Privacy Policy

theBMA (“theBMA”, “we”, “us”) is operated by Zain, trading as The Bright Minds Academy. For the purposes of UK data protection law, Zain is the data controller responsible for your personal information.

If you have any questions about this policy or how your data is handled, contact us at the.bma@outlook.com.

When you use our booking form to arrange a consultation, we ask for:

• Your full name, email address and phone number.
• What kind of support you're looking for (tutoring, university admissions support, or medicine admissions support).
• If relevant: the subject and exam board you need tutoring in.
• If relevant: which universities and course you're interested in.
• If relevant to medicine admissions: your UCAT score and band, your predicted or achieved A-Level grades, your achieved GCSE grades, and whether you receive (or have recently received) free school meals or have experience of being care-experienced, a care leaver, or estranged from your family. We ask about free school meals and care experience only to check whether you may be eligible for contextual offers, so we can give you accurate advice — you don't have to answer these, and leaving them blank doesn't affect the rest of your booking.
• Your rough budget range for our services.
• Anything else you choose to tell us in the comments field.

We only collect what we need to give you useful, accurate advice and to arrange your consultation. Every field above except your name, email, phone and the type of support you're after is optional.

We use this information to:

• Understand what you need before your consultation, so the person you speak to can prepare properly and give you relevant advice.
• Contact you about the consultation you've booked.
• Assess whether contextual offer eligibility questions are relevant to your situation, where you've chosen to answer them.

Our legal basis for processing most of this information is that it's necessary to take steps at your request before entering into a service with you (UK GDPR Article 6(1)(b)), and our legitimate interest in providing a properly tailored service (Article 6(1)(f)). Where you choose to answer the free school meals or care-experience questions, we rely on your consent (Article 6(1)(a)) — you can withdraw this at any time by contacting us, and answering is never required to complete your booking.

Many of the students who use this form are studying for GCSEs, A-Levels, or preparing university applications, and so are likely to be under 18. If you're under 13, please ask a parent or guardian to fill in the form on your behalf. If you're a teenager using this form yourself, we handle your information with the same care described in this policy, and we never use it for marketing or share it for any purpose beyond arranging and delivering the support you've asked for.

Submissions are stored in a secure database provided by Supabase, sent over an encrypted connection. Access is limited to the people at theBMA who need it to deliver your consultation and follow-up support — currently that's Zain and his co-founder.

Once you've completed the form, you're taken to Cal.com to pick an actual time for your consultation. Cal.com is a separate service we use to manage bookings and video call links — when you pick a time there, Cal.com processes your name and email under its own privacy policy, which you can find at cal.com/privacy. We don't control how Cal.com handles that part of the process.

At the time of writing, this website does not use tracking, advertising, or analytics cookies. If we introduce an analytics tool (such as Google Analytics) in future, we'll update this policy and, where the law requires it, ask for your consent first.

We keep your booking information for as long as we're actively working with you, and for up to 24 months after our last contact with you, in case you get back in touch. If you'd like us to delete your information sooner, just email us and we will, unless we're legally required to keep it for longer.

We don't sell your information, and we don't share it with anyone outside theBMA except the service providers mentioned in this policy (Supabase, to store it, and Cal.com, if you go on to book a time slot), who only process it on our instructions.

Under UK GDPR, you have the right to:

• Ask us what information we hold about you, and get a copy of it.
• Ask us to correct anything that's inaccurate.
• Ask us to delete your information.
• Ask us to restrict or object to how we use it.
• Ask for your information in a portable format.

To exercise any of these, email the.bma@outlook.com. If you're not happy with how we've handled your information, you also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

We take reasonable technical and organisational steps to protect your information, including encrypted storage and restricted access. No method of storage or transmission is ever 100% secure, but we work to keep your information as safe as we reasonably can.

We may update this policy from time to time, for example as our services or the tools we use change. We'll update the date at the top of this page when we do.

If you have any questions about this policy or your information, email the.bma@outlook.com.