Privacy Policy

1. Introduction

This Privacy Policy is provided by VIRTUALPATIENTS LTD, a company incorporated in England and Wales with company number 16303492 and registered office at 2 St. Marys Road, Tonbridge, England, TN9 2LB, trading as “MedMock” (“MedMock”, “we”, “our” or “us”). We provide a browser-based educational practice platform for people aged 18 or over, including medical students, international graduates and doctors, to practise spoken clinical examinations and interviews using AI virtual patients and examiners and to receive AI-generated marks and feedback (the “Services”). For the processing described in this notice, we are the controller unless we expressly state otherwise.

We take your privacy very seriously. Please read this privacy policy carefully as it contains important information on how and why we collect, store, use and share any information relating to you (your personal data).

It also explains your rights in relation to your personal data and how to contact us or the relevant regulator if you have a complaint. Our collection, storage, use and sharing of your personal data are regulated by law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, to the extent in force, the Data (Use and Access) Act 2025.

We act as controller when we process personal data about website visitors, prospective and current users, account holders, institution-funded users, partners in our referral programme, users referred by partners, people making enquiries, newsletter subscribers and other people who deal with us. Where a university or other institution supplies a student’s name and university email address so that we can provide funded access, the institution and VirtualPatients Ltd each act as independent controllers for their own purposes. The institution is responsible for its own privacy information and lawful disclosure to us.

2. What this policy applies to

This privacy policy applies when you visit https://medmock.com, create or use a MedMock account, access institution-funded use, buy a subscription or credits, complete practice sessions, use the leaderboard, participate in our partner or referral programme, share an invite-a-colleague link, contact us, subscribe to marketing or otherwise deal with us. The Services are for users aged 18 or over. We do not knowingly permit children under 18 to create accounts and may take reasonable steps to verify age where appropriate; if we learn that we have collected their personal data, we will take appropriate steps to delete it.

Our website and Services may link to websites or integrate services operated by third parties. Those providers may process information under their own privacy notices. We are not responsible for the privacy practices of independent websites you choose to visit. Relevant providers are described under ‘Who we share your personal data with’ below.

3. Personal data we collect about you

We may collect identity, contact and account data, such as your name, email address, account identifier, authentication information, preferences, subscription or credit status and, where relevant, university or institution. We may also collect your approximate location derived from your IP address and any partner or referral code linked to your account. Where you consent to analytics and advertising cookies, we may also record the website that referred you, advertising campaign details and an advertising click identifier (including an OpenAI ad click ID) included in the link by which you reached us, and link them to your account if you sign up. If you are a partner, we process the partner data described below. If you sign in using Google, we receive sign-in and basic profile information that Google makes available in accordance with your settings.

We may collect subscription and payment metadata supplied by Stripe (such as plan, amount, currency, transaction identifier, payment status and limited billing details), but we do not receive or store full payment-card details. We also collect usage and credit records, session transcripts, prompts, AI-generated marks, scores and feedback, leaderboard scores and, only where you choose to display them, your first name and country, support communications, and technical, device, log, security, cookie and analytics data. Please do not submit real patient information, confidential examination content, health information or other special category or criminal offence data.

We may also collect, use and share aggregated or truly anonymised data such as statistical or demographic data. Where such data does not directly or indirectly identify any individual, it is not personal data. For example, we may aggregate Website usage data to analyse trends and improve the Website and our services. If aggregated data could be combined with other information to identify you, we treat it as personal data in accordance with this Privacy Policy.

We collect and use this personal data for the purposes described in the section ‘How and why we use your personal data’ below.

4. Special category and patient data

Sensitive personal data (also known as special category data) means personal data that reveals racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic data; biometric data (where used for identification purposes); data concerning health; data concerning a person’s sex life; and data concerning a person’s sexual orientation.

We do not need real patient data or special category data to provide the Services and do not intentionally collect it through practice sessions. MedMock is a simulated educational-practice service: use fictional details and do not identify any real patient. If sensitive information is included in an accessibility request, complaint or other necessary communication, we process it only where an Article 6 lawful basis and an additional condition under Article 9 UK GDPR apply — for example, where you have given explicit consent, where processing is necessary for the establishment, exercise or defence of legal claims, or where processing is necessary for reasons of substantial public interest — or, for criminal offence data, where a condition under section 10 of the Data Protection Act 2018 is met.

Do not submit real patient information, health data, confidential examination content or other special category or criminal offence data through practice sessions. If we discover such data, we may restrict access to it and delete or anonymise it, subject to legal obligations and any need to investigate misuse or security concerns.

