Privacy Policy

Introduction

BMEssentia LLC-FZ ("BMEssentia," "we," "us," "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share, and protect your personal data, and how we use cookies and tracking technologies, when you use BMEssentia: our website (www.bmessentia.com), the Platform (platform.bmessentia.com), BMEssentia Medical City (the desktop application for Windows and Mac) and the BMEssentia App (iOS and Android).

By using BMEssentia, you agree to the collection and use of your information as described in this Privacy Policy. If you do not agree, please discontinue use of the platform immediately.

This Privacy Policy should be read alongside our Terms and Conditions. Together these documents constitute the complete legal framework governing your use of the BMEssentia platform.

SECTION 1: WHO WE ARE

• Legal Entity: BMEssentia LLC-FZ
• Founder and CEO: Hasan Khaled Hasan Ismail
• Registered in: Dubai, United Arab Emirates
• Privacy Requests: team@bmessentia.net (subject line "Privacy Request")
• General Support: team@bmessentia.net
• Tutoring Support: specialistnetworksupport@bmessentia.com
• Institutional Support: institutionalsupport@bmessentia.com
• Website: www.bmessentia.com
• Platform: platform.bmessentia.com

BMEssentia LLC-FZ is the data controller for the personal data of visitors to our website and of individual users: subscribers and trial users, buyers of the one-time Medical City licence, founding members, tutor applicants and tutors, and institutional contacts. As data controller, BMEssentia determines the purposes and means of processing that personal data and is responsible for ensuring that processing complies with applicable data protection laws including the UAE Federal Decree Law No. 45 of 2021 on Personal Data Protection, the EU General Data Protection Regulation (GDPR), and the UK GDPR. Where your seat is provided by a university, hospital, company or other institution, that institution is the data controller for the personal data processed in connection with your seat and BMEssentia acts as its data processor, as explained in Section 12.

SECTION 2: WHAT DATA WE COLLECT

2.1 Data You Provide Directly

When you create an account or use the platform, we collect your full name, email address, password (encrypted, we never store plain-text passwords), subscription and billing information processed by third-party payment providers, and any content you create on the platform such as notes, highlights, and portfolio entries.

2.2 Payment Information

We do not directly store your full payment card details. Payment transactions are handled by PCI-compliant third-party payment processors. We may retain limited transaction records such as subscription tier, payment date, and amount for billing and legal purposes.

2.3 Usage and Analytics Data

When you use BMEssentia, we automatically collect: courses, devices, guides, and content accessed; time spent on platform features; learning progress and completion data; Essentia Points activity and streak data; features used and interactions with the platform; and login timestamps and session activity. Equivalent data from Medical City is described in Section 14.

2.4 Technical Data

We may collect limited technical information including IP address, browser type and version, operating system, device type (desktop, mobile, tablet), app version, and referring URLs. This data is used for security monitoring, fraud detection, and platform performance optimization. When something goes wrong, the website, the Platform, the App and Medical City send an automatic error or crash report (error message, stack trace, app or browser version, operating system and the page or place where it happened) to our error-monitoring provider, Sentry; email addresses and access tokens are removed before the report is sent.

2.5 Community Data

When you participate in the Private Global BME Community, we collect your community posts, replies, and interactions; content you report to our moderation team; reactions and engagement data within the community; and your community activity timestamps. Community posts you make publicly within the platform are visible to all community members. Moderation records relating to your account are retained by BMEssentia for platform integrity purposes.

2.6 Tutoring Data

If you enroll in a tutoring cohort as a student or apply to become a tutor, additional data is collected as described in full in Section 11 of this Privacy Policy.

2.7 Institutional Data

If you access BMEssentia through an institutional license, the roles and the additional data are described in full in Section 13 of this Privacy Policy.

2.8 Founding Member Data

If you participate in the BMEssentia Founding Members Program, additional data is collected as described in full in Section 13 of this Privacy Policy.

2.9 AI Interaction Data

When you interact with the Essentia Assistant, we collect your text inputs and any images, diagrams, or files you upload to the Assistant. This data is processed to generate responses and may be used in anonymized and aggregated form to improve the Assistant's performance. We do not use individually identifiable AI interaction data for any purpose other than generating your response and platform quality assurance. Full details of how AI interaction data is handled are described in Section 9 of this Privacy Policy.

2.10 Medical City Data

If you use BMEssentia Medical City, we collect licence and purchase data, gameplay and learning data (including your position in the 3D city, sampled at regular intervals), certificate data and any bug or crash reports you send, as described in full in Section 14 of this Privacy Policy.

SECTION 3: HOW WE USE YOUR DATA

3.1 Account Management

To create and manage your BMEssentia account, verify your identity and authenticate your access, and process your subscription and billing.

