Privacy Policy

This policy explains what personal data [COMPANY NAME] ("we", "us") collects when you use Plastic Surgery Exams (the "Service"), why we use it, who we share it with and the rights you have. We are the data controller for your personal data. You can contact us at [CONTACT EMAIL] or write to us at [COMPANY ADDRESS].

1. The data we collect

• Account details: your name and email address, and your password if you set one (stored only in hashed form; we can never see it).
• Sign-in codes: when you ask for an email code we briefly store a scrambled version of it, for at most 10 minutes, to check it.
• Study data: the exams and practice sessions you take, your answers, scores, time spent and the questions you flag.
• Purchase records: the plan you bought, the price, currency, dates of access and the payment reference from our payment provider. We never see or store your full card details.
• Technical data: your IP address, browser type and the times you use the Service, recorded in our server logs and used to keep the Service secure (for example, to limit repeated sign-in attempts).
• Messages: anything you send us by email, for example support requests.

2. How and why we use it

• To provide the Service (performance of our contract with you): creating and securing your account, signing you in, giving you access to the content you have paid for, saving your progress and showing your results.
• To take payment and keep records (contract and legal obligation): processing your purchase and keeping accounting records as the law requires.
• To email you about your account (contract): sign-in and verification codes, confirmation that your access is active, a reminder before it ends and a note when it has ended.
• To tell you about new exams (legitimate interests): occasional emails when new content is published. Every one has an unsubscribe link, and opting out does not affect account emails.
• To keep the Service safe and working (legitimate interests): preventing abuse and fraud, fixing problems and understanding, in aggregate, which questions students find hardest so we can improve them.

We do not sell your data, use it for advertising, or make decisions about you based solely on automated processing.

3. Who we share it with

We share personal data only with service providers that help us run the Service, under contracts that require them to protect it and use it only on our instructions:

• Stripe, which processes card payments. Stripe receives your email address and payment details directly and acts under its own privacy policy for fraud prevention and legal compliance.
• Our hosting provider, which stores the Service and its database.
• Our email delivery provider, which sends the emails described above.
• Google Fonts, which serves the typeface the website uses; your browser connects to Google to download it, which shares your IP address with Google.

We may also disclose data where the law requires it, or to protect our rights or the safety of others.

4. International transfers

Some of these providers may process data outside the UK. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement (or Addendum to the EU Standard Contractual Clauses) to make sure your data stays protected.

5. How long we keep it

• Account and study data: for as long as your account exists. If you ask us to delete your account, we delete or anonymise it within 30 days.
• Purchase records: six years after the end of the financial year they relate to, as UK tax law requires.
• Server logs: up to 90 days, unless needed to investigate a security incident.

6. Cookies

We use only cookies that are strictly necessary for the Service to work: a session cookie that keeps you signed in, and small cookies that remember who is signed in on this browser. We do not use advertising or analytics cookies, so we do not ask for cookie consent. Signing out removes the session cookie.

7. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you and get a copy of it;
• have inaccurate data corrected (you can change your name yourself in Account settings);
• have your data deleted, or its use restricted;
• object to our use of your data based on legitimate interests, including emails about new exams;
• receive the data you gave us in a portable format.

To use any of these rights, email [CONTACT EMAIL]. We will reply within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk), though we would appreciate the chance to put it right first.

8. Security

All traffic to the Service is encrypted (HTTPS). Passwords are hashed, sign-in codes expire after 10 minutes and lock after repeated wrong attempts, and access to our systems is limited to the people who need it.

9. Children

The Service is designed for qualified doctors and surgical trainees. It is not intended for anyone under 18, and we do not knowingly collect data from children.

10. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it last changed. If a change materially affects how we use your data, we will tell you by email before it takes effect.