Privacy Policy

1. Who we are

Medexia provides educational tools for doctors preparing for postgraduate exams.

For the purposes of UK data protection law, Medexia acts as the data controller for information collected through AKT Navigator at app.medexia-akt.com and our marketing website at medexia-akt.com. This policy covers both properties.

Contact: support@medexia-akt.com

2. What data we collect

Information you provide

• Email address and password (passwords are stored hashed, never in plain text)
• Profile details such as your name, deanery, training stage, and target exam date
• Notes, flags, and study data you choose to create
• Feedback, bug reports, and testimonials you submit

Information generated by using the app

• Questions answered, your responses, and results
• Time spent on questions and explanations, including how long you read each explanation page
• Audiobook playback events (which chapters you start, pause, and complete)
• Use of features such as notes, flags, history, and AI tutor help
• Interactions with in-app prompts (for example, when we ask you for feedback)
• Email delivery and engagement events for selected campaigns (for example, delivered, link clicked and, where enabled, an indicative open event)
• Basic technical information (for example, browser or device type, IP address used to detect approximate location for security)

We do not ask for or want:

• Patient-identifiable data
• NHS numbers
• Real clinical case details

Free-text fields (feedback, bug reports, AI tutor) should never contain patient information. If you submit something that looks like it may identify a patient, we will delete it.

Payment information

If you subscribe, your payment is processed directly by Stripe. We do not store full card details on our servers — we only retain the subscription status and a reference ID needed to manage your access.

3. How we use your data

We use your data to:

• Provide core app functionality
• Improve learning flow and question selection
• Understand how features are used during beta
• Respond to support requests and feedback
• Maintain platform security and reliability
• Send product updates and relevant offers where you have not opted out, and measure whether those messages were delivered or acted on

We do not use learning content, audiobook titles, chapters or topics, question performance or answers, notes, deanery, training stage, target exam date, or clinical or patient information for advertising. If you explicitly allow optional marketing measurement, we may use limited campaign identifiers, technical request data, transaction metadata, a securely hashed email address and aggregate audio-listening milestones to measure whether a Medexia advertisement led to a registration, purchase or 30-minute or 120-minute audio-listening milestone. The data sent depends on the advertising provider, as described in section 7. With your consent, we also use website analytics and advertising tools as described in section 9. You can withdraw consent at any time using the controls described there.

We do not sell your data. With your Marketing consent, our website uses advertising tools for campaign measurement and retargeting, as described in sections 7 and 9. Advertising providers may also process information for their own purposes under their applicable terms and privacy notices. You can opt out of marketing messages at any time using the unsubscribe link in an email. Email-open data is inherently imprecise because some mail providers preload images; we treat clicks and responses as stronger signals.

4. Lawful basis for processing (UK GDPR)

Under the UK General Data Protection Regulation (UK GDPR), we process personal data on the basis of:

• Contract – to provide access to the app
• Legitimate interests – to improve and secure the platform
• Consent – where you voluntarily submit feedback, use optional features, agree to receive marketing, or allow optional advertising measurement and marketing cookies

5. AI-assisted features

When you choose to use AI-assisted explanations:

• Relevant question data is sent to an AI service
• No identifying personal details are included
• AI is used solely to generate educational explanations

AI responses are not guaranteed to be accurate and should always be checked against official UK guidance.

6. AKT Navigator in ChatGPT

You can practise AKT questions with AKT Navigator inside ChatGPT. This part of the service works without an AKT Navigator account and without signing in.

What we receive when you use AKT Navigator in ChatGPT

• Your practice actions: the revision area or topic you ask for, the answer option you choose, and a temporary encrypted question reference that lets us mark your answer
• Question reports and topic requests you choose to submit
• Technical information ChatGPT may send with a request, which can include an anonymised ChatGPT user identifier, a conversation identifier, your language setting, an approximate location (for example a city, region, country, time zone, or coarse latitude and longitude) and a description of your browser or app. None of these has to be present on every request

What we do not receive from anonymous practice

• Your ChatGPT conversation. We do not fetch the chat transcript. Words you type into a question report, a topic request or a search are still sent with that request
• Your name, email address or ChatGPT account details
• We do not ask for health or patient information. Please do not include personal or patient details in question reports or topic requests

How we use it

We use the anonymised ChatGPT user identifier to apply fair-use limits, avoid repeating the same question within a day, and recognise a returning guest practice profile when we can verify the request came from ChatGPT. We retain a one-way, server-keyed identifier for this guest profile, not the original ChatGPT identifier. The separate in-memory fair-use and daily-repeat keys expire 24 hours after your last request. They are removed from memory when a later request runs cleanup, or when the process stops. We do not use the conversation identifier, language setting, approximate location or browser description.

