to identify and administer the transaction, such as the amount paid, payment status and transaction reference.
Stripe processes personal information in accordance with its own privacy and security arrangements. Further information is available in the Stripe Privacy Policy.
We do not ask you to send payment card details to us by ordinary email.
7. Marketing Communications
We may send you information about PME and JBJS MRC Oxford courses, events and related educational services that we believe may be relevant to you.
We will only send electronic direct marketing where permitted by applicable data protection and electronic marketing law. Depending on the circumstances, this may be:
- where you have consented to receive marketing; or
- where the law permits us to contact existing customers about our own similar products or services and the applicable requirements of the “soft opt-in” are satisfied.
Where we rely on consent, our UK GDPR lawful basis is consent. Where the soft opt-in applies, our lawful basis for processing your personal information is generally our legitimate interests in promoting relevant services to existing customers.
You have an absolute right to object to the use of your personal information for direct marketing at any time.
Every marketing email we send will contain an unsubscribe facility. You may also contact us at info@professionalmedical.co.uk.
If you unsubscribe, we may retain a minimal record of your email address on a suppression list so that we can ensure that we do not send you further marketing communications. This does not mean that we will delete information that we need for other purposes, such as records relating to a course you have purchased.
Our marketing platform may provide us with information about delivery and engagement with our communications. Any use of tracking technologies within electronic communications will be managed in accordance with applicable data protection and electronic communications law.
8. Website Analytics and Cookies
Our website uses cookies and similar technologies to operate the site, maintain shopping-cart and checkout functionality, protect the website and understand how people use our services.
We use Google Analytics to help us understand matters such as which pages are visited, how visitors reach our website and how people interact with the site. This information helps us improve our website and services.
Analytics and other technologies may involve processing technical information and online identifiers such as device information, browser information, cookie identifiers and information about use of the website.
We use cookies and similar technologies in accordance with the Privacy and Electronic Communications Regulations (“PECR”). Where consent is required, non-essential technologies will only be used in accordance with the choices you make through our cookie controls.
Where applicable law permits particular technologies to be used without consent, we will comply with the conditions of the relevant exception, including providing appropriate information and a means of objecting where required.
Further information about the cookies and similar technologies used on our website should be available through our Cookie Policy / Cookie Settings.
9. Who We Share Your Information With
We do not sell personal information as a standalone commercial product.
We may share personal information with trusted third parties where reasonably necessary to operate our services, including:
- website hosting, IT and technical-support providers;
- WooCommerce and providers of website and e-commerce functionality;
- Stripe and other payment or financial-service providers;
- email and communications providers;
- learning-management, webinar and online teaching platforms;
- venues and organisations assisting us in delivering courses or events;
- professional or accreditation bodies where relevant;
- partner organisations where information needs to be shared in order to provide a service or benefit associated with a course;
- professional advisers, including accountants, lawyers and insurers; and
- regulators, courts, law-enforcement agencies or other authorities where disclosure is required or permitted by law.
We require organisations processing personal information on our behalf to protect that information appropriately and to use it only for the purposes for which it has been provided.
Some organisations receiving information may act as independent data controllers for particular processing activities and will have their own privacy obligations.
Business transfers
If PME or all or part of its business or assets is reorganised, transferred, acquired or sold, personal information relevant to that business may be disclosed to prospective purchasers and professional advisers and may subsequently be transferred to the acquiring organisation.
Any such disclosure or transfer will be carried out in accordance with applicable data protection law and subject to appropriate confidentiality, transparency and security arrangements.
10. International Transfers
Some of the organisations that provide services to us may process personal information outside the United Kingdom.
Where personal information is transferred internationally and the destination is not covered by UK adequacy regulations, we will ensure that an appropriate legal safeguard is used where required. This may include an approved international data-transfer agreement, the UK Addendum to approved standard contractual clauses or another legally permitted transfer mechanism.
We will also take reasonable steps to ensure that personal information continues to receive an appropriate level of protection.
