Privacy Policy UK Medical Appraisals (Golder Medical Services Ltd)
Last updated: 25 May 2026

1. Who we are
This Privacy Policy explains how Golder Medical Services Ltd, trading as UK Medical Appraisals ("UKMA", "we", "us" or "our"), collects, uses and protects personal data when you visit www.uk-medical-appraisals.co.uk (the "Website"), enquire about or book a medical appraisal, register for one of our courses, or otherwise interact with us.

We are the "controller" of your personal data for the purposes of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

Our details
Controller: Golder Medical Services Ltd (trading as UK Medical Appraisals)
Company number: 07734528 (registered in England and Wales)
Registered office: Unit 15 City Business Centre, Lower Road, London SE16 2XB, United Kingdom
ICO registration number: ZA065642
Email: email@msgolder.co.uk
Telephone: 0203 633 0150 (from outside the UK: +44 203 633 0150)

Mr Mark Golder is the Company Director and the senior individual responsible for data protection within UKMA. We are not required by law to appoint a statutory Data Protection Officer, but you can raise any data protection question with us using the contact details above.

2. Scope of this Policy
This Policy applies to personal data we collect:

• through the Website and any sub-domains;
• when you contact us by email, telephone or letter;
• when you enquire about, book or undergo a medical appraisal with us;
• when you register for, access or complete a UKMA course or download a UKMA resource;
• when you sign up to our newsletter or other marketing communications; and
• when third parties (such as the General Medical Council, your Designated Body, or referees you have nominated) share personal data about you with us in connection with your appraisal.

The Website is built on the LearnWorlds platform. Where you create an account, your account data is hosted by LearnWorlds on our behalf as our processor; this Policy describes how we use that data.

Our Website may contain links to third-party websites. We are not responsible for the privacy practices of those sites, and we encourage you to read their privacy notices.

3. Personal data we collect
We collect and process the following categories of personal data. Not all categories will apply to every individual; for example, we will only collect appraisal-related information if you are a doctor having an appraisal with us.

Identity data: Name, title, GMC registration number, professional qualifications, specialty.
Contact data: Postal address, email address, telephone number, country of residence.
Professional data: Designated Body status, scope of practice, employer, CV, university and graduation year, training history, appraisal documents, REV12 / REV11 form data, CPD records, reflective notes, complaints, significant events, audit and quality-improvement evidence.
Special category data: Health-related and clinical information contained in appraisal portfolios, supporting information, and (where relevant) information disclosed during appraisals of doctors under GMC investigation. This is treated as special category personal data under Article 9 UK GDPR.
Financial data: Billing details and payment information. Payment card data is collected and processed directly by our payment processor (Stripe); we do not store full card numbers on our systems.
Account data: Username, password (encrypted), course progress, certificates issued.
Technical data: IP address, browser type and version, operating system, device identifiers, time-zone setting, referring URLs, pages visited.
Marketing and communications data: Your preferences in receiving marketing from us and your communication preferences.

We collect most of this information directly from you. We may also receive information about you from third parties, including your Designated Body, your employer, referees, the General Medical Council (the "GMC"), and our service providers (for example, payment confirmation from Stripe).

4. Why we use your personal data and our lawful bases
Under the UK GDPR we must have a lawful basis for processing personal data. Where we process special category data (such as health-related information in appraisal portfolios), we must also satisfy a separate condition under Article 9. The table below sets out the main purposes for which we use your personal data and the lawful bases we rely on.

4.1 Providing medical appraisal services
Purpose: To facilitate your medical appraisal; to prepare and finalise your appraisal documentation and REV12 form; to discuss and reflect on your supporting information; to liaise with the GMC, your Designated Body (where relevant), and others involved in your revalidation; and to provide follow-up support and guidance.
Lawful basis: Article 6(1)(b) UK GDPR - performance of a contract with you (or to take steps at your request before entering into a contract).
Special category condition: Article 9(2)(h) UK GDPR - processing necessary for the provision of health or social care or treatment, or the management of health or social care systems and services, on the basis of a contract with a health professional, read with Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018. Where appropriate, we may additionally rely on Article 9(2)(a) (your explicit consent), Article 9(2)(f) (establishment, exercise or defence of legal claims), or Article 9(2)(g) (substantial public interest - regulatory requirements relating to the medical profession).

4.2 Selling and delivering courses and digital resources
Purpose: To create and manage your course account, to deliver the courses and resources you have purchased or registered for, to issue CPD certificates, and to provide customer support.
Lawful basis: Article 6(1)(b) - performance of a contract with you.