3.2 Platform Delivery

To provide access to courses, devices, guides, and all platform features; to track your learning progress and Essentia Points; and to personalise your learning experience based on your activity and preferences.

3.3 Communication

To send subscription confirmations, renewal reminders, and billing notifications; to send platform updates, new feature announcements, and policy changes; to respond to your support inquiries; and to send marketing communications where you have consented, with opt-out available at any time.

3.4 Platform Improvement

To analyse usage patterns and improve platform features, monitor platform performance and fix technical issues, and develop new content and features based on aggregated, anonymized user behaviour data. We do not use individually identifiable data for platform improvement purposes.

3.5 Security and Fraud Prevention

To detect, prevent, and investigate fraudulent activity, unauthorized access, credential sharing, competitor access, scraping, and any other activity that violates our Terms and Conditions. Access logs, session data, and usage patterns may be reviewed for security enforcement purposes. This processing is carried out under our legitimate interests in protecting the platform, its users, and our intellectual property.

3.6 Legal Compliance

To comply with applicable laws and regulations including UAE Federal Decree Law No. 45 of 2021, GDPR, UK GDPR, and any other applicable data protection law. To respond to lawful requests from regulatory authorities, courts, or law enforcement agencies.

3.7 Legitimate Interests Assessment

Where BMEssentia processes your data on the basis of legitimate interests, we have conducted a Legitimate Interests Assessment and determined that our interests in platform security, fraud prevention, IP protection, and platform improvement are not overridden by your rights and freedoms as a data subject. You have the right to object to processing on this basis at any time by contacting team@bmessentia.net.

SECTION 4: LEGAL BASIS FOR PROCESSING (GDPR AND UAE LAW)

4.1 EU and UK Users: GDPR Legal Bases

For users in the EU and UK, we process your personal data on the following legal bases:

• Contract: processing necessary to provide you with the platform and fulfil your subscription agreement
• Legitimate Interests: processing necessary for platform security, fraud prevention, IP protection, and analytics, where these interests are not overridden by your rights as confirmed by our Legitimate Interests Assessment
• Legal Obligation: processing required to comply with applicable laws
• Consent: for marketing communications and any optional data processing you have explicitly agreed to

You may withdraw consent at any time by contacting team@bmessentia.net or using the opt-out option in any marketing email. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

4.2 UAE Users: Federal Data Protection Law

For users in the United Arab Emirates, BMEssentia processes your personal data in compliance with UAE Federal Decree Law No. 45 of 2021 on Personal Data Protection. Under this law BMEssentia processes your data on the following bases:

• Performance of a contract to which you are a party: providing you with platform access under your subscription agreement
• Compliance with a legal obligation to which BMEssentia is subject
• Legitimate interests pursued by BMEssentia that do not prejudice your interests or fundamental rights
• Your consent where explicitly provided

UAE users have the right to access their personal data, request correction of inaccurate data, request deletion of their data subject to applicable legal retention requirements, and object to processing that causes them damage. To exercise these rights contact team@bmessentia.net.

4.3 Global Users

For users outside the EU, UK, and UAE, BMEssentia applies data protection standards consistent with the principles in this Privacy Policy. We are committed to handling all user data responsibly regardless of jurisdiction.

SECTION 5: HOW WE SHARE YOUR DATA

BMEssentia does not sell your personal data. We do not share your data with data brokers or with any third party for that party's own marketing. On bmessentia.com we use advertising measurement tags, described in Section 10.5, to measure our own advertising; they run only as your cookie choice allows. We may share your data only in the following limited circumstances:

5.1 Service Providers

We work with trusted third-party service providers who assist us in operating the platform, including payment processors to handle subscription billing, cloud hosting providers to store platform data securely, email delivery services to send platform communications, and analytics providers to understand platform performance in anonymized form. All service providers are contractually required to handle your data securely, to use it only for the purposes we specify, and to comply with applicable data protection law. We do not allow service providers to use your data for their own purposes. The service providers we use at launch are listed in the table below. We will update this list before adding a new provider.

5.2 Tutoring Feature

Within the tutoring feature, limited data is shared between tutors and enrolled students as necessary to deliver the tutoring service, including attendance records, assignment submissions and feedback, and Board Room interactions. This sharing is governed by Section 10 of this Privacy Policy. Tutors cannot access student personal account information beyond what is displayed within the cohort space.

5.3 Institutional Licensing

Where your seat is provided by an institution, the institution decides how your learning data is used, and your usage, progress and engagement data are visible to the institution's designated administrator, and to professors or supervisors the institution sets up, through the organisational dashboard as described in Section 12. BMEssentia processes that data on the institution's documented instructions and does not share it with the institution beyond what the dashboard and the institution's licence provide. Your payment details (if any) and private messages are not shown to the institution.