Guest ChatGPT practice can retain authored question versions, chosen answers, results and timestamps in a separate pseudonymous practice record. When ChatGPT supplies a consistent anonymised identifier through a verified connection, new chats can return to the same guest practice profile and its earlier saved sets. We store only a one-way identifier and capability digests; separate proof protects ownership. This is not an AKT login and grants no audio or account access. If ChatGPT does not supply a trustworthy, consistent identifier, retain the original card and practice reference for continuity; new chats may otherwise start separate records. We cannot recover anonymous history by email or guessed identity. Guest access expires after 90 days without saved practice activity. Expiry currently blocks access; deletion is not automated, and retained records can be addressed through our support/privacy request route. After you connect and approve practice access, answers from new connected sets are saved with their question version, selected answer and result. They contribute to your learning history, mastery and study recommendations. Signing in through Medexia Accounts does not move earlier guest practice onto the account. Guest question cards do not automatically prompt you to sign up or connect. You can open the account control in the card to connect; connecting does not include previous guest practice. When you request a follow-up session, encrypted completed-session evidence and matching question references can be retrieved for up to 15 minutes so the next card can load reliably. After that they are no longer usable. Routine cleanup removes expired copies about every five minutes while the service is running. A stopped service or a failed cleanup can leave them longer. Short question and shortlist references last up to 15 minutes as references that can still be used; answered-question and set references can last up to two hours, in the same sense, when the supporting database constraint is installed. Passing those times stops the reference from being used. It does not by itself delete the stored copy. Expired references cannot recover an unfinished card. We do not use this information for advertising or to discover an anonymous learner’s real identity. Our hosting provider, Replit (see section 7), may keep standard server logs such as IP address and time of request for security and reliability.

Reports submitted from ChatGPT are stored with a pseudonymous identifier: a one-way identifier that links reports from the same ChatGPT user, used only to prevent abuse, including duplicate reports. Topic requests are stored without any identifier for the requester.

If you choose to rate a question, we store its question reference, content version, your one-, two- or three-star rating, timestamps and either your connected account identifier or a one-way guest identifier so you can change your vote. You can rate without connecting an account. Ratings are optional quality feedback and help prioritise questions within our existing quality rules. Connected users have one editable vote per question across the app and ChatGPT; guest votes contribute anonymously. We do not store your answers or conversation with the rating, and we do not display community averages. A content change clears ratings for the old question version.

Our lawful basis is our legitimate interest in providing the practice service you asked for and preventing misuse.

If you connect your AKT Navigator account

Connecting is optional. You sign in to AKT Navigator and explicitly approve the connection. ChatGPT can recognise your account using an account identifier, your name and your email address. Connected practice answers are saved to your AKT Navigator learning history while answer saving is enabled. With progress permission, ChatGPT can read compact summaries of your exam date, pace, evidence-qualified readiness, coverage, areas to strengthen and reviews due. Those summaries, including the pace inside them, are limited to an included plan unless that plan limit is turned off. The separate exam-pace tool needs an included plan either way, and it also needs progress permission. The answered-question history is limited to an included plan unless that same plan limit is turned off. With history permission, that history is your own answered questions, newest first: the question as you saw it, the answer you chose, how it was marked, the date, and our reviewed explanation. An account outside the plan is told that the restricted reading is not included. Practice and saving your answers still work. A linked account, including a free one, can read its own saved revision session with the practice permission, and its own mock with the practice and progress permissions. Reading a timed revision session after its deadline can finish that sitting and grade the answers already saved. Disconnecting in the card pauses these linked readings until you connect again. We do not store notes or conclusions written by ChatGPT. A requested completed-card recap contains server-owned performance text and any selected unchanged explanation excerpts, kept available in process memory for delivery to that card for up to 15 minutes, after which it can no longer be retrieved and is purged from memory the next time anything accesses the store. Audio-progress tools are not enabled. Changing the saved exam date is off unless that separate permission is turned on. Disconnecting stops future linked access; your saved learning history stays in AKT Navigator.

