Privacy Policy | OSCE Revisions

1. Introduction

OSCE Revisions (“the Platform”) is operated by OSCE Revisions Education Inc (part of the MedRevisions family / MedRevisions Education Ltd). We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This Privacy Policy explains how we collect, use, and protect your information.

2. Data Controller

OSCE Revisions Education Inc is the data controller for personal data processed through the Platform. You can contact us at contact@oscerevisions.com.

3. Data We Collect

We collect the following categories of personal data:

Account information: name, email address, and authentication data when you register
Usage data: session transcripts, grading results, scenario completion records, and performance analytics
Payment data: processed securely by Stripe; we do not store your full card details
Technical data: browser type, device information, IP address, and cookies for analytics and session management. We use Google Analytics 4 to understand how the Platform is used (page views, sign-ups, and purchases).
Audio data: voice recordings during AI patient sessions, processed in real-time and stored as transcripts

4. Legal Basis for Processing

We process your data based on:

Contract: to provide the services you have subscribed to
Legitimate interests: to improve our Platform and ensure security
Consent: for marketing communications (which you can withdraw at any time)
Legal obligation: to comply with applicable laws and regulations

5. How We Use Your Data

Your data is used to:

Provide and maintain the Platform's services
Process payments and manage subscriptions
Generate personalised grading and performance analytics
Improve our AI models and content quality
Communicate about your account and service updates
Ensure platform security and prevent fraud

6. Data Sharing

We share your data only with:

Firebase (Google Cloud): for authentication, database, and hosting
Google Gemini API: for AI voice conversation processing (audio processed in real-time, not permanently stored by Google)
Stripe: for payment processing

We do not sell your personal data to third parties.

7. Data Retention

We retain your account data and session history for the duration of your account. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or legitimate business purposes.

8. Your Rights

Under UK GDPR, you have the right to:

Access your personal data
Rectify inaccurate or incomplete data
Erase your data (“right to be forgotten”)
Restrict processing in certain circumstances
Data portability — receive your data in a structured, machine-readable format
Object to processing based on legitimate interests
Withdraw consent at any time for consent-based processing

To exercise any of these rights, contact us at contact@oscerevisions.com.

9. Cookies

We use essential cookies for authentication and session management. We may use analytics cookies to understand how the Platform is used. You can manage cookie preferences in your browser settings.

10. Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, access controls, and regular security reviews. However, no method of electronic transmission or storage is 100% secure.

11. International Transfers

Your data may be processed outside the UK by our service providers (Google Cloud, Stripe). These transfers are protected by appropriate safeguards including Standard Contractual Clauses and adequacy decisions.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Platform. The “Last updated” date will be revised accordingly.

13. Complaints

If you have concerns about how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

14. Contact

For any questions about this Privacy Policy, please contact us at contact@oscerevisions.com.