Privacy notice

Who operates this service

MedEthicsAI is operated by Zayn Bellazrak, trading as MedEthicsAI, contactable at medethicsaisupport@gmail.com and [BUSINESS CONTACT POSTAL ADDRESS — REQUIRED BEFORE PUBLICATION]. This operator is responsible for deciding how personal data is used for the service.

What information we collect

• Account details: email, account identifier, and any profile information you provide; Google sign-in may supply basic profile details.
• Practice information: selected topics, fictional scenarios, your written answers, AI-generated feedback, and dates of sessions.
• Feedback you submit about the service.
• Subscription status and Stripe customer/subscription identifiers. Payment card details are processed by Stripe, not stored in the MedEthicsAI application database.
• Technical information needed for service operation, security, and error diagnosis; hosting and provider logs may also contain IP addresses.

Why we use data and our lawful bases

• To create accounts, provide practice sessions and deliver paid features: performance of our contract with you.
• To maintain service security, prevent abuse and improve reliability: our legitimate interests, balanced against your rights.
• To maintain necessary financial records and respond to lawful requests: compliance with legal obligations where applicable.
• For optional analytics or marketing, if introduced: we will provide appropriate information and obtain consent where required before using non-essential cookies or similar technologies.

AI processing and sensitive information

Your practice answers and scenario details are sent to OpenAI to generate educational feedback. They may be processed by OpenAI as our service provider under its applicable API terms. Do not submit real patient information, identifying case details, health records or other sensitive personal information. We cannot guarantee AI outputs are accurate. Confirm provider-specific data use, retention and processing terms before publication.

Who receives information

We use Supabase (authentication and database), OpenAI (AI scenario generation and feedback), Stripe (payments and subscriptions), Vercel (hosting), and Google (optional Google authentication). These providers process relevant information according to their roles and agreements. We do not sell personal information.

International transfers

Some providers may process personal information outside the UK. Before publication, verify actual service regions and applicable UK international transfer safeguards, including relevant contractual protections and adequacy arrangements.

How long we keep information

Account and practice records are held while your account remains active. Account deletion removes the Supabase authentication account and related records configured to cascade on deletion. Stripe billing records, provider logs, backups and legally required financial records may persist under separate retention rules. Operator to confirm and publish precise retention periods and backup deletion schedules.

Your choices and rights

Depending on applicable UK data protection law, you may request access, correction, erasure, restriction, portability or object to certain processing. Contact medethicsaisupport@gmail.com. You may also complain to the UK Information Commissioner’s Office at ico.org.uk.

Cookies and local storage

Authentication and service functionality may require essential cookies or browser storage. We have not established whether non-essential analytics or advertising technologies are installed. Any such technologies must be inventoried, disclosed and, where required, disabled until valid consent is obtained.

Children and patient data

MedEthicsAI is intended for adult learners. Do not use the service to store or discuss identifiable patient information.

Changes

We may update this notice when our practices change. Material changes will be communicated through the website or, where appropriate, by email.