5.4 Legal Requirements

We may disclose your data if required to do so by law, court order, governmental authority, or regulatory body. We may also disclose data where we believe disclosure is necessary to protect the rights, property, or safety of BMEssentia, its users, or the public, including for the investigation and prosecution of platform abuse, scraping, unauthorized access, or intellectual property infringement.

5.5 Business Transfers

In the event of a merger, acquisition, or sale of all or part of BMEssentia's assets, your data may be transferred as part of that transaction. You will be notified via email and a prominent notice on the platform prior to any such transfer, and the acquiring entity will be required to honour this Privacy Policy.

5.6 With Your Consent

We may share your data with third parties where you have given us explicit, informed consent to do so. You may withdraw this consent at any time by contacting team@bmessentia.net.

SECTION 6: DATA RETENTION

We retain your personal data for as long as necessary to fulfil the purposes described in this Privacy Policy and as required by applicable law. The following retention periods apply:

Upon a valid deletion request, we will remove your personal data within 90 days, except where retention is required by applicable law or where the data is necessary for the resolution of a pending dispute or legal claim.

SECTION 7: YOUR RIGHTS

7.1 All Users

All BMEssentia users regardless of location have the right to access the personal data we hold about them, request correction of inaccurate data, request deletion of their account and associated data subject to legal retention requirements, opt out of marketing communications at any time, and lodge a complaint regarding our data practices.

7.2 EU and UK Users (GDPR)

If you are located in the EU or UK, you have the following additional rights: Right to Erasure to request deletion of your personal data; Right to Restriction to request that we limit how we process your data; Right to Data Portability to receive your data in a structured, commonly used, machine-readable format; Right to Object to processing based on legitimate interests or for direct marketing purposes; and Right to Withdraw Consent where processing is consent-based. To exercise any of these rights, contact team@bmessentia.net. We will acknowledge your request within 72 hours and respond fully within 30 days.

7.3 UAE Users

If you are located in the UAE, you have the right under Federal Decree Law No. 45 of 2021 to access your personal data, request correction of inaccurate or incomplete data, request deletion of your data where it is no longer necessary for the purpose for which it was collected, and object to processing that causes you damage. Contact team@bmessentia.net to exercise these rights. We will respond within 30 days.

7.4 Data Subject Request Process

To submit a data subject request: send your request to team@bmessentia.net with the subject line "Privacy Request." Include your full name, the email address registered to your account, the specific right you are exercising, and any relevant details. BMEssentia will verify your identity before processing any request. Verification may require you to confirm details associated with your account. Once verified, BMEssentia will acknowledge your request within 72 hours and provide a full response within 30 days. If your request is complex or you have submitted multiple requests, we may extend this period by a further 30 days and will notify you accordingly.

7.5 Automated Decision-Making

BMEssentia does not make any decisions about you solely through automated processing that produce legal or similarly significant effects on you without human review. The Essentia Points system, content recommendations, and learning progress tracking are automated features that affect your learning experience but do not produce legal or employment-related decisions. If this changes, we will update this Privacy Policy and notify you accordingly. Medical City scores, competency evidence and certificates are calculated automatically from your results; they are educational records with no legal effect, and you can ask us to review a score or certificate you believe is wrong.

SECTION 8: DATA SECURITY

BMEssentia takes the security of your personal data seriously. We implement reasonable technical and organisational measures to protect your data against unauthorised access, loss, destruction, or alteration, including:

• Encrypted storage of passwords: plain-text passwords are never stored
• Secure HTTPS connections across all platform touchpoints
• Access controls limiting who within BMEssentia can access user data on a need-to-know basis
• Regular monitoring for suspicious access patterns, scraping activity, and unauthorized extraction
• PCI-compliant payment processing: full card details are never stored by BMEssentia
• Encrypted storage for all credential documents submitted during the tutor application process
• Restricted access controls for session recordings and sensitive tutoring data
• Medical City licence keys stored only in hashed form; offline licence tokens digitally signed so they cannot be altered

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

8.1 Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, BMEssentia will notify the relevant supervisory authority within 72 hours of becoming aware of the breach as required by GDPR and UK GDPR. BMEssentia will also comply with UAE Federal Decree Law No. 45 of 2021 breach notification requirements for UAE users. Where the breach is likely to result in a high risk to your rights and freedoms, we will notify affected users directly without undue delay. Breach notifications will describe the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures taken or proposed to address the breach. For institution-provided seats, BMEssentia notifies the institution, as controller, without undue delay and in any event within 48 hours of becoming aware of a breach, as set out in the Data Processing Agreement.