Complaints, disputes and security data: We may process information about complaints, disputes, suspected fraud, misuse, security incidents, content concerns, account restrictions and other compliance matters. This may come from you, customers, suppliers, partners, public sources, regulators, law enforcement or professional advisers. We use it to investigate concerns, protect the Services and our business, manage access, prevent unlawful activity and establish, exercise or defend legal claims. Where it includes special category or criminal offence data, we process it only where the required additional condition applies.

5. How your personal data is collected

We use different methods to collect data from and about you, including through:

• Your interaction with us and other sources: We collect personal data directly from you when you visit our website, create or use an account, complete a practice session, use voice or leaderboard features, join or interact with our partner or referral programme, communicate with support, make a purchase, subscribe to communications or otherwise correspond with us. We may receive sign-in data from Google, payment and partner-onboarding metadata from Stripe, referral and campaign information from links and partners, technical data from our service providers, and your name and university email from an institution funding your access. An institution does not receive your individual scores, transcripts, recordings or feedback from us; at most, we may provide anonymised aggregate usage information.
• Automated technologies or interactions: As you interact with the website or Services, we may automatically collect technical and usage data through cookies, local storage, server logs, tags and similar technologies. Google and Meta code, analytics and advertising cookies, and any storage recording how you found us are loaded or set only after you consent. Non-essential cookies or similar storage technologies are used only where permitted by PECR and applicable consent requirements; see our Cookie Policy.

6. How and why we use your personal data

Under data protection law, personal data may only be processed where there is a lawful basis. We act as controller for our website, account and subscription administration, institution-funded onboarding, practice sessions, AI-generated evaluation and feedback, payments, partner and referral administration, advertising attribution, support, marketing, analytics, complaints, legal claims, compliance, security and service improvement. Where we act as controller, we rely on one or more of the following lawful bases:

• where you have given consent;
• to comply with our legal and regulatory obligations;
• for the performance of a contract with you or to take steps at your request before entering into a contract; or
• for our legitimate interests or those of a third party.

A legitimate interest exists when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own. You can obtain details of this assessment by contacting us (see ‘How to contact us’ below).

MedMock uses Google Gemini to simulate virtual patients or examiners and generate practice marks, scores and feedback from your session inputs and transcripts. These outputs are supplementary educational practice, may be inaccurate or incomplete, and are not medical advice, accredited assessment results or guarantees of exam outcomes. They do not determine access to education, employment, professional registration or any other legal or similarly significant matter. We therefore do not currently make solely automated decisions that produce legal or similarly significant effects. You may query an output through the contact route below. We may also use anonymised or aggregated data derived from your session inputs, transcripts and outputs to develop, test and improve our AI models and the Services; where such data does not identify you it is not personal data. We do not use identifiable personal data for AI model training, and you may ask us not to use even de-identified content from your sessions for service improvement. If our use changes, we will update this policy and provide any safeguards required by law.

The table below explains what we use your personal data for and why.

See ‘Who we share your personal data with’ for further information on the steps we will take to protect your personal data where we need to share it with others.

7. Marketing

We may send operational communications about accounts, subscriptions, credits, practice sessions, payments, support, security and changes to the Services. Separately, we may send product news, offers and other promotional communications where permitted.

Where required by law, including PECR, we will obtain consent before sending direct marketing by email, SMS or similar electronic means. Where PECR permits marketing without consent, including where the corporate-subscriber rules or soft opt-in properly apply, we may rely on our legitimate interests, always subject to your right to opt out. We seek consent where required for non-essential cookies and similar technologies and record relevant preferences.

You will have the right to opt out of receiving marketing communications at any time by:

• contacting us using the contact details set out in ‘How to contact us’ below;
• using the ‘unsubscribe’ link included in all marketing emails you may receive from us.

We will not sell, rent or otherwise disclose your personal data to third parties for their own direct marketing purposes without your prior consent.

For more information on your right to object at any time to your personal data being used for marketing purposes, see ‘Your rights’ below.

