Privacy policy

• Account details: your email address, and optionally your name, profession, exam date, and destination country.
• Practice content: the letters you write, the audio you record in speaking practice, transcripts of that audio, and the marking and feedback produced for them.
• Usage events: first party records of actions like submitting a letter or viewing the dashboard, used for product analytics and abuse prevention.
• Billing status: your plan and subscription state. Card details go directly to Stripe; we never see or store them.
• Support correspondence: emails you send us.

We do not collect health data about you, and practice scenarios are fictional. Please do not include real patient information in practice letters.

• Running the service (contract): marking your submissions, tracking your progress, sending magic sign in links and receipts.
• Study reminders and progress emails (legitimate interest): you can switch these off in your account at any time. Marketing email is sent only with your opt in.
• Improving marking quality (consent): your marked submissions join our anonymised calibration set only if you switch on calibration consent in account settings. It is off by default.
• Security and abuse prevention (legitimate interest): rate limiting, bot protection on the public checker, and investigating misuse.
• Legal obligations: tax and accounting records for payments.

We do not sell your data, we do not use your submissions to train general purpose AI models, and we do not show advertising.

These providers process data on our behalf under data processing agreements, and only to provide the service described:

Some providers process data in the United States. Where data leaves the UK, transfers are covered by the providers' data processing agreements incorporating recognised safeguards such as the International Data Transfer Agreement or standard contractual clauses.

MedEngly sets one strictly necessary cookie: the session cookie that keeps you signed in. There are no advertising pixels and no cross site tracking. The public letter checker uses Cloudflare Turnstile for bot protection, and site analytics use Cloudflare Web Analytics, which does not use cookies or track you across sites. If we ever introduce advertising measurement, it will sit behind a consent banner and this policy will be updated first.

• Account details and practice content: for as long as your account exists.
• On account deletion: your personal details, drafts, sessions, sign in links, and progress records are deleted, and usage events are unlinked from you. Attempt records are kept in anonymised form; the text and audio of your submissions are deleted too unless you had switched on calibration consent, in which case the marked text is retained without any link to you.
• Encrypted backups are retained for up to 30 days, after which deleted data ages out of them.
• Payment records are kept as required by UK tax law.

You can export everything we hold on you as a file from the account page, correct your details there, and delete your account there too, no email required. You also have the rights of access, rectification, erasure, restriction, portability, and objection under UK GDPR, and you can exercise any of them by emailing support@medengly.com.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

MedEngly is for healthcare professionals and is not intended for anyone under 18.

If this policy changes materially we will tell you by email or in the product before the change takes effect. The version on this page, with the date above, is always the current one.