8.2 Platform Integrity Monitoring

BMEssentia monitors platform access patterns, session behaviour, and usage data for the purpose of detecting and preventing unauthorized access, scraping, competitive intelligence gathering, credential sharing, and other activities that violate our Terms and Conditions. Access logs and session data may be reviewed by the BMEssentia security team for this purpose. This monitoring is carried out under our legitimate interests in protecting the platform, its users, and our intellectual property.

SECTION 9: ARTIFICIAL INTELLIGENCE AND THE ESSENTIA ASSISTANT

9.1 What the Essentia Assistant Collects

When you interact with the Essentia Assistant, BMEssentia collects your text inputs and any images, diagrams, files, or other content you upload to the Assistant. This data is processed in real time to generate your response.

9.2 How AI Interaction Data Is Used

AI interaction data is used for the following purposes and no others: to generate the response to your specific query in real time; for quality assurance review on an anonymized basis; and in aggregated, anonymized form to improve the performance and accuracy of the Essentia Assistant over time. BMEssentia does not use individually identifiable AI interaction data to train external AI models, sell to third parties, or use for any commercial purpose unrelated to improving the Essentia Assistant for your benefit. The Essentia Assistant is powered by Claude, an AI model provided by Anthropic, PBC (United States), acting as our service provider. When you use the Assistant we send Anthropic your message, any images, diagrams or files you upload to it, and the earlier messages and lesson context needed to answer. We do not send your payment details or your password. Under our commercial agreement, Anthropic does not use this data to train its models.

9.3 AI Interaction Data Retention

Individually identifiable AI interaction data is retained for 90 days from the date of the interaction. After 90 days, interaction data is anonymized and may be retained in aggregated form for platform improvement purposes. You may request deletion of your AI interaction data within the 90-day retention period by contacting team@bmessentia.net.

9.4 Uploaded Content

Images, diagrams, and files you upload to the Essentia Assistant are processed to generate your response and are not stored beyond the 90-day retention period. BMEssentia does not use uploaded images or files for any purpose other than generating your requested response and quality assurance.

9.5 AI and GDPR

Processing of AI interaction data is carried out on the legal basis of contract performance, providing you with the Essentia Assistant feature as part of your subscription. Where AI interaction data is used for platform improvement, processing is carried out on the basis of our legitimate interests in maintaining and improving the quality of the Essentia Assistant, subject to your right to object at any time.

9.6 Prohibited AI Interactions

You may not use the Essentia Assistant to attempt to extract BMEssentia's proprietary content, test platform vulnerabilities, generate content designed to compete with BMEssentia, or engage in any activity prohibited under our Terms and Conditions. BMEssentia monitors AI interaction patterns for such prohibited uses as part of its platform integrity monitoring described in Section 8.2.

SECTION 10: COOKIES AND TRACKING TECHNOLOGIES

10.1 What Are Cookies?

Cookies are small text files placed on your device when you access the BMEssentia platform. They allow us to recognise your device, remember your preferences, and provide a smoother, more personalised experience. Similar technologies we may use include local storage, session storage, pixel tags and web beacons, and analytics identifiers.

10.2 Strictly Necessary Cookies

These cookies are essential for the platform to function and cannot be disabled. They include cookies that keep you logged in during your session, remember your subscription status and access tier, enable secure authentication and protect against session hijacking, and maintain your language and region preferences. These cookies do not require your consent as they are technically essential.

10.3 Functional Cookies

These cookies enable enhanced functionality and personalisation. They remember your last accessed course, device, or guide; preserve your notepad and highlight settings; remember your display preferences within the platform; and store your learning stack selections between sessions. Disabling functional cookies may reduce the quality of your experience but will not prevent you from accessing core content.

10.4 Analytics and Performance Cookies

These cookies and similar technologies help us understand how people use BMEssentia. We use PostHog for this. In the EU and the UK, PostHog analytics run only after you give consent in the cookie banner; elsewhere, PostHog runs in cookieless mode, without analytics cookies or identifiers stored on your device. Analytics show which courses, devices and guides are used most, how long features are used, technical errors and performance issues, and user journeys, and we report them in aggregated form. We do not sell or share analytics data with third parties for advertising purposes.

10.5 Marketing and Advertising Measurement

On the public website bmessentia.com we use advertising measurement tags, at launch the Meta Pixel, to understand whether our advertising works: which visits came from an ad, and how many visitors then start the free trial or request a demo. The tag sets cookies and sends Meta your browser's details, the page visited and these actions; Meta may combine this with information it already holds about you under its own privacy policy. In the EU, EEA, UK and Switzerland these tags run only after you choose "Accept all" in the cookie banner. Elsewhere they run unless you choose "Reject non-essential". You can change your choice at any time through "Cookie settings" in the website footer. These tags are not used on the Platform, Medical City or the App. If we add another advertising provider, we will list it in Section 5.1 before it is used.

