Praxly Privacy Policy

At present, Praxly is operated by Callum Pearse trading under the Praxly name.

For the purposes of UK data protection law, Praxly is generally the data controller for personal data collected and used through the Service. This means Praxly decides why and how personal data is processed.

If Praxly is later incorporated or transferred to Praxly Ltd or another legal entity, this Privacy Policy may be updated to reflect the new operator.

For privacy questions, data protection requests, account deletion requests, or complaints, please contact: privacy@praxly.co.uk.

This Privacy Policy applies to users of Praxly; medical students; healthcare students; doctors in training; healthcare trainees; website visitors; people who join a waitlist; people who submit a contact form or enquiry; and anyone else who interacts with Praxly.

Praxly is not intended for children under 18. Praxly does not knowingly collect personal data from children under 18.

The personal data Praxly collects depends on how you use the Service.

Account data may include your name, if provided; email address; login and authentication details; account identifiers; account settings; communication preferences; and information associated with account creation, login, security, and account management.

At launch, Praxly may use email and password authentication. In future, Praxly may support third-party sign-in options, such as Google sign-in or other secure authentication providers.

Educational usage data may include OSCE practice activity; typed answers; AI conversations; simulated station attempts; scores; feedback; revision progress; saved notes; educational preferences; learning activity; and performance analytics.

At MVP stage, Praxly is intended to support text-based educational interactions only. Praxly does not currently intend to collect audio recordings, video recordings, uploaded clinical files, biometric data, facial analysis data, or voice analysis data.

If Praxly introduces audio, video, recording, transcription, or file upload features in future, this Privacy Policy will be updated before those features are launched, and users will be given appropriate information before submitting such content.

Website and technical data may include IP address; browser type; device type; operating system; pages visited; referring website; approximate location derived from IP address; access times and timestamps; error logs; security logs; session information; and usage events.

If you join a waitlist, submit a contact form, or email Praxly, Praxly may collect your name; email address; role or institution, if provided; message content; contact preferences; and any other information you choose to provide.

Praxly does not ask for, require, or permit users to upload identifiable patient information or confidential clinical material.

You must not submit patient names; NHS numbers; hospital numbers; dates of birth; addresses; telephone numbers; email addresses; identifiable clinical images; identifiable audio or video recordings; hospital letters; discharge summaries; clinic letters; referral letters; investigation reports; prescriptions; screenshots from clinical systems; or any other information that could identify a real patient.

Praxly is intended for fictional, simulated, anonymised, or educational material only.

If Praxly becomes aware that content may contain identifiable patient information or confidential clinical material, Praxly may remove the content, restrict access, suspend or terminate accounts, and take any other action reasonably necessary to protect privacy, confidentiality, safety, and legal compliance.

Praxly does not intentionally request real patient health data or other special category data.

However, because Praxly is used for simulated healthcare education, users may voluntarily include sensitive information in typed educational responses, simulated histories, AI conversations, or other educational interactions. This could include information relating to health, disability, ethnicity, religion, sex life, sexual orientation, or other protected characteristics.

You should avoid submitting sensitive personal information unless it is necessary for your use of the Service and you are comfortable doing so.

Where Praxly processes sensitive information that you voluntarily provide, Praxly will do so only where reasonably necessary to provide the Service, maintain safety and security, comply with law, respond to support requests, investigate misuse, or operate and improve the platform.

If Praxly later introduces features that specifically ask users to provide sensitive or special category data, Praxly will provide appropriate information and, where required, obtain explicit consent or rely on another appropriate legal basis and condition under data protection law.

Praxly may use personal data to create and manage user accounts; authenticate users; provide the Service; generate AI-assisted educational feedback; deliver simulated educational interactions; save progress, scores, notes, and feedback; personalise educational features; respond to enquiries and support requests; manage waitlists; send service messages; send marketing or product updates where permitted; analyse platform performance and usage; debug errors and improve reliability; maintain security and prevent misuse; investigate breaches of the Terms and Conditions; comply with legal obligations; protect Praxly, users, and third parties; develop new features; improve educational quality; and create anonymised, aggregated, or de-identified analytics for internal improvement, research, and development.

Praxly will not use the Service to provide real-world clinical advice, diagnosis, treatment, prescribing, triage, clinical decision-making, or patient management.

Praxly processes personal data only where it has a lawful basis to do so.

Praxly may process personal data where it is necessary to provide the Service to you or take steps at your request before providing the Service. This may include account creation, authentication, educational functionality, AI-assisted feedback, progress tracking, support, and account management.

