Legal
Privacy policy.
What personal information MRCPsych Prep collects, why, who helps us process it and the choices and rights you have under UK GDPR and the Data Protection Act 2018.
Last updated: 9 October 2026
1. Who is responsible
The controller of your personal information is Certiva (Pty) Ltd, a company registered in South Africa (registration number 2026/338141/07), registered address [registered address], which operates MRCPsych Prep. For any privacy question or request, email support@mrcpsychprep.com.
2. What we collect
| Information | Details |
|---|---|
| Account | Your name, email address and password. Passwords are stored by our authentication provider as a secure one-way hash; we never see them. |
| Study data | Your answers, whether they were right, when you answered, questions you flag, timed mock exams, your study plan settings and the scores worked out from them (topic results, revision due, readiness score). |
| Payments | When you buy, Lemon Squeezy tells us your order number, the pass you bought, the amount, the currency, your email address, the time of the order and any refund. Lemon Squeezy handles your card or other payment details; we never receive them. |
| Analytics, only if you allow it | Pages you visit, buttons you press, how far you scroll, your device and browser type and approximate location, through Google Analytics and the Meta pixel. See section 6. |
| Messages | What you send us by email, such as corrections or support requests. |
| Technical data | Our hosting and database providers keep short-lived server logs (such as IP address and request time) to run the service securely. |
We do not ask for information about your health or other special category data, and please do not send it to us.
3. Why we use it and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Creating your account, saving your progress, running practice, revision, mock exams, the readiness score and the study plan | Contract: we need it to provide what you signed up for |
| Giving you access when you buy a pass, and handling refunds | Contract |
| Keeping payment and refund records | Legal obligation (tax and accounting law) and contract |
| Emails about your account, such as password resets | Contract |
| Answering your messages and corrections | Legitimate interests: to help you and improve the content |
| Keeping the service secure and preventing misuse, such as shared accounts | Legitimate interests: to protect the service and its users |
| Analytics and measuring which adverts lead to sign-ups and purchases | Consent, which you can withdraw at any time |
| Emails about your pass: welcome, weekly progress, reminders before your pass ends, reminders to start and asking how your exam went | Contract and our legitimate interest in helping you use what you paid for. Every one of these emails has a link to stop that kind of email. |
| Study tips, exam dates and offers by email | Your consent, given by the unticked box at sign-up or on your Account page. Withdraw it at any time with the unsubscribe link or on your Account page. We keep a record of each choice as proof. |
The readiness score and study plan are worked out automatically from your answers. They are study guides only and have no legal or similarly significant effect on you. We do not sell your personal information, and we do not send marketing emails without asking you first.
4. Who processes it for us
We use these service providers. They process personal information on our instructions and under data processing terms:
| Provider | What they do |
|---|---|
| Supabase | Database and sign-in: your account and study data (hosted on Amazon Web Services) |
| Netlify | Hosts the website and runs the function that receives payment notifications |
| Google (Google Fonts) | Serves the website’s font, which means Google receives your IP address when a page loads |
| Google Analytics | Website analytics, only with your consent |
| Meta (Facebook and Instagram) | Measures which adverts lead to sign-ups and purchases, only with your consent |
| Resend | Sends our emails from an mrcpsychprep.com address: your email address, name and the content of each email. |
Lemon Squeezy is the merchant of record: it sells the pass to you, takes your payment and handles tax. It is responsible for the personal information it collects at checkout under its own privacy policy, and shares with us the order details in section 2.
5. Payments and purchase measurement
The checkout passes your account ID to Lemon Squeezy so the payment can be matched to your account, and records whether you allowed analytics. Only if you allowed analytics cookies, when a purchase is confirmed we send Google Analytics the order number, value and your analytics ID, and send Meta the order number, value and a one-way scrambled code (hash) of your email address that Meta can only match to an existing Meta account. If you rejected analytics cookies, none of this is sent.
6. Cookies and similar storage
We use your browser’s storage for things the site needs to work, such as keeping you signed in, remembering your cookie choice and some study preferences. These don’t need consent.
Analytics cookies from Google Analytics and the Meta pixel are set only if you choose “Allow analytics” in the banner. If you choose “Reject non-essential”, they are not loaded. Advertising personalisation signals stay switched off either way.
7. International transfers
MRCPsych Prep is operated from South Africa, and our providers store and process information in the United States and the European Union as well as other countries. Where personal information leaves the UK for a country without UK adequacy regulations, we rely on appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses in our providers’ data processing terms, or the UK Extension to the EU-US Data Privacy Framework where a provider is certified. Email us for more information about these safeguards.
8. How long we keep it
| Information | How long |
|---|---|
| Account and study data | While your account exists. When you ask us to delete your account, we delete it within 30 days. |
| Payment and refund records | Up to 7 years after the purchase, as tax and accounting law requires, even if you delete your account |
| Support emails | Up to 2 years after the conversation ends |
| Analytics data | For the retention period set in Google Analytics and Meta, and no longer than 26 months |
| Server logs | Kept by our providers for a short period, usually days to weeks |
| Your marketing email choices and the record of emails sent | While you have an account. A record that you unsubscribed is kept so we don’t email you again. |
9. Your rights
Under UK GDPR you have the right to:
- access a copy of your personal information;
- correct information that is wrong;
- delete your information;
- restrict or object to how we use it, including where we rely on legitimate interests;
- data portability: receive your data in a machine-readable format;
- withdraw consent to analytics at any time, without affecting what happened before.
You can do some of this yourself. On your Account page, Download my data gives you a file of everything your account holds, and you can change your name. To delete your account or make any other request, use the buttons on the same page or email support@mrcpsychprep.com. We reply within one month and may ask you to confirm your identity first.
10. Complaints
Please contact us first so we can try to put things right. You also have the right to complain to the UK Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.
11. Children
MRCPsych Prep is for doctors preparing for postgraduate exams. It is not intended for anyone under 18, and we do not knowingly collect information from children.
12. Changes to this policy
We will update this policy when how we use personal information changes. The date at the top shows the latest version, and we will tell you about important changes by email or on the site.