Privacy Policy

This privacy notice explains how KMT Healthcare Ltd trading as GP in Practice collects, uses, shares and protects your personal data when you: use our website, products and services; contact us; attend our events; or receive marketing from us. Our cookie information sits separately in a separate document which can be accessed here: https://gpinpractice.co.uk/cookies-policy/

 

Who we are

KMT Healthcare Ltd (trading as GP in Practice) is the Data Controller of your personal data for the activities covered by this notice. Company number: 11807419. Registered address: 1 Hardman street, Spinningfields, Manchester, Greater Manchester, UK, M3 3HF.

We operate https://gpinpractice.co.uk/ and associated subdomains. 

In our privacy policy, we might refer to ‘we’, ‘us’ or ‘our’, to indicate KMT Healthcare Ltd.

 

Contact details

If you have any questions about this notice or want to exercise your data protection rights, please contact us at info@gpinpractice.co.uk. Office hours are Monday to Friday, 9.00am to 5.00pm, but we may reply to emails outside these hours.

 

What this notice covers

This notice applies when you use our website or app, create an account, buy a product or service, attend one of our events, contact our support team, subscribe to marketing, or interact with us in any other way.

 

The personal data we collect

In some cases, we need certain personal data to create your account, process your order, deliver a product or service, or respond to your request. If you do not provide that information, we may not be able to provide the relevant service or complete your request.

Depending on how you use our services, we may collect:

• Identity and contact details, such as your name, email address, postal address and telephone number;
• Account, profile and professional details, such as your username, encrypted password, professional registration details, and job role;
• Order, payment and transaction details, such as what you bought, subscription status, invoice information and payment references (we do not store your payment card details on our own systems);
• Technical and usage data, such as IP address, device and browser information, sign-in history, cookies, website/app activity and security logs;
• Communications and support data, such as emails, chat messages, call recordings and transcripts, feedback, event questions and support history; and
• Marketing preferences and suppression records, so we know what you do and do not want to receive.
• We may also collect dietary or accessibility information where needed for a face-to-face event. 
• If you have an account with us, please keep your details up to date.

 

Where we get your data from

We collect personal data:

• Directly from you, for example when you create an account on our website, place an order, complete a form, book an event, contact us, interact during a live event, or through participation in an offer, program or promotion;
• From your employer, commissioner or colleague where they arrange or fund access for you;
• From payment, webinar, event, support and marketing platforms that help us deliver our services; and
• From public sources such as Companies House, business websites, online directories, news sources, social media and LinkedIn where we are dealing with business-to-business enquiries, relationships or prospecting.
  
  

How we use your data and our lawful bases

We use personal data only where the law allows us to. The main reasons and lawful bases are:

• To create and manage your account, give you access to content, event registration, and deliver the services you have asked for – performance of a contract;
• To process orders, payments, refunds, renewals and invoices, and keep the records we need for tax and accounting – performance of a contract and legal obligation;
• To deliver face to face courses, webinars, live events and commissioned courses, including reporting account registration, attendance and feedback to commissioners where relevant – performance of a contract or legitimate interests, depending on the arrangement;
• To help us handle customer support enquiries by email, chat or phone, including recording or transcribing calls where needed for training, quality checks, dispute resolution and managing queries. If a query needs specialist input, we may share it and your contact details internally with the appropriate member of staff, including a GP in Practice clinician where relevant, so we can respond accurately – performance of a contract and/or legitimate interests;
• To send you service and administrative messages, such as account, booking and product information – performance of a contract and, where relevant, legal obligation;
• To send newsletters, product updates and other marketing via e-mail, post, or SMS (customers can request to unsubscribe from any or all channels of marketing) – consent where required by law, and otherwise legitimate interests where permitted (for example some business-to-business marketing or soft opt-in marketing to existing customers);
• To respond to website contact forms and business enquiries, manage sales discussions and keep CRM records – steps before entering into a contract and/or legitimate interests;
• To improve and secure our website, app and services, including analytics, fraud prevention, bot protection, testing, troubleshooting, hosting and system security – legitimate interests, and consent where required for non-essential cookies or similar technologies; and
• If you opt out of marketing, we will still send you non-marketing messages that are needed to provide your service, such as booking confirmations, joining instructions and important account updates. You can specify the type of marketing media you wish to opt-out of such as emails, post or SMS messaging.

