Quesmed Privacy Policy

This Privacy Policy explains how SYSMED LTD, trading as Quesmed ("Quesmed", "we", "us" or "our"), collects and uses personal data when you use our websites, web applications, mobile applications and educational services (together, the "Services").

SYSMED LTD is a company registered in England and Wales (company number 10241223), with registered office at 124 City Road, London, England, EC1V 2NX. For most direct-to-consumer use of Quesmed, SYSMED LTD is the controller of your personal data.

Where a university, employer or other organisation provides access to Quesmed under an institutional licence, that organisation may be the controller of personal data it provides to us or instructs us to process, and Quesmed may act as its processor. In other circumstances, Quesmed may act as an independent controller for data we process for our own legitimate business purposes, such as account security, service administration and compliance with law.

If you have questions about this Privacy Policy or wish to exercise your data-protection rights, contact us at support@quesmed.com.

The personal data we collect depends on how you use the Services. It may include:

- Identity and account data, such as your name, email address, username, account identifiers and password-related authentication information.

- Education and institutional data, such as your university or organisation, course or year group, licence entitlement and other information provided by you or your institution to provision or administer access.

- Learning and assessment data, such as questions attempted, answers, scores, progress, revision history, notes, bookmarks, flashcard activity, OSCE/PACES/interview practice activity and other educational interactions.

- AI and consultation interaction data, such as text you submit, prompts, consultation transcripts, voice input or derived text, automated marking outputs and feedback where you use AI-enabled features.

- Purchase and billing data, such as products purchased, subscription status, transaction references and billing-related information. Payment-card details are normally processed by our payment providers rather than stored directly by Quesmed.

- Communications and support data, such as emails, help-desk messages, feedback, survey responses and other communications with us.

- Technical and usage data, such as IP address, browser and device type, operating system, app version, approximate location derived from IP, log-in events, timestamps, referring pages, pages/features used, diagnostic information, crash data and security logs.

- Cookie and similar-technology data, as described in section 10 below.

We may receive personal data directly from you, automatically from your use of the Services, from an institution that provides you with access, and from service providers that support functions such as payments, authentication, analytics or customer support.

Quesmed is an educational service. We do not require users to submit identifiable patient information, and users must not upload or disclose identifiable patient data through the Services unless Quesmed has expressly agreed a lawful and secure workflow for that purpose.

Some educational interactions may contain clinical scenarios, medical terminology or user-generated health-related content. This does not necessarily mean that the information is personal health data about the user or another identifiable person. If you choose to provide information that constitutes special-category personal data, including personal health information, we will process it only where a valid legal basis and an applicable condition for special-category processing are available.

Where possible, clinical and patient-related educational content should be anonymised before it is submitted to Quesmed.

Where we rely on legitimate interests, we consider whether our interests are necessary and balanced against your rights and expectations. You can object to processing based on legitimate interests in certain circumstances.

If you access Quesmed through a university, NHS organisation, employer or other institution, that organisation may provide us with information such as your name, institutional email address, year group or course and licence entitlement so that we can create, match or administer your account.

Depending on the institutional agreement, we may provide authorised institutional administrators with agreed usage, engagement, progress or assessment information relating to users covered by that licence. The categories of data shared and the purposes for which they may be used are governed by the relevant institutional agreement and, where applicable, a Data Processing Agreement.

If you have questions about how your institution uses information obtained from Quesmed, you should also review the institution's own privacy information.

Some Quesmed features use artificial intelligence to simulate educational interactions, process voice or text, generate feedback, assess responses or support personalised learning. To provide these features, relevant interaction data may be sent to specialist service providers acting on our behalf.

For example, an AI OSCE or PACES session may involve voice or text input, a transcript, generated responses, marking criteria, scores and feedback. These data are used to deliver the session, allow you to review your learning history where that feature is available, maintain safety and service quality, and improve the educational experience in accordance with this Policy.

Quesmed may use automated methods to generate educational scores, feedback, recommendations or content. These outputs are intended for learning and revision. They are not used by Quesmed to make solely automated decisions that produce legal or similarly significant effects on users.

We do not sell personal data. We share personal data only where necessary for the purposes described in this Policy, including with service providers that help us operate Quesmed.

We require service providers that process personal data on our behalf to handle that data only for agreed purposes and subject to appropriate confidentiality and data-protection obligations.

