Privacy Policy

DrugDesk is an AI-powered learning platform for UK pharmacy students. For any privacy question, or to exercise your rights, contact us at privacy@drugdesk.co.uk.

• Account data: your name, email address and password (stored only as a secure hash by our authentication provider).
• Study profile: university, year of study, chosen modules, exam dates, target grade, weekly study hours and learning preferences you enter during onboarding.
• Learning activity: lessons opened and completed, quiz answers and scores, flashcard reviews, study time, streaks and focus sessions.
• AI tutor content: the questions you ask and the responses generated, so we can maintain your chat history and monitor usage limits and abuse.
• Feedback and waitlist data: lesson ratings, comments, NPS scores, and the name, email, university and year you submit when joining the DrugDesk Pro waitlist.
• Technical data: IP address, browser and device type, and error logs generated when the platform is used.

We do not ask for special category data (such as health information) and you should not submit patient-identifiable information to the AI tutor or notes.

• To provide your account, lessons, quizzes, planner and AI tutor — performance of our contract with you.
• To personalise study plans and recommendations from your performance data — performance of our contract with you.
• To keep the platform secure, prevent abuse and fix errors — our legitimate interests.
• To understand aggregate usage and improve content quality — our legitimate interests, using aggregated or de-identified data wherever possible.
• To send service emails such as password resets and important changes — performance of our contract with you.
• To send product updates or launch news — your consent, which you can withdraw at any time.

DrugDesk scores topics from your quiz answers and study history to build daily plans and recommend revision. This personalisation has no legal or similarly significant effect on you, it never determines academic outcomes, and you can ignore or reset any plan at any time.

• Our hosting, database and authentication providers, who store your account and study data on our behalf.
• Our AI model providers, who process the prompts you send to the AI tutor in order to generate a response.
• Professional advisers, or authorities where we are legally required to disclose information.

All providers act as our processors under written terms. We never sell your personal data or use it for third-party advertising. Where data is transferred outside the UK, we rely on adequacy regulations or the International Data Transfer Addendum to the EU standard contractual clauses.

We keep your account and study data for as long as your account is active. If you delete your account, we remove your personal data within 30 days, except where we must keep limited records for legal or security reasons. Aggregated statistics that cannot identify you may be retained. Waitlist entries are deleted once the waitlist closes or on request.

Data is encrypted in transit and at rest, access to student records is restricted by row-level security so you can only read your own data, and administrative access is role-based and limited to named staff. No system is completely secure, so please use a strong, unique password.

We use strictly necessary cookies and browser local storage to keep you signed in and to remember preferences such as appearance and in-progress study sessions. We do not use advertising or third-party tracking cookies.

• Access a copy of the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased, and delete your account from Settings.
• Restrict or object to processing based on our legitimate interests.
• Receive your data in a portable format.
• Withdraw consent for optional emails at any time.

Email privacy@drugdesk.co.uk and we will respond within one month. If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk.

DrugDesk is intended for university students and is not directed at children under 16. If you believe a child has created an account, contact us and we will remove it.

We may update this notice as the platform develops. If a change materially affects how we use your data, we will notify you by email or in the app before it takes effect.