 

Who we share your data with

We keep your data secure in our database with appropriate security mechanisms in place including firewalls, 2 factor authentication and secure passwords. We share personal data only where necessary and only with appropriate safeguards in place.

Depending on the service you use, this may include:

• Service providers who host, maintain or support our website, app and business systems (for example hosting, CRM, support, authentication, search, analytics and security providers);
• Providers who help us deliver courses, webinars and events, including event platforms, live audience interaction tools, venues and call-handling providers;
• Payment and finance providers, including Square, and professional advisers such as lawyers, auditors, insurers and accountants;
• Commissioners or funding organisations where they have arranged or funded your place and need confirmation of account registration, eligibility verification, attendance, feedback or related reporting;
• Group companies where there is a lawful basis to do so; and
• HMRC, regulators, courts, law enforcement or other authorities where we are required to do so or where disclosure is lawful and necessary.
• Some recipients act as our Data Processors and handle data only on our instructions. An example would be providing data to a mailing house, such as mailchimp (used currently by us), in order to send a newsletter. A contract is always in place with a Data Processor, and they are not allowed to do anything with your data other than what we have requested. We use mailchimp to send out emails to our existing subscribers and customers. We share your email, first name and surname with mailchimp.
• Other recipients, such as Square ((https://squareup.com/us/en) who we use for taking payments) and commissioners, may act as independent controllers for their own purposes.

We require these service providers by contract to safeguard the privacy and security of personal information they process on our behalf

 

How long we keep your data

We keep personal data for different periods depending on what it is and why we hold it. In summary:

• Account and service records are usually kept for the life of the account and then for up to 6 years after the account becomes dormant;
• Financial, tax and transaction records are generally kept for 6 years after the end of the relevant financial year or transaction;
• Marketing records are kept until you unsubscribe, object or withdraw consent, after which we may keep limited suppression information so we can respect your choice;;
• Dietary or accessibility information collected for a face-to-face event is kept for 90 days after the event date and then deleted in line with our event retention controls;
• If we have recorded testimonials where you can be identified such as video testimonials or written testimonials with your name, we will get your explicit consent to use this for marketing purposes. You can withdraw this consent at any time and we will remove your testimonial; and
• If you want the exact period for a specific record type, please ask us.

 

Security

We use appropriate technical and organisational security measures to protect personal data. Access is limited to people who need it for their job, and our suppliers are expected to protect personal data in line with the law and our contracts with them.

 

Your rights

You have the right to ask us to access, correct, erase, restrict or transfer your personal data, and to object to processing based on legitimate interests, including direct marketing. Where we rely on consent, you can withdraw it at any time.

• Where our use of your data requires consent, you may withdraw this consent at any time. You can do so by clicking the unsubscribe button at the bottom of every email we send you, or requesting not to be messaged directly such as by post or by SMS.
• You may ask us to change or stop the way in which we communicate with you or process data about you, and if it is not required for the purpose you provided it, then we will do so. Activities such as fulfilling our contractual obligations to you, may mean we cannot entirely stop processing your data.  However, we will always endeavour to comply with such a request.
• We may ask for proof of identity before dealing with a rights request. We usually respond within one month, although this can take longer for complex requests.
• You also have the right to complain at any time about our processing of your personal data. If you have any questions, comments or concerns about any aspect of this policy, you can contact us at info@gpipnpractice.co.uk.
• We hope we’ll be able to resolve any concerns you may have, so please contact us in the first instance.
• However, if we cannot resolve your issue to your satisfaction, you have the right to raise a complaint to the UK’s supervisory authority for data protection, the Information Commissioner’s Office (ICO), at:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Alternatively, you can email the ICO at casework@ico.org.uk or call 0303 123 1113.

 

Third-party links

Our website and app may contain links to third-party websites or services such as some of our sponsors or our CPD accreditor. We are not responsible for their privacy practices, so please read their privacy information separately.

 

Changes to this notice

We keep this privacy notice under review and may update it from time to time. If we make a significant change, we will take reasonable steps to bring it to your attention before the change takes effect where required.

 

This privacy policy was last updated 1st August 2026