Privacy policy

• Account details: your email address, and optionally your name, profession, exam date, and destination country. If you sign in with Google, we receive your verified email address and name from Google; we never see your Google password.
• Practice content: the letters you write, the audio you record in speaking practice, transcripts of that audio, and the marking and feedback produced for them.
• Usage events: first party records of actions like submitting a letter or viewing the dashboard, used for product analytics and abuse prevention.
• Billing status: your plan and subscription state. Card details go directly to Stripe; we never see or store them.
• Support correspondence: emails you send us, and messages sent through the in product support form.

We do not collect health data about you, and practice scenarios are fictional. Please do not include real patient information in practice letters.

• Running the service (contract): marking your submissions, tracking your progress, sending magic sign in links and receipts.
• Study reminders and progress emails (legitimate interest): you can switch these off in your account at any time. Marketing email is sent only with your opt in.
• Improving marking quality (consent): your marked submissions join our anonymised calibration set only if you switch on calibration consent in account settings. It is off by default.
• Security and abuse prevention (legitimate interest): rate limiting, bot protection on the public checker, and investigating misuse.
• Advertising measurement (consent): if you allow advertising cookies in the cookie banner, we tell Meta and Google Analytics when an ad or post led to a signup or purchase, so we can spend responsibly. Identifiers are hashed, your letters and recordings are never shared, and declining changes nothing about the product.
• Legal obligations: tax and accounting records for payments.

We do not sell your data, we do not use your submissions to train general purpose AI models, and we do not show advertising inside the product.

Our OET guides and subtest pages offer a free seven day writing course by email. It is entirely optional, it is separate from having an account, and the only thing we ask for is an email address.

• Double opt in (consent): giving your address sends you one email containing a confirmation link. Nothing else is ever sent until you click it. If you never do, the address is deleted after 30 days.
• What we store: your email address, which page you subscribed from, the dates you subscribed and confirmed, and a one way keyed hash of your IP address used only to rate limit the form. We do not store the IP address itself.
• Who sends it: Resend, our email provider, listed in the table below.
• Unsubscribing: every email carries a one click unsubscribe link that works without signing in, and your mail app's own unsubscribe button works too. It takes effect immediately.
• After you unsubscribe: we keep your address on a suppression list so that no later form submission can quietly add you back. If you would rather it were erased outright, email support@medengly.com and we will delete the record entirely.

These providers process data on our behalf under data processing agreements, and only to provide the service described:

Some providers process data in the United States. Where data leaves the UK, transfers are covered by the providers' data processing agreements incorporating recognised safeguards such as the International Data Transfer Agreement or standard contractual clauses.

MedEngly sets strictly necessary cookies (the session cookie that keeps you signed in, and small first party cookies recording your cookie choice and, if you arrived from a link with campaign tags, which campaign that was). The public letter checker uses Cloudflare Turnstile for bot protection, and site analytics use Cloudflare Web Analytics, which does not use cookies or track you across sites. The product also records first party usage events (for example, opening a feedback note) with a random identifier kept in your browser's session storage; it is not a cookie, it never identifies you across sites or devices, and it is discarded when the tab closes.

One optional advertising cookie exists: the Meta pixel, which loads only if you choose Allow in the cookie banner and never loads if you decline. It helps us measure which posts and ads bring people here. You can change your choice at any time via Cookie preferences in the footer; withdrawing consent stops all advertising measurement from that moment.

• Account details and practice content: for as long as your account exists.
• On account deletion: your personal details, drafts, sessions, sign in links, and progress records are deleted, and usage events are unlinked from you. Attempt records are kept in anonymised form; the text and audio of your submissions are deleted too unless you had switched on calibration consent, in which case the marked text is retained without any link to you.
• Encrypted backups are retained for up to 30 days, after which deleted data ages out of them.
• Payment records are kept as required by UK tax law.

You can export everything we hold on you as a file from the account page, correct your details there, and delete your account there too, no email required. You also have the rights of access, rectification, erasure, restriction, portability, and objection under UK GDPR, and you can exercise any of them by emailing support@medengly.com.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

MedEngly is for healthcare professionals and is not intended for anyone under 18.

If this policy changes materially we will tell you by email or in the product before the change takes effect. The version on this page, with the date above, is always the current one.