Privacy policy

This policy explains what personal data FRCS Plast Part A (frcsplast.app) collects, why, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. The data controller is Ciel Ventured Ltd, a company registered in England and Wales (company number 13590557). You can reach us through our contact form; we reply by email.

What we collect

• Account data — your name, email address and profile picture as provided by Google when you sign in with Google. We do not receive or store your Google password.
• Learning data — the questions you attempt, your answers, confidence ratings, time taken, bookmarks and flags, mock-exam results, Daily Five activity and the analytics derived from them (accuracy, streaks, topic mastery, readiness estimates). This is the product: without it we cannot show your progress or personalise your revision.
• Preferences — study settings such as theme and whether confidence prompts are shown.
• Messages you send us — if you use the contact form we keep your name, the email address you give us and your message so we can reply and keep a record of the conversation.
• Billing data — if you buy a plan, payment is handled by Stripe Payments Europe Ltd. We receive confirmation of what you bought, when, and a Stripe customer reference; we never see or store your full card number.
• Technical data — server logs (IP address, browser type, pages requested, errors) kept for security and reliability. We do not run advertising trackers.

How and why we use it

• To provide the service you signed up for, save your progress and sync it across your devices (contract).
• To operate your account, take payment, prevent fraud and provide support (contract and legitimate interests).
• To keep the service secure and reliable, and to understand which content is hardest or most used so we can improve it, using aggregated data wherever possible (legitimate interests).
• To send you service messages about your account or purchase. We only send marketing email with your consent, and you can withdraw it at any time.

Who we share it with

We use a small number of processors to run the service, each bound by data-processing terms: our hosting provider (Vercel Inc., with servers that may be located in the EU and United States), our database provider (Neon Inc., hosted in the EU — London region), Google (sign-in), and Stripe (payments). Where data leaves the UK it is protected by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. We do not sell personal data, and we do not share your learning data with employers, deaneries or examining bodies.

How long we keep it

Your account and learning data are kept while your account is open. If you delete your account (Settings → Delete account) it is removed immediately from our database, and from backups within 35 days. Billing records are kept for six years as required by UK tax law. Server logs are kept for up to 90 days.

Your rights

You can access and export your data (Settings → Export progress), correct it, delete it (Settings → Delete account), object to or restrict certain processing, and withdraw consent where processing is based on consent. To exercise any right, or to ask a question, use our contact form. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Cookies

We use strictly necessary cookies only: a session cookie that keeps you signed in and a cookie that protects sign-in against cross-site request forgery. Because we set no analytics or advertising cookies, no cookie banner is required. If that changes we will ask for your consent first.

Children

The service is intended for medical professionals and is not directed at anyone under 18.

Changes

We will post any changes here and update the date above. If a change materially affects how we use your data we will tell you by email or in the app.