10.6 Third-Party Cookies

BMEssentia works with trusted third-party service providers who may set their own cookies on your device, including payment processors to enable secure billing and fraud prevention, cloud hosting providers to deliver platform content reliably, email delivery services to manage platform communications, and analytics providers to help us understand platform performance in anonymised form. Apart from the advertising measurement tags on bmessentia.com described in Section 10.5, BMEssentia does not allow third-party advertising networks to place cookies, and none are placed on the Platform, Medical City or the App. We do not show third-party advertisements.

10.7 Cookie Duration

Session Cookies are temporary and deleted automatically when you close your browser or log out. Persistent Cookies remain on your device for a set period after your session ends. The majority of our persistent cookies expire within 12 months. Where longer retention is necessary, this will not exceed 24 months.

10.8 Managing Your Cookie Preferences

You have full control over the cookies placed on your device through your browser settings. All major browsers allow you to view, manage, block, or delete cookies. On bmessentia.com you can also change your choice at any time through "Cookie settings" in the footer. To opt out of anonymised analytics tracking contact team@bmessentia.net and we will process your request within 30 days.

10.9 Do Not Track

BMEssentia has made a deliberate policy decision not to alter its data collection practices in response to Do Not Track (DNT) browser signals. This decision reflects the current absence of a universal legal or industry standard for how DNT signals should be interpreted and implemented. BMEssentia is committed to reviewing this policy as standards evolve and will update this Privacy Policy accordingly.

10.10 Cookies and GDPR

For users in the EU or UK, strictly necessary cookies do not require your prior consent. All non-essential cookies require your freely given, informed, and unambiguous consent before being activated. You may withdraw consent at any time without detriment to your platform access. We do not use cookie consent as a condition of accessing core platform services.

SECTION 11: TUTORING SERVICES: DATA COLLECTION AND USE

11.1 Overview

BMEssentia's live expert tutoring feature connects verified specialist tutors with enrolled students through the BMEssentia platform. All tutoring activity takes place exclusively within the BMEssentia platform. This section covers all personal data collected in connection with the tutoring feature for both students and tutors.

11.2 Data Collected from Students

When a student enrolls in a tutoring cohort BMEssentia collects: full name and registered email address; subject and cohort enrolled in; enrollment type (full cohort or mid-cycle); payment confirmation including amount, date, and transaction reference (full card details are never stored, payment processing is handled by Stripe); session attendance records and join and leave timestamps; in-session activity data; all platform messages with their tutor; all Board Room interactions; assignment submissions, grades, and written feedback received; and star ratings and written reviews submitted at cohort completion.

11.3 Data Collected from Tutor Applicants

During the tutor application process BMEssentia collects: full legal name; government-issued photo ID; date of birth to verify the minimum age requirement of 22 years; country of residence; official university transcripts; graduation or degree certificates; type-specific supporting credential documents; all responses to the four-section online application form; subjects and devices applied to teach; and pre-recorded teaching demonstration videos where submitted. These documents are reviewed by the BMEssentia team for verification purposes only and are not shared with any third party.

11.4 Data Collected from Active Tutors

Once a tutor is approved and active BMEssentia collects: profile photograph, tutor type badge, headline, bio, and video introduction (all public-facing); cohort and session delivery records; student enrollment numbers; assignment grading records and turnaround times; student message response times; Board Room activity; star ratings and reviews received; performance review records; Stripe Connect account reference; payout amounts and confirmation dates; held payout records and their reasons; and all platform communications between the tutor and BMEssentia.

11.5 Session Recordings

All live sessions conducted through the BMEssentia Live Lecture Room are recorded automatically from the moment the session begins. Recordings capture all audio, video, screen sharing, and in-session activity from both the tutor and participating students. Recordings are stored securely and made available to enrolled students through the Lecture Library within 1 hour of session completion. Enrolled students retain permanent read-only access to recordings from cohorts they completed regardless of subsequent subscription status. BMEssentia may review recordings for quality assurance, complaint investigation, and dispute resolution. Tutors and students may not download, copy, share, or distribute recordings outside the platform.

11.6 How Tutoring Data Is Used

BMEssentia uses tutoring data to deliver the tutoring service including enrollment, session management, assignment grading, and cohort completion; verify tutor credentials against published qualification standards; process student enrollment payments and tutor cohort payouts through Stripe; monitor tutor performance against published quality standards; display approved tutor profile information publicly to enable informed student enrollment decisions; record session attendance and assignment completion to determine review eligibility; review communications and recordings in the event of a dispute or complaint; and improve the platform using aggregated and anonymized data only.

