Privacy Policy

1. Who we are

Medexia provides educational tools for doctors preparing for postgraduate exams.

For the purposes of UK data protection law, Medexia acts as the data controller for information collected through AKT Navigator.

Contact: support@medexia-akt.com

2. What data we collect

Information you provide

• Email address and password (passwords are stored hashed, never in plain text)
• Profile details such as your name, deanery, training stage, and target exam date
• Notes, flags, and study data you choose to create
• Feedback, bug reports, and testimonials you submit

Information generated by using the app

• Questions answered, your responses, and results
• Time spent on questions and explanations, including how long you read each explanation page
• Audiobook playback events (which chapters you start, pause, and complete)
• Use of features such as notes, flags, history, and AI tutor help
• Interactions with in-app prompts (for example, when we ask you for feedback)
• Basic technical information (for example, browser or device type, IP address used to detect approximate location for security)

We do not ask for or want:

• Patient-identifiable data
• NHS numbers
• Real clinical case details

Free-text fields (feedback, bug reports, AI tutor) should never contain patient information. If you submit something that looks like it may identify a patient, we will delete it.

Payment information

If you subscribe, your payment is processed directly by Stripe. We do not store full card details on our servers — we only retain the subscription status and a reference ID needed to manage your access.

3. How we use your data

We use your data to:

• Provide core app functionality
• Improve learning flow and question selection
• Understand how features are used during beta
• Respond to support requests and feedback
• Maintain platform security and reliability

We do not use your data for advertising or marketing.

4. Lawful basis for processing (UK GDPR)

Under the UK General Data Protection Regulation (UK GDPR), we process personal data on the basis of:

• Contract – to provide access to the app
• Legitimate interests – to improve and secure the platform
• Consent – where you voluntarily submit feedback or use optional features

5. AI-assisted features

When you choose to use AI-assisted explanations:

• Relevant question data is sent to an AI service
• No identifying personal details are included
• AI is used solely to generate educational explanations

AI responses are not guaranteed to be accurate and should always be checked against official UK guidance.

6. Data sharing and sub-processors

We do not sell your data and we do not share it for advertising.

We do rely on a small number of trusted service providers ("sub-processors") to run the platform. Each one only receives the data they need to perform their function:

• Replit – application hosting
• Neon – managed PostgreSQL database
• Stripe – payment processing (subscription billing)
• Resend – transactional email (e.g. password reset, account notifications)
• OpenAI – generating AI-assisted explanations and tutor responses, when you choose to use those features

Each sub-processor is bound by a data processing agreement and may only use your data to provide the service to us.

7. International data transfers

Some of our sub-processors (notably OpenAI, Stripe, Resend, and Replit) are based in the United States and may process data outside the UK or European Economic Area.

Where this happens, we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or another transfer mechanism recognised under UK GDPR, to make sure your data continues to be protected.

8. Cookies and local storage

We use a small number of cookies and browser storage items that are strictly necessary to run the app:

• An authentication token so you stay signed in
• Local preferences such as your dark/light theme choice
• Limited progress data cached locally to keep the app responsive

We do not use advertising cookies or third-party tracking cookies. Because all storage is strictly necessary, we don't show a cookie banner.

9. Data storage and security

We take reasonable steps to protect your data, including:

• Secure authentication
• Encrypted storage where appropriate
• Restricted internal access

No system is completely risk-free, but we aim to handle your data responsibly.

10. Data retention

We retain your data:

• While your account is active
• For as long as needed to operate and improve the platform

If you delete your account from your profile page, we immediately purge your profile and all associated study, behavioural, and feedback data from our database. Limited records may be retained for longer only where we are required to keep them by law (for example, billing records held by Stripe).

11. Your rights

Under UK GDPR, you have the right to:

• Access a copy of your data
• Correct inaccurate data
• Request deletion of your account and data
• Restrict or object to certain processing
• Withdraw consent where applicable
• Receive your data in a portable format

To exercise any of these rights, contact: support@medexia-akt.com

If you are not satisfied with how we have handled your data, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. We would appreciate the chance to put things right first, but you can contact the ICO at any time.

12. Beta status

AKT Navigator is currently in early beta. Data handling practices may evolve as the platform matures, but we aim to maintain the same standard of care.

13. Changes to this policy

We may update this policy as the product develops. Significant changes will be communicated within the app.

14. Final note

AKT Navigator is for exam revision only. Always consult NICE, NICE CKS, and the BNF for current clinical guidance.