Praxly may process personal data where it has a legitimate interest and that interest is not overridden by your rights and freedoms. This may include security, fraud prevention, platform improvement, debugging, analytics, misuse prevention, service reliability, and internal research and development.

Praxly may rely on consent where required, such as for certain marketing communications, optional analytics cookies, or future features that specifically require consent. Where processing is based on consent, you may withdraw consent at any time.

Praxly may process personal data where necessary to comply with legal obligations, respond to lawful requests, or meet regulatory requirements.

Praxly does not intentionally request special category data at MVP stage. If sensitive information is voluntarily included by users, Praxly will minimise its processing and handle it with appropriate safeguards.

If Praxly later asks users to provide special category data for a specific feature, Praxly will identify an appropriate Article 6 lawful basis and Article 9 condition before processing, such as explicit consent where appropriate.

Praxly uses artificial intelligence to provide educational functionality, such as simulated interactions, educational feedback, explanations, and learning support.

Praxly uses the OpenAI API to provide certain AI-powered features. When you use AI features, your prompts, typed responses, contextual information, and AI outputs may be sent to OpenAI for processing where necessary to provide the feature.

Praxly will not knowingly use your identifiable User Content to train external third-party AI models unless this is clearly disclosed to you or you have consented where required.

Praxly may use anonymised, aggregated, or de-identified information to evaluate and improve its own platform functionality, educational quality, safety, reliability, and AI-assisted features.

Your typed responses and the conversation so far are stored in your Praxly account and are sent to OpenAI each time the AI patient replies or feedback is generated. Under OpenAI’s API data terms as at the date of this policy, data sent to the API is not used to train OpenAI’s models by default, and OpenAI may retain API inputs and outputs in abuse monitoring logs for up to 30 days unless a longer period is required by law. OpenAI is a processor acting on Praxly’s instructions. These terms are set by OpenAI and may change, so Praxly will review this section when they do.

AI-generated content may be inaccurate, incomplete, outdated, or inappropriate. Praxly is for educational use only and must not be used for real-world clinical decisions.

Praxly may use cookies and similar technologies to operate and improve the Service.

Praxly may use essential cookies for login, authentication, session management, security, and core functionality; preference cookies to remember settings; and optional analytics cookies where consent is required.

Praxly may use Google Analytics to understand website and platform usage, such as page visits, engagement, referral sources, device information, approximate location, errors, and feature usage.

Where required, Praxly will ask for consent before setting non-essential analytics cookies.

Further details will be provided in Praxly’s Cookie Policy.

Praxly may send non-marketing service emails, including account verification emails; password reset emails; security notices; policy updates; important product or service updates; support replies; waitlist updates directly related to your request; and responses to data protection requests.

Praxly may send marketing or product update emails where permitted, such as where you have opted in or where another lawful route applies.

You can unsubscribe from marketing emails at any time by using the unsubscribe mechanism provided or by contacting privacy@praxly.co.uk.

Praxly does not routinely manually review user educational content.

However, Praxly may review user content where reasonably necessary for support requests; debugging; safety; abuse prevention; legal compliance; quality assurance; security; investigation of misuse; enforcement of the Terms and Conditions; or where a feature clearly includes human or tutor review.

Access to user content will be limited to those who reasonably need access for these purposes.

Praxly may share personal data with trusted third parties where necessary to operate, secure, improve, or provide the Service.

These may include hosting providers; database providers; authentication providers; backend infrastructure providers; AI providers, including OpenAI; analytics providers, including Google Analytics; email and communication providers; security providers; payment providers in future; professional advisers; regulators, authorities, courts, or law enforcement where legally required; and any future company or legal entity that operates Praxly as part of incorporation, restructuring, sale, investment, merger, acquisition, or business transfer.

Praxly does not sell personal data.

Praxly may use Supabase and similar cloud infrastructure for authentication, database hosting, backend services, and storage.

Praxly’s primary database is currently hosted in Supabase’s West Europe (London) region, eu-west-2.

Praxly may also use other secure cloud providers as the Service develops.

Some of Praxly’s service providers may process personal data outside the United Kingdom.

Where personal data is transferred outside the UK, Praxly will use appropriate safeguards where required by data protection law. These may include adequacy regulations, standard contractual clauses, international data transfer agreements, or other lawful transfer mechanisms.

Praxly keeps personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Account data is retained while your account remains active. If you request account deletion, Praxly will delete or anonymise account data unless retention is reasonably necessary for legal compliance, security, fraud prevention, dispute resolution, backups, audit, or legitimate operational purposes.

Practice transcripts, AI conversations, marks and feedback are deleted automatically 12 months after your last activity (your last sign-in or practice attempt), unless you or Praxly delete them earlier. Notes and progress data are kept while your account is active.

