Privacy

Who we are

Samyar Aminalsharieh Najafi operates PrepMed as a sole trader, trading as “PrepMed”. Our address for correspondence is 11 Whistle Hollow Way, Stockport, Greater Manchester, SK2 7DB, United Kingdom. If PrepMed is later incorporated, this notice will be updated to name the company and its registered address, and your existing rights will not be reduced. We are the data controller for the personal information described here. For any privacy question or to exercise your rights, contact us at privacy@auth.prepmed.co.uk.

What we collect

When you create an account we store your email address, your selected interview audience, acquisition source, and, if provided, your full name. We record the version and time of your Terms and Privacy acceptance. As you use the app we store the practice content you generate: answers, editable transcripts, custom and advanced scenarios, and your scoring history. We also keep trial/pass state, usage counts, payment references, service events, your most recent authenticated activity time, and reports you submit so we can provide access, prevent repeat trials, operate the beta, and respond to problems. The activity heartbeat contains only your account ID and a timestamp, is sent only while the signed-in app tab is visible, and is rate-limited; it does not record the page, action, device, or browser details. Provider-cost records contain model name, token-category counts, transcription duration, calculated cost, and reservation/settlement state; cost tracking does not add copies of prompts, answers, audio, or raw provider responses. If you complete your profile we store the career details you enter. PrepMed does not currently accept CV uploads. Data retained from the former CV feature is no longer used for coaching and remains removable through the delete-my-data action or an erasure request.

How we use it and our legal basis

We use this information to provide the interview-practice service, enforce trials and passes, prevent abuse, measure signup-to-feedback and payment funnels by audience/source, monitor reliability and safety, and answer support or privacy requests. Our primary legal basis for providing the service is performance of our agreement with you; security, fraud prevention, and service improvement may also rely on our legitimate interests where appropriate. We do not sell personal information or use it for third-party advertising.

What we do not store

Raw voice audio is not stored by default. Voice recordings are sent for transcription and the resulting transcript may be added to your answer and saved as part of your attempt history, but the original audio file is not kept.

Third-party processing and transfers

We use a small number of service providers to run PrepMed. When OpenAI is the active provider, your answer text and temporary voice uploads are sent to OpenAI (a US company) to generate coaching feedback or transcripts; OpenAI's API does not use this data to train its models, and we request no persistent storage of conversation state. Our database, server-side product events, and email/password authentication run on Supabase. Resend delivers our authentication and minimised operational alert email and, when inbound support is enabled, receives and forwards messages sent to our published support and privacy addresses; we do not copy those inbound message bodies or attachments into our application database. Cloudflare provides the Turnstile bot-protection check on our signup and login forms, which processes your IP address and browser characteristics to distinguish people from bots. Hosting, application logs, and aggregate cookieless traffic analytics are provided by Vercel. If you buy a pass, Stripe hosts the checkout and processes your payment; we receive payment references and status, never your card details — Stripe also acts as an independent controller for its own fraud-prevention and regulatory obligations, described in Stripe's privacy policy. Operational alerts do not include interview answers, transcripts, feedback, account email addresses, user IDs, or detailed event metadata.

Some of these providers process personal data in the United States. Where they do, we rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, and otherwise on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, in each case as incorporated in our contracts with them. You can ask us at privacy@auth.prepmed.co.uk for more detail about any of these safeguards.

Cookies and sessions

We use essential cookies set by our authentication provider to keep you signed in. We do not use third-party advertising or tracking cookies. Your light/dark theme preference is stored locally in your browser, not used to identify you.

Your rights

Under UK GDPR you have the right to access, correct, erase, restrict, or object to the processing of your personal information, and the right to receive a copy of it in a portable format. Where we rely on legitimate interests (security, abuse prevention, service measurement), you can object at any time and we will stop unless we have compelling grounds. None of our processing involves decisions with legal or similarly significant effects made solely by automated means: AI feedback is coaching content, and access decisions such as trials, passes, and refunds follow the rules you agreed to, with a human handling any dispute. You can exercise these rights by emailing privacy@auth.prepmed.co.uk. You also have the right to complain to the UK Information Commissioner's Office (ICO), ico.org.uk if you believe your information has been handled unlawfully.

Retention and deletion

We keep your account, profile, and practice content while your account is active; the delete-my-data action removes practice/profile content immediately. You can also submit a verified full account deletion request. Some records may need to be kept separately where reasonably necessary for legal claims, tax and accounting obligations, payment administration, trial-abuse prevention, cost reconciliation, product measurement, security, support, safety, or privacy-request accountability. We keep each category only for as long as it is needed for its stated purpose or as required by law. Specific periods will be published once the corresponding deletion and anonymisation processes are implemented and verified. You can download a portable JSON copy or submit a full account deletion request from Privacy & security in Settings. See Data retention for more detail.

Your responsibilities

Do not enter patient-identifiable information, confidential employer information, or other sensitive real-world material. This product is intended for private interview practice, not live clinical or employment workflows.

Changes and contact

We may update this notice as the product develops; the date above reflects the latest version. For any question about your information, contact us at privacy@auth.prepmed.co.uk.