Privacy policy

Who is responsible for your data

This app is run by Rayyan Malik as an independent study project, and for data protection purposes Rayyan Malik is the data controller, contactable at rayyanhamdanmalik2003@gmail.com.

It is not run by a university, a medical school, the General Medical Council or any examining body, and none of them receive your data.

What we store

This is an exam app, so most of what it holds is your own work:

• Your account: your email address, an optional display name, and the invite code you signed up with. Your password is handled by Supabase Auth and stored as a hash. Nobody, including us, can read it.
• Your attempts: every question you answer, the option you picked, whether it was right, how long you took, and your score. This is the entire point of the app, because it is what the analysis is built from.
• Your progress: which papers you have sat and your performance broken down by topic against the MLA content map.

Who can see your results

Your answers and scores are yours. Other users cannot see them, and there is no leaderboard, no cohort ranking and no sharing of your performance with anyone.

Whoever administers this app can see the list of accounts and can see attempt data, because that is unavoidable when someone has to keep the question bank and the app working. It is not used to assess you, it is not passed to your medical school, and it has no bearing on your actual exams.

What we do not do

There is no analytics tool, no advertising, no tracking pixel and no third-party script in this app at all. We do not profile you, we do not sell or share your data, and nothing you do here is reported to anyone.

Why we are allowed to hold it

We rely on your consent, given when you created an account with an invite code, and on performance of a contract: we cannot give you an exam app that remembers your results without storing your results.

You can withdraw consent at any time by asking us to delete your account, which deletes the data with it.

The services we use

Two, and no others:

• Supabase provides the database and the authentication, and sends account emails such as confirmation and password resets.
• Cloudflare hosts the app and processes the technical request data any web server sees, such as your IP address, in order to serve it.

Where your data goes

Both providers may process data outside the UK. Where that happens it is under the safeguards those providers offer, such as the UK addendum to the EU standard contractual clauses.

How long we keep it

Your account and your attempt history are kept for as long as your account exists, because losing your history would defeat the purpose of revising with it.

If you ask us to delete your account, we delete it and every attempt attached to it. There is no financial record to keep, because nothing is ever charged.

Your rights, and how to use them

Under UK GDPR you can ask us for a copy of the data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to us holding it, or ask for it in a portable format.

Email rayyanhamdanmalik2003@gmail.com from your account address and say what you want. You do not need to give a reason, there is no charge, and we will reply within one month.

Deleting your account is the fastest way to remove everything at once. Ask, and we will do it and confirm when it is done.

If you are not happy with how your data has been handled you can complain to the Information Commissioner’s Office at ico.org.uk.

Changes

This policy was last reviewed on 26 September 2026.