Privacy Notice

1. Who we are

Medflow Learning is operated by Medflow Learning Ltd, a company registered in England and Wales (Company No. 17512158), whose registered office is at 1 Ashley Drive, Brierley, Barnsley, England, S72 9FJ. We are the data controller for the personal data described in this notice. Contact us at support@medflowlearning.com for any privacy question or request.

2. What we collect and why

• Account data (name, email address, login credentials, roles) — to create and secure your account. Legal basis: performance of our contract with you.
• Study data (question attempts, answers, sessions, mastery and performance statistics, AI remediation history) — to provide adaptive practice and analytics. Legal basis: performance of our contract.
• Subscription and entitlement data (plan, status, renewal dates, identifiers from our payment provider) — to give you access to what you paid for. Legal basis: contract and legal obligation.
• Support messages — to answer you. Legal basis: legitimate interests in supporting our users.
• Technical and usage data (IP address, device and browser information, log and error data, feature usage) — for security, fraud prevention, debugging and product improvement. Legal basis: legitimate interests in a safe, working service.
• Marketing emails, where you opt in. Legal basis: consent, withdrawable at any time.

Card details are never collected or stored by us — they are handled entirely by our payment provider.

3. Who we share data with

• Service providers / subprocessors — cloud hosting, database and authentication, email delivery, error monitoring, and the AI provider used to generate labelled practice content from your incorrect answers.
• Stripe (including Link), our payment processor, for subscription payments, billing management, fraud prevention, tax calculation and invoicing.
• Professional advisers such as accountants or lawyers, where necessary.
• Authorities, where required by law or to protect our legal rights.

We do not sell your personal data.

4. International transfers

Some providers process data outside the UK/EEA. Where they do, transfers are protected by an adequacy decision or by Standard Contractual Clauses (with the UK Addendum where applicable), together with appropriate technical safeguards.

5. Retention

We keep account and study data for as long as your account is active, and for up to 12 months afterwards so you can return without losing progress. Billing and tax records are kept for 6 years as required by law. Logs are typically kept for up to 12 months. After these periods data is deleted or anonymised.

6. Your rights

Under the UK GDPR and EU GDPR you have the right to access, rectify, erase, restrict, port, or object to the processing of your personal data, and to withdraw consent at any time. Email support@medflowlearning.com and we will respond within one month. You may also complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.

7. Security

We use appropriate technical and organisational measures, including encryption in transit, encrypted storage, row-level access controls in our database, role-based staff access, and the principle of least privilege. No system is perfectly secure, but we act promptly on any incident and will notify you and regulators where required.

8. Cookies

We use strictly necessary cookies and local storage to keep you signed in and to keep the service secure — these cannot be switched off. Where we use analytics or payment-provider cookies, they are limited to understanding product usage and completing checkout. You can clear or block cookies in your browser settings, though signing in will not work without the essential ones.

9. Children

Medflow Learning is intended for medical students and is not directed at children under 16.

10. Changes

We may update this notice; the "last updated" date above always reflects the current version, and we will tell you about material changes in the app or by email.