This Privacy Policy explains how PassPharma (“PassPharma”, “we”, “us”, or “our”) collects, uses, and protects your personal data when you use the PassPharma website and web application (the “Service”). We are the data controller for the personal data described below, and we process it in accordance with UK data protection law, including the UK GDPR and the Data Protection Act 2018.
1. What personal data we collect
We collect:
- Account data: your email address, first name, the exam sitting you are preparing for, and your password (handled by our authentication provider, Supabase — we never see or store your raw password). If you choose to sign in with Google, we receive your email address and basic profile details from Google instead of a password.
- Study data: your exam attempts, answers, scores, streaks, topic progress, the time you spend active in the app, questions you flag or dispute, and any notes, transcripts, summaries, flashcards, and quizzes you create in the Service. When you record or upload audio, it is turned into a text transcript and the audio itself is not kept. When you upload a document, we keep the text extracted from it, not the original file.
- Payment data: your subscription or purchase status, and billing details processed by Stripe. We do not store your full card number or card security code.
- Referral and ambassador data: your referral code, who referred you (if anyone), referral credit earned, and, if you join the ambassador programme, your commission balance and payout requests. We ask you directly for the details needed to pay you when a payout is due.
- Support messages: emails you send to us and our replies.
- Email preferences: whether you have opted in to our daily revision emails, and whether an email to you has bounced or been marked as spam.
- Technical data: your IP address and basic request metadata, used to enforce rate limits and protect the Service against abuse (for example, limiting repeated login or verification-code attempts). Our hosting and security providers also process this data when they deliver the Service to you.
- Website visit data: when you visit our public pages we record the page viewed, the website that referred you, and any campaign tags in the link you followed. To count visitors we create a short code from your IP address and browser type that changes every day. We do not store your IP address with these records, we do not use cookies for this, and we do not record visits from browsers that send a “Do Not Track” or Global Privacy Control signal.
2. How we use your data
We use your personal data to:
- Create and maintain your account, and authenticate you;
- Provide the Service, including mock exams, the question bank, progress tracking, and AI-generated summaries, explanations, and practice questions;
- Process payments, subscriptions, and referral credit;
- Send you emails about your account (such as sign-in codes and password resets) and replies to questions you have raised about the Service;
- Send you our daily revision email and study reminders, if you have opted in. You can stop these at any time using the unsubscribe link in any email or in your account settings;
- Understand how our public pages are used, using the website visit data described in Section 1;
- Detect and prevent fraud, abuse, and unauthorised access (including rate limiting and reviewing referral/ambassador activity for abuse);
- Respond to support requests sent to supportmilli@pharmapass.co.uk; and
- Comply with our legal obligations.
We do not use your data for third-party advertising, and we do not sell your personal data.
3. Lecture recordings and AI processing
If you upload or record lecture audio, documents, or notes, or ask the AI tutor to explain an answer, that content is sent to third-party AI providers (see Section 5) to generate transcripts, summaries, explanations, and study materials at your request. Your content is used only to provide these features to you and is not shared with other users. We do not use your content to train AI models.
- Voice conversations. If you use the voice tutor, audio from your microphone goes directly from your browser to our voice provider, ElevenLabs, together with the text of the lecture you are discussing.
- Live transcription. Some recording features show a live transcript using the speech recognition built into your browser. Depending on your browser, this may send the audio to the browser’s maker (for example Google or Apple) to be transcribed, under their own privacy terms.
- YouTube links. If you paste a YouTube link, we fetch that video’s captions from YouTube and store the transcript in your account.
Recordings can capture other people, such as a lecturer or other students. Only record or upload material where you have permission to do so.
4. Legal basis for processing
We rely on the following legal bases:
- Contract: to create your account, provide the Service you’ve signed up for, and process payments;
- Consent: to send you our daily revision email and study reminders. You can withdraw your consent at any time;
- Legitimate interests: to prevent fraud and abuse, secure the Service, measure visits to our public pages, and improve the Service, in a way that does not override your rights; and
- Legal obligation: where we need to retain or disclose data to comply with the law (for example, tax and accounting records for payments).
5. Who we share data with
We share personal data only with the third-party providers we use to run the Service, under their own terms and privacy practices:
- Supabase — authentication and database hosting;
- Netlify — website hosting;
- Stripe — payment processing and billing;
- OpenAI — transcription of audio you submit, and generation of summaries, explanations, and practice questions from your content;
- ElevenLabs — the voice tutor;
- Resend — sending and receiving email;
- Cloudflare — a security check on our sign-in and sign-up pages that helps tell people from automated traffic; and
- Google — sign-in with Google, if you choose to use it, and hosting for our support mailbox.
We do not otherwise sell, rent, or share your personal data with third parties, except where required by law or to protect our legal rights.
6. International transfers
Some of our service providers process data outside the UK, including in the United States. Where this happens, we rely on appropriate safeguards required under UK data protection law, such as standard contractual clauses, to ensure your data continues to receive an adequate level of protection.
7. Cookies and similar technologies
We do not use advertising or analytics cookies, and we do not set any cookies when you simply browse our public pages. The Service uses only the following, all of which are needed for it to work or to remember choices you have made:
- Sign-in cookies, set when you log in, to keep you signed in.
- Security check. The Cloudflare check on our sign-in and sign-up pages may store a small amount of data on your device to confirm you are not a bot.
- App preferences saved in your browser’s local storage, such as whether a sidebar is collapsed and your progress through the product tour. These stay on your device.
Our visit counting for public pages (see Section 1) does not store anything on your device.
8. Data retention
We keep your account and study data for as long as your account is open. You can delete your account yourself at any time from your account settings, which removes your account and the data linked to it straight away. If you ask us to delete it for you, we will do so within one month. In either case we keep records we need to keep to comply with legal obligations (such as payment and tax records, which are kept for up to six years), resolve disputes, or enforce our agreements. Support emails are kept for as long as needed to deal with your enquiry and keep a record of it. Website visit data is not linked to your account. See Section 9 for how to make a request.
9. Your rights
Under UK data protection law, you have the right to request access to, correction of, deletion of, or an exportable copy of your personal data, to object to or restrict certain processing, and to withdraw consent to marketing emails at any time. To exercise any of these rights, contact us at supportmilli@pharmapass.co.uk. We will respond within one month. You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk.
10. Security
We use technical measures such as encryption in transit, database access controls, and rate limiting to protect your personal data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. Children
The Service is intended for users aged 16 and over, in line with our Terms of Service. We do not knowingly collect personal data from children under 16.
12. Changes to this policy
We may update this Privacy Policy from time to time, for example to reflect changes to the Service or to applicable law. If we make material changes, we will take reasonable steps to notify you, such as by email or an in-app notice.