Privacy Policy

Home Privacy Policy

Privacy Policy

Table of content
1. Introduction

Welcome to MedDigest.co.uk. This Privacy Policy explains how MedDigest Ltd collects, uses, shares, and protects your personal information when you visit or use our Website and services, including our AI-powered SCA practice consultations. We are committed to protecting your privacy and processing your data in accordance with the UK General Data Protection Regulation (UK GDPR) and other applicable data protection laws.

The data controller for this Website is MedDigest Ltd, located at 27 Taffrail House, Burrells Wharf Square, London, E14 3TG (registered in England and Wales, company number 16428717). You can contact us regarding data protection matters at enquiries@meddigest.co.uk.

2: Information We Collect

We collect information about you in the following ways:

Information You Provide Directly:

  • Account Registration: When you create an account, we collect information such as your name, email address, and password.
  • Subscription & Payment: If you subscribe to a premium service, we (or our third-party payment processor) collect billing information, such as your billing address and payment method details (we typically only receive confirmation of payment and limited card details, such as the last four digits).
  • Profile Information: You may optionally provide additional information in your profile, such as your professional role or specialty.
  • Communications: If you contact us directly (e.g., via email or a contact form), we collect your name, email address, and the content of your message.
  • Saved Content: We store information about which guideline summaries you save or mark as favourites within your account.

Information from AI SCA Practice Consultations:

Our service includes simulated consultation (SCA) practice sessions in which you speak with an AI-simulated patient by voice. When you use this feature, we process:

  • Your voice during the session: Your microphone audio is streamed in real time to our AI processor (OpenAI) to operate the simulated patient and to produce a written transcript. We do not store a recording of your voice audio; only the written transcript and usage records (such as session duration and processing costs) are retained (see Data Retention).
  • The consultation transcript: A written, text transcript of the practice consultation is generated and stored so that it can be assessed.
  • AI-generated feedback and grading: After the consultation, an AI model produces structured feedback and practice grades based on the transcript. This feedback is stored so you can review it.
  • Consent records: When you start a practice consultation you are asked to confirm that you will not enter or speak any real, identifiable patient information. We keep a record of this confirmation (including which versions of these terms and this privacy notice you accepted, the exact confirmations you ticked with their date and time, and hashed technical identifiers — your IP address, browser type and session token are stored only as one-way cryptographic hashes, never in raw form) as evidence of consent.
  • Microphone test: The pre-consultation microphone test runs entirely on your device. The short test recording is never transmitted to us or to anyone else, is never stored, and is discarded immediately after playback.

Important: Our AI SCA consultations are for exam practice only. You must not speak or enter any real, identifiable patient information during a session. The simulated patients are fictional and any clinical details are for training purposes.

Information Collected Automatically:

  • Usage Data: We collect information about how you interact with our Website, such as the pages you visit, time spent on pages, links clicked, guideline summaries accessed or listened to, search queries, and practice sessions undertaken.
  • Device Information: We collect technical information about the device you use, including IP address, browser type and version, operating system, and device identifiers.
  • Cookies and Similar Technologies: We use cookies and similar tracking technologies to collect information about your browsing activities. Please see our Cookie Policy for more details.
3: How We Use Your Information

We use the information we collect for various purposes, including:

  • To provide, operate, and maintain our Website and services, including the AI SCA practice consultations.
  • To operate the simulated patient, generate your consultation transcript, and produce AI feedback and practice grades.
  • To manage your account, including processing registrations and logins.
  • To process your subscriptions and payments.
  • To personalise your experience (e.g., showing relevant content based on saved items or profile information).
  • To communicate with you, respond to your inquiries, send service-related notifications (e.g., subscription renewals, policy updates), and provide customer support.
  • To send marketing communications (only with your explicit consent), such as newsletters or information about new features.
  • To analyse usage trends, monitor the effectiveness of our content, and improve the Website’s functionality and user experience.
  • To maintain a record of your consent for practice consultations, and to protect the integrity and security of our service and prevent fraud or misuse.
  • To comply with legal obligations and enforce our Terms & Conditions.
 
4. AI Processing and Automated Feedback
  • Our AI SCA practice feature uses third-party artificial intelligence services (provided by OpenAI) to operate the simulated patient, transcribe the consultation, and generate written feedback and practice grades.
  • This feedback is generated automatically. It is intended solely as a study and revision aid to support your exam preparation. It does not constitute a formal assessment, an official examination result, medical advice, or any decision that produces a legal or similarly significant effect on you. You remain responsible for your own learning and clinical practice, and the feedback should not be relied upon as a substitute for formal training, supervision, or assessment.
5. Lawful Basis for Processing

We only process your personal data when we have a valid legal basis under UK GDPR. These bases include:

  • Consent: Where you have given clear consent to process your personal data for a specific purpose (e.g., for marketing emails or non-essential cookies). You can withdraw your consent at any time.
  • Contract: Where processing is necessary to perform a contract with you (e.g., to provide the subscription services you have paid for, operate your practice consultations, and manage your account).
  • Legitimate Interests: Where processing is necessary for our legitimate interests (or those of a third party), provided your interests and fundamental rights do not override them (e.g., website security, analytics, responding to inquiries, maintaining records of consent, and improving our service).
  • Legal Obligation: Where processing is necessary for us to comply with the law (e.g., retaining financial records).
6: Data Sharing and Disclosure

We do not sell your personal data. We may share your information with third parties only in the following circumstances:

  • Service Providers: We engage third-party companies to perform services on our behalf. They have access to your personal information only to perform these tasks and are obligated not to disclose or use it for any other purpose. These include, for example: Stripe (payment processing), OpenAI (AI processing of the consultation audio, transcript, and feedback), WP Engine (website hosting), and, where enabled, analytics and email delivery providers.
  • Legal Requirements: If required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).
  • Business Transfers: If we are involved in a merger, acquisition, or asset sale, your personal data may be transferred as part of that transaction. We will notify you before your personal data becomes subject to a different privacy policy.
  • Protection of Rights: To enforce our Terms & Conditions, protect the security or integrity of our service, and protect our rights, property, or safety, or that of our users or the public.