Email delivery logs are kept for 12 months and then deleted.

If you request deletion, Praxly will delete or anonymise this content unless retention is reasonably necessary for legal, security, backup, audit, or legitimate operational purposes.

Waitlist and contact form data may be retained for as long as reasonably necessary to manage your enquiry, provide updates where permitted, assess interest in Praxly, and maintain appropriate records.

Security logs, error logs, analytics logs, and technical logs may be retained for as long as reasonably necessary for security, debugging, reliability, analytics, and operational purposes.

Deleted data may remain in backups for a limited period before being overwritten or deleted through normal backup cycles.

Depending on the circumstances and applicable law, you may have the right to request access to your personal data; request correction of inaccurate personal data; request deletion of your personal data; request restriction of processing; object to certain processing; request data portability; withdraw consent where processing is based on consent; and complain to the UK Information Commissioner’s Office.

These rights are not absolute and may be subject to legal limitations.

To exercise your rights, please contact: privacy@praxly.co.uk.

Praxly may need to verify your identity before responding to certain requests.

At launch, account deletion and data deletion requests are handled manually by email.

To request deletion of your account or personal data, please contact: privacy@praxly.co.uk.

Praxly will respond in accordance with applicable data protection law.

Some information may be retained where reasonably necessary for legal compliance, security, fraud prevention, dispute resolution, backups, audit, or legitimate operational purposes.

Praxly uses reasonable technical and organisational measures to protect personal data.

These may include authentication controls; access restrictions; encrypted connections; restricted administrative access; secure cloud infrastructure; environment variable and secrets management; security logs where appropriate; and regular review of security settings.

No system is completely secure. You are responsible for keeping your account login details confidential and for notifying Praxly if you believe your account has been compromised.

If Praxly identifies a personal data breach, Praxly will assess the likely risk to affected individuals.

Where required by data protection law, Praxly will notify the Information Commissioner’s Office and/or affected users.

Praxly may contain links to third-party websites, resources, or services.

This Privacy Policy does not apply to third-party websites or services that Praxly does not control. You should read the privacy policies of any third-party services you use.

Praxly may update this Privacy Policy from time to time.

If changes are material, Praxly will take reasonable steps to notify users, such as by posting an updated version, showing an in-platform notice, or sending an email where appropriate.

Your continued use of Praxly after an updated Privacy Policy becomes effective indicates that you have read the updated policy.

If you have concerns about how Praxly handles your personal data, please contact Praxly first so the issue can be reviewed: privacy@praxly.co.uk.

You also have the right to complain to the UK Information Commissioner’s Office.

Praxly is currently running a limited pilot. This section applies to people who apply for, or take part in, the pilot, and adds to the rest of this Privacy Policy.

If you apply through praxly.co.uk, Praxly collects the details in the application form: your name; email address; stage of training; medical school or employer; when your next clinical exam is; the prices you say you would pay; any OSCE practice tools you currently use, if you choose to say; and whether you are willing to take part in a feedback call. Praxly records when you gave consent.

Praxly uses application details to decide who is admitted to each pilot cohort, to contact you about access, and, in aggregate, to inform product and pricing decisions. Praxly does not make decisions about you that have legal or similarly significant effects.

During the pilot, Praxly may review practice transcripts, marks and feedback to check that marking is accurate and to fix errors. This review is currently carried out by Praxly's founder and, in future, may also be carried out by qualified doctors with an academic background who work with Praxly under a confidentiality agreement. Reviewers see transcripts identified only by a reference number, and are not given your name or email address. Any transcripts used in a published evaluation will be anonymised first.

Pilot access is free. It may include a limit on the number of practice attempts for each person, and access may be changed or withdrawn.

Praxly keeps pilot application data for up to 12 months after the pilot ends, or until you withdraw consent or ask for deletion, whichever is sooner. Practice transcripts and marks are handled under section 15.

You can withdraw from the pilot, or ask for your data to be deleted, at any time by contacting privacy@praxly.co.uk.

In summary: Praxly is an educational and training platform only; Praxly must not be used for real patient care, diagnosis, treatment, prescribing, triage, clinical decision-making, or patient management; you must not submit identifiable patient information or confidential clinical material; Praxly currently supports text-based educational interactions only; Praxly may process account data, educational usage data, AI conversations, analytics data, technical data, waitlist data, and support communications; Praxly uses the OpenAI API for AI-powered educational features; Praxly may use Supabase and Google Analytics; Praxly does not sell personal data; and users can contact privacy@praxly.co.uk to exercise data rights or request account deletion.