Privacy Policy

Last updated: 1 October 2026

PharmaStudy ("we", "us") is currently operated by Zakki [add your full legal name and, once registered, your sole trader / business details], as an individual based in the United Kingdom. This policy explains what personal data PharmaStudy collects, why, and what rights you have over it, under UK data protection law (UK GDPR).

1. What we collect

• Account details: the email address you sign up with, and your password (which we never see or store ourselves — it is handled securely by our authentication provider, Supabase).
• Profile details you choose to add: a display name and year of study, if you fill these in.
• Content you create: flashcards, questions, mark schemes, OSCE stations, and your answers and progress, so the app can show them back to you and track your revision.
• Lecture files you upload: we extract the text from a PDF or PowerPoint you upload in order to generate flashcards or questions from it. We do not keep the original file after processing.
• AI conversation content: if you use the AI patient OSCE, your messages and the simulated patient's replies are stored as part of your OSCE attempt history, so you can review your own feedback later.
• Friends: if you add a friend using a friend code, we store that connection, and your display name becomes visible to that friend.
• Subscription and billing status: whether you're on Free, Plus or Pro, and basic subscription status (such as active, trialing, or cancelled). We do not see or store your card details — these are handled entirely by Stripe, our payment processor.
• Basic technical data: standard server logs (such as IP address and browser type) kept briefly by our hosting provider, Vercel, for security and reliability, not for tracking you.
• A theme preference (light or dark mode), stored only in your browser, never sent to us.

We do not run advertising, and we do not sell your data to anyone.

2. Why we use it, and our legal basis

• To provide the service you've signed up for — flashcards, exam practice, OSCE, and your saved progress (necessary to perform our contract with you).
• To generate AI content (lecture summaries, flashcards, MCQs, the AI patient, and OSCE feedback) using the features you've chosen to use (also necessary to perform our contract with you).
• To process payments and manage your subscription via Stripe (necessary to perform our contract with you).
• To keep the service secure and working properly (our legitimate interest in running a reliable service).
• To respond if you contact us with a question or problem (our legitimate interest, or your consent in contacting us).

3. AI processing

Some features (lecture summarisation, flashcard and MCQ generation, the AI patient OSCE, and AI OSCE feedback) send the relevant text — such as your lecture content or OSCE conversation — to Anthropic, the company behind the Claude AI models, in order to generate a response. As of writing, Anthropic's API does not use this content to train their models, but AI providers' policies can change, so if this matters to you, it's worth checking Anthropic's current terms directly. AI-generated content (flashcards, MCQs, OSCE feedback) is clearly labelled as AI-assisted and is for educational practice only — it is not official university marking, and not a substitute for the BNF, NICE guidance, or your own course materials.

4. Who we share data with

We use a small number of other companies to run PharmaStudy, each only for the specific job described:

• Supabase — stores your account and all app data. Our database is hosted in Frankfurt, Germany (within the EU).
• Vercel — hosts and serves the website itself.
• Stripe — processes payments and stores your payment details securely; we never see your card number.
• Anthropic — processes the AI features described above.

We don't share your data with anyone else, and we don't sell it.

5. How long we keep it

We keep your data for as long as your account exists. If you'd like your account and data deleted, contact us (details below) and we'll delete it, usually within 30 days, except where we're required to keep basic payment records for tax purposes.

6. Your rights

Under UK GDPR, you have the right to:

• Ask what personal data we hold about you, and get a copy of it
• Ask us to correct anything inaccurate
• Ask us to delete your data
• Object to, or ask us to restrict, certain uses of your data
• Complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), if you're unhappy with how we've handled your data

7. Children

PharmaStudy is intended for university-level pharmacy students and isn't aimed at children. We don't knowingly collect data from children under 16. If you believe a child has created an account, please contact us and we'll remove it.

8. Security

We rely on our providers' security measures (Supabase, Vercel, Stripe, Anthropic), and access to your own data within the app is restricted so that only you can see your own flashcards, questions, and progress, enforced at the database level.

9. Changes to this policy

If we make significant changes to this policy, we'll update the date at the top of this page, and where appropriate, let you know directly.

10. Contact

Questions about this policy or your data: zakkitariq1@gmail.com