Privacy Policy

MRCEM Mastery ("we", "us", "our") operates the MRCEM Mastery website and learning platform. This Privacy Policy explains how we collect, use, store and protect personal information when you use our services.

We are committed to handling personal data responsibly and in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who we are

MRCEM Mastery provides online educational resources for candidates preparing for MRCEM examinations. We are a medical education and examination preparation platform. We do not provide medical advice or clinical services.

If you have questions about this policy, contact us at support@mrcemmastery.co.uk.

Information we collect

We may collect the following categories of information:

Account information

• Name
• Email address
• Login credentials (stored securely via our authentication provider)
• Subscription or access status
• Exam product entitlements

Usage and learning data

• Questions attempted and answers submitted
• Performance analytics, progress and study activity
• Mock exam sessions and practice history
• Saved or flagged questions

Technical information

• IP address
• Browser and device information
• Log files and security events
• Cookies and similar technologies (see below)

Communications

• Messages you send to us
• Support enquiries
• Email preferences

We collect only information that is reasonably necessary to provide, secure and improve the platform.

How we use your information

We use personal information to:

• Create and manage your account
• Provide access to question banks, analytics and learning tools
• Track progress and personalise your revision experience
• Process subscriptions and access rights
• Send service-related communications
• Maintain platform security and prevent misuse
• Improve our content, features and reliability
• Comply with legal obligations

We do not sell your personal data.

Legal bases for processing

Where UK GDPR applies, we rely on one or more of the following legal bases:

• Contract — to provide the platform you have registered for
• Legitimate interests — to secure, improve and operate our services
• Consent — where required, for example for non-essential cookies or marketing emails
• Legal obligation — where we must retain or disclose information by law

Cookies and analytics

We use cookies and similar technologies to:

• Keep you signed in
• Remember preferences
• Measure website usage and performance
• Support marketing analytics (where enabled)

You can control cookies through your browser settings. Disabling essential cookies may affect platform functionality.

Where we use analytics or advertising tools (such as Google Analytics or Meta Pixel), those providers may process technical usage data in accordance with their own privacy policies.

Authentication

Account authentication is handled through Supabase Auth or equivalent secure authentication services. Passwords are not stored in plain text on our servers.

You are responsible for keeping your login credentials confidential.

Payments

If you purchase a subscription in future, payment processing will be handled by a third-party payment provider. We will not store full payment card details on our servers.

Payment providers will process billing information in accordance with their own privacy and security standards.

Email communications

We may send:

• Account and security notifications
• Service updates
• Subscription and billing messages
• Educational or product updates (where permitted)

You can opt out of non-essential marketing emails at any time.

Data retention

We retain personal information only for as long as necessary to:

• Provide the platform
• Meet legal, accounting or regulatory requirements
• Resolve disputes and enforce our terms

When data is no longer required, we delete or anonymise it using appropriate technical and organisational measures.

Data sharing

We may share information with trusted service providers who help us operate the platform, such as:

• Hosting and database providers
• Authentication services
• Email delivery providers
• Analytics providers
• Payment processors (future)

These providers may only use data on our instructions and must apply appropriate security safeguards.

We may also disclose information where required by law or to protect the rights, safety and integrity of our users and platform.

International transfers

Some service providers may process data outside the United Kingdom. Where this occurs, we take steps to ensure appropriate safeguards are in place, consistent with applicable data protection law.

Your rights

Depending on your location, you may have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data
• Object to or restrict certain processing
• Request data portability
• Withdraw consent where processing is based on consent
• Lodge a complaint with the Information Commissioner's Office (ICO) in the UK

To exercise your rights, contact support@mrcemmastery.co.uk. We may need to verify your identity before responding.

Security

We implement appropriate technical and organisational measures to protect personal information, including access controls, encryption in transit and secure infrastructure practices.

No online service can be guaranteed completely secure, but we work to protect your data proportionate to the nature of our platform.

Children's privacy

MRCEM Mastery is intended for medical trainees and healthcare professionals. It is not directed at children under 18, and we do not knowingly collect personal data from children.

Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect the latest version. Material changes will be communicated where appropriate.

Contact

For privacy enquiries:

Email: support@mrcemmastery.co.uk