Website registration & enquiry privacy notice · Version 2026-10-29-r32 · 29 October 2026
Who is responsible?
MediBay Limited, company number 14540473, is responsible for information submitted through this website. Registered office: 128 City Road, London, EC1V 2NX, United Kingdom. Operational contact: 2nd Floor, East Neighbourhood, Usher Building, 5–7 Little France Road, Edinburgh, EH16 4UX. Privacy contact: hello@mymedibay.com.
Information we collect
The form collects your first and last name, email address and interest category. Both name fields are required. Phone number and organisation are optional. We also record transactional-email submission status for each recipient and the time of the email attempt, any selected event, your request for a reply, terms acceptance, the terms and privacy versions, your optional email-updates choice and its wording version, submission time, and a random submission reference. A digital fingerprint of the submitted fields helps avoid duplicate records when a request is retried. Replaying the same saved submission does not send its emails again.
Do not provide health information, children's details or identity documents. This is not a clinical-record or patient-registration service. Browsing registration does not verify your identity.
Purposes and legal bases
For new submissions under this notice, we handle the registration and requested reply for our legitimate interests in managing enquiries, responding to people who contact us, organising requested event attendance and protecting the website against misuse. These purposes are limited to the enquiry and necessary administration; accepting the terms is not blanket data-protection consent.
Optional launch and future-event marketing uses your separate consent. It is not required for registration or browsing. We may retain information where necessary to meet a legal obligation. You can object to processing based on legitimate interests and can object to direct marketing at any time. The team will consider your request and explain any applicable reason for retaining information.
Where enquiries go
Authorised MediBay administrators access enquiries in the website's administrator inbox. The form saves to Base44, a Wix service. After an enquiry is saved, the website attempts a transactional receipt email to the address supplied and a copy of the submitted enquiry to our Microsoft 365 shared mailbox, hello@mymedibay.com, for the authorised team handling enquiries. That shared-mailbox copy includes your first and last name, email address, phone and organisation if supplied, interest category, event selection where relevant, reply request, optional marketing choice, submission time and enquiry reference. It lets the team respond from the shared mailbox without opening the administrator workspace for each enquiry.
Separate enquiry alerts to individual staff inboxes are no longer sent. Reference-only alerts from earlier submissions may remain in authorised staff business mailboxes until reviewed under our retention arrangements. Those references remain personal data because authorised administrators can link them to a saved enquiry.
The full form record remains in Base44, and a detailed email copy is held in Microsoft 365 when delivered; the shared mailbox is not the only storage location. Email providers process message content during delivery. Provider acceptance does not prove delivery. Enquiries remain in the administrator inbox even if emails cannot be sent, are delayed or are filtered. A separate email link lets you contact the team using your own email service.
Administrator accounts
Authorised team members use a separate login and email-verification process handled by Base44. Account credentials and verification codes are not placed in enquiry records or saved by our public form. Creating or verifying an account does not assign administrator permission; the authenticated role and protected backend access are checked separately. Account recovery messages are separate from enquiry receipts and optional marketing.
Providers and overseas processing
Base44 hosts the website and enquiry records and processes technical information needed to run and protect them. Its email service and delivery providers process the recipient address, message content and delivery-related information for transactional messages. Microsoft 365 processes the detailed enquiry copies in the shared mailbox and any remaining reference-only alerts from earlier submissions in individual business mailboxes. Direct emails and replies to hello@mymedibay.com are also held in that mailbox and may contain the information you choose to send. Copies of confirmations are delivered to the email address you supply. Hosting or support may involve processing outside the UK. See Base44's data processing agreement for its processing terms and transfer safeguards, or ask MediBay for the arrangements that apply to this website. No UK-only storage promise is made here.
Base44's published AI-training policy depends on the workspace plan: Enterprise excludes training use, while other plans may permit it. The workspace-specific plan and storage arrangements should be confirmed with MediBay before you share information you are not comfortable submitting. See Base44's privacy and security information. Do not use the form for sensitive information.
Founder portraits originate from Forte Healthcare's public profiles. Optimised display copies are served with this website; older cached pages may request the original public image host. Loading images or videos sends standard technical information, including an IP address, to the relevant media host; it does not send registration fields.
How long information is kept
Enquiries are kept while needed for the selected enquiry, relevant requested follow-up, managing an event request or resolving a complaint or legal obligation. The team considers whether an enquiry is still active, whether a reply or event follow-up is outstanding and whether a record is needed to evidence a request or consent. This website does not implement or promise automatic deletion after a fixed number of days. Ask the team to close an enquiry or explain the retention decision for it. Retention reviews and applicable access, correction or erasure requests cover the Base44 record, shared-mailbox copies, reference alerts and related correspondence. Deleting a record in one system does not automatically delete copies in another; the team must handle those copies separately.
Optional marketing stops when you withdraw that choice. A minimal record may be needed to respect an opt-out and avoid contacting you again. Requests about earlier enquiries will be handled according to their recorded permissions and applicable notice; this update does not mark old records as accepting new terms.
Your choices and rights
Contact hello@mymedibay.com to ask for access, correction, erasure or restriction, to object to relevant processing, or to request portability where applicable. You may withdraw optional marketing consent at any time without affecting earlier lawful processing. Replying to an update or emailing the team is sufficient; you do not need a patient account.
You can raise a concern directly with the UK Information Commissioner's Office. Contacting us first is welcome but not required.
Browser storage, timing and security
A session deadline remembers when the optional two-minute enquiry prompt is due. A separate shown marker prevents repeated reminders in the same tab. After successful submission, a receipt identifier and completion time also prevent repeat reminders. These markers contain no contact-form values and do not grant patient-portal access. Display preferences use local storage; authenticated administrator sessions use separate session storage. Read the Cookies & Browser Storage information for the detail.
The server validates submissions, blocks direct public writes, checks repeated requests and applies submission limits. Aggregate counters contain no contact details. These checks are not identity verification. There are no automated clinical decisions or clinical profiling through this form.
What is required and what is optional?
Public browsing does not require registration. When you choose to send an enquiry, first name, last name, email, interest category, the requested-reply confirmation and terms acceptance are required for that submission. Other contact fields and marketing updates are optional. Transactional receipt emails do not sign you up for marketing.
Future clinical services will provide separate patient terms, privacy information and clinical consent arrangements.