Medessa Privacy Policy (draft)
Last updated 28 October 2026
Who we are
Medessa is run by Ghali & Geres Solutions Ltd, a company registered in England and Wales (company number 17510357). We are the data controller for the personal information collected through medessa.health. We handle it in line with the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations.
| Registered office | 71–75 Shelton Street, Covent Garden, London WC2H 9JQ |
| Privacy contact | privacy@medessa.health |
| ICO registration number | 00016067940 |
What we collect
We collect only what we need to give you access to the videos and run the site.
| Information | When we collect it |
|---|---|
| Your name, email address and country | When you sign up |
| That you are a dental professional, if you register on our For Dentists page | When you register for Chairside |
| The date you last used Medessa | Automatically when you use the site, so we know when an account has become inactive |
| Technical information: IP address, browser and device type, pages visited | Automatically when you use the site, to keep it secure and working |
| Messages you send us | When you email us |
We do not ask for health information. We count how many times each video is watched in total, but we do not record which videos you watch, so we do not build a record of the health topics you look at.
We get this information directly from you or automatically when you use the site. To watch the videos, you need to sign up with your name, email address and country. Emails about new videos are optional: you choose whether to receive them when you sign up, and you can watch the videos either way.
How we use your information
UK data protection law requires a lawful basis for each use. Ours are below.
| Use | Lawful basis |
|---|---|
| Creating your account and giving you access to the videos | Necessary to provide the service you sign up for |
| Counting sign-ups and total video views by country, to measure how Medessa is used and report this to funders without identifying you | Our legitimate interest in understanding and growing the service |
| Sending you emails about new videos, if you tick the box | Your consent. You can unsubscribe at any time using the link in every email |
| Running, securing and improving the website | Our legitimate interest in providing a safe, working service |
| Replying to your messages | Our legitimate interest in answering you |
| Meeting legal obligations | Legal obligation |
We do not sell your information, use it for advertising, or share it with other organisations for their marketing.
Cookies
We use only the cookies needed to run the site. We do not use advertising or analytics cookies.
| Type | What it does | Your choice |
|---|---|---|
| Essential | Keeps the site secure, for example blocking malicious traffic (set by Cloudflare, our hosting provider), and remembers that you have signed up | Always on; the site cannot work without them |
| Analytics | None at present. If we add analytics, we will update this policy first |
Cookies we use:
| Cookie | Set by | Purpose | Lasts |
|---|---|---|---|
| __cf_bm | Cloudflare | Distinguishes people from automated bots | 30 minutes |
| _cfuvid | Cloudflare | Applies fair-use limits when several people share one internet connection | Until you close your browser |
| medessa_member | Medessa | Remembers that you have signed up, using a random code linked to your account, so you can keep watching | 1 year |
| medessa_chairside | Medessa | Lets a dentist show videos to patients during appointments on the dentist's sign-up, without each patient signing up | Ends after 10 minutes without use |
Changing your choices. The site sets no optional cookies, so there is no cookie banner. You can block or delete cookies in your browser settings, though the site may then not work properly. If a dentist shows you a video during your appointment using Chairside, we do not collect your details.
Our videos are stored with Cloudflare and play directly on our site. No third-party video service tracks you when you watch them.
Links to other websites
The site may link to other websites, such as NHS pages or our social media accounts. We are not responsible for how those sites handle your information, so please read their privacy policies.
Who we share it with
We share your information only with service providers who help us run Medessa. They may use it only on our instructions.
| Provider | What they do | Where data may be processed |
|---|---|---|
| Cloudflare | Website hosting, security, video storage, sign-up storage and email forwarding | UK, EU, US and other countries |
| Brevo | Sends emails about new videos | EU |
| Google (Gmail) | Stores the messages you send to privacy@medessa.health | US and other countries |
We may also share information if the law requires it, for example with a regulator or the police; with our professional advisers, such as lawyers and accountants; or with a buyer or investor if Medessa is sold or restructured, who must protect it in line with this policy.
International transfers
Some of our providers, including Cloudflare and Google, may process information outside the UK, for example in the United States. Where this happens, we rely on the UK's approved safeguards, such as the UK-US Data Bridge or the UK International Data Transfer Agreement.
If you live outside the UK, local laws may give you additional rights.
How long we keep it
| Information | How long |
|---|---|
| Your account (name, email and country) | Until you ask us to delete your account. If your account has been inactive for 3 years, we delete your details. Each time you use Medessa, this 3-year period starts again |
| Unsubscribe record | Your email address only, kept for 3 years after you unsubscribe so that we do not email you again |
| Technical and security logs | Up to 30 days |
| Messages and complaints you send us | 2 years after our last reply |
| Backups | Deleted information may remain in secure backups for up to 30 days before it is overwritten |
How we keep your information secure
We use technical and organisational measures to protect your information from loss, misuse and unauthorised access. These include:
encrypted connections (HTTPS) between your device and our site
a web application firewall and protection against denial-of-service attacks, provided by Cloudflare
two-step verification on all our accounts
access limited to the people who need it
If a data breach is likely to affect you, we will tell you and report it to the Information Commissioner’s Office, as the law requires.
Automated decisions
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
Your rights
You can ask us to:
give you a copy of your information
correct it
delete it
stop or limit how we use it
send it to you or another organisation in a common format
If you would rather we did not use your information for one of the purposes above, you can tell us and we will consider your request. You can stop our emails at any time using the unsubscribe link. Email privacy@medessa.health; we will reply within one month. For complex requests this can be extended by up to two further months, and we will tell you if so. We may ask you to confirm your identity first, so that we never give your information to someone else.
Complaints. If you are unhappy with how we handle your information, email privacy@medessa.health with "Privacy complaint" in the subject, or write to us at our registered office. We will acknowledge your complaint within 30 days and tell you the outcome. If you are still unhappy, you can contact the Information Commissioner's Office.
Children
You must be 13 or older to sign up. Children are welcome to watch the videos with a parent or carer. If we learn that a child under 13 has signed up, we will delete their details.
Changes to this policy
We will update this policy when the site changes, for example when booking features are added. The date at the top shows the latest version. If a change significantly affects you, we will email you at least 15 days before it takes effect.