Privacy policy

OnCallPrep provides online educational tools for UK GP trainees (AKT question practice, SCA preparation, portfolio guidance, and related learning resources). This policy explains how we collect, use, and protect personal data when you use our website and services.

For data protection queries, contact us via the contact form or at hello@oncallprep.com.

Account information: name, email address, authentication identifiers, training stage or preferences you choose to provide, and subscription status.

Usage and progress data: questions attempted, case practice, topic progress, and similar study analytics to run the product and show your dashboard.

Technical data: IP address, browser type, device information, and logs needed for security, fraud prevention, and service reliability.

Payment data: billing is handled by Stripe. We do not store full card numbers on our servers.

Communications: messages you send via our contact form or support channels.

Important: OnCallPrep is an educational study platform. We do not provide clinical care and we do not ask you to enter real patient identifiable information into the service. Do not submit patient-identifiable data in contact messages or free-text fields.

• Create and manage your account
• Deliver study content, progress tracking, and subscription features
• Process payments and prevent fraud
• Respond to support requests and improve the platform
• Send service-related emails (e.g. account, security, billing)
• Comply with legal obligations

We do not sell your personal data. We do not use your study data for advertising profiles sold to third parties.

Where UK GDPR applies, we rely on:

• Contract — to provide the service you sign up for
• Legitimate interests — security, analytics, product improvement (balanced against your rights)
• Consent — where required (e.g. non-essential cookies, if offered)
• Legal obligation — where we must retain or disclose data by law

We use trusted providers who process data on our instructions, including:

• Supabase (authentication and database hosting)
• Stripe (payments)
• Hosting and infrastructure providers for the website

We may disclose data if required by law, court order, or to protect rights, safety, and security. Business transfers (e.g. merger) may involve data transfer with appropriate safeguards.

We keep account and study data while your account is active and for a reasonable period afterwards so you can return to your progress. Billing records may be kept longer for tax and accounting. Logs are retained for limited periods unless needed for security investigations.

Depending on applicable law, you may have the right to:

• Access a copy of your personal data
• Correct inaccurate data
• Request erasure (subject to legal exceptions)
• Restrict or object to certain processing
• Data portability where applicable
• Withdraw consent where processing is consent-based
• Lodge a complaint with the UK ICO (ico.org.uk)

To exercise rights, contact us via the contact form. We will respond within applicable time limits.

We use essential cookies and similar technologies for authentication, security, and core functionality. If we use optional analytics cookies, we will describe them and seek consent where required.

Some providers may process data outside the UK. Where they do, we use appropriate safeguards (such as UK adequacy decisions or standard contractual clauses) as required.

We apply reasonable technical and organisational measures (access controls, encryption in transit, reputable hosts). No online service is completely secure; keep your password confidential and tell us if you suspect unauthorised access.

The service is intended for medical trainees and professionals. It is not directed at children under 16. If you believe a child has provided personal data, contact us and we will delete it where appropriate.