11. How Long We Keep Your Information
We do not keep identifiable personal information for longer than is reasonably necessary for the purpose for which it was collected.
The retention period depends on the nature of the information and why we hold it.
Financial, payment and transaction records may normally be retained for up to six years or longer where required by applicable accounting, tax or legal requirements.
Course registration, attendance, assessment and certification information may be retained for as long as reasonably necessary to administer the course, maintain an appropriate educational record, verify completion or certification and respond to subsequent enquiries.
General enquiries and correspondence will be retained only for as long as reasonably necessary to deal with the enquiry and any subsequent issues arising from it.
Marketing information is retained while we continue to have an appropriate basis to contact you. If you opt out, we may retain limited suppression information for as long as necessary to ensure that your preference continues to be respected.
Technical and analytics information is retained in accordance with our website, analytics and cookie settings and applicable legal requirements.
Information may be retained for longer where necessary to establish, exercise or defend legal claims or where we are required to do so by law.
12. Keeping Your Information Secure
We take appropriate technical and organisational measures designed to protect personal information against unauthorised access, disclosure, alteration, loss or destruction.
Access to personal information is restricted to people who require it for legitimate business purposes.
Online payments are processed through Stripe rather than PME storing full online card details ourselves.
Although no internet-based service can guarantee absolute security, we regularly consider the measures appropriate to the nature of the information we hold and the risks associated with its processing.
13. Photography and Video at Courses and Events
Photography and videography may take place at some of our courses and events.
General photographs or recordings of an event may be used for purposes such as documenting the event, reporting on our activities and promoting future PME or JBJS MRC Oxford courses.
We will provide appropriate notice where photography or filming is planned. Where an individual is the particular focus of promotional material, we will seek consent where appropriate.
If you do not wish to be photographed or filmed, please inform a member of the PME team. We will take reasonable steps to respect your request.
14. Your Data Protection Rights
Depending on the circumstances and the lawful basis on which we process your information, you may have the following rights:
- Right of access – to ask us for a copy of personal information we hold about you;
- Right to rectification – to ask us to correct inaccurate information or complete information that is incomplete;
- Right to erasure – to ask us to delete your personal information in certain circumstances;
- Right to restriction – to ask us to restrict the way we use your information in certain circumstances;
- Right to object – to object to particular processing based on legitimate interests;
- Right to data portability – in certain circumstances, to receive information you have provided to us in a structured, commonly used and machine-readable format or ask us to transfer it to another organisation; and
- Right to withdraw consent – where we rely on your consent, to withdraw that consent at any time.
You have an absolute right to object at any time to the use of your personal information for direct marketing.
These rights are not absolute and particular rights may not apply in every circumstance.
You can exercise your rights by contacting us at info@professionalmedical.co.uk.
We may ask you for information reasonably necessary to verify your identity before disclosing personal information.
We will normally respond to a valid request within one month, subject to the provisions of applicable data protection law.
There is normally no charge for exercising your data protection rights. A reasonable fee may be charged in the limited circumstances permitted by law.
15. Automated Decision-Making
We do not currently use personal information to make solely automated decisions about individuals that produce legal or similarly significant effects.
16. Data Protection Complaints
If you have concerns about how PME has collected or used your personal information, please contact us in the first instance at:
info@professionalmedical.co.uk
We take data protection complaints seriously.
We will acknowledge a data protection complaint within 30 days of receiving it, take appropriate steps to investigate it without undue delay, keep you informed where appropriate and tell you the outcome.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.
Information about making a complaint is available on the ICO website.
17. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our services, technology, suppliers or legal obligations.
The most recent version will be published on our website together with the date it was last updated.
Where a change is significant and it is appropriate to do so, we may also notify affected individuals by email or through another appropriate communication.
18. Contact Us
For questions about this Privacy Policy, to exercise a data protection right or to make a data protection complaint, please contact:
Professional Medical Education Ltd
Riverview
Sutton Courtenay
Oxfordshire
OX14 4NR
United Kingdom