Signing in through Medexia Accounts does not start practice notices, and it does not turn off a notice that an older AKT connection still sends. A notice is a count and a time. It does not include your answers, questions, name or email address. ChatGPT reads any further detail through the permissions above. While the paid-only check is on, these notices are produced only for accounts whose plan includes them, and only while the notice job is running. While monitoring is still on we keep the address ChatGPT gives us and the signing secret it supplies. We store that secret encrypted. Monitoring ends on the next notice check if that older connection is revoked or has expired, if you reset or change your AKT Navigator password, if you sign out on all devices, if the account is no longer a verified standard account, if a required permission is removed, if the paid-only check is on and the plan no longer includes the notice, or if you turn monitoring off in ChatGPT. If the notice job is not running, that check does not happen: no new notice is sent, and the saved monitoring details are left until a later check. Ending monitoring stops new notices. It does not immediately delete the stored address, secret or past notices. Those become eligible for deletion 30 days after monitoring ends, or 30 days after a notice is delivered, dropped or failed. Deletion then runs in batches of up to 200, about once an hour, only while the notice job is running. A stopped job or a large backlog can leave them longer. Disconnecting in the card, and choosing a different account, do not end that older notice.

The connection can include permission to read compact summaries of your exam date, pace, readiness, coverage, areas to strengthen and reviews due, and your own answered questions with the answer you chose and how it was marked, and permission to record practice answers. Changing the saved exam date is a separate permission and is off unless that permission is turned on. There is no permission to change weekly pace. Payment details, prices, remaining free-audio time, and other learners' information are not returned. When you ask about the linked account, ChatGPT receives the plan tier (free, full access or expired), the entitlement end time when one is recorded, and the permission names on the connection. Opening AKT Navigator can also receive whether the account can use the features an included plan covers.

Medexia Accounts, not AKT Navigator, issues the access tokens for this connection. This app is written for Accounts access tokens that last 10 minutes. If the live Accounts configuration uses a different lifetime, that configured lifetime applies. Accounts issues a refresh token only when the connection requests offline access. AKT Navigator does not set or store that refresh token's lifetime. When the pause store is installed, AKT Navigator stores an in-card disconnect or account-switch marker: the account identifier and the client identifier, or, for a switch, a one-way marker of that token. A switch marker older than a day is deleted only when that same account switches again and the deletion succeeds. There is no daily job, so a marker can stay indefinitely. Disconnecting in the card pauses sharing of the account with ChatGPT until you connect again in the card. Choosing a different account ends the connection at Medexia Accounts, including the consent for this client. You can also disconnect from ChatGPT's plugin settings. Deleting your AKT Navigator account removes the disconnect and switch markers stored with it. Requests to delete information already shared with OpenAI are handled under OpenAI's own policies.

Read-only ChatGPT tools do not add an operational record. State-changing ChatGPT tool calls can add an operational record used to run and protect the service: the tool name, whether the call succeeded, a fixed error code when the tool set one, how long the call took, whether the caller was a guest or a linked account, the linked account identifier or a one-way guest identifier, and a one-way hash of a practice-set reference when the call has one. The record does not include your name, email address, the chat transcript, chosen answers or question text. For a linked caller the stored access label is not the plan tier. A record becomes eligible for deletion after 180 days. Cleanup tries about once a day, only while the plugin process is running. A missed run, a timeout or a database error leaves the record until a later successful cleanup, so it can stay longer than 180 days.

ChatGPT is operated by OpenAI. OpenAI's own privacy policy governs how OpenAI handles your conversations. You can disconnect AKT Navigator at any time from the Plugins settings in ChatGPT.

7. Data sharing and sub-processors

We do not sell your data. If you explicitly allow optional marketing measurement, we may share a limited conversion signal with an advertising provider. This is restricted to campaign identifiers, technical request data, limited transaction metadata, a securely hashed email address and, for audio activation, an aggregate listening milestone. It excludes learning content, audiobook titles, chapters and topics, question performance and answers, notes, deanery, training stage, target exam date, free-text, clinical and patient data.

We use service providers to run the app and our marketing website. The following providers support these functions:

• Replit – application hosting
• Neon – managed PostgreSQL database
• Stripe – payment processing (subscription billing)
• Resend – transactional and opted-in marketing email, including delivery and engagement events where tracking is enabled
• OpenAI – generating AI-assisted explanations and tutor responses, when you choose to use those features
• PostHog (PostHog Inc., data hosted in the EU) – website analytics on medexia-akt.com if you allow Analytics cookies there, and a small set of app account milestones if you allow both Analytics and Marketing in the app (see section 9)
• Vercel – website analytics on medexia-akt.com, only if you allow Analytics cookies (see section 9)

Providers' roles and data-protection terms depend on the service and the processing involved. Their privacy notices explain any processing they carry out for their own purposes.