8. Who we share your personal data with

We seek to collect, use and share only the personal data reasonably necessary for the relevant purpose. We share personal data only where necessary for the purposes set out in this Privacy Policy. Where we act as controller, recipients may include:

• Google, including Google sign-in, Firebase, Google Cloud, Google Cloud Speech-to-Text, Gemini and Google Analytics, for authentication, hosting, storage, speech transcription and recognition when ElevenLabs is switched off or on our company service, AI functionality and consented analytics; Apple for Safari browser speech recognition when ElevenLabs is switched off or on our company service;
• ElevenLabs for speech transcription and voice functionality, which receives audio and AI reply text and may retain audio for a limited period for security and troubleshooting but may not use it to train its models; Anthropic’s Claude and OpenAI’s tools, including Codex, as internal coding, content and support tools, which may receive personal data only when we investigate a fault, under data processing agreements that prohibit training on our data; OpenAI also as an advertising platform (where you have consented, we store OpenAI’s ad click identifier and, if we introduce conversion reporting, may send that identifier alone, without your email or other contact details, back to OpenAI); and other technology providers needed to operate and secure the Services;
• Resend for email delivery; Sentry for EU-hosted error reporting; Cloudflare Turnstile for bot checks on sign-up, sign-in, password reset, contact forms and our report-a-problem form; ipapi.co to derive approximate location from IP addresses; Meta for advertising measurement; and other communications, software, storage, customer-support and security providers used to send service or marketing emails and operate the Services;
• Stripe and relevant invoicing or accounting providers used to process customer payments, administer partner commissions through Stripe Connect and meet financial obligations; Stripe processes full card details and, for partners, identity and UK bank details, and may act as an independent controller for some activities under its own privacy information;
• a university or other institution funding access, but only as needed for onboarding and account administration; we provide at most anonymised aggregate usage and do not provide individual scores, transcripts, recordings or feedback;
• Google Analytics, Meta and any other analytics or advertising-measurement providers, only after you consent, as described in our Cookie Policy; and
• professional advisers, auditors, insurers, regulators, courts, law enforcement and other authorities or recipients where required or permitted by law.

Where service providers process personal data on our behalf, they do so under appropriate contractual obligations and must use it only for the relevant services and in accordance with our instructions. Some providers may also act as independent controllers for specified activities and should provide their own privacy information. An institution funding access and VirtualPatients Ltd are independent controllers for their respective purposes; the present model does not give institutions administrative access to student session data.

We require processors to provide sufficient guarantees of appropriate technical and organisational measures and to process personal data only on documented instructions, subject to applicable contractual and legal obligations. Some recipients may instead act as independent controllers and should provide their own privacy information. If we introduce new features involving institutional access to student data, we will first put in place appropriate written arrangements (including a data processing agreement where required) and update relevant privacy information.

We or the third parties mentioned above may occasionally also need to share your personal data with:

• external auditors, e.g. in relation to the audit of our accounts and our company — the recipient of the information will be bound by confidentiality obligations;
• professional advisers (such as lawyers and other advisers) — the recipient of the information will be bound by confidentiality obligations;
• law enforcement agencies, courts or tribunals and regulatory bodies to comply with legal and regulatory obligations;
• other parties in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency — usually, information will be anonymised, but this may not always be possible; however, the recipient of the information will be bound by confidentiality obligations.

If you would like more information about who we share our data with and why, please contact us (see ‘How to contact us’ below).

We do not share your personal data with third parties except as described in this Privacy Policy or where required or permitted by law.

9. How long your personal data will be kept

We keep personal data only for as long as reasonably necessary for the relevant purpose. We set and review retention periods by considering the nature, amount and sensitivity of the data, the risk of harm, account and subscription status, the purpose of processing, whether that purpose can be achieved another way, legal and accounting requirements, applicable limitation periods, security needs and provider settings. Account and profile data, sessions, transcripts, scores, AI outputs, referral codes and attribution data linked to an account are generally retained while the account remains open. Leaderboard names and countries are removed when you withdraw your choice or delete your account. Invite-a-colleague records (your invite code and the records of who signed up with whose link) are deleted when the account is deleted. Self-service account deletion through Profile & Settings takes effect immediately, with backup copies cleared within 14 days. Sentry error reports are retained for up to 90 days, server logs for 30 days and email-delivery records for approximately 30 days. Billing records and partner commission, payment, referral and tax records (including records of which partner referred whom) are retained for six (6) years, including after account deletion. Consent and terms-acceptance records are kept for the life of the account; the consent you give when you buy a subscription or credits is kept with our billing records for six (6) years. After deletion, we retain a one-way hash of the email address to prevent the same person claiming a second free trial, relying on our legitimate interest in preventing abuse of free trials. We retain opt-out information as needed to honour your preference and may retain relevant records where necessary to prevent fraud, enforce agreements, resolve complaints or establish, exercise or defend legal claims.

Following the end of the applicable retention period, we will delete or anonymise personal data in accordance with applicable data protection requirements, unless we are required to retain it (for example, due to legal obligations or a legal hold).

