Privacy Policy

1. Information we collect

• Account data — your email address and authentication details (managed via Supabase).
• Usage and study data — quiz attempts, scores, flags, and review progress, so we can show your dashboard and spaced-repetition schedule.
• Billing data — handled by Stripe. We store a Stripe customer reference and subscription status, but we never see or store your full card details.
• Technical data — basic logs and error reports used to keep the Service running and secure.

2. How we use it

To provide and personalise the Service, process payments, respond to support requests, maintain security, and meet legal obligations. We do not sell your personal information.

Under UK GDPR, we rely on the following legal bases: performance of a contract with you (providing the Service you signed up for and processing payment), our legitimate interests (keeping the Service secure and working properly), and compliance with our legal obligations (such as tax and accounting requirements).

3. Third-party processors

We share data only with service providers that help us run the platform:

• Supabase — authentication and database hosting.
• Stripe — payment processing.
• Vercel — application hosting.
• Sentry — error monitoring, to help us find and fix bugs.
• Google Analytics — aggregate usage analytics (e.g. which pages are visited), to help us understand and improve the Service.

We do not use artificial intelligence tools to process your personal information as part of running the Service. Some course content was developed with AI assistance before publication — see our Terms of Service for detail — but that is separate from how we handle your account and usage data.

Source code for the Service is maintained on GitHub, but GitHub does not process your personal information as part of that — it only stores code, not user data.

These providers may store or process data outside the United Kingdom and outside Australia — including in the United States and the European Union. Where we transfer personal information internationally, we rely on the provider's own compliance with UK GDPR transfer safeguards (such as the UK's international data transfer agreement or standard contractual clauses) and take reasonable steps to ensure the data is handled consistently with both the UK GDPR and the Australian Privacy Principles.

4. Cookies and local storage

We use cookies and browser local storage for sign-in sessions, preferences (such as theme), and to remember your study progress on your device.

5. Data retention

We keep your information while your account is active and as needed to provide the Service or comply with legal obligations. You can delete your account and associated data at any time from your account settings — this is immediate and cannot be undone.

One exception: records of payments you have made are held by our payment provider, Stripe, and are retained by them independently of your ClinicalStem account, because we are required to keep transaction records for tax and accounting purposes. Deleting your account removes your data from ClinicalStem and cancels any active subscription; it does not erase Stripe's record of past transactions.

6. Your rights

Under UK GDPR and the Australian Privacy Principles, you have the right to request access to, correction of, or erasure of your personal information; to restrict or object to certain processing; to receive a copy of your data in a portable format; and to withdraw consent or close your account at any time. Contact us using the details below to exercise any of these rights.

7. Security

We take reasonable technical and organisational measures to protect your information. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

8. Complaints and contact

To make a privacy enquiry or complaint, email privacy@clinicalstem.com. If you are not satisfied with our response, you may lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or, as an Australian user, with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

9. Changes

We may update this Policy from time to time. The "last updated" date above reflects the latest version.