Privacy Policy

DrugDesk is an AI-powered learning platform for UK pharmacy students. For any privacy question, or to exercise your rights, contact us at DrugDesk@outlook.com.

• Account data: your name, email address and password (stored only as a secure hash by our authentication provider).
• Study profile: university, year of study, chosen modules, exam dates, target grade, weekly study hours and learning preferences you enter during onboarding.
• Learning activity: lessons opened and completed, quiz answers and scores, flashcard reviews, study time, streaks and focus sessions.
• AI tutor usage: we do not store the questions you ask or the answers you receive. We keep only a broad subject label (for example “calculations”), whether the answer succeeded and how long it took, so we can monitor reliability, usage limits and abuse. Your conversation stays in your browser for that session only.
• OSCE practice: your practice station, your typed or spoken answers in that station and the marking feedback, so you can review your own attempts. Only you can see them.
• Wellbeing space: nothing at all. What you tap in the wellbeing area is never stored, never linked to your account and never visible to staff, other students or any dashboard.
• Feedback and waitlist data: lesson ratings, comments, NPS scores, and the name, email, university and year you submit when joining the DrugDesk Pro waitlist.
• Technical data: browser and device type, and error logs generated when the platform is used. Error logs record technical failures, not the content of your questions or answers.

We do not ask for special category data (such as health information) and you should not submit patient-identifiable information to the AI tutor or notes.

• To provide your account, lessons, quizzes, planner and AI tutor — performance of our contract with you.
• To personalise study plans and recommendations from your performance data — performance of our contract with you.
• To keep the platform secure, prevent abuse and fix errors — our legitimate interests.
• To understand aggregate usage and improve content quality — our legitimate interests, using aggregated or de-identified data wherever possible.
• To send service emails such as password resets and important changes — performance of our contract with you.
• To send product updates or launch news — your consent, which you can withdraw at any time.

DrugDesk scores topics from your quiz answers and study history to build daily plans and recommend revision. This personalisation has no legal or similarly significant effect on you, it never determines academic outcomes, and you can ignore or reset any plan at any time.

• Our hosting, database and authentication providers, who store your account and study data on our behalf.
• Our AI model providers, who process what you send to the AI tutor, OSCE simulated patient and OSCE marking in order to generate a response. This includes your question, the lesson you are studying, your year of study and, in OSCE voice mode, the audio of your answer. Your name, email and university are never sent.
• Professional advisers, or authorities where we are legally required to disclose information.

All providers act as our processors under written terms. We never sell your personal data or use it for third-party advertising. Where data is transferred outside the UK, we rely on adequacy regulations or the International Data Transfer Addendum to the EU standard contractual clauses.

We keep your account and study data for as long as your account is active. AI tutor usage records are deleted automatically after 180 days, and OSCE practice sessions — including the transcript and the marking feedback — are deleted automatically 12 months after the attempt. Page-view analytics, lesson feedback, lesson requests, support messages, emails we have sent you and our administrative audit trail are deleted automatically after 24 months. Checkout consent records are kept for 7 years alongside the payment records they evidence. These windows are enforced by an automated nightly housekeeping job, not by hand. You can download everything we hold about you at any time from Settings → Legal and your data. When you delete your account from Settings, we immediately remove your profile, learning history, AI usage records, OSCE and simulator attempts, XP and saved revision work. Where you have a payment history, we keep the subscription and invoice records we are legally required to retain for accounting purposes and anonymise your profile instead; those payment records are then deleted after 7 years. Aggregated statistics that cannot identify you may be retained. Waitlist entries are deleted once the waitlist closes or on request.

Data is encrypted in transit and at rest, access to student records is restricted by row-level security so you can only read your own data, and administrative access is role-based and limited to named staff. Administrators cannot read your AI tutor questions or your wellbeing activity. No system is completely secure, so please use a strong, unique password.

We use strictly necessary cookies and browser local storage to keep you signed in and to remember preferences such as appearance and in-progress study sessions. With your consent we also record simple, anonymous page counts (a random identifier, the page path and the site that referred you) so we can see which pages students use — never your IP address, and never a fingerprint. The wellbeing area is excluded from this entirely. You can change or withdraw your cookie choices at any time from the footer. We do not use advertising or third-party tracking cookies.

• Access a copy of the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data erased, and delete your account from Settings.
• Restrict or object to processing based on our legitimate interests.
• Receive your data in a portable format.
• Withdraw consent for optional emails at any time.

Email DrugDesk@outlook.com and we will respond within one month. If you are unhappy with our response you can complain to the Information Commissioner's Office at ico.org.uk.

DrugDesk is intended for university students and is not directed at children under 16. If you believe a child has created an account, contact us and we will remove it.

We may update this notice as the platform develops. If a change materially affects how we use your data, we will notify you by email or in the app before it takes effect.