Privacy Policy

Last updated 6 July 2026. Data controller: Med Services Ltd (Company No. 14915054), Oxford, United Kingdom

The short version

UCATPulse keeps your practice data on your own device by default. Creating an account is optional: if you do, we store your email address and back up your practice data to our servers so it syncs across your devices. You can delete your account and everything synced to it at any time from Settings. No ads, no cross-site trackers, no selling of data. On the website we count visits with Plausible Analytics, which uses no cookies and collects nothing personal about you.

1. What we collect

• On your device (no account needed). Your Pulse, streak, review schedule, settings and progress are stored in local storage on your device. If you never create an account, this data never leaves your device. Clearing the app's data deletes it (use Settings, then Export progress, to keep a backup).
• If you create an account. Accounts use a 6-digit email code, with no password. We then store your email address (to sign you in and to link your Pro purchase to you) and a synced copy of your practice data (Pulse, streak, progress and settings) on our backend (Supabase) so it is backed up and available on your other devices. Sign-in codes are sent by email through our backend provider, Supabase. Our backend may store or process this data in, or transfer it to, the United States under appropriate safeguards (Standard Contractual Clauses and the UK International Data Transfer Agreement).
• Payments. On the web, Pro is processed by Stripe, who collect your payment details and email under their own privacy policy. We receive confirmation of the payment and your email address so we can grant Pro and, if needed, issue a refund. Stripe may transfer data to the US under Standard Contractual Clauses and the UK International Data Transfer Agreement.
• Payments. On iPhone, Pro is bought through Apple's In-App Purchase. Apple processes the payment under Apple's own privacy policy; we receive only confirmation that you are entitled to Pro. We never see or store your card details.
• Hosting logs. Our hosting and backend providers record standard, short-lived server logs (such as IP address and user agent) to serve and secure the service.
• Website visit counts. On the ucatpulse.com website we use Plausible Analytics to count visits and see which screens are used. Plausible is privacy-first and EU-hosted: it sets no cookies, stores nothing on your device, does not collect any personal data, and cannot follow you to other websites. The figures are aggregated and cannot be traced back to you. The iPhone app does not use Plausible at all.
• Support email. If you email us, we keep the correspondence for as long as needed to help you.

2. What we don't do

• No advertising, no cross-site tracking, no analytics cookies, no selling of data. The website's visit counter (Plausible) is cookieless and does not follow you to other sites.
• No health data is collected. This is exam practice, not a medical service.

3. Lawful basis (UK GDPR)

We rely on contract (providing Pro and syncing an account you asked us to create), legitimate interests (running and securing the service) and, where relevant, consent (which you can withdraw by deleting your account).

4. Retention

On-device practice data lives on your device until you delete it. Account data (your email and synced practice data) is kept until you delete your account, which you can do at any time in Settings, then Delete account. Payment records are kept for 6 years as required by UK tax law. Support emails are deleted when no longer needed.

5. Your rights

You have the right to access, correct, delete and port your data, to object to or restrict our processing, to withdraw consent at any time, and to complain to the ICO (ico.org.uk). You can delete your account and all data synced to it directly in the app (Settings, then Delete account). For anything else we hold (payment records, support emails), contact us and we will respond within one month.

6. Children

UCATPulse is intended for users aged 16 and over. We do not knowingly collect data from younger users.

7. Contact

Med Services Ltd, UCATPulse@gmail.com