Privacy Policy

The data controller is [YOUR NAME OR REGISTERED COMPANY NAME], of [BUSINESS ADDRESS, INCLUDING POSTCODE], United Kingdom, trading as StepUp ST4.

For any privacy question, or to exercise your rights, email [SUPPORT@YOURDOMAIN.COM].

Account data

Your email address and password (stored only as a secure hash), plus anything you choose to add to your profile — your grade, target specialty and display name. We need this to give you an account. Lawful basis: performance of our contract with you.

Your progress and work

Which topics you have marked complete or flagged for revisit, your portfolio self-assessment entries, mock interview scores, and notes you write. This is what lets your progress follow you across devices. Lawful basis: performance of our contract.

Voice recordings, if you use them

The practice tools let you record an answer and have it transcribed so you can review what you said. If you use that feature, your audio is sent to our transcription provider, converted to text, and returned to you. We do not use your recordings to train any model. Lawful basis: performance of our contract; you choose whether to record at all.

Payment data

Your billing name, email, country and subscription status. Card details are collected directly by Stripe and never reach our systems. Lawful basis: performance of our contract, and our legal obligation to keep tax records.

Technical data

IP address, browser type and pages requested, recorded in ordinary server logs to keep the service secure and working. Lawful basis: our legitimate interest in operating a secure service.

Support messages

Anything you send us by email or through the in-page assistant. Lawful basis: our legitimate interest in answering you.

• We do not sell your personal data.
• We do not share it with advertisers, and we run no advertising on the site.
• We do not use your content, notes or recordings to train machine-learning models.
• We do not create marketing profiles about you.

We use the following providers. Each is bound by a contract that permits them to use your data only on our instructions.

Where a provider is outside the UK, transfers are protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or by UK adequacy regulations.

• Account and progress data: while your account is open, and for 12 months after you close it, in case you return.
• Voice recordings: transcribed and discarded — we do not retain the audio after transcription.
• Payment and invoice records: six years, as HMRC requires.
• Server logs: 30 days.
• Support emails: three years.

You can ask us to delete your account and data at any time — see your rights below.

We use only what the service needs to function: a cookie that keeps you signed in, and browser storage that remembers your theme preference and your progress between visits. These are strictly necessary, so no consent banner is required for them.

Stripe sets cookies during checkout for fraud prevention. The in-page assistant sets storage when you open it. We use no advertising or cross-site tracking cookies.

Under UK GDPR you have the right to:

• Access a copy of the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased.
• Restrict or object to how we use it.
• Receive your data in a portable, machine-readable format.
• Withdraw consent at any time, where we rely on consent.

Email [SUPPORT@YOURDOMAIN.COM] and we will respond within one month, free of charge.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put it right first.

Data is encrypted in transit and at rest. Access to production data is limited to those who need it. Passwords are hashed and never stored in readable form. No system is perfectly secure, but if a breach affects your rights we will tell you and the ICO as the law requires.

The service is for qualified doctors and is not directed at anyone under 18. We do not knowingly collect data from children.

We will update this page if our processing changes, and email you if the change is significant. See also our Terms of Service.