4.3 Taking payment
Purpose: To take payment for appraisals, courses or other services, to issue invoices and receipts, and to keep accounting records.
Lawful basis: Article 6(1)(b) - performance of a contract, and Article 6(1)(c) - compliance with our legal obligations under UK tax and accounting law.

4.4 Responding to enquiries and providing customer support
Purpose: To respond when you contact us by email, telephone or through any contact form on the Website.
Lawful basis: Article 6(1)(b) where you are an existing or prospective client, and Article 6(1)(f) - legitimate interests in running and developing our practice and responding to people who contact us.

4.5 Operating, securing and improving the Website
Purpose: To host the Website, keep it secure, prevent fraud and abuse, monitor performance, and understand how visitors use it so we can improve it.
Lawful basis: Article 6(1)(f) - legitimate interests in running a secure and effective website. Where cookies and similar technologies are not strictly necessary, we rely on your consent (Article 6(1)(a)) given through our cookie banner.

4.6 Marketing communications
Purpose: To send you our newsletter, weekly Hot Topic updates, course announcements and other information we think will be of interest to you.
Lawful basis: Article 6(1)(a) - your consent, which you give by ticking the relevant box when you register; or Article 6(1)(f) - legitimate interests, where you are an existing client and we contact you about similar services ("soft opt-in" under the Privacy and Electronic Communications Regulations). You can unsubscribe at any time using the link in any marketing email or by contacting us.

4.7 Complying with legal and regulatory obligations
Purpose: To comply with our obligations under company, tax, health and safety, professional regulation and data protection law; to respond to lawful requests from regulators, courts or law enforcement; and to establish, exercise or defend legal claims.
Lawful basis: Article 6(1)(c) - compliance with a legal obligation, and Article 6(1)(f) - legitimate interests in protecting our rights.

5. Who we share your personal data with
We do not sell your personal data. We share it only with the recipients listed below, and only to the extent necessary for the purposes described in Section 4:

• You and your nominated representatives (for example, we send your completed appraisal forms and REV12 to you for upload to your GMC online account).
• The General Medical Council - when the GMC contacts the appraiser to confirm that an appraisal took place, we will confirm this. In limited circumstances, we may need to communicate other relevant information with the GMC where required by our professional obligations.
• Your Designated Body or employer - only where you have asked us to liaise with them in connection with your appraisal or revalidation.
• Our service providers (processors), who act on our instructions, including: LearnWorlds Ltd (website hosting, course platform and account management); Stripe Payments Europe, Ltd. and Stripe, Inc. (payment processing); Google LLC (Google Analytics website analytics); our email and document storage providers; and our accountants.
• Professional advisers, such as our lawyers, insurers and auditors, where necessary to obtain advice or to protect our interests.
• Regulators, courts and law enforcement, where we are legally required or permitted to do so.
• A buyer or successor entity in the event of a sale, merger, reorganisation or transfer of all or part of our business; we will let you know in advance if this happens.

All of our processors are bound by written contracts that require them to keep your data secure and to use it only for the purposes we specify.

6. International transfers
Some of our service providers are based outside the United Kingdom, or may store or process personal data outside the UK. In particular:

• LearnWorlds is headquartered in Cyprus (European Economic Area) and uses sub-processors in the EEA and other jurisdictions to host the platform;
• Stripe processes payments through entities in the EEA, the United States and elsewhere; and
• Google Analytics is provided by Google LLC, which may process data in the United States.

Whenever we transfer personal data out of the UK, we ensure a similar degree of protection is afforded to it by relying on one of the following safeguards:

• transfers to countries that have been deemed by the UK Government to provide an adequate level of protection (such as countries in the EEA);
• the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another approved transfer mechanism with the recipient; and
• additional safeguards where appropriate, such as encryption in transit.

You may contact us using the details in Section 1 to ask for a copy of the safeguards in place for a specific transfer.

7. How long we keep your personal data
We keep personal data only for as long as is necessary for the purposes for which it was collected, including for the purpose of satisfying any legal, regulatory, tax, accounting or reporting requirements. The main retention periods we apply are as follows:

Appraisal records (completed appraisal forms, REV12 documentation, supporting information): Retained for the duration of the revalidation cycle plus a minimum of five years thereafter, in line with NHS England and General Medical Council guidance on appraiser record-keeping.
Records relating to doctors under GMC investigation: Retained for as long as is reasonably necessary to support the GMC process and any subsequent regulatory action, and thereafter in line with the period above.
Financial and accounting records (invoices, receipts, tax records): Retained for at least six years from the end of the financial year to which they relate, to comply with HMRC requirements.
Course account data and CPD certificates issued via the LearnWorlds platform: Retained for as long as your account remains active, and for a reasonable period after closure so that we can re-issue certificates if requested.
Marketing data: Retained until you unsubscribe or otherwise object to receiving marketing.
Website analytics data: Retained in line with our analytics provider's standard retention settings (typically up to 14 months in Google Analytics 4).
Enquiry correspondence (where no appraisal proceeds): Retained for up to 12 months from the date of last contact, then deleted.

