Privacy Policy

RxPrep Limited is the controller for personal information processed through RxPrepAI. Privacy enquiries and data-rights requests can be sent to support@rxprep.ai or submitted through the authenticated Data Rights page.

Depending on the features you use, we may process account details such as your name and email; optional study information such as exam date, training sector and attempt type; practice answers, scores, progress and mock-exam history; user-created Study Workspace folders, note content, tags, sources, review dates and linked-question references; subscription and billing identifiers; security and audit logs, including mock-start email verification status and failed-code attempt counts, and protected-content capture or extraction signals, the protected route or question context, event timestamps, acknowledgement status, browser/device user-agent information and a pseudonymous account watermark reference; legal-consent records; and information you deliberately submit to support.

We do not need or store full payment-card details. Payments are handled by Stripe. Study Workspace is for personal revision material only. Do not enter identifiable patient information, confidential pharmacy records, personal health information or other special-category personal data into notes or other RxPrepAI study features.

We use personal information to create and secure accounts, provide practice and mock-exam features, save progress, generate personal study achievements, administer subscriptions, deter and investigate unauthorised capture or distribution of protected question-bank content, prevent misuse, troubleshoot the service, respond to requests and meet legal obligations. Where optional analytics or marketing is used, it is handled according to the consent choice presented to you.

RxPrepAI may derive motivational achievement milestones from your own study activity, such as eligible practice attempts, unique questions seen, practice accuracy, study streaks, review activity, question-bank coverage and completed mock exams. Each achievement explains the rule used to calculate it, and you can report an achievement that appears inaccurate.

Achievements are designed to support study motivation and progress tracking. They are not GPhC qualifications, registration assessment results, accreditation, pass predictions or guarantees of examination performance. Achievement sharing is optional and is not made public by default.

Our legal basis depends on the activity. It may include performance of a contract for the service you request, legitimate interests in operating and securing RxPrepAI, compliance with legal obligations, and consent where the law requires consent, including optional marketing or non-essential tracking.

RxPrepAI uses Supabase for authentication and database services, Vercel for hosting and delivery, Resend for transactional verification emails, and Stripe for payment processing. OpenAI processes prompts only when an administrator uses enabled AI question-generation or enhancement features; learner-facing AI chat is not available. The application does not activate session replay, advertising pixels or optional web analytics. Each provider processes information for its defined service under its contractual and security arrangements.

Our Supabase project is hosted in the United States (us-east-1). Vercel, Stripe and OpenAI may also process information outside the United Kingdom. Where a restricted transfer requires protection, we use an applicable UK adequacy regulation or contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses. The providers' data-processing terms include transfer provisions for UK data where applicable. Contact support@rxprep.ai to request further information or a copy of the relevant safeguards, subject to permitted redactions.

We apply the following retention schedule, unless a longer period is required for an active dispute, fraud or security investigation, legal claim, court order or other legal obligation:

• Account and identifiable study records, including Study Workspace notes: while the account is active, then deleted or anonymised within 30 days after account closure.
• Study Workspace items moved to Trash: retained for up to 30 days to allow restoration, then permanently deleted from the active database. Earlier permanent deletion is available from Trash.
• Ordinary support correspondence: 12 months after the matter is closed.
• Data-rights request records and our response: three years after the request is closed.
• Mock email verification challenges (salted code hashes, send/attempt status and timestamps): 30 days. Codes expire after 10 minutes and cannot be reused.
• Security and audit logs, including protected-content capture/extraction events: 12 months from creation, unless a longer period is reasonably required for an active security investigation, dispute or legal claim.
• Subscription, invoice and accounting records: six years from the end of the company financial year to which they relate, or longer where HMRC or another applicable law requires it.
• Legal acknowledgements needed to establish the contract or demonstrate compliance: six years after the relevant contract ends.
• Deleted data remaining in disaster-recovery backups: overwritten within 90 days and not restored except for disaster recovery.
• Marketing consent evidence: while relied upon and for up to 24 months after its last use. A minimal suppression record is kept for as long as we conduct direct marketing so that we continue to respect an unsubscribe or objection.

An erasure request is reviewed rather than automatically deleting every record. The review addresses authentication, subscriptions, application data and records that must lawfully be retained. Stripe records and provider backups are not erased merely by deleting an RxPrepAI profile.

UK data-protection law may give you rights including access, correction, erasure, restriction, objection and data portability, depending on the circumstances. These rights are not all absolute. Use the Data Rights page to make a request or download the account and study data available there. Additional records, such as support correspondence and security logs, can be requested through an access request. You may also have the right to complain to the UK Information Commissioner's Office.

Our Cookie Policy describes sign-in, requested settings and recovery storage. No optional analytics consent is inferred from using the service.

RxPrepAI is intended for users aged 18 and over. We do not knowingly offer the service to children or seek children's personal information.

We use access controls, row-level database security, authenticated server routes and other technical measures intended to protect account data. No online service can promise absolute security. We may update this notice when the product, providers or law changes and will show a new effective date for material revisions.