Privacy notice
Last updated 11 October 2026. This notice explains what Cyrus Medical collects, why, and your rights under the UK GDPR and the Data Protection Act 2018.
Who we are
Cyrus Medical is run by [operator name], the data controller. Contact: [privacy contact email].
What we collect
- Account details: your email address, a securely hashed password (we never see or store the password itself), or your Google account ID if you sign in with Google.
- Profile, if you add it: display name, avatar, medical school, year of study, exam target and date, and your study preferences.
- Learning activity: each answer you submit (the option chosen, whether it was correct, your confidence and the time taken), flags, bookmarks, notes, flashcard reviews and your revision schedule.
- Technical data: sign-in session cookies (strictly necessary) and server logs kept by our hosting providers for security.
We don't use advertising or tracking cookies, and we don't sell your data. Never enter real patient information anywhere on the site.
Why we use it (lawful basis)
- To provide your account and save your progress across devices: contract.
- To keep the service secure, for example rate-limiting sign-in attempts: legitimate interests.
- Anonymous comparison with other students, only if you switch it on: consent, which you can withdraw at any time in Settings.
Who processes it
Supabase hosts our database and handles sign-in. Your data is stored in the European Union (Paris, France), which the UK recognises as providing adequate data protection. [Hosting provider] serves the website, and [email provider] sends account emails. Where any provider processes data outside the UK or EU, it's protected by the UK International Data Transfer Addendum.
How long we keep it
We keep your data while your account is open. When you delete your account, your data is erased from the live database straight away and drops out of backups within [backup retention, e.g. 7 days].
Your rights
- Access and portability: download everything we hold about you in Settings → Your data.
- Erasure: delete your account in Settings → Account.
- Rectification: edit your profile at any time.
- Objection and restriction: contact us at the address above.
If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).