Meta advertising measurement: if you consent, a verified-registration signal may be sent to Meta Platforms, Inc. under the Meta Business Tools Terms. For UK data, those terms describe Meta as our processor for specified matching, measurement and reporting, and Meta and Medexia as joint controllers for specified collection and transmission, after which Meta may act as an independent controller. Meta's own Privacy Policy explains its processing and rights routes. Meta's terms state that Event Data may be retained for up to two years.

Reddit advertising measurement: if you consent, limited Page Visit, verified-registration, purchase and server-validated 30-minute audio-activation signals may be sent to Reddit through Reddit's advertising tools. Depending on the event and what is available, server-side event data may include a Reddit click identifier, event name and time, a deduplication identifier, event source URL, securely hashed email address, browser user-agent string and, for a purchase, its value, currency and item count. The Reddit Pixel may also collect limited page, browser, cookie, referrer, device and network information. We do not send learning content, audiobook titles, chapters or topics, question performance or answers, notes, deanery, training stage, target exam date, free-text, clinical or patient data. Reddit's Privacy Policy explains how Reddit processes information, international transfers, and available rights and choices.

Google advertising measurement: with marketing consent, we may send Google Ads conversion signals for a sign-up, the first 30 minutes of audio listening, a 120-minute audio-listening milestone or a purchase. In the app, Google's advertising tag loads only after you allow marketing. Browser conversion signals use a transaction identifier: for sign-up and audio milestones it contains your internal Medexia account identifier, and for a purchase it uses a payment reference. Purchase signals also include value and currency. If we hold a Google advertisement click identifier (gclid, gbraid or wbraid) collected with marketing consent, our servers may also send it with the conversion time and an order identifier to match a purchase or the first 30 minutes of audio to the advertisement. For purchases, that order identifier is the Stripe checkout-session reference; for the 30-minute signal it contains your internal Medexia account identifier. Server delivery checks whether marketing consent has been withdrawn for the account before claiming a signal for transmission. A signal already being transmitted cannot be recalled. We do not include your name or email address in the Google conversion payloads we construct. We do not include learning content, audiobook titles, chapters or topics, question performance or answers, notes, deanery, training stage, target exam date, free-text, clinical or patient data in those payloads. Google's tag may separately collect cookie identifiers, page and referrer information, and browser, device and network information. Depending on the service and applicable terms, Google may act as an independent controller for advertising data. Google's Privacy Policy and information about data received from other sites and apps explain its processing. See section 9 for website tags and consent controls.

8. International data transfers

Some service providers (notably OpenAI, Stripe, Resend, Replit, and—if optional advertising measurement is enabled—Meta and Reddit) are based in the United States and may process data outside the UK or European Economic Area. Google, PostHog and Vercel may also process data outside the UK or European Economic Area, although PostHog data from medexia-akt.com is hosted in the EU.

Where required, international transfers must be covered by a mechanism recognised under UK GDPR, such as an applicable adequacy decision or appropriate safeguards including Standard Contractual Clauses with the UK Addendum, or the UK International Data Transfer Agreement. Contact us for information about the safeguards applicable to your data and how to obtain a copy.

9. Cookies and local storage

We use a small number of cookies and browser storage items that are strictly necessary to run the app. Optional marketing identifiers are used only after an explicit consent choice:

• An authentication token so you stay signed in
• Local preferences such as your dark/light theme choice
• Limited progress data cached locally to keep the app responsive
• With marketing consent, limited campaign and ad-click identifiers used for attribution and conversion measurement
• With marketing consent, Google's advertising tag may set or read cookies and similar storage, including first-party cookies on our domain. Google's cookie information explains its cookie purposes and durations.

Optional advertising conversion signals from the app remain off unless you consent. You can use "Withdraw advertising consent" on the app's Legal page at any time to clear advertising identifiers held in this browser and request cancellation of pending Medexia conversion signals. Sign in to withdraw consent stored against your account as well. A signal whose transmission has already begun cannot be recalled. Withdrawal does not itself delete cookies or information held by Google, Meta or Reddit; use your browser controls and the providers' privacy policies and account tools for those choices. An already-loaded Google tag receives a consent-denied update, which may still allow limited cookieless consent and measurement signals.

In the app (app.medexia-akt.com)

The app shows its own cookie banner with separate Analytics and Marketing choices. Both are off until you choose, and you can change your choice or withdraw it at any time from "Cookie settings" on the app's Legal page. If you withdraw Marketing, email support@medexia-akt.com to turn it back on. If you allow both Analytics and Marketing, our server may send PostHog (PostHog Inc., data hosted in the EU) a small number of account milestones: signing up, first playing audio, reaching 5, 30 and 120 minutes of listening, starting a checkout and completing a purchase, together with your exam month. These are linked to an internal account number, not your name or email address. We do not send question answers, learning content or detailed listening history, and the app does not load PostHog in your browser. Withdrawing either choice stops further milestones being sent.