Our primary application infrastructure is hosted using Amazon Web Services in the eu-west-1 region in Ireland.

This means our principal service infrastructure is hosted within the European Economic Area (EEA).

Some service providers or authorised contractors may process or access limited personal data from outside the UK or EEA where this is necessary to provide, support or secure the Services.

Where personal data is transferred to contractors, we take steps intended to ensure that an appropriate level of protection is maintained in accordance with applicable data-protection law. The safeguards used will depend on the destination and the circumstances of the transfer and may include applicable adequacy regulations or approved contractual safeguards. You may contact us for further information about the safeguards relevant to your data.

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, including to provide the Services, maintain appropriate business and security records, comply with legal or regulatory obligations, resolve disputes and enforce agreements.

Retention periods vary according to the type of data, the nature of the account, whether access is provided under an institutional agreement, the need to maintain learning history, and applicable legal or contractual requirements. Where an institution acts as controller and Quesmed acts as processor, deletion or return of personal data is also governed by the relevant Data Processing Agreement and the institution's documented instructions.

We may retain aggregated or effectively anonymised information that no longer identifies an individual for analytics, research, product development or reporting.

We use cookies and similar technologies to operate our websites and applications, remember preferences, maintain sessions, understand how the Services are used and, where you have consented or where otherwise permitted by law, support analytics or marketing.

Strictly necessary cookies may be used without consent where they are required for the operation or security of the service. Where consent is required for non-essential cookies or similar technologies, you can make or change your choices through the cookie controls made available on our website.

Third-party services integrated into Quesmed may also set or access cookies or similar technologies in accordance with the choices and controls presented to you.

We may send information about Quesmed products, services, educational resources, events or offers where permitted by law. Where consent is required, we will rely on your consent. You can unsubscribe from marketing emails at any time using the unsubscribe link in the message or by contacting support@quesmed.com.

Service-related communications, such as account, security, subscription or important operational notices, are not marketing and may still be sent where necessary to provide the Services.

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. Measures include encryption in transit, access controls and authentication mechanisms, restricted production access, logging and monitoring, and cloud-security controls appropriate to the Services.

No internet-based service can guarantee absolute security. Users are responsible for keeping their credentials confidential and for notifying us promptly if they believe their account has been compromised.

Depending on the circumstances and the lawful basis on which we process your data, you may have rights to:

- request access to your personal data;

- request correction of inaccurate or incomplete data;

- request deletion of personal data in certain circumstances;

- request restriction of processing in certain circumstances;

- object to processing based on legitimate interests or to direct marketing;

- receive certain personal data in a portable format; and

- withdraw consent at any time where we rely on consent, without affecting processing that was lawful before withdrawal.

To exercise your rights, contact support@quesmed.com. We may need to verify your identity before acting on a request. Some rights are subject to legal limitations or exemptions.

If Quesmed processes your data solely on behalf of an institution, we may refer your request to that institution or assist it in responding, as appropriate.

You have the right to object at any time to our processing of your personal data for direct marketing. You may also have the right to object to processing based on our legitimate interests, depending on your particular circumstances.

If you have concerns about how we use your personal data, please contact us first at support@quesmed.com so that we can try to resolve them.

You also have the right to complain to the UK Information Commissioner's Office (ICO), the UK supervisory authority for data protection. Information about making a complaint is available at ico.org.uk. If you are located outside the UK, you may also have the right to complain to your local data-protection authority.

Quesmed is primarily designed for students and healthcare professionals. Some services, such as admissions-related educational products, may be used by people under 18. Where our Services are offered to children, we will take account of applicable age, transparency and consent requirements and will aim to provide privacy information in clear, age-appropriate language.

If you believe a child has provided personal data to us in circumstances where appropriate permission was required but not obtained, please contact support@quesmed.com.

The Services may contain links to websites or services operated by third parties. Their privacy practices are governed by their own privacy notices. We are not responsible for the privacy practices of third-party services that are not acting as our processors.

We may update this Privacy Policy from time to time to reflect changes to our Services, technology, legal requirements or data-processing practices. We will publish the updated version on our website and update the date shown at the top of the Policy. Where a change materially affects how we use personal data, we will take reasonable steps to bring the change to the attention of affected users before the new use begins where required by law.

SYSMED LTD (trading as Quesmed)

Company number: 10241223

Registered office: 124 City Road, London, England, EC1V 2NX

Email: support@quesmed.com