Privacy policy

Who we are

PassFinals (“we”, “us”) operates www.passfinals.co.uk, a revision platform for UK medical school finals, the UKMLA AKT and PLAB 1. We are the data controller for the personal data described here. You can contact us at support@passfinals.co.uk.

What we collect and why

• Account data: your email address and a password (stored only as a secure hash, never in plain text), plus an auto-generated display name. Lawful basis: performing our contract with you (running your account).
• Learning data: your question attempts, scores, confidence ratings, spaced-repetition schedule and which pages you have marked as read. This exists so the product works: it drives your review queue, progress tracking and performance dashboard. Lawful basis: performing our contract with you.
• Payment data: payments are processed by Stripe. We never see or store your card details; we store only your subscription status and Stripe’s reference identifiers. Lawful basis: performing our contract; retaining transaction records is a legal obligation.
• Analytics: we use Google Analytics to understand which pages help people revise (pages visited, approximate location, device type). Lawful basis: our legitimate interest in understanding how the site is used so we can improve it. For signed-in members, analytics events carry a pseudonymous account identifier - never your email - so the same member is not double-counted across devices. You can block or delete analytics cookies in your browser at any time.
• Emails: we send transactional emails (verification, password reset) via Resend. We do not send marketing email.

Cookies

Essential cookies (signing in, security) are always on, because the site cannot work without them. We also use Google Analytics cookies to recognise repeat visits; you can block or delete these at any time in your browser settings without affecting how the site works.

Who processes data for us

We use a small number of service providers, each processing data only on our instructions: Vercel (website hosting), Turso (database hosting), Stripe (payments), Resend (transactional email), Google (analytics) and, when the optional progress-summary feature is enabled, Anthropic (a pseudonymous aggregate of your revision performance, not your email or answers). Some providers process data outside the UK; where they do, transfers are covered by recognised safeguards such as the UK International Data Transfer Agreement or adequacy decisions. We do not sell personal data, and we do not share it with anyone else except where the law requires.

How long we keep data

Account and learning data are kept while your account exists and deleted when the account is deleted. Payment records are kept for as long as tax and accounting law requires (generally six years). Analytics data is retained per Google Analytics account’s configured retention period.

Your rights

Under UK GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, object to or restrict our processing, and take your data elsewhere. Contact us at support@passfinals.co.uk and we will respond within one month. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk) if you think we have handled your data badly, although we would rather you told us first so we can fix it.

Changes

If this policy changes materially we will update this page and the date at the top. See also our terms of service and educational disclaimer.