Privacy notice
Version 2026-10-25, last updated 25 October 2026.
This notice explains what personal information we collect when you use st3interview.com or buy from us, why we collect it, who else handles it, how long we keep it and what your rights are.
1. Who we are
ST3 Interview is a trading name of Medicloud Ltd, a company registered in England and Wales with company number 08341463, whose registered office is 2 Sherrock Gardens, Hendon, London NW4 4JJ. Medicloud Ltd is the controller of your personal information, which means we decide how it is used and are responsible for it under UK data protection law.
For any question about this notice or your information, email us at [email protected] or use our contact form.
2. What we collect
Information you give us
- Your account: your name, email address and password. We store your password only as a salted, peppered PBKDF2 hash, so nobody at ST3 Interview can read it.
- Your purchases: what you bought, when, the price paid and the PayPal payment references. PayPal also tells us the name on your PayPal account. Your card and bank details go to PayPal and never reach us.
- Your checkout confirmations: which boxes you ticked before paying (for example, asking for your question bank access to start straight away), the version of our terms and when you did it.
- Messages you send us through the contact form or by email: your name, email address, the topic you choose and your message.
- For a one-to-one or the course day: anything you choose to send us to prepare, such as your CV, portfolio or application.
Information created when you use the site
- Your progress: the question bank topics you mark as done, and when.
- Sign-in records: when you signed in, your IP address, the country it comes from and your browser’s description of itself (its “user agent”).
- Security records: failed log-in attempts and temporary lockouts, and short-lived counters that limit how often a log-in, contact or payment can be tried from one IP address or email address.
Live sessions
- When you join the webinar, a course day or a one-to-one on Zoom, Zoom and we see the name and email address you join with, and your video, audio and chat messages during the session.
- We record the live preparation webinar so buyers who cannot attend can watch it. If you attend, your name, anything you type in the chat and, if you turn them on, your camera and microphone may appear in the recording. You can join with your camera and microphone off.
- We do not record course day mock interviews or one-to-one sessions unless we ask you first.
We do not ask for health information or any other special category information. Please do not send us any, or details of any patient, through the contact form or in a session.
3. Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Create and run your account, give you question bank access, save your progress, and provide the course day, one-to-ones and webinar you have bought | Contract: we need it to provide what you asked for |
| Take payments, send order confirmations, booking details and password-reset emails | Contract |
| Keep order, payment and checkout-confirmation records | Legal obligation (tax and company records), and our legitimate interest in being able to show what was agreed |
| Keep accounts and the site secure: sign-in records, lockouts, rate limits, the bot check on the contact form and breached-password checks | Legitimate interests: protecting your account, our members and our material |
| Reply to your messages | Legitimate interests, or contract when you are a customer |
| Record the webinar and share the recording with buyers | Legitimate interests: letting buyers who cannot attend watch it |
| Deal with complaints, refunds and legal claims | Legitimate interests, and legal obligation where it applies |
We only email you about your account, purchases and bookings. We do not send marketing emails, sell your information, show adverts or use advertising or analytics trackers. We do not make decisions about you by automated means.
4. Who else handles it
We use these service providers. Each one handles your information only to provide its service to us, under a contract with us, except PayPal, which is responsible for its own use of payment information.
- Cloudflare hosts the website, stores our member database (held in Western Europe), protects the site from attacks and runs Turnstile, the check on the contact form that tells people from bots. Cloudflare sees the IP address and browser details of every visit.
- PayPal takes payments. When you pay, PayPal’s own privacy notice applies to what you give PayPal.
- Resend sends our emails (order confirmations, booking details, password resets) from its EU region, and passes contact-form messages and order notices to our mailbox.
- 123-Reg (GoDaddy) hosts our email inbox, where your messages to us are kept.
- Zoom runs the webinar, course day and one-to-one sessions.
- Vimeo and YouTube (Google) play the videos in the question bank. We embed Vimeo in its do-not-track mode and YouTube in its privacy-enhanced mode. When you play a video, the provider receives your IP address and device details.
- Have I Been Pwned: when you choose a password, we send the first five characters of a SHA-1 hash of it to this breached-password service, so we can warn you if it has appeared in a data breach. Neither your password nor your email address is sent.
Our faculty (the founders and examiners named on our about page) see the information they need to teach you, such as your name, email address, booking and anything you send for a one-to-one.
We may also share information with our professional advisers, with the police, courts or regulators when the law requires it, or with a buyer if the business is sold, in which case they would have to use it as this notice describes.
5. Information outside the UK
Some of our providers, including Cloudflare, PayPal, Resend, Zoom, Vimeo and Google, are based in or may process information in the United States or other countries outside the UK. Where they do, the transfer is protected as UK law requires, for example by the UK Extension to the EU–US Data Privacy Framework or by the UK’s International Data Transfer Agreement or Addendum to the EU standard contractual clauses.
6. How long we keep it
| Information | How long |
|---|---|
| Your account and progress | Until you ask us to delete your account. Many candidates apply more than once, so we do not delete accounts automatically, but we may delete one that has had no access and no sign-in for three years. |
| Sign-in records | 12 months |
| Log-in, contact and payment rate counters | Up to one hour |
| Order, payment and checkout-confirmation records | Six years after the end of the financial year of the purchase, as tax and company law require |
| Messages you send us | As long as we need them to deal with your message and any follow-up |
| Your CV, portfolio or application for a one-to-one or the course day | Used only to run your session or course day, and deleted as soon as practical afterwards |
| The webinar recording | Until the national interviews for that season have finished |
7. Cookies and browser storage
We use only what the site needs to work, so we do not ask for cookie consent.
| Name | What it does | How long |
|---|---|---|
| __Host-st3 (cookie) | Keeps you logged in. Set only when you log in or create an account. | 30 days, or until you log out |
| st3:last (browser storage) | Remembers the last question bank topic you opened, so you can go back to it. It stays in your browser and is not sent to us. | Until you clear your browser’s site data |
Turnstile on the contact form, and the Vimeo and YouTube players once you press play, may store information in your browser to work. See their providers’ privacy notices for details.
8. How we protect it
The whole site uses HTTPS. Passwords are hashed and never stored as plain text. Accounts lock for 15 minutes after 10 failed log-in attempts. Password-reset links work once and only for a limited time. The question bank is served only to signed-in members. Only the people who run ST3 Interview can see member records.
9. Your rights
You have the right to:
- ask for a copy of the information we hold about you;
- ask us to correct information that is wrong;
- ask us to delete your information;
- ask us to restrict how we use it, or object to us using it on the basis of our legitimate interests;
- ask for the information you gave us in a format you can take elsewhere.
To use any of these rights, email us at [email protected] or use our contact form. We may need to check your identity first. We will reply within one month. Some rights have limits: for example, we must keep order records for as long as the law requires, even if you ask us to delete your account.
10. Complaints
If you are unhappy with how we have used your information, please tell us first. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, or 0303 123 1113.
11. Age
Our courses are for doctors, and you must be 18 or over to create an account. We do not knowingly collect information about anyone under 18.
12. Changes to this notice
We update this notice when what we do with your information changes. The version and date at the top show when it last changed. If we make an important change, we will tell members by email.