Privacy Policy

1. Data Controller

IBRAM — International Board of Regenerative & Aesthetic Medicine — acts as the data controller for personal data collected through our website and services. Our registered address is:

2. Information We Collect

Identity & Contact Data: Full name, title, email address, telephone number, postal address, country of residence.

Professional Data: Medical licence number, specialty, institution, country of practice, years of experience, professional qualifications, CPD records.

Application Data: Information submitted in certification, accreditation, or membership applications, including supporting documents, references, and clinical evidence.

Account Data: Username, hashed password, account preferences, and login history.

Payment Data: Billing address and payment transaction references. Full card details are processed by our PCI-DSS-compliant payment processor and are not stored by IBRAM.

Technical Data: IP address, browser type and version, operating system, referring URLs, pages visited, and session duration.

Communications: Records of correspondence, support requests, and feedback submitted to IBRAM.

Marketing Preferences: Your preferences for receiving marketing communications and the channels you prefer.

3. How We Collect Data

We collect personal data through:

• Direct Interactions: When you create an account, submit an application, make a purchase, contact us, or subscribe to communications.
• Automated Technologies: Cookies, web beacons, and similar tracking technologies as you interact with our website.
• Third Parties: Verification services, professional licensing bodies, academic institutions, and payment processors.
• Public Sources: Publicly available professional registries and licensing databases used for verification purposes.

4. How We Use Your Data

We use your personal data to:

• Process and administer certification, accreditation, and membership applications
• Maintain the IBRAM Verification Registry of certified professionals
• Deliver educational content, course access, and CPD records
• Process payments and manage financial transactions
• Communicate about your application status, credential renewals, and account matters
• Send newsletters, event invitations, and professional updates (where you have consented)
• Comply with legal and regulatory obligations
• Conduct research and analysis to improve our services
• Prevent fraud and ensure the security of our services
• Enforce our Terms and Conditions

5. Legal Basis for Processing

We process your personal data on the following legal bases:

• Contract Performance: Where processing is necessary to deliver services you have requested or applied for.
• Legitimate Interests: For fraud prevention, network security, and improving our services — where these interests are not overridden by your data protection rights.
• Legal Obligation: Where we are required by law to process your data.
• Consent: For marketing communications and optional data uses. You may withdraw consent at any time.

6. Sharing Your Data

We may share your personal data with:

• Service Providers: Cloud hosting providers, payment processors, email delivery platforms, and analytics services — under strict data processing agreements.
• Professional Verifiers: Employers, licensing bodies, and healthcare institutions verifying credentials through our public registry (name, credential type, status, and ID only).
• Partner Organisations: Where you have expressly consented to such sharing in connection with a specific programme or event.
• Legal Authorities: Where required by applicable law, court order, or regulatory authority.

We do not sell, rent, or otherwise commercialise your personal data to third parties for marketing purposes.

7. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected, including:

• Active accounts and credentials: For the duration of your relationship with IBRAM plus 7 years
• Certification records: Indefinitely (as part of the permanent professional registry)
• Financial records: 7 years (regulatory requirement)
• Marketing data: Until you unsubscribe or withdraw consent
• Technical logs: 12 months

8. Data Security

We implement appropriate technical and organisational security measures to protect your personal data, including:

• TLS/SSL encryption for all data in transit
• Encryption of sensitive data at rest
• Access controls limiting data access to authorised personnel
• Regular security assessments and penetration testing
• PCI-DSS compliant payment processing

No method of transmission over the internet is 100% secure. If you believe your data has been compromised, please contact us immediately at privacy@ibram.org.

9. International Data Transfers

IBRAM operates globally and your data may be transferred to and processed in countries outside your country of residence, including the UAE and countries within the European Economic Area (EEA) and beyond. Where data is transferred outside the EEA, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

10. Cookies

We use cookies and similar technologies to operate our website effectively. These fall into three categories:

• Essential Cookies: Necessary for the website to function. Cannot be disabled.
• Analytics Cookies: Help us understand how visitors use our site (e.g. Google Analytics). These are anonymised.
• Functional Cookies: Remember your preferences and settings, including language preferences.

You can control non-essential cookies through your browser settings. Note that disabling certain cookies may affect website functionality.

11. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate or incomplete data
• Erasure: Request deletion of your data in certain circumstances
• Restriction: Request that we restrict processing of your data
• Portability: Receive your data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdraw Consent: Withdraw consent for consent-based processing at any time

To exercise any of these rights, please contact privacy@ibram.org. We will respond within 30 days. We may need to verify your identity before processing your request.

12. Children's Privacy

Our services are intended for medical professionals and are not directed at individuals under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe we have inadvertently collected data from a minor, please contact us immediately.

13. Policy Changes

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. When we make material changes, we will update the "last updated" date and, where appropriate, notify registered users by email. Your continued use of our services after any update constitutes acceptance of the revised policy.

14. Contact & Complaints

For any privacy-related questions, data subject requests, or complaints, please contact our Privacy Team: