MedQuiz MBBS
Smart Learning
Back to site

Privacy Policy

Last updated: 12/10/2026

1. Who we are

MedQuiz MBBS is run by MedQuiz MBBS Limited, a company registered in England and Wales (company number 17366716). Our registered office is 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ.

We are the data controller for the personal data described in this policy. This means we decide how and why it is used.

Privacy questions or requests: enquiries@medquizmbbs.com

Doctor reviewer questions: reviewers@medquizmbbs.com

2. Who this policy covers

  • People who join our waitlist
  • Students who create an account, including for the free Master Deck
  • Student ambassadors and people who apply to become one
  • Doctors who review our content (section 11)
  • Anyone who visits our website

3. The information we collect

If you join the waitlist

  • Your name and email address
  • Your medical school, if you tell us
  • How you heard about us, and any ambassador referral code you used

If you create an account

  • Your name, email address, medical school and year of study
  • Your sign-in details. Passwords are stored by our authentication provider in a scrambled (hashed) form that we cannot read.
  • Your marketing email choice, and when you made or changed it
  • Any ambassador referral code you used when signing up, and which ambassador it belongs to
  • Your study activity: which cards you have studied, your ratings (Again, Hard, Good, Easy), when you studied, and the scheduling information this produces
  • Your study settings: daily limits, text size, theme and hidden cards
  • Any changes you make to cards in your own copy of the deck
  • Any problems you report about a card, including any note you add
  • Simple daily totals, such as how many cards you reviewed each day

If you apply to be, or become, a student ambassador

  • Your name, email address, medical school and year
  • What you tell us in your application
  • If you agree to a public profile: your display name, photograph, year, a short bio and any social media links you choose to share
  • Referral tracking: your referral code and the sign-ups linked to it
  • Information needed to manage our agreement with you and any payments

When you use our website

  • Basic technical information your browser sends when you visit, such as your IP address and device and browser type. Our hosting provider uses this to deliver the site and keep it secure.
  • To stop abuse, such as automated sign-ups or too many requests, we keep short-lived records of activity. Some are linked to a one-way scrambled code rather than to you by name.
  • Our hosting and authentication providers keep security logs, which can include IP addresses.

What we do not collect

  • We do not collect health information about you. Your study activity shows which medical topics you are revising, not anything about your own health.
  • We do not collect payment card details. The Master Deck is free.

4. Why we use it, and our legal basis

UK data protection law requires us to have a legal reason, called a "lawful basis", for each use of your data.

  • Creating and running your account, and providing the Master Deck (saving progress, scheduling cards, keeping your settings and edits): Contract. We need it to provide the service you signed up for.
  • Sending essential service emails, such as sign-in links, password resets, and important corrections to cards you study: Contract.
  • Reviewing card reports and correcting content: Legitimate interests (keeping our content accurate).
  • Sending launch news, product updates and offers by email: Consent. Only if you opted in. You can withdraw at any time.
  • Keeping a single waitlist of everyone who has shown interest or created an account, to understand how people find us and how many sign up: Legitimate interests (understanding and growing our service). Being on this list does not mean we will send you marketing emails unless you have consented.
  • Tracking which ambassador referred you, and paying ambassadors: Legitimate interests (for you), and contract (for the ambassador).
  • Running the ambassador programme: Contract / legitimate interests.
  • Running the doctor reviewer programme (section 11): Contract / legitimate interests.
  • Counting how many people visit and sign up, using totals from our own sign-up records and from Google Search Console, which reports on how people find us in Google search and does not track you on our site: Legitimate interests.
  • Keeping the service secure and preventing abuse: Legitimate interests.
  • Meeting legal duties, such as tax and accounting records: Legal obligation.

Where we rely on legitimate interests, we have weighed our interests against yours. You can object at any time (section 10).

You need to give us your name, email address, medical school and year to create an account. Without them, we cannot provide one. Everything else is optional.

5. Automated decisions

The Master Deck uses a spaced-repetition algorithm to decide when each card is shown again, based on your ratings. This only affects your own study schedule. It has no legal or similarly significant effect on you.

We do not make any other automated decisions about you, and we do not use your personal data to train AI models.

6. Who we share it with

We do not sell your personal data, and we do not share it with advertisers. We use these service providers to run MedQuiz MBBS. They process data for us, on our instructions:

  • Lovable: hosts and runs our website and app
  • Supabase: stores our database and handles account sign-in
  • Resend: sends our emails
  • Cloudflare: delivers our website securely and protects it from attacks

We may also share information:

  • with professional advisers such as accountants and lawyers;
  • if the law requires it;
  • with a buyer, if our business is sold, in which case this policy would still apply to your data.

7. Where your data is stored

Some of our providers may store or process data outside the UK. When this happens, we rely on a UK adequacy decision or on approved safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

8. How long we keep it

  • Your account and study data: while your account is open. If you delete your account, we delete it, except as described below.
  • Card reports you made: open reports are deleted with your account. Reports we have already acted on are kept as part of our content records, with your name and any note removed.
  • Waitlist entry: until you ask us to remove you, or you delete your account.
  • Marketing consent records: while you are on our lists, and for up to 2 years after, so we can show we had your consent.
  • Ambassador records: for the length of our agreement, then up to 6 years for tax and legal purposes.
  • Doctor reviewer records: see section 11.
  • Security and abuse-prevention records: short-term only, normally no more than 90 days.
  • Backups: deleted data can remain in our providers' backups for a limited time before it is overwritten.

9. Cookies

We only use cookies and similar technologies that are essential to make the site work. We do not use analytics, advertising or tracking cookies. Full details are in our Cookie Policy.

10. Your rights

You have the right to:

  • access the personal data we hold about you;
  • correct anything that is wrong;
  • ask us to delete your data;
  • restrict how we use it;
  • object to uses based on legitimate interests;
  • data portability: receive your data in a commonly used format;
  • withdraw consent at any time, for example to marketing emails. This does not affect anything we did before you withdrew it.

How to use these rights:

  • Marketing emails: use the unsubscribe link in any email, or change your email choice in Master Deck Settings.
  • Everything else: email enquiries@medquizmbbs.com from the email address on your account. We may ask you to confirm your identity.

We will reply within one month. If a request is complex, we may need up to two more months, and we will tell you if so. There is normally no charge.

Complaints: if you are unhappy with how we use your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

11. Doctor reviewers

This section applies to doctors we invite to review content under our Doctor Reviewer Agreement.

What we collect

  • Your name, email address, GMC number, grade and specialty
  • Your account and sign-in details, including when you sign in and when you use an invitation or sign-in link
  • The review work you do: which questions you were assigned, and every decision you record (approve, amend, reject, second opinion or skip), with the date and time
  • The exact wording of any amendment you approve, and any notes you leave for us or for another reviewer
  • If you give separate consent to a public profile: your photograph, professional title and a short summary of your role

Amendments and notes you have typed but not yet submitted are kept only in your own browser. They are not sent to us until you press a decision button.

Why we use it

  • To run the review programme under your Doctor Reviewer Agreement: giving you access, assigning batches, and sending you invitations, sign-in links and batch emails (contract)
  • To keep an accurate, permanent record of which doctor reviewed and approved each question, so we can show that the questions students see have been checked by a named clinician (legitimate interests)
  • To confirm your professional registration (legitimate interests)
  • To keep the review portal secure, for example by signing you out after a period of inactivity (legitimate interests)
  • To publish a public profile, only if you separately agree to it (consent)

What students see

Students see that a question has been clinically reviewed. We do not show an individual doctor's name against individual questions unless you ask us to. Your name appears publicly only where you have consented to it, such as a public profile.

How long we keep it

  • The record of your review decisions and approved wording is kept permanently, as part of the history of our content. This continues after your involvement ends, as set out in the Doctor Reviewer Agreement.
  • Your contact and account details are kept while you are a reviewer, and for up to 6 years after your involvement ends, in case of legal claims.
  • A public profile is removed if you withdraw consent.

Your rights as a reviewer

You have the rights in section 10. Because the review record is how we show that our content was checked by a qualified clinician, we may not be able to delete your name from past review decisions. We will explain this if you ask. You can withdraw consent to a public profile at any time by emailing reviewers@medquizmbbs.com.

12. Children

MedQuiz MBBS is for university medical students. It is not intended for anyone under 16, and we do not knowingly collect their data. If you believe someone under 16 has given us their data, contact us and we will delete it.

13. Security

We protect your data with encrypted connections (HTTPS), database rules that stop one user seeing another user's data, and admin access limited to the people who need it. No system is completely secure. If a breach is likely to put you at risk, we will tell you and the ICO as the law requires.

14. Changes to this policy

When we update this policy, we change the date at the top. If a change is significant, we will tell account holders by email before it takes effect.