Privacy Policy

Medicine in Practice (“we”, “us”) operates this service. This policy explains what personal data we process, why, and your rights under UK GDPR and the Data Protection Act 2018. The data controller is Medicine in Practice, established in the United Kingdom. For any data-protection query, or to exercise your rights, email [email protected].

Data	Why	Lawful basis
Account details (name, email, password hash, role, organisation)	To create and secure your account and, for managers, a team dashboard	Contract
Learning progress, scores, assessment and certificate records	To deliver the training, track progress and issue certificates	Contract
Payment records (what you bought, amount, Stripe reference)	To process purchases and provide access	Contract / legal obligation (records)
Support & bug reports (your message, optional email, and technical diagnostics: the page you were on, screen size and browser user-agent)	To answer you and fix problems	Legitimate interests
Feedback you leave (a star rating and any comment about a module or practice session), with your account email attached if you are signed in	To review learner feedback and improve the training	Legitimate interests
Privacy-minimised public-site usage (top-level page categories, previous/next page, destination-only CTA clicks, time on the page capped at 30 minutes, an interaction yes/no signal, broad device class, and a daily-rotating pseudonymous visitor code). We do not store the raw IP address, query strings, form entries, names, account IDs, clinical answers or patient/case IDs in this analytics record.	To identify confusing journeys, broken sign-in routes and pages that need clearer design. Journey reporting is aggregate and is not joined to learner accounts.	Legitimate interests in improving and securing the service, subject to our documented balancing assessment. You can object by rejecting non-essential measurement in Cookie settings.
Newsletter email (if you subscribe)	To send clinical updates you asked for	Consent
Product-update preference and selected learning-progress signals (if you opt in)	To send occasional personalised product updates, useful next steps and relevant offers. Automated journey emails are frequency-limited and include one-click unsubscribe.	Consent
Learning-reminder preference and last progress date (if you opt in)	To send one supportive reminder after 14 days without learning activity	Consent

We do not intentionally collect special-category (health) data about you. All patients, letters and records in the training are fictional. Do not submit real patient-identifiable information.

Payments are processed by Stripe. Your full card details are entered on Stripe’s secure checkout and are never seen by or stored on our servers. See Stripe’s privacy policy for their processing.

Account, progress and payment records are held in our application database, hosted on Amazon Web Services (AWS) in the UK (London / eu-west-2) region. We share data only with processors that help us run the service: currently Stripe (payments), AWS (application hosting & database), Resend (transactional and opted-in email delivery), and, only when you use the AI-mode Calls lab, Anthropic (AI patient responses, receives the text of that conversation) and ElevenLabs (text-to-speech for voice calls). We do not sell your data. Your learning progress can also be stored locally in your browser (see our Cookies & storage notice).

For organisation licences, where we make your learning records available to your employer’s managers through the dashboard, your employer is the data controller for that processing and we act as its processor; see our Organisation & Site-Licence Terms (which include a data-processing agreement and the full sub-processor list).

Our hosting and database sit in the UK, so account, progress and payment records stay in the UK. Some other providers may process data outside it. In particular, when you use the AI-mode Calls lab, Anthropic and ElevenLabs are based in the United States. Where personal data is transferred outside the UK, we put in place the appropriate safeguards required by UK GDPR, which may include the UK International Data Transfer Agreement (or the EU Standard Contractual Clauses with the UK Addendum), or a provider’s certification under the UK Extension to the EU-US Data Privacy Framework.

We keep account and learning records while your account is active and for up to 6 years afterwards where needed for records/tax, then delete or anonymise them. Bug reports, enquiries and feedback are kept for up to 24 months. Privacy-minimised page, journey and demo-play analytics are automatically deleted after 400 days.

You have the right to access, correct, delete, restrict, port and object to processing of your data, and to withdraw consent. Signed-in users can export or delete their account and data from the Account page. To exercise any right, email [email protected]. You can complain to the UK Information Commissioner’s Office (ICO) at ico.org.uk.