11.7 Tutoring Data Access

Tutors may access their own cohort data, session records, student attendance, assignment submissions, payout records, and platform messages within their cohorts. They cannot access other students' personal account information. Students may access their own session recordings, assignment feedback, Board Room content, and messages within enrolled cohorts. They cannot access other students' data, submissions, or grades. The BMEssentia team accesses all tutoring data for operational, verification, quality assurance, and dispute resolution purposes. Stripe processes payment and payout data under its own Privacy Policy. No tutoring data is sold, rented, or shared with any other third party.

11.8 Tutoring Data Retention

11.9 Tutoring Security

All tutor credential documents are transmitted over encrypted connections and stored in access-controlled secure storage. Session recordings are stored in encrypted cloud infrastructure with restricted access. Payout data is processed through Stripe's PCI-compliant infrastructure. Platform messaging is transmitted and stored within BMEssentia's secure environment. Internal access to tutoring data is restricted on a need-to-know basis within the BMEssentia team.

SECTION 12: INSTITUTIONAL LICENSING: DATA COLLECTION AND USE

12.1 Overview

Where BMEssentia is accessed through an institutional licence, the institution is the data controller for the personal data processed in connection with its licensed users' seats, and BMEssentia processes that data as the institution's data processor, on the institution's documented instructions and under a Data Processing Agreement signed with the institution. The institution's own privacy notice applies to that processing. BMEssentia remains a data controller for: institutional contact and billing data (Section 12.2); the processing needed to secure its services, prevent fraud and comply with its own legal obligations; and, if you choose to continue using BMEssentia on your own individual plan after your seat ends, your account from that point on.

12.2 Data Collected from Institutional Contacts

During the institutional onboarding process BMEssentia collects, as controller: institution name, type, and registered address; designated administrator full name, email address, and phone number; billing contact name and email; and details of the agreed licence including division, tier, seat count, duration, learning pathway, and commercial terms.

12.3 Data Processed for Licensed Institutional Users

For users accessing BMEssentia through an institutional licence, BMEssentia processes the categories of data described in Sections 2 and 14 (account data, learning records across the Platform, Medical City and the App, and engagement data) on behalf of the institution. This data is made visible to the institution's designated administrator, and to professors or supervisors the institution sets up, through the organisational dashboard in accordance with the institution's licence.

12.4 Institutional Administrator Visibility

The institutional dashboard can show the following data for licensed users: user names and email addresses, login activity and session times, course and device progress and completion, quiz performance data, time spent on platform features, Medical City mission, challenge and Device Lab progress, competency evidence, heat maps of where users spent time in Medical City, and certificate status. Enterprise tier institutions additionally see time-based engagement analytics and trends, completion and progress trends, engagement rankings, and exportable reports (CSV and PDF) as described in the Institutional Licensing Contract. The institution does not see your payment details or private messages.

12.5 Institution's Data Responsibilities

As data controller, the institution is responsible for having a lawful basis for the processing, for informing its users that their data will be processed through BMEssentia and visible on the organisational dashboard, for obtaining any consent required under local law, for using dashboard data in compliance with applicable data protection laws, and for responding to its users' data protection requests. If you are an institutional user, please send requests about your seat data to your institution. Requests we receive about institution-provided seats are forwarded to the institution within 48 hours, and BMEssentia assists the institution in responding to them.

12.6 Institutional Data Retention

Institutional contact and billing data is retained for the duration of the licence plus 5 years for legal and dispute resolution purposes. Seat data is processed for the duration of the licence; when the licence ends, BMEssentia deletes or returns it on the institution's instructions as set out in the Data Processing Agreement, unless the law requires us to keep it. The administrator can export available data from the dashboard before the termination date. If you choose to keep your account and continue on your own individual plan, your learning record continues in your individual account, for which BMEssentia is the controller.

SECTION 13: FOUNDING MEMBERS PROGRAM: DATA COLLECTION AND USE

13.1 Overview

Participants in the BMEssentia Founding Members Program are subject to the standard data collection described in Sections 2 and 3 of this Privacy Policy. This section covers the additional data collected specifically in connection with the Founding Members Program.

13.2 Beta Deliverable Data

As part of the Founding Members Program, BMEssentia may collect written testimonials provided by founding members; video testimonials recorded and submitted by founding members; community posts made as part of the founding member engagement; and written feedback provided during the beta access period. This data is collected with your knowledge and cooperation as part of the founding member commitment described in the Terms and Conditions.

