What we do with your details.
Plain English, no legal padding. If anything here is unclear, email us and we’ll explain it.
Who we are
Shortlist is a UK medical school admissions coaching service run by two founders. For the purposes of UK GDPR we are the data controller for the information described here. You can reach us at hello@shortlistmed.co.uk.
What we collect
Only what you type into the enquiry form on our contact page: your name, email address, an optional phone number, the entry route you’re applying through, your application cycle, any universities you list, your exam status, and whatever you write in the message box.
We don’t use tracking cookies, we don’t run advertising pixels, and we don’t buy or scrape contact details from anywhere else.
Why we collect it
To reply to your enquiry and to prepare properly for your free consultation. If you go on to work with us, to deliver the coaching you’ve asked for. That’s the whole list.
Our lawful basis is your consent when you tick the box on the form, and legitimate interests in responding to someone who has contacted us about our service.
Who else sees it
Enquiries are delivered to us through Formspree, a form-handling service, and then sit in our email inbox. Nobody else has access. We do not sell, rent or share your details with other companies, and we never pass them to universities.
How long we keep it
If you enquire and we don’t end up working together, we delete your enquiry within 12 months. If you become a client, we keep records for the duration of your application cycle and for two years afterwards, in case you reapply or ask us for a reference point.
Your rights
Under UK GDPR you can ask us to show you what we hold about you, correct it, delete it, or stop using it. Email hello@shortlistmed.co.uk and we’ll action it within one month, usually much sooner. You don’t need to give a reason.
If you think we’ve handled your information badly, you can complain to the Information Commissioner’s Office at ico.org.uk.
Applicants under 18
Many of the people who contact us are 16 to 18. If you’re under 18, please check with a parent or guardian before sending us your details. We’re happy for them to be copied into everything, and both founders hold Enhanced DBS certification.
Changes
If we change how any of this works, we’ll update this page. This version was last reviewed in August 2026.