Privacy Policy

What We Collect

MRCOG AI is an educational tool for exam preparation. We do not collect any patient data, clinical records, or health information. The data we collect is limited to what is needed to provide and improve the service:

• Account information: name, email address, and authentication credentials (held by our authentication provider)
• Study data: question attempts, answers, scores, study session history, and spaced-repetition card states
• Preferences: exam target (Part 1/2/3), target exam date, daily study goal
• Billing information: subscription plan and payment status (card details are handled entirely by our payment processor and never touch our servers)
• Usage analytics: page views, feature usage, and performance metrics
• Email engagement: when you click a link in an email we send you, we record which link and when. We do not use tracking pixels, so we cannot tell whether an email was opened or how long it was read. You can turn link measurement off in Settings, which sends you ordinary links that record nothing
• Error data: crash reports and error logs (collected by our error-monitoring provider)
• AI tutor interactions: questions you ask our AI tutor or the "Ask Guidelines" feature, and the explanations generated in response
• Lead-magnet data: if you download our free exam-dates guide before creating an account, we collect your email address, IP address, and browser information

How We Use Your Data

• To provide adaptive, personalised study recommendations based on your performance
• To schedule spaced-repetition reviews at optimal intervals
• To generate exam readiness scores and topic mastery analytics
• To process your subscription and manage billing
• To send transactional emails (e.g., trial expiry reminders, question-of-the-day), and to see which links in them are useful
• To improve the product through aggregated, anonymised usage analytics
• To diagnose and fix errors and bugs

Legal Basis for Processing

We process your personal data on the following bases:

• Contract: account, study, and billing data is processed because it's necessary to provide the service you've signed up for
• Legitimate interest: error data and aggregated usage analytics are processed to keep the service reliable and to improve it, lead-magnet data is processed to follow up on your download request, and email link clicks are processed to understand which emails are worth sending. You can object to that last one at any time by turning off link measurement in Settings
• Consent: analytics cookies (set by our analytics provider) are only set if you accept them via our cookie banner; you can withdraw consent at any time

Data Storage

Your data is stored on secure servers hosted by Fly.io (backend), Neon (database), Upstash (Redis cache), and Vercel (frontend). Data is encrypted in transit using industry-standard TLS, and encrypted at rest by those providers. Our database provider maintains continuous backups with point-in-time recovery over a rolling 6-hour window.

Service Providers

We use a small number of specialist providers to run MRCOG AI. We do not name them individually here; if you would like the current list, ask us and we will tell you. They act as our processors under contract, may only use your data to provide their service to us, and never for their own purposes. The categories are:

• Authentication — account sign-in, password storage and session management. We never store your password ourselves.
• Payments — card processing and billing. Card details never reach our servers.
• Hosting and infrastructure — running the application and storing its database.
• Email delivery — sending transactional email such as trial reminders.
• Product analytics and error monitoring— understanding how the product is used and diagnosing faults.
• AI model providers — powering the AI tutor, explanations and guideline search. Questions you type into the AI, and the content you ask it about, are sent to these providers to generate a response. They do not use your data to train their models.

International Data Transfers

Some of the providers described above process data outside the UK/EEA. Where this happens, we rely on appropriate safeguards, including Standard Contractual Clauses and each provider's own data processing agreement, to ensure your data receives an equivalent level of protection.

Data Retention

We retain your account and study data for as long as your account is active. Deleting your account erases your personal data immediately, along with everything linked to it, except where we're required to keep it longer: billing records are retained for 6 years to meet UK tax obligations. Copies held in database backups age out within 6 hours, our provider's point-in-time recovery window.

Some data is also removed on a schedule regardless of whether you delete your account: questions you ask the AI are kept for 90 days, email link clicks for 12 months, administrative access logs for 24 months, and lead-magnet data (email and IP address collected before account creation) for 30 days after you unsubscribe.

Cookies

We use essential cookies for authentication and session management (set by our authentication provider). We also use analytics cookies to understand product usage. We do not use advertising or tracking cookies from third-party ad networks.

Children's Privacy

MRCOG AI is intended for medical professionals and trainees preparing for a postgraduate exam. It is not directed at, and we do not knowingly collect personal data from, anyone under 18.

Data Breaches

If we become aware of a data breach affecting your personal data, we will notify you and the relevant supervisory authority without undue delay, in line with our obligations under UK GDPR.

Your Rights

In accordance with GDPR and applicable data protection laws, you have the following rights:

• Access: request a copy of all personal data we hold about you
• Rectification: request correction of inaccurate data
• Deletion: request deletion of your account and all associated data
• Portability: request an export of your data in a machine-readable format
• Restriction: request that we limit how we process your data
• Objection: object to processing of your data for specific purposes

You can exercise Access, Portability and Deletion yourself, immediately, from Settings → Your data. For anything else, contact us at hello@mrcog-ai.com. We will respond within 30 days.

Contact

If you have any questions about this privacy policy or how we handle your data, please contact us at hello@mrcog-ai.com.