Privacy Policy

This Privacy Policy explains how PassPharma (“PassPharma”, “we”, “us”, or “our”) collects, uses, and protects your personal data when you use the PassPharma website and web application (the “Service”). We are the data controller for the personal data described below, and we process it in accordance with UK data protection law, including the UK GDPR and the Data Protection Act 2018.

1. What personal data we collect

We collect:

• Account data: your email address, first name, and password (handled by our authentication provider, Supabase — we never see or store your raw password).
• Study data: your exam attempts, answers, scores, streaks, topic progress, and any lecture recordings, audio, transcripts, or notes you upload or create in the Service.
• Payment data: your subscription or purchase status, and billing details processed by Stripe. We do not store your full card number or card security code.
• Referral and ambassador data: your referral code, who referred you (if anyone), referral credit earned, and, if you join the ambassador programme, payout details needed to pay you.
• Technical data: IP address and basic request metadata, collected briefly to enforce rate limits and protect the Service against abuse (for example, limiting repeated login or verification-code attempts).

2. How we use your data

We use your personal data to:

• Create and maintain your account, and authenticate you;
• Provide the Service, including mock exams, the question bank, progress tracking, and AI-generated summaries and practice questions;
• Process payments, subscriptions, and referral credit;
• Detect and prevent fraud, abuse, and unauthorised access (including rate limiting and reviewing referral/ambassador activity for abuse);
• Respond to support requests sent to supportmilli@passpharma.co.uk; and
• Comply with our legal obligations.

We do not use your data for third-party advertising, and we do not sell your personal data.

3. Lecture recordings and AI processing

If you upload or record lecture audio, documents, or notes, that content is processed to generate transcripts, summaries, and study materials at your request. This processing is carried out using third-party AI model providers (see Section 5). Your content is used only to provide these features to you, not to train third-party models, and is not shared with other users.

4. Legal basis for processing

We rely on the following legal bases:

• Contract: to create your account, provide the Service you’ve signed up for, and process payments;
• Legitimate interests: to prevent fraud and abuse, secure the Service, and improve it, in a way that does not override your rights; and
• Legal obligation: where we need to retain or disclose data to comply with the law (for example, tax and accounting records for payments).

5. Who we share data with

We share personal data only with the third-party providers we use to run the Service, under their own terms and privacy practices:

• Supabase — authentication and database hosting;
• Stripe — payment processing and billing;
• AI model providers — used to generate transcripts, summaries, and AI-assisted practice questions from content you submit.

We do not otherwise sell, rent, or share your personal data with third parties, except where required by law or to protect our legal rights.

6. International transfers

Some of our service providers may process data outside the UK. Where this happens, we rely on appropriate safeguards required under UK data protection law, such as standard contractual clauses, to ensure your data continues to receive an adequate level of protection.

7. Cookies

The Service uses strictly necessary cookies to keep you signed in and to operate core functionality. We do not currently use third-party advertising or analytics cookies.

8. Data retention

We keep your personal data for as long as your account is active, and for a reasonable period afterwards to comply with legal obligations (such as payment and tax records), resolve disputes, and enforce our agreements. You can ask us to delete your account and associated data at any time; see Section 9.

9. Your rights

Under UK data protection law, you have the right to request access to, correction of, deletion of, or an exportable copy of your personal data, and to object to or restrict certain processing. To exercise any of these rights, contact us at supportmilli@passpharma.co.uk. We will respond within the timeframes required by law. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.

10. Security

We use technical measures such as encryption in transit, database access controls, and rate limiting to protect your personal data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Children

The Service is intended for users aged 16 and over, in line with our Terms of Service. We do not knowingly collect personal data from children under 16.

12. Changes to this policy

We may update this Privacy Policy from time to time, for example to reflect changes to the Service or to applicable law. If we make material changes, we will take reasonable steps to notify you, such as by email or an in-app notice.

13. Contact us

Questions about this Privacy Policy or how we handle your data can be sent to supportmilli@passpharma.co.uk.