Privacy Policy | OSCE Revisions

1. Introduction

OSCE Revisions (“the Platform”) is operated by OSCE Revisions Education Inc (part of the MedRevisions family / MedRevisions Education Ltd). We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This Privacy Policy explains how we collect, use, and protect your information.

2. Data Controller

OSCE Revisions Education Inc is the data controller for personal data processed through the Platform. You can contact us at contact@oscerevisions.com.

3. Data We Collect

We collect the following categories of personal data:

Account information: name, email address, and authentication data when you register
Phone number (optional): if you choose to provide it at signup or in your profile, stored in international (E.164) format
WhatsApp marketing consent (optional): if you opt in, we store your phone number, the exact consent wording shown to you, and the timestamp of consent, so we can contact you with exam tips and offers via WhatsApp. Consent is unchecked by default and can be withdrawn at any time by contacting us or replying STOP when messaging is enabled
Usage data: session transcripts, grading results, scenario completion records, and performance analytics
Payment data: processed securely by Stripe; we do not store your full card details
Technical data: browser type, device information, IP address, approximate location derived from IP (city/region/country) for security investigation, cookies, and a device fingerprint used only to prevent multi-account abuse and fraud. Security login logs (IP, approximate location, device label) are retained for up to 90 days and are accessible only to platform administrators. We use Google Analytics 4 to understand how the Platform is used (page views, sign-ups, and purchases). We also use the Reddit Pixel and Reddit Conversions API to measure advertising performance (page visits, sign-ups, and purchases), including hashed identifiers such as email where available for conversion matching.
Audio data: voice recordings during AI patient sessions, processed in real-time and stored as transcripts

4. Legal Basis for Processing

We process your data based on:

Contract: to provide the services you have subscribed to
Legitimate interests: to improve our Platform and ensure security
Consent: for marketing communications (which you can withdraw at any time)
Legal obligation: to comply with applicable laws and regulations

5. How We Use Your Data

Your data is used to:

Provide and maintain the Platform's services
Process payments and manage subscriptions
Generate personalised grading and performance analytics
Improve our AI models and content quality
Communicate about your account and service updates
Send exam tips and offers via WhatsApp only if you have given explicit opt-in consent
Ensure platform security and prevent fraud (including limiting one active login at a time and detecting multi-account abuse)

6. Data Sharing

We share your data only with:

Firebase (Google Cloud): for authentication, database, and hosting
Google Gemini API: for AI voice conversation processing (audio processed in real-time, not permanently stored by Google)
Stripe: for payment processing
Reddit: for advertising measurement and conversion attribution via the Reddit Pixel and Conversions API

We do not sell your personal data to third parties.

7. Data Retention

We retain your account data and session history for the duration of your account. Security login logs (IP address and approximate location) are retained for up to 90 days. If you delete your account, we will delete your personal data within 30 days, including associated security logs, except where we are required to retain it for legal or legitimate business purposes (including fraud prevention under UK GDPR legitimate interests).

8. Your Rights

Under UK GDPR, you have the right to:

Access your personal data
Rectify inaccurate or incomplete data
Erase your data (“right to be forgotten”)
Restrict processing in certain circumstances
Data portability — receive your data in a structured, machine-readable format
Object to processing based on legitimate interests
Withdraw consent at any time for consent-based processing

To exercise any of these rights, contact us at contact@oscerevisions.com.

9. Cookies

We use essential cookies for authentication and session management. We may use analytics and advertising cookies (including Google Analytics 4 and the Reddit Pixel) to understand how the Platform is used and to measure ad performance. You can manage cookie preferences in your browser settings.

10. Security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, access controls, and regular security reviews. However, no method of electronic transmission or storage is 100% secure.

11. International Transfers

Your data may be processed outside the UK by our service providers (Google Cloud, Stripe). These transfers are protected by appropriate safeguards including Standard Contractual Clauses and adequacy decisions.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Platform. The “Last updated” date will be revised accordingly.

13. Marketing Communications (WhatsApp / SMS)

If you opt in to WhatsApp (or future SMS) marketing, we rely on your express consent under applicable laws including Canada's Anti-Spam Legislation (CASL) and UK GDPR. We store proof of consent (timestamp and the exact wording shown). We will not send marketing messages without that consent. You can withdraw consent at any time by emailing contact@oscerevisions.com or by following opt-out instructions in the message when WhatsApp outreach is enabled. Transactional messages about your account (e.g. security alerts) may still be sent where permitted by law.

14. Complaints

If you have concerns about how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

15. Contact

For any questions about this Privacy Policy, please contact us at contact@oscerevisions.com.