Privacy Policy

This policy explains what we do with your information when you use this website or our coaching services. It is written to be read, not to be survived, so it says plainly what we collect, why, who else sees it, how long we keep it, and what you can require of us.

The short version. We collect what you type into our forms, and very little else. We run no advertising trackers and no analytics. We do not sell or share your personal information, and we never will. You can ask us to show you what we hold, correct it, or delete it, and we will do it.

1. Who we are

Caribbean Medical Student is a division of Medical Futures Group, LLC ("we", "us", "our"). We are the controller of the personal information described here, which means we decide why and how it is processed.

For any privacy question or request, contact us at [email protected], or by post at PO Box 3115, Kennesaw, GA 30156, United States.

We have not appointed a representative in the European Union or the United Kingdom under Article 27 of the UK and EU GDPR. If you are in either place and want to raise a privacy matter, write to us at the email or postal address above and we will deal with it directly.

2. What we collect

Information you give us. When you submit the consultation form we ask for your name and email, and optionally your phone number, your school, where you are in your training, your timeline, and what you want help with. When you request the Playbook we ask for your first name and email, both required so that we can address you properly, and optionally where you are in your training. We ask about your stage so that any guidance we later send is relevant to it, rather than sending everyone the same thing. If you go on to work with us, you may share application materials such as a personal statement or CV.

Information collected automatically. Our hosting and security provider processes your IP address and basic request data in order to serve pages and to tell real visitors apart from bots. We do not use this to build a profile of you, and we do not have an analytics platform that would let us.

What we deliberately do not collect. No advertising identifiers, no cross-site tracking, no behavioral profile, and no special category data. Please also see section 11 on health information.

3. Why we use it, and our legal basis

If you are in the UK or the EEA, we must have a lawful basis for each purpose. Here they are, purpose by purpose.

Where we rely on your consent, you can withdraw it at any time, and doing so is as easy as giving it. Withdrawing consent does not affect processing that already happened.

4. Cookies and similar technologies

This site sets nothing beyond what it needs to work securely, plus a record that you have seen the cookie notice. We use no advertising or analytics cookies of our own. The scheduling tool used to book a call, Calendly, sets its own cookies including analytics ones, and it loads whenever you open the booking page.

Every cookie is listed by name, purpose and duration in our Cookie Policy, which also explains how to block or clear the ones Calendly sets on the booking page.

5. Who we share it with

We do not sell your personal information, and we do not share it for advertising. We use a small number of service providers who process information on our instructions and are contractually bound to protect it:

• Cloudflare, for hosting, security and anti-spam protection on our forms.
• Resend, to send the emails you receive from us.
• Calendly, to run the booking calendar. It loads on the booking page and sets its own cookies, including analytics cookies of its own.
• An email delivery platform for newsletters. We have not selected one yet and no newsletter is being sent, so no such provider currently receives your information. We will name the provider here before the first newsletter goes out.

We may also disclose information where the law requires it, to establish or defend legal claims, or to protect the safety of any person. If the business is ever sold or reorganized, information may transfer as part of it, and this policy would continue to apply.

6. Where your information is processed

We operate from the United States and our service providers are largely US based, so your information will be processed there. If you are in the UK or the EEA, this means your information leaves your jurisdiction.

Where that happens we rely on the UK and European Commission Standard Contractual Clauses, or on another approved transfer mechanism such as an adequacy decision or a provider's certification under the EU-US Data Privacy Framework. You can ask us which mechanism applies to a particular provider and we will tell you.

7. How long we keep it

You can ask us to delete your information sooner, and we will unless we are required to keep it, for example for tax records.

8. How we protect it

The site is served only over encrypted connections, with a strict content security policy that blocks unauthorised scripts. Form submissions are protected against automated abuse. Access to the information you send us is limited to Shalabh Bansal and anyone directly supporting an engagement. We ask you not to send sensitive documents by email when a more secure route is available.

No system is perfectly secure, so we cannot promise absolute security. If a breach ever affects your information and creates a real risk to you, we will notify you and the relevant regulator as the law requires.

9. Your rights

Wherever you live, you can ask us to:

• tell you what we hold about you, and give you a copy;
• correct anything inaccurate or incomplete;
• delete it;
• restrict or object to how we use it;
• provide it in a portable, machine-readable form;
• stop sending you marketing, which you can also do from any email we send.

Write to us at the address in section 1. We will respond within 30 days. We may need to confirm your identity first, so that we do not disclose your information to someone else. Exercising these rights costs nothing and we will not treat you differently for it.

10. If you are in the UK or the EEA

You have the rights in section 9 under the UK GDPR and the GDPR, and you also have the right to complain to a data protection authority. In the UK that is the Information Commissioner's Office at ico.org.uk. In the EEA it is the authority in the country where you live or work. You can complain to them without contacting us first, though we would rather have the chance to put things right.

11. If you are in Canada

We handle your information in line with PIPEDA. You can ask for access to it and challenge how we handle it, using the contact details in section 1, and you may escalate to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

We only send you commercial email where you have given express consent, every message identifies us and includes a way to stop, and we act on requests to stop promptly, as CASL requires.

12. If you are in the United States

Depending on your state, you may have the right to know what we collect, to obtain a copy, to correct it, to delete it, and not to be discriminated against for asking.

We do not sell personal information, and we do not share it for cross-context behavioral advertising. There is therefore no opt-out to offer, because there is nothing to opt out of. We also do not use or disclose sensitive personal information for purposes that require a right to limit.

13. No automated decision-making

We make no decisions about you by automated means, and we do not profile you. Every judgment about your situation is made by Shalabh Bansal, personally.

14. No protected health information

Our services are career coaching, not clinical care, and no physician-patient relationship is created by using this site or by the free 20-minute call. Please do not send us protected health information, patient identifiers, or any details about patients you have treated. We are not acting as a HIPAA covered entity here, so information you send is not protected by HIPAA. If you send it anyway, we will delete it.

15. Adults only

This site and these services are for adults aged 18 and over. We do not knowingly collect information from children. If you believe a child has given us information, tell us and we will delete it.

16. Other sites

We link to third-party sites, including the separate USMLEtutor question bank at usmletutor.com, and we embed the Calendly booking calendar on the booking page. Those services are governed by their own privacy policies, not this one. Please read them.

17. Changes to this policy

If we change this policy we will update the date at the top, and where the change is significant we will make it obvious rather than quietly editing the page. If a change affects what you have consented to, we will ask you again instead of assuming your old consent still covers it.

18. Contact and complaints

Privacy questions, requests and complaints all go to [email protected]. If you are not satisfied with our response, sections 10 to 12 explain who you can escalate to.

Caribbean Medical Student is a division of Medical Futures Group, LLC. See also our Terms & Conditions and our Cookie Policy.