Privacy Policy

1. Who we are

MedCompass operates a platform that helps UK students applying to medicine and dentistry organise their applications, track work experience, and prepare for admissions assessments.

In this Privacy Policy, references to "we", "us", and "our" mean MedCompass.

For questions about this policy, contact us at support@medcompass.uk.

2. What data we collect

We collect the following categories of personal data:

• Waitlist registrations: name, email address, school or organisation name, and role (student, teacher, or parent).
• Account data (pilot users): email address, name, and information you choose to add to your profile.
• Application data: work experience logs, personal statement drafts, university shortlists, reflection notes, and other content you create within the platform.
• Usage data: pages visited, actions taken within the app, browser type, and device information, collected via server logs and analytics.
• Communications: any messages you send to us by email.

3. How we use your data

We use your data to:

• Operate and improve the MedCompass platform.
• Communicate with you about your account, pilot access, and platform updates.
• Understand how the platform is used so we can fix bugs and prioritise features.
• Comply with legal obligations.

We do not sell your personal data to third parties. We do not use your data for automated decision-making that produces legal or similarly significant effects.

4. Legal basis for processing

Under UK GDPR, we process your data on the following bases:

• Contractual necessity: processing required to provide the platform to you as a registered user.
• Legitimate interests: understanding usage patterns, improving the service, and operating the waitlist. Our interests do not override your rights.
• Consent: where you have given specific consent, such as receiving marketing communications.
• Legal obligation: where required by applicable law.

5. Data storage and security

Your data is stored using Supabase, which operates on AWS infrastructure within the European Union. Data at rest and in transit is encrypted. We apply access controls so that only authorised personnel can access your data.

No security system is completely impenetrable. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected users without undue delay.

6. Data retention

• Waitlist data: retained until you request deletion or two years after collection, whichever comes first.
• Account and application data: retained for the duration of your account plus 12 months, then deleted.
• Usage logs: retained for up to 12 months.

7. Sharing your data

We share data only where necessary:

• Supabase: our database and authentication provider. Processes data under a Data Processing Agreement.
• Vercel: our hosting provider. Processes server request logs.
• Legal requirements: if required by law, court order, or to protect our legal rights.

We do not share your data with advertisers, data brokers, or any third party for marketing purposes.

8. Your rights under UK GDPR

You have the right to:

• Access the personal data we hold about you.
• Rectification of inaccurate or incomplete data.
• Erasure ("right to be forgotten") in certain circumstances.
• Restriction of processing in certain circumstances.
• Data portability where processing is based on consent or contract.
• Object to processing based on legitimate interests.
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email support@medcompass.uk. We will respond within one calendar month.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Cookies

We use essential cookies to operate the platform (for example, to maintain login sessions). We may use analytics cookies to understand how visitors use the site. See our Cookie Policy for full details.

10. Children

MedCompass is intended for users aged 16 and over. If you are under 16, please ask a parent or guardian before registering. We do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected such data, contact us immediately.

11. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the "Last updated" date at the top and, where appropriate, notify you by email. Continued use of the platform after changes take effect constitutes acceptance of the updated policy.