Privacy notice
Last updated: 9 November 2026
This notice explains what personal data PharmEase collects, why, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Who we are
We, PharmEase (), are the data controller for your personal data. Contact us at [support@your-domain.co.uk].
What we collect
| Data | Why we use it | Lawful basis |
|---|---|---|
| Name, email address and password (stored only as a secure hash by our login provider) | To create and secure your account, and to send account emails such as confirmations and password resets | Contract |
| Study progress: XP, answers, streaks, badges, saved mistakes, avatar choices and your assessment date (if you add it) | To run the service and sync your progress between devices | Contract |
| Friend connections, display name, avatar and XP shown to friends you add | To run the friend leaderboard | Contract |
| Subscription status, plan and the customer ID from our payment provider. We never see or store your full card details. | To provide Premium and handle billing | Contract; legal obligation (tax and accounting records) |
| Technical data such as IP address and browser type in server logs | To keep the service secure and working | Legitimate interests |
We don't use advertising or analytics cookies, and we don't sell your data.
Cookies and local storage
We use your browser's local storage, which is strictly necessary, to keep you signed in and to save your progress and settings. Stripe uses its own strictly necessary cookies on its checkout and billing pages. Because we only use strictly necessary storage, we don't need to ask for cookie consent. Our pages load fonts from Google Fonts, which means Google receives your IP address.
Who we share data with
We use these service providers (processors) to run PharmEase. They only process your data on our instructions:
- Supabase: account login and database hosting
- Stripe: payment processing (Stripe is also an independent controller for some payment data)
- Netlify: website hosting and server functions
- Google Fonts: website fonts
Some of these providers may process data outside the UK. Where they do, transfers are protected by UK adequacy regulations or the International Data Transfer Agreement or Addendum.
How long we keep it
We keep your account data while your account is open. If you delete your account, we delete your profile and progress straight away. Payment and invoice records are kept for 6 years to meet tax law. Server logs are kept for a short period by our hosting provider.
Your rights
You have the right to access, correct, delete or download your data, to object to or restrict how we use it, and to complain. You can download your data or delete your account at any time from Account in the app. For anything else, email us. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), though we'd appreciate the chance to help first.
Security
Data is encrypted in transit (HTTPS) and at rest by our providers. Access to your data is limited by database access rules, so each person can only read their own account.
Changes
If we change this notice in a way that matters, we'll tell you in the app or by email.