When we no longer need your personal data, we will securely delete or anonymise it. In some circumstances, we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

8. How we protect your personal data
We have put in place appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These measures include:

• encryption of the Website using HTTPS / TLS;
• restricting access to personal data to those who need it to perform their role;
• using reputable service providers who themselves apply appropriate security measures;
• storing appraisal documentation in access-controlled systems; and
• regularly reviewing our information-security practices.

Despite our safeguards, no method of transmission over the internet or method of electronic storage is completely secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office and, where required by law, we will notify you.

9. Cookies and similar technologies
Our Website and the LearnWorlds platform use cookies and similar technologies. A "cookie" is a small text file placed on your device when you visit a website. We use the following categories of cookies:

• Strictly necessary cookies - required for the Website to function (for example, to keep you logged in, to remember items in a basket, to record your cookie preferences). These do not require your consent.
• Analytics cookies - set by Google Analytics to help us understand how visitors use the Website (for example, which pages are most popular and how visitors arrive at the site). These are only set with your consent.
• Functionality cookies - used by the LearnWorlds platform to remember your preferences and improve your experience. Some of these are strictly necessary; others are only set with your consent.

When you first visit the Website you will see a cookie banner explaining the cookies we use and allowing you to accept or reject non-essential cookies. You can change your preferences at any time by clearing your cookies and re-visiting the Website, or by adjusting your browser settings to block or delete cookies. Please note that disabling certain cookies may affect the functionality of the Website.

10. Your rights
Under the UK GDPR you have a number of rights in relation to your personal data:

Right to be informed: To be told how we collect and use your personal data (this notice fulfils that obligation).
Right of access: To ask for a copy of the personal data we hold about you.
Right to rectification: To ask us to correct inaccurate or incomplete personal data.
Right to erasure: To ask us to delete your personal data in certain circumstances. This right is not absolute; for example, we may be required to retain appraisal records for regulatory or contractual reasons.
Right to restrict processing: To ask us to suspend the processing of your personal data in certain circumstances.
Right to data portability: To receive the personal data you have provided to us in a structured, commonly used, machine-readable format, or to ask us to transmit it to another controller.
Right to object: To object to our processing of your personal data where we rely on legitimate interests, and to object at any time to processing for direct marketing.
Rights relating to automated decision-making: We do not carry out automated decision-making (including profiling) that produces legal or similarly significant effects on you.
Right to withdraw consent: Where we rely on consent (for example, to send marketing emails), you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
Right to complain: To lodge a complaint with the Information Commissioner's Office (see Section 12).

You can exercise any of these rights by contacting us using the details in Section 1. We will respond within one month of receiving your request, although we may extend this period by up to two further months for complex or numerous requests (we will let you know if that applies). There is no fee for exercising your rights, except in limited circumstances where a request is manifestly unfounded or excessive. To protect your personal data, we may need to verify your identity before responding to a request.

11. Whether you must provide personal data
Where we collect personal data to deliver a contracted service (such as facilitating your appraisal or providing a course), the provision of that data is necessary to enter into and perform the contract. If you do not provide it, we may be unable to provide the service. Where we ask for personal data for other purposes (for example, optional marketing preferences or demographic information), providing it is voluntary.

12. How to complain
We hope you will not have any cause for complaint, but if you do please contact us first so we can try to resolve the matter. You also have the right to lodge a complaint with the Information Commissioner's Office ("ICO"), the UK supervisory authority for data protection issues.

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
Website: https://ico.org.uk

13. Children
Our services are aimed at qualified doctors and other professionals. The Website is not intended for children, and we do not knowingly collect personal data from anyone under the age of 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

14. Changes to this Policy
We may update this Policy from time to time, for example to reflect changes in the law or in our practices. The date at the top of this Policy shows when it was last updated. Where the changes are material, we will take reasonable steps to draw them to your attention (for example, by a notice on the Website or by email). We encourage you to review this Policy periodically.

15. Contacting us
If you have any questions about this Policy, or about how we handle your personal data, please contact us:

Golder Medical Services Ltd (trading as UK Medical Appraisals)
Unit 15 City Business Centre, Lower Road, London SE16 2XB, United Kingdom
Email: email@msgolder.co.uk
Telephone: 0203 633 0150 (from outside the UK: +44 203 633 0150)