LEGAL

Privacy policy.

What personal information MedMocks collects, why, who helps us process it and the choices and rights you have under UK GDPR and the Data Protection Act 2018. Last updated: 25 October 2026.

1. Who is responsible

The controller of your personal information is Certiva (Pty) Ltd, a company registered in South Africa (registration number 2026/338141/07), which operates MedMocks. For any privacy question or request, email support@medmocks.com.

2. What we collect

• Account: your name, email address and password. Passwords are stored by our authentication provider as a secure one-way hash; we never see them.
• Study data: your answers, whether they were right, when you answered, questions you flag, timed mock exams, your study plan settings and the scores worked out from them.
• Payments: when you buy, Lemon Squeezy tells us your order number, the pass you bought, the amount, the currency, your email address, the time of the order and any refund. Lemon Squeezy handles your card or other payment details; we never receive them.
• Email choices: whether you asked for study tips and offers, and when you changed that choice.
• Analytics, only if you allow it: pages you visit, buttons you press, how far you scroll, your device and browser type and approximate location, through Google Analytics and the Meta pixel. See section 6.
• Messages: what you send us by email.
• Technical data: our hosting and database providers keep short-lived server logs (such as IP address and request time) to run the service securely.

We do not ask for information about your health or other special category data; please do not send it to us.

3. Why we use it and our lawful bases

• Creating your account, saving your progress and running practice, revision, mock exams, the readiness score and the study plan: contract.
• Giving you access when you buy a pass, and handling refunds: contract.
• Keeping payment and refund records: legal obligation (tax and accounting law).
• Service emails, such as your welcome email, weekly progress and reminders before your pass ends: legitimate interests in helping you use what you bought. Every one has a link to stop it.
• Study tips and offers by email: consent, only if you tick the box at sign-up or on your Account page. You can withdraw it at any time.
• Analytics and ad measurement: consent, through the cookie banner.
• Keeping the service secure and preventing misuse: legitimate interests.

4. Who processes it for us

• Supabase (database and sign-in).
• Netlify (hosting).
• Lemon Squeezy (payments, as merchant of record; it is also a controller for the payment itself).
• Resend (sending our emails).
• Google (Google Analytics) and Meta (Meta pixel), only with your consent.

Each acts under a contract with data protection terms.

5. Payments and purchase measurement

When you buy, the checkout link carries your MedMocks account id so the payment can be matched to your account, and, if you allowed analytics, an anonymous analytics id so the purchase can be counted once in Google Analytics and Meta. Without your consent, no analytics id is sent.

6. Cookies and similar storage

Essential storage keeps you signed in and remembers your choices on this device (for example your last exam and your cookie choice). Analytics cookies from Google and Meta are set only if you choose “Allow analytics” in the banner. You can change your choice at any time by clearing this site’s data in your browser, which shows the banner again.

7. International transfers

Our providers may process data outside the UK, including in the European Economic Area and the United States, and we are based in South Africa. Where data leaves the UK, we rely on adequacy regulations or the UK International Data Transfer Agreement or Addendum.

8. How long we keep it

• Account and study data: while your account is open, and deleted within 30 days of closing it.
• Payment records: six years, for tax law.
• Email choices: while your account is open, as proof of your choice.
• Server logs: a few weeks.

9. Your rights

You can ask for a copy of your data (your Account page also lets you download it), to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. You can withdraw consent at any time. Email support@medmocks.com; we reply within one month.

10. Complaints

If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner’s Office (ico.org.uk).

11. Children

MedMocks is for adults. We do not knowingly collect data from anyone under 18.

12. Changes to this policy

We will update the date at the top when this policy changes and tell you about important changes.