13.3 How Beta Deliverable Data Is Used

Written testimonials and video testimonials may be used by BMEssentia for marketing, promotional, and platform credibility purposes including publication on the BMEssentia website, social media channels, investor materials, and other promotional contexts. By providing a testimonial as part of the founding member program, you grant BMEssentia a non-exclusive, royalty-free, perpetual licence to use your testimonial in these contexts. Your first name and tutor type or professional role may be attributed to the testimonial. Your last name and personal contact details will never be published without your explicit additional consent.

13.4 Withdrawal of Testimonial Consent

You may request withdrawal of consent for future use of your testimonial at any time by contacting team@bmessentia.net. Withdrawal of consent does not affect uses of your testimonial that have already occurred prior to the withdrawal request. BMEssentia will cease future use of your testimonial within 30 days of a valid withdrawal request.

13.5 Founding Member Data Retention

Written testimonials and video testimonials are retained for the duration of their commercial usefulness to BMEssentia unless you withdraw consent for their use. Beta feedback data is retained for 3 years from the end of the founding member access period and then securely deleted.

SECTION 14: MEDICAL CITY: DATA COLLECTION AND USE

14.1 Overview

BMEssentia Medical City is a desktop application for Windows and Mac. You sign in to it with the same BMEssentia account you use for the website, the Platform and the App, and your Medical City progress joins the same progress record. This section describes the additional data processed when you buy, install and use Medical City. If your seat is provided by an institution, Section 12 also applies.

14.2 Licence, Purchase and Download Data

We process your licence type (subscription, one-time licence, instalment plan, Update Pass or institutional seat), licence status, the version you were entitled to at purchase and the date until which you receive updates, instalment payment status, and transaction references (full card details are handled by Stripe and never stored by BMEssentia). Licence keys are stored only in hashed form. Each time Medical City checks its licence we record the time, the result, the app version and the platform. When you download an installer we record the version, the platform and the country derived from your IP address. We use this data to deliver and protect your licence, to prevent licence sharing and fraud, and to keep billing records.

14.3 Offline Play

When an online licence check succeeds, Medical City stores a digitally signed licence token on your computer. It allows Medical City to run without an internet connection for up to 7 days after the last successful check. The token contains your licence details and its expiry time and stays on your computer; BMEssentia cannot read it remotely. Progress made offline is sent to us the next time you connect.

14.4 Gameplay and Learning Data

While you play, Medical City sends us: your position inside the city (the floor or area and map coordinates), sampled every 5 seconds, which we use to calculate the time you spend in each mode and to build heat maps of where time is spent; the start and end of sessions and the time spent in free exploration, story mode and the Device Lab; the chapters, missions, simulations and challenges you start and complete, with the correctness of answers, attempts, hints used, mistakes, scores, stars and difficulty level; your Device Lab progress for each device; and competency evidence derived from these results. We use this data to save and synchronise your progress, to show your progress, points and rank, to issue certificates, to provide institutional dashboards for institution-provided seats, and, in aggregated form, to improve Medical City. The legal basis is the performance of our contract with you and, for improvement in aggregated form, our legitimate interests.

14.5 Certificates and Public Verification

Certificates you earn carry a unique certificate code. Anyone who has the code can check the certificate at platform.bmessentia.com/verify/ followed by the code. The verification page shows only what the certificate shows: the holder's name, the certificate title and level, the issue date and the issuing institution where applicable. It never shows your email address. You decide with whom you share a certificate code. You can ask us to revoke a certificate, after which the verification page reports it as no longer valid.

14.6 Bug and Crash Reports

Medical City sends automatic crash reports to Sentry as described in Section 2.4, with email addresses and access tokens removed. If you send a bug report, crash report or idea from Medical City, we receive what you write, the app version, the platform, the place in the city where it happened, a technical log of up to 16 KB, and your email address if you provide it or are signed in. We use reports only to investigate and fix problems and to reply to you.

14.7 Medical City Data Retention

Raw position samples are deleted about 100 days after they are recorded; the daily time totals and heat-map cells calculated from them, and your other progress records, are kept with your account for the retention period of account data in Section 6. Licence and purchase records are kept as billing records (7 years). Licence check and download logs are kept for 12 months. Bug and crash reports are kept for 2 years, like support communications. Certificate records are kept for as long as your account exists so that issued certificates can be verified, unless you ask us to revoke them.

SECTION 15: CHILDREN'S PRIVACY

BMEssentia is intended for users who are at least 18 years of age. We do not knowingly collect personal data from anyone under the age of 18. If we become aware that we have collected data from a minor, we will delete it promptly without notice. If you believe a minor has provided us with personal data, contact us immediately at team@bmessentia.net and we will take action within 48 hours.