AI processing by OpenAI.

When you use the AI SCA practice feature, your microphone audio and the resulting transcript are processed by OpenAI to operate the simulated patient and generate feedback. OpenAI processes this data on our behalf as a data processor. OpenAI may retain data sent to its API for a limited period for the purposes of providing the service and monitoring for abuse, in accordance with its own terms and data processing terms.

OpenAI may retain data submitted to its API, including audio processed during a session, for up to 30 days for abuse-monitoring purposes, after which it is deleted, in accordance with its API data-processing terms. OpenAI does not use data submitted via the API to train its models. We have a data processing agreement in place with OpenAI covering this processing.

7: International Data Transfers

Some of our service providers, including OpenAI, may be located or process data outside the United Kingdom (UK) or European Economic Area (EEA). When we transfer your personal data outside the UK/EEA, we ensure a similar degree of protection by relying on at least one of the following safeguards:

  • The country has been deemed to provide an adequate level of data protection by the UK authorities (Adequacy Regulations).
  • We use specific contracts approved by the UK authorities which give personal data the same protection it has in the UK (e.g., the UK Addendum to the EU Standard Contractual Clauses).
8: Data Security

We implement appropriate technical and organisational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include encryption, access controls that restrict each user’s practice data to their own account, and regular security reviews. We do not store recordings of your consultation audio. However, please remember that no method of transmission over the Internet or method of electronic storage is 100% secure.

9: Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which we collected it, including to satisfy any legal, accounting, or reporting requirements. Specific retention periods for the AI SCA practice feature are:

  • Consultation audio: Not stored. Your microphone audio is processed in real time to operate the simulated patient and generate the transcript, and is not retained by us as a recording.
  • Consultation transcript: The written transcript of your practice consultation is retained for 7 days after the session, after which it is automatically deleted. (The transcript is only deleted once your feedback has been generated, so that every completed session can be assessed.)
  • AI feedback and practice grades: Your feedback is retained for 6 months so that you can review it (for example, with a supervisor), after which it is automatically deleted. You can also delete your feedback yourself at any time using the delete option on the feedback page.
  • Account information: Retained for as long as your account is active and for a reasonable period thereafter, or as required by law.
  • Consent records and financial records: Retained for as long as necessary to meet our legal, regulatory, and accounting obligations. Where we are required to keep financial transaction records, we may anonymise the associated personal data rather than delete it.
  • Practice and billing records: Records of practice attempts (dates, case, and outcome status), credit transactions, and any refunds are retained for billing integrity and fraud prevention even after the associated transcript and feedback have been deleted, in line with our financial record-keeping obligations.

When personal data is no longer needed, we delete or anonymise it. The retention periods above are also shown to you within the practice feature so that the information you see and this policy remain consistent.

10:  Your Data Protection Rights

Under UK GDPR, you have the following rights regarding your personal data:

  • Right to be Informed: To know how we collect and use your personal data.
  • Right of Access: To request a copy of the personal data we hold about you.
  • Right to Rectification: To request correction of inaccurate or incomplete data.
  • Right to Erasure (‘Right to be Forgotten’): To request deletion of your personal data under certain conditions. You can delete individual practice feedback yourself from the feedback page, and you can request full erasure of your account data by contacting us. We fulfil erasure requests using WordPress’s formal personal-data erasure process, which deletes your practice attempts, feedback, and consent records and anonymises billing ledger entries.
  • Right to Restrict Processing: To request the restriction of processing under certain conditions.
  • Right to Data Portability: To receive your data in a structured, commonly used, machine-readable format under certain conditions.
  • Right to Object: To object to processing based on legitimate interests or for direct marketing purposes.
  • Rights related to Automated Decision-Making: Our AI feedback is a study aid and does not produce legal or similarly significant effects, so it does not constitute solely automated decision-making of the kind that gives rise to additional rights under Article 22 of the UK GDPR. You can still contact us with any questions about how the feedback is generated.

To exercise any of these rights, please contact us at enquiries@meddigest.co.uk or manage your account settings via your Dashboard where applicable. We may need to request specific information from you to confirm your identity before processing your request.

11: Children's Privacy

Our Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children under 18. If we become aware that we have collected personal data from a child under 18 without verification of parental consent, we take steps to remove that information.

13: Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last Updated” date. We may also notify you via email or through a notice on our Website prior to the change becoming effective, especially for material changes. You are advised to review this Privacy Policy periodically.

14: Contact Us

  • If you have any questions about this Privacy Policy or our data practices, please contact us:

    • By email: enquiries@meddigest.co.uk
    • By post: MedDigest Ltd, 27 Taffrail House, Burrells Wharf Square, London, E14 3TG

Add Your Heading Text Here

Log In

To keep connected with us please login with your personal info