10. Transferring your personal data out of the UK

Our databases are hosted in Google’s EU multi-region and our application servers are in London. Sign-in details (your email address, your password, which is stored only as a secure hash, and your sign-in records) are handled by Google’s Firebase Authentication service, which Google runs only in the United States. Some providers or their support teams may process personal data outside the UK, including in the United States. These may include ElevenLabs, Google, Apple, Stripe, Resend, Cloudflare, ipapi.co, Meta, Anthropic and OpenAI. Where an adequacy regulation does not apply, we ensure that a lawful transfer mechanism and any required risk assessment and supplementary measures are in place. Depending on the circumstances, this may include an approved UK international data-transfer agreement or addendum, another legally recognised safeguard, or a specific statutory exception. You may request information about relevant destinations and safeguards.

Under UK data protection law, we transfer personal data outside the UK only where the destination benefits from applicable UK adequacy regulations, appropriate safeguards provide enforceable rights and effective remedies, or a specific statutory exception applies.

The EEA: we may rely on the UK adequacy regulations in respect of EEA countries (where applicable).

Other countries: we will use the safeguards and any transfer-risk assessment or supplementary measures required by UK data protection law.

If a transfer mechanism we rely on ceases to be valid, we will ensure an appropriate alternative safeguard or exception under UK data protection law is in place before continuing to transfer personal data outside the UK.

11. Your rights

You generally have the following rights, which you can usually exercise free of charge. You may direct requests to us using the details under ‘How to contact us’ below. You can also update certain account information and delete your account and associated data directly from your profile page. We may need information to verify your identity and clarify your request. Where we rely on your consent as a lawful basis, you have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. Further information is available from the ICO at https://ico.org.uk/.

For further information on each of those rights, including the circumstances in which they do and do not apply, please contact us (see ‘How to contact us’ below). You may also find it helpful to refer to the guidance from the UK’s Information Commissioner on your rights under the UK GDPR.

If you would like to exercise any of those rights, please email or write to us — see below, under ‘How to contact us’. We may need to verify your identity before responding. We will respond to your request without undue delay and in any event within one month of receipt; this period may be extended by a further two months where necessary, taking into account the complexity and number of requests. When contacting us, please:

• provide enough information to identify yourself (for example, your full name and MedMock account email or identifier) and any additional information we reasonably need to verify your identity; and
• let us know which right(s) you want to exercise and the information to which your request relates.

12. Keeping your personal data secure

We use technical and organisational measures designed to provide security appropriate to the risks, taking account of the nature, scope, context and purposes of processing. Depending on the relevant system and risk, appropriate measures may include access controls, authentication, confidentiality obligations, supplier due diligence, resilience, backup, testing and incident-management procedures. We assess data-protection risks, including whether a data protection impact assessment is required for AI evaluation, voice and transcript processing and other innovative functionality, and review that assessment when functionality or risk changes. No system is completely secure, and this notice does not guarantee absolute security.

We assess suspected personal data breaches and notify affected individuals and the ICO where required by applicable law. We require personnel and service providers to report suspected breaches promptly so that they can be investigated and managed.

13. How to complain

Please contact us if you have any queries or concerns about our use of your information (see ‘How to contact us’ below). In line with our obligations under the Data (Use and Access) Act 2025, you may submit a data-protection complaint electronically through our website contact form. We will acknowledge complaints within 30 days, take appropriate steps to respond without undue delay and aim to provide a full response within 30 days, telling you the outcome. We hope we will be able to resolve any issues you may have.

VirtualPatients Ltd is registered with the Information Commissioner’s Office. You also have the right to lodge a complaint with the Information Commissioner.

The Information Commissioner can be contacted at https://ico.org.uk/make-a-complaint or telephone: 0303 123 1113.

14. Changes to this privacy policy

We may change this privacy policy from time to time to reflect changes in the Services, our processing activities, suppliers, Cookie Policy or legal requirements. We will publish the updated version on our website and update the date above. Where we make material changes, we will give reasonable advance notice (for example, by email or prominent notice on the website) before such changes take effect. A privacy notice describes processing; continued use is not treated as consent where consent is legally required.

15. How to contact us

You can contact us by post, email or through the contact form published on our website if you have questions about this privacy policy or our use of your personal data, wish to exercise your data protection rights, or want to make a complaint.

Our contact details are shown below:

• VirtualPatients Ltd, 2 St. Marys Road, Tonbridge, England, TN9 2LB
• contact@medmock.com
• Website and contact form: https://medmock.com/contact