PRIVACY POLICY

1) Who we are

SMLE Med is an online medical education platform operated by Cerna Learn Ltd. Cerna Learn Ltd is the controller of your personal data.

2) What we collect and why

We collect account, learning, content, subscription and technical data, plus cookies and local-storage data. This includes your email address, display name, answers, progress, notes, comments, support messages, subscription status and payment-provider identifiers.

We receive this data from you, automatically when you use SMLE Med, and from providers such as Stripe. Stripe processes your card details; SMLE Med does not store your full card number.

We may process technical information, such as IP addresses and browser information, for hosting, security and fraud prevention.

We use data to provide SMLE Med and subscriptions, save your progress, process payments, provide support, operate and secure the service, prevent fraud and meet legal, tax and accounting obligations.

Our lawful bases are contract (providing SMLE Med and paid subscriptions), legitimate interests (operating, securing and improving the service), legal obligation, and consent for optional analytics.

An email address and authentication details are needed to create an account. Payment information is needed for a subscription. Notes and display names are optional.

We do not use automated decision-making that produces legal or similarly significant effects.

AI question tutor

Where enabled, the optional AI tutor sends your messages, the current question, its answer and explanations, attached images, your saved answer and relevant conversation history to OpenAI to generate educational replies. Do not include personal or patient-identifiable information. AI replies may contain errors.

We save tutor conversations to let you return to them. They expire after 30 days of inactivity and are removed by scheduled cleanup. You can clear the current conversation in the tutor panel. Clearing it, expiry or account deletion removes its messages, feedback and saved provider replay; usage and cost records remain for allowance enforcement and operational accounting. On account deletion those records are detached from your account.

Requests use OpenAI's API with response storage disabled. This setting does not remove any separate processing or retention required by the provider's policies. You can submit reply feedback to help us assess tutor quality.

3) Sharing and international transfers

We use providers for hosting, authentication, payments, security, support email and error monitoring, including Supabase, Vercel, Stripe, Sentry, Upstash and Resend. We may also disclose data where required by law or to investigate fraud, misuse or security incidents. We do not sell personal data.

Some providers process data outside the UK. Where required, transfers rely on UK adequacy regulations or approved contractual safeguards. Contact us for more information about those safeguards.

4) Retention

We keep personal data only as long as needed to provide SMLE Med, meet legal obligations and resolve security or support issues. Billing records may be kept for six years or longer where required by law. Account and learning data is generally deleted or anonymised after account deletion, subject to legal requirements and limited backup retention.

5) Your rights

Depending on the circumstances, you may have rights to access, correct, delete, restrict or receive a copy of your personal data, and to withdraw consent.

You may object to our use of your data based on legitimate interests.

To exercise a right, email support@cerna.co.uk. We may need to verify your identity. Legal exceptions may apply.

6) Cookies and similar technologies

We use cookies and local storage needed for authentication, security, preferences and operation of SMLE Med. Optional Vercel Analytics is enabled only if you accept analytics cookies. You can change your choice through our cookie settings.

7) Children

SMLE Med is not intended for children under 13. Children under 13 must not create an account or use SMLE Med. Contact us if you believe a child has provided us with personal data.

8) Contact and complaints

For privacy questions, requests or complaints, email support@cerna.co.uk.

You can also complain to the Information Commissioner's Office.