SECTION 16: INTERNATIONAL DATA TRANSFERS

BMEssentia LLC-FZ is based in Dubai, United Arab Emirates. If you access BMEssentia from the EU, UK, or other regions with data protection laws, your data may be transferred to and processed in the UAE, the United States (for example by Stripe, Google, Vercel, Resend, Sentry and Anthropic), the European Union (PostHog) and other countries where our service providers operate, including on Cloudflare's and Vercel's global networks.

Where such transfers occur and are subject to GDPR, we ensure appropriate safeguards are in place including Standard Contractual Clauses (SCCs) approved by the European Commission and transfers only to service providers who provide adequate levels of data protection.

For UAE-based users, data transfers to third-party service providers outside the UAE are made only to jurisdictions that provide an adequate level of data protection or where appropriate contractual safeguards are in place as required by UAE Federal Decree Law No. 45 of 2021.

SECTION 17: UAE FEDERAL DATA PROTECTION LAW: COMPLIANCE

BMEssentia LLC-FZ is registered in Dubai, United Arab Emirates and is subject to UAE Federal Decree Law No. 45 of 2021 on Personal Data Protection (UAE PDPL). This section sets out BMEssentia's specific obligations and your rights under UAE law.

17.1 BMEssentia's Obligations Under UAE PDPL

• Process personal data only for specified, explicit, and legitimate purposes
• Collect only the minimum data necessary for the stated purpose
• Keep personal data accurate and up to date
• Implement appropriate technical and organisational security measures
• Notify the UAE Data Office and affected individuals of personal data breaches where required
• Respect data subject rights as defined under the UAE PDPL
• Ensure that cross-border data transfers comply with UAE PDPL requirements

17.2 Your Rights Under UAE PDPL

If you are located in the UAE, you have the following rights under Federal Decree Law No. 45 of 2021:

• Right to be informed about how your personal data is collected and used
• Right to access a copy of the personal data BMEssentia holds about you
• Right to request correction of inaccurate or incomplete personal data
• Right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, subject to legal retention requirements
• Right to object to processing of your personal data where such processing causes damage to your interests
• Right to data portability where technically feasible

To exercise any of these rights, contact team@bmessentia.net. BMEssentia will respond to all UAE PDPL rights requests within 30 days.

17.3 UAE Data Office

If you are a UAE resident and believe BMEssentia has not handled your personal data in accordance with UAE PDPL, you have the right to lodge a complaint with the UAE Data Office. BMEssentia encourages you to contact us at team@bmessentia.net first so we can address your concerns directly.

SECTION 18: THIRD-PARTY LINKS AND SERVICES

The BMEssentia platform may contain links to third-party websites or integrate with third-party services. This Privacy Policy does not apply to those third parties. We are not responsible for the privacy practices of third-party websites or services and encourage you to review their privacy policies before providing any personal data.

SECTION 19: CHANGES TO THIS PRIVACY POLICY

BMEssentia reserves the right to update this Privacy Policy at any time. When we make material changes, we will notify you by email to your registered address, display a notice on the platform, and update the Last Updated date at the top of this policy.

Your continued use of BMEssentia after changes are posted constitutes your acceptance of the updated Privacy Policy. If you do not agree, you must discontinue use and may request deletion of your data by contacting team@bmessentia.net.

SECTION 20: CONTACT AND COMPLAINTS

For any questions, concerns, or requests relating to this Privacy Policy or your personal data:

• Data and Privacy Requests: team@bmessentia.net (subject line "Privacy Request")
• General Support: team@bmessentia.net
• Tutoring Support: specialistnetworksupport@bmessentia.com
• Institutional Support: institutionalsupport@bmessentia.com
• Website: www.bmessentia.com
• Platform: platform.bmessentia.com
• Response Time: BMEssentia aims to respond to all privacy inquiries within 48 business hours

20.1 EU Users: Supervisory Authority

If you are located in the European Union and are not satisfied with our response, you have the right to lodge a complaint with your national data protection supervisory authority. A full list of EU supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en. BMEssentia encourages you to contact us at team@bmessentia.net before escalating to a supervisory authority.

20.2 UK Users: Supervisory Authority

If you are located in the United Kingdom and are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). Website: www.ico.org.uk. Phone: 0303 123 1113. Address: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom.

20.3 UAE Users: UAE Data Office

If you are located in the UAE and are not satisfied with our response, you have the right to lodge a complaint with the UAE Data Office in accordance with Federal Decree Law No. 45 of 2021. BMEssentia encourages you to contact us at team@bmessentia.net before escalating to the Data Office.