Marketing website (medexia-akt.com)

Our marketing website has its own cookie banner and a "Cookie settings" link in the footer. There you can choose Functional, Analytics and Marketing cookies separately and change or withdraw a choice at any time. Optional tools are not initially loaded until the relevant consent is given. These website settings are separate from the app's consent controls: changing them does not update the app's stored consent choice or withdraw consent stored against your account. To withdraw app advertising consent too, use "Withdraw advertising consent" on the app's Legal page, signing in for account-level withdrawal. Website Marketing withdrawal also writes a shared denial marker used to reject earlier Meta or Reddit consent handoffs; this is not a general withdrawal of app consent. The Cookie policy describes the website's cookies, storage and retention periods.

• Analytics: Vercel Analytics and PostHog (PostHog Inc., data hosted in the EU) load on the marketing website only after you allow Analytics. Vercel receives page-view and technical information for aggregate website statistics and does not use third-party cookies for this service. PostHog uses browser storage on medexia-akt.com and a first-party cookie beginning ph_ that can also be available to app.medexia-akt.com. Local storage is specific to the website origin; sharing the cookie does not share your consent choice. The PostHog cookie has a configured lifetime of up to 1 year, which may be renewed during use; the browser-storage copy stays until website Analytics consent is withdrawn or browser data is cleared. We do not send your name or email address to PostHog and we do not record your screen or what you type. Before anything is sent to PostHog we remove ad click identifiers, search terms carried over from search engines, and every web address parameter except the standard campaign tags (utm_source, utm_medium, utm_campaign, utm_content and utm_term); page paths are kept. Withdrawing Analytics consent in the website's Cookie settings stops website PostHog collection and clears its identifiers accessible to the website. PostHog processes this website analytics data on our behalf.
• Marketing: where configured, the Google tag, Google Analytics 4 and Google Ads, the Meta Pixel and the Reddit Pixel load on the website only after you allow Marketing, for campaign measurement and retargeting. The Google tag's analytics storage follows your separate Analytics choice; its advertising storage, advertising-data use and ad personalisation follow your Marketing choice. Analytics consent alone does not load the Google tag on this website. If the Google tag has already loaded, changing your choices sends it a consent update; denied storage choices may still permit limited cookieless consent and measurement signals. Ad click identifiers are handled only after Marketing consent. These website tools are separate from the app conversion signals described in section 7.
• Our own cookies: mx_consent_v1 remembers your website cookie choices for about 6 months. The mx_meta_capi_* cookies help bind consented Meta or Reddit conversion handoffs to this browser, reject earlier handoffs after Marketing is withdrawn, and confirm a later explicit regrant. The session-binding cookie, including withdrawal-scoped variants, lasts up to 24 hours. The seed, withdrawal, acknowledgement and regrant markers last up to 183 days. Some denial markers are set when Marketing is off so an earlier consent cannot be reused. The Cookie policy lists the individual cookie names and purposes.

10. Data storage and security

We take reasonable steps to protect your data, including:

• Secure authentication
• Encrypted storage where appropriate
• Restricted internal access

No system is completely risk-free, but we aim to handle your data responsibly.

11. Data retention

We retain your data:

• While your account is active
• For as long as needed to operate and improve the platform
• Email delivery and engagement event metadata for up to 12 months, unless it is needed for a security, complaint, or legal record

If you delete your account from your profile page, we immediately purge your profile and all associated study, behavioural, and feedback data from our database. Limited records may be retained for longer only where we are required to keep them by law (for example, billing records held by Stripe).

12. Your rights

Under UK GDPR, you have the right to:

• Access a copy of your data
• Correct inaccurate data
• Request deletion of your account and data
• Restrict or object to certain processing
• Withdraw consent where applicable
• Receive your data in a portable format

To exercise any of these rights, contact: support@medexia-akt.com

If you are not satisfied with how we have handled your data, you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. We would appreciate the chance to put things right first, but you can contact the ICO at any time.

13. Beta status

AKT Navigator is currently in early beta. Data handling practices may evolve as the platform matures, but we aim to maintain the same standard of care.

14. Changes to this policy

We may update this policy as the product develops. Significant changes will be communicated within the app.

15. Final note

AKT Navigator is for exam revision only. Always consult NICE, NICE CKS, and the BNF for current clinical guidance.