Privacy Policy

The data controller is Vitalcare Ltd, of Whinney Heys Road, Blackpool, United Kingdom, trading as StepUp ST4.

For any privacy question, or to exercise your rights, email Vitalcaredx@gmail.com.

Account data

Your email address and password (stored only as a secure hash), plus anything you choose to add to your profile — your grade, target specialty and display name. We need this to give you an account. Lawful basis: performance of our contract with you.

Your progress and work

Which topics you have marked complete or flagged for revisit, your portfolio self-assessment entries, mock interview scores, and notes you write. This is what lets your progress follow you across devices. Lawful basis: performance of our contract.

Voice recordings, if you use them

The practice tools let you record an answer and have it transcribed so you can review what you said. If you use that feature, your audio is sent to our transcription provider, converted to text, and returned to you. We do not use your recordings to train any model. Lawful basis: performance of our contract; you choose whether to record at all.

Mock interview marking, if you ask for it

When you ask for your mock interview to be marked, the answers you typed are sent to our AI provider, scored against the four national domains, and returned to your screen. We do not store your answers or your scores, and we do not email them to you or to anyone else — when you leave the page they are gone. Lawful basis: performance of our contract — you asked us to mark what you wrote.

Payment data

Your billing name, email, country and subscription status. Card details are collected directly by Stripe and never reach our systems. Lawful basis: performance of our contract, and our legal obligation to keep tax records.

Technical data

IP address, browser type and pages requested, recorded in ordinary server logs to keep the service secure and working. Lawful basis: our legitimate interest in operating a secure service.

Support messages

Anything you send us by email or through the in-page assistant. Lawful basis: our legitimate interest in answering you.

• We do not sell your personal data.
• We do not share it with advertisers, and we run no advertising on the site.
• We do not use your content, notes or recordings to train machine-learning models.
• We do not create marketing profiles about you.

We use the following providers. Each is bound by a contract that permits them to use your data only on our instructions.

Where a provider is outside the UK, transfers are protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or by UK adequacy regulations.

• Account and progress data: while your account is open, and for 12 months after you close it, in case you return.
• Voice recordings: transcribed and discarded — we do not retain the audio after transcription.
• Payment and invoice records: six years, as HMRC requires.
• Server logs: 30 days.
• Support emails: three years.
• Mock interview answers and marking: not stored at all if you are signed out. If you are signed in, kept in your account until you delete the attempt or close the account.
• Abuse-prevention counters: a salted, one-way hash of your IP address — never the address itself — for one day.

You can ask us to delete your account and data at any time — see your rights below.

We use only what the service needs to function: a cookie that keeps you signed in, and browser storage that remembers your theme preference and your progress between visits. These are strictly necessary, so no consent banner is required for them.

Stripe sets cookies during checkout for fraud prevention. The in-page assistant, which is available to signed-in members only, sets storage when you open it. We use no advertising or cross-site tracking cookies.

We measure page views with our hosting provider's own analytics, which counts requests on the server and sets no cookie and no identifier on your device. We also use Google Analytics 4 to understand which pages are useful and where visitors come from. Google Analytics sets its own cookies (such as _ga) and collects a truncated IP address and device information; it is not used for advertising and we do not enable Google signals or ad personalisation. You can block it with any standard tracker blocker without affecting how the site works.

Under UK GDPR you have the right to:

• Access a copy of the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased.
• Restrict or object to how we use it.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time, where we rely on consent.

Email Vitalcaredx@gmail.com and we will respond within one month, free of charge.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put it right first.

Data is encrypted in transit and at rest. Access to production data is limited to those who need it. Passwords are hashed and never stored in readable form. No system is perfectly secure, but if a breach affects your rights we will tell you and the ICO as the law requires.

The service is for qualified doctors and is not directed at anyone under 18. We do not knowingly collect data from children.

We will update this page if our processing changes, and email you if the